This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Increase Spam

Over the past month or so I have have noticed an increase of spam I recieve.
Granted I only have "Confirmed SPAM" being Quarentined and other spam just set to "Warn".

Maybe it is nothing, but I wanted to see if anyone else has noticed this as well. Could be my email address is getting popular, lol.

BTW, I have not changed/modified any spam settings in a year.

Thanks in advance,

Joe

This thread was automatically locked due to age.

Parents

0 joequick over 15 years ago

The mail is coming from other sources, nothing inside my network.
Astaro is marking it as *SPAM*, but not "confirmed Spam" so its not being quarentined.

I dont know if the spam logic has been changed that Astaro does.

My mail host also does Spam/AV scanning. When it detects Spam it marks it [POSSIBLE-SPAM] the subject. (I have it set not to block).
Then when Astaro gets it and thinks it is spam, it adds *SPAM* to the subject line.
It use to be my quarentine spam report would have 90% of the emails with:
*SPAM* [POSSIBLE-SPAM] in the subject line.
I would occasionaly get a few in my inbox.

But now I am getting more in my inbox than on the spam report.

Here is a sample header of on I got earlier.
Return-Path:
Delivered-To: "blocked to protect the innocent"
Received: (qmail 7336 invoked by uid 399); 9 Jun 2010 14:50:57 -0700
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
sa-xen1.hosting-advantage.com
X-Spam-Flag: YES
X-Spam-Level: **********************
X-Spam-Status: Yes, score=22.7 required=4.0 tests=DKIM_SIGNED,DKIM_VALID,
DKIM_VALID_AU,HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,
HTML_SHORT_LINK_IMG_3,KAM_MXURI,MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100,
RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,
RCVD_IN_BL_SPAMCOP_NET,SARE_HTML_HTML_TBL,SARE_SUB_MONEY,SC_SPAM_1,SC_SPAM_2,
T_REMOTE_IMAGE,URIBL_DBL_SPAM,URIBL_OB_SURBL shortcircuit=no
autolearn=disabled version=3.3.1
X-Spam-Report:
*  3.9 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
*      [Blocked - see ]
*  3.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
*      [URIs: catchwrecks.com]
*  1.7 URIBL_DBL_SPAM Contains an URL listed in the DBL blocklist
*      [URIs: catchwrecks.com]
*  0.6 SARE_SUB_MONEY subject has likely spammer phrase or word
*  2.5 KAM_MXURI URI: URI begins with a mail exchange prefix, i.e. mx.[...]
*  0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
*  0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
*  0.0 HTML_MESSAGE BODY: HTML included in message
*  1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
*  2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
*      above 50%
*      [cf: 100]
* -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
*       domain
*  0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
*      [cf: 100]
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
*  0.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
*      above 50%
*      [cf: 100]
*  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
*      valid
*  2.2 RAZOR2_CHECK Listed in Razor2 (Vipul's Razor: home)
*  0.6 SARE_HTML_HTML_TBL FULL: Message body has very strange HTML sequence
*  0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
*  1.0 SC_SPAM_2 SC_SPAM_2
*  0.0 T_REMOTE_IMAGE Message contains an external image
*  1.0 SC_SPAM_1 SC_SPAM_1
X-Virus-Scan: Scanned by ClamAV 0.94.2 (no viruses);
  Wed, 09 Jun 2010 14:50:57 -0700
Received: from mail.catchwrecks.com (8.17.250.211)
  by mail3.hosting-advantage.com with ESMTP; 9 Jun 2010 14:50:57 -0700
X-Originating-IP: 8.17.250.211
Received-SPF: pass (mail3.hosting-advantage.com: SPF record at catchwrecks.com designates 8.17.250.211 as permitted sender)
identity=mailfrom; client-ip=8.17.250.211;
envelope-from=;
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=catchwrecks.com;
h=Date:From:Subject:To:Message-ID:Mime-Version:Content-Type:Content-Transfer-Encoding; i=governmentgrants@catchwrecks.com;
bh=NeNvNIct8jUQAiIyp0fm2vT+x4s=;
b=fisD4YzgN/giP878sxH1ujfsleBPWWHsqQ8Ub2P9Nl7SlFKr33zqTADB7HuxSRBv+NYN1/65u4ee
   rFZucnz38Ve8borKm7Sughgo41kosCy9s6unUr3yYRCU2GtC2X+amPj35aam51Q0YZwyHUOZreDY
   lDEgzxcwdBWYfIX/zXg=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=default; d=catchwrecks.com;
b=QByBzf+/tjfT7GMU2HG3f0Yzzi2YhmWncVFwkCAeH+unGIsa1a9uPAzmYq69bvWFQPuzmoNDnRwj
   /xej+eCSHLiFFNK+xUdp8rIKprVKkXb0xZc4iJe3Agk9eAtlvv2YA9sMEK52u6BRYjbkrdNjSYhc
   qjlXd8I2RXC2K82bQVk=;
Date: Wed, 9 Jun 2010 17:50:39 -0400
From: "Government Grants"
Subject: *SPAM* [POSSIBLE-SPAM] Federal grant money is available
To:
Message-ID:
X-Spam-Prev-Subject: Federal grant money is available
X-Proxy-Ident: 0/27273-1-1276120427
X-Spam-Result: Spam
X-CTCH-RefID: str=0001.0A02020A.4C100CD0.01A7,ss=3,sh,fgs=0
MIME-Version: 1.0
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 joequick over 15 years ago

The mail is coming from other sources, nothing inside my network.
Astaro is marking it as *SPAM*, but not "confirmed Spam" so its not being quarentined.

I dont know if the spam logic has been changed that Astaro does.

My mail host also does Spam/AV scanning. When it detects Spam it marks it [POSSIBLE-SPAM] the subject. (I have it set not to block).
Then when Astaro gets it and thinks it is spam, it adds *SPAM* to the subject line.
It use to be my quarentine spam report would have 90% of the emails with:
*SPAM* [POSSIBLE-SPAM] in the subject line.
I would occasionaly get a few in my inbox.

But now I am getting more in my inbox than on the spam report.

Here is a sample header of on I got earlier.
Return-Path:
Delivered-To: "blocked to protect the innocent"
Received: (qmail 7336 invoked by uid 399); 9 Jun 2010 14:50:57 -0700
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
sa-xen1.hosting-advantage.com
X-Spam-Flag: YES
X-Spam-Level: **********************
X-Spam-Status: Yes, score=22.7 required=4.0 tests=DKIM_SIGNED,DKIM_VALID,
DKIM_VALID_AU,HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,
HTML_SHORT_LINK_IMG_3,KAM_MXURI,MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100,
RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,
RCVD_IN_BL_SPAMCOP_NET,SARE_HTML_HTML_TBL,SARE_SUB_MONEY,SC_SPAM_1,SC_SPAM_2,
T_REMOTE_IMAGE,URIBL_DBL_SPAM,URIBL_OB_SURBL shortcircuit=no
autolearn=disabled version=3.3.1
X-Spam-Report:
*  3.9 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
*      [Blocked - see ]
*  3.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
*      [URIs: catchwrecks.com]
*  1.7 URIBL_DBL_SPAM Contains an URL listed in the DBL blocklist
*      [URIs: catchwrecks.com]
*  0.6 SARE_SUB_MONEY subject has likely spammer phrase or word
*  2.5 KAM_MXURI URI: URI begins with a mail exchange prefix, i.e. mx.[...]
*  0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
*  0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
*  0.0 HTML_MESSAGE BODY: HTML included in message
*  1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
*  2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
*      above 50%
*      [cf: 100]
* -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
*       domain
*  0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
*      [cf: 100]
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
*  0.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
*      above 50%
*      [cf: 100]
*  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
*      valid
*  2.2 RAZOR2_CHECK Listed in Razor2 (Vipul's Razor: home)
*  0.6 SARE_HTML_HTML_TBL FULL: Message body has very strange HTML sequence
*  0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
*  1.0 SC_SPAM_2 SC_SPAM_2
*  0.0 T_REMOTE_IMAGE Message contains an external image
*  1.0 SC_SPAM_1 SC_SPAM_1
X-Virus-Scan: Scanned by ClamAV 0.94.2 (no viruses);
  Wed, 09 Jun 2010 14:50:57 -0700
Received: from mail.catchwrecks.com (8.17.250.211)
  by mail3.hosting-advantage.com with ESMTP; 9 Jun 2010 14:50:57 -0700
X-Originating-IP: 8.17.250.211
Received-SPF: pass (mail3.hosting-advantage.com: SPF record at catchwrecks.com designates 8.17.250.211 as permitted sender)
identity=mailfrom; client-ip=8.17.250.211;
envelope-from=;
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=catchwrecks.com;
h=Date:From:Subject:To:Message-ID:Mime-Version:Content-Type:Content-Transfer-Encoding; i=governmentgrants@catchwrecks.com;
bh=NeNvNIct8jUQAiIyp0fm2vT+x4s=;
b=fisD4YzgN/giP878sxH1ujfsleBPWWHsqQ8Ub2P9Nl7SlFKr33zqTADB7HuxSRBv+NYN1/65u4ee
   rFZucnz38Ve8borKm7Sughgo41kosCy9s6unUr3yYRCU2GtC2X+amPj35aam51Q0YZwyHUOZreDY
   lDEgzxcwdBWYfIX/zXg=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=default; d=catchwrecks.com;
b=QByBzf+/tjfT7GMU2HG3f0Yzzi2YhmWncVFwkCAeH+unGIsa1a9uPAzmYq69bvWFQPuzmoNDnRwj
   /xej+eCSHLiFFNK+xUdp8rIKprVKkXb0xZc4iJe3Agk9eAtlvv2YA9sMEK52u6BRYjbkrdNjSYhc
   qjlXd8I2RXC2K82bQVk=;
Date: Wed, 9 Jun 2010 17:50:39 -0400
From: "Government Grants"
Subject: *SPAM* [POSSIBLE-SPAM] Federal grant money is available
To:
Message-ID:
X-Spam-Prev-Subject: Federal grant money is available
X-Proxy-Ident: 0/27273-1-1276120427
X-Spam-Result: Spam
X-CTCH-RefID: str=0001.0A02020A.4C100CD0.01A7,ss=3,sh,fgs=0
MIME-Version: 1.0
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data