Re: SPAM Filtering from lists/digest

>On Wed, 30 Mar 2005 13:01:17 -0800 (PST), you wrote:

>On Wed, 30 Mar 2005, George R.Kasica wrote:
>
>> Date: Wed, 30 Mar 2005 12:37:55 -0600
>> From: George R.Kasica <[email protected]>
>> To: [email protected]
>> Subject: SPAM Filtering from lists/digest
>> 
>> Just curious, how can I filter to prevent spam from getting on my
>> various lists and or digests? I'm running SpamAssassin 3.0.2 and
>> getting things tagged as SPAM **** and the spam tag set to yes, and
>> then using the taboo header setting to block it. 
>> 
>> It seems to catch most things, but I still seem to end up with spam in
>> digests (clearly tagged as spam) as if its eiter missing the taboo
>> header check sometimes or someone is sending directly to the digests
>> rather than posting to the list. I have the digest postings restricted
>> to just list members.
>> 
>> Any suggestions? If someone needs headers or examples I can provide
>> that.
>
>Have you used the taboo header setting in listname-digest.config also,
>or just in listname.config?

Here are the settings for the "regular" list:

        # taboo_headers        [regexp_array] (undef) <resend>
        # If any of the headers matches one of these regexps, then the
        # message will be bounced for review.
taboo_headers       <<  END
/^X-Spam-Status: Yes/i
/^X-Spam-Flag: YES/i
/^X-Spam-Level: \*\*\*\*\*\*/i
END


and the corresponding digest:

        # taboo_headers        [regexp_array] (undef) <resend>
        # If any of the headers matches one of these regexps, then the
        # message will be bounced for review.
taboo_headers       <<  END
/^X-Spam-Status: Yes/i
/^X-Spam-Flag: YES/i
/^X-Spam-Level: \*\*\*\*\*\*/
-
 
END

I see a difference here and have edited that to match all the other
digests and lists which are like the first one. Could that be the
cause of the spam getting in? If not, what other steps can I take to
filter this out short of moderating the lists. I'm also currently
preventing MIME on the lists, but it seems as if the spammers can get
the stuff through somehow. I tested posting a MIME attach to each list
and it was stripped. Is is possible they are sending to one of the
majordomo or list-owner or outgoing addresses and somehow bypassing
the scans, etc?


Here is a header from one list message that is clearly marked as spam
yet ended up in my digest directory...it seems like they are sending
to the digestify address directly.....this seems to be the "methodf
used for all the spam that gets through...HELP!

[root@eagle acg-l-digest]# more 001
From [email protected] Fri Mar 11 07:37:50 2005
Received: from mail by eagle.netwrx1.com with spam-scanned (Exim 3.36
#1)
        id 1D9kKj-00049Y-00; Fri, 11 Mar 2005 07:37:45 -0600
Received: from [61.177.119.253] (helo=68.248.203.41)
        by eagle.netwrx1.com with smtp (Exim 3.36 #1)
        id 1D9kKS-00049P-00; Fri, 11 Mar 2005 07:37:27 -0600
X-Message-Info: 09ZUSUvrbtu59725CHLJHlbbzjMZEMXRDcf+3548
Received: from [email protected] ([101.80.150.24]) by
uit5631-bmf.
61.177.119.253 with Microsoft SMTPSVC(5.0.2195.6824);
         Fri, 11 Mar 2005 16:34:14 +0300
Message-ID: [email protected]
Conversion-With-Loss: Yes
Sensitivity: 3
Expiry-Date: Never
Xref: wwgdlcfubvnyopgjzxrn
Reply-To: "Rosa Joseph" <[email protected]>
From: "Rosa Joseph" <[email protected]>
To: [email protected], [email protected]
Subject: ***** SPAM ***** market you healthcare products to all
hospitals.7,000 
Senior Hospitals,, 172,000 Senior Hospital Administrators and doctors.
Date: Fri, 11 Mar 2005 19:28:14 +0600
MIME-Version: 1.0
Content-Type: multipart/alternative;
[root@eagle acg-l-digest]# more 001
From [email protected] Fri Mar 11 07:37:50 2005
Received: from mail by eagle.netwrx1.com with spam-scanned (Exim 3.36
#1)
        id 1D9kKj-00049Y-00; Fri, 11 Mar 2005 07:37:45 -0600
Received: from [61.177.119.253] (helo=68.248.203.41)
        by eagle.netwrx1.com with smtp (Exim 3.36 #1)
        id 1D9kKS-00049P-00; Fri, 11 Mar 2005 07:37:27 -0600
X-Message-Info: 09ZUSUvrbtu59725CHLJHlbbzjMZEMXRDcf+3548
Received: from [email protected] ([101.80.150.24]) by
uit5631-bmf.
61.177.119.253 with Microsoft SMTPSVC(5.0.2195.6824);
         Fri, 11 Mar 2005 16:34:14 +0300
Message-ID: [email protected]
Conversion-With-Loss: Yes
Sensitivity: 3
Expiry-Date: Never
Xref: wwgdlcfubvnyopgjzxrn
Reply-To: "Rosa Joseph" <[email protected]>
From: "Rosa Joseph" <[email protected]>
To: [email protected], [email protected]
Subject: ***** SPAM ***** market you healthcare products to all
hospitals.7,000 
Senior Hospitals,, 172,000 Senior Hospital Administrators and doctors.
Date: Fri, 11 Mar 2005 19:28:14 +0600
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="--35091972050672979"
X-Scanner: exiscan *1D9kKS-00049P-00*zgNVjVp6L5M* (Netwrx Consulting
Inc., Jacks
on, WI USA) 
X-Spam-Prev-Subject: market you healthcare products to all
hospitals.7,000 Senio
r Hospitals,, 172,000 Senior Hospital Administrators and doctors.
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
eagle.netwrx1.com
X-Spam-Level: ******************************
X-Spam-Status: Yes, score=30.4 required=5.0 tests=BAYES_50,DCC_CHECK,
        DIGEST_MULTIPLE,FORGED_HOTMAIL_RCVD,INVALID_MSGID,
        MIME_BOUND_DD_DIGITS,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
        RCVD_HELO_IP_MISMATCH,RCVD_IN_DSBL,RCVD_IN_NJABL_DUL,

RCVD_IN_SORBS_DUL,RCVD_IN_SORBS_WEB,RCVD_IN_XBL,RCVD_NUMERIC_HELO,

SARE_HEAD_HDR_CONVWLS,SARE_HEAD_HDR_EXPRYDT,SARE_HEAD_HDR_XREF,
        X_MESSAGE_INFO autolearn=spam version=3.0.2
X-Spam-Report: 
        *  1.1 SARE_HEAD_HDR_CONVWLS Message headers used which
identify spam
        *  0.5 SARE_HEAD_HDR_XREF Message headers used which identify
spam
        *  4.2 X_MESSAGE_INFO Bulk email fingerprint (X-Message-Info)
found
        *  4.1 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
        *  0.5 SARE_HEAD_HDR_EXPRYDT Message headers used which
identify spam
        *  2.5 FORGED_HOTMAIL_RCVD Forged hotmail.com 'Received:'
header found
        *  2.2 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not
match, but sho
uld
        *  1.2 RCVD_NUMERIC_HELO Received: contains an IP address used
for HELO
        *  0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
        *      [score: 0.5002]
        *  0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence
level above 
50%
        *      [cf: 100]
        *  1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
        *  2.2 DCC_CHECK Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
        *  2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from
dynamic IP addre
ss
        *      [61.177.119.253 listed in dnsbl.sorbs.net]
        *  3.8 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
        *      [<http://dsbl.org/listing?61.177.119.253>]
        *  3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
        *      [61.177.119.253 listed in sbl-xbl.spamhaus.org]
        *  0.0 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web
server
        *      [61.177.119.253 listed in dnsbl.sorbs.net]
        *  0.1 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did
non-local SMTP
        *      [61.177.119.253 listed in combined.njabl.org]
        *  0.1 DIGEST_MULTIPLE Message hits more than one network
digest check
        *  1.1 INVALID_MSGID Message-Id is not valid, according to RFC
2822
 
and another header:

To: [email protected]
Cc: [email protected], [email protected],
[email protected],
[email protected],[email protected],
[email protected], [email protected],
[email protected], [email protected]


George

===[George R. Kasica]===        +1 262 677 0766
President                       +1 206 374 6482 FAX 
Netwrx Consulting Inc.          Jackson, WI USA 
http://www.netwrx1.com
[email protected]
ICQ #12862186