Also bei mir ist mittlerweile wieder Ruhe eingekehrt nach knapp mehr als einer Woche Dauerbeschuss ist scheinbar die Welle um und ich bekomme annähernd keinen SPAM mehr, max. 3-4 Mails am Tag die eigentlich immer erkannt werden... für alle anderen habe ich mir als Behelfslösung Filterregeln angeleg, die diese automatisch in SPAM verschieben...
SOGo SPAM Training bzw. lernen
- KORN3Y
- Erledigt
-
-
ich habe dank Sieve-Filterung nun einen Annehmbaren ZUstand erreicht trotzdem möchte ich nochmal kurz das Thema aufgreifen und fragen wie es eigentlich sein kann, dass ein und die selbe Mail vom Spam-Filter mal erkannt wird und mal nicht.
SPAM-Mail erreichen mich in der Regel meist doppelt dabei wird z.T. eine Mail korrekt erkannt und als SPAM markiert und die andere landet (ohne Sieve-Regel) unmarkiert im Posteingang.
Hier mal der Quelltext einer solchen Beispielmail
Korrekt erkannte Mail:
Code: Korrekt erkannt als SPAM
Alles anzeigenReturn-Path: <jasmine_thompson@heduld.bid> Delivered-To: mail@domaincom Received: from localhost (localhost [127.0.0.1]) by mxe217.netcup.net (Postfix) with ESMTP id C3B689A459 for <mail@domain.com; Sun, 1 Oct 2017 04:25:30 +0200 (CEST) X-Quarantine-ID: <haPNJFiKwdfA> X-Virus-Scanned: Debian amavisd-new at mxe217.netcup.net X-Spam-Flag: YES X-Spam-Score: 11.589 X-Spam-Level: *********** X-Spam-Status: Yes, score=11.589 tagged_above=-10 required=5 tests=[BAYES_99=3.5, BAYES_999=0.2, DIET_1=0.001, HTML_MESSAGE=0.001, RCVD_IN_SBL_CSS=3.335, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_ABUSE_SURBL=1.25, URIBL_BLOCKED=0.001, URIBL_DBL_SPAM=2.5] autolearn=no Received: from mxe217.netcup.net ([127.0.0.1]) by localhost (mxe217.netcup.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id haPNJFiKwdfA for <mail@domain.com>; Sun, 1 Oct 2017 04:25:30 +0200 (CEST) X-policyd-weight: IN_SBL_XBL_SPAMHAUS=4.35 NOT_IN_SPAMCOP=-1.5 (only DNSBL check requested) Received: from heduld.bid (unknown [199.229.255.173]) by mxe217.netcup.net (Postfix) with ESMTP id BC8FA9A44A for <mail@domain.com>; Sun, 1 Oct 2017 04:25:29 +0200 (CEST) Date: Sat, 30 Sep 2017 19:23:13 -0700 To: <mail@domain.com> Content-Transfer-Encoding: 8bit Message-ID: <141447183567896-e835a761f47c01fcf41889383bd3c71f@heduld.bid> From: jasmine_thompson <jasmine_thompson@heduld.bid> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="14144718_3567896_14144718" Subject: ***SPAM*** Stanford student says of her discovery, "Eat, Drink and Still Shrink!" --14144718_3567896_14144718 Content-Type: text/plain TV doctor features Stanford research student, mother of 2, Heather Nelson. She was able to eliminate 37lbs off her waist in 4 weeks without using more than 5-dollars. Learn What Grocery Item Speeds Weightloss >>>, Exclusively Here: http://cider.heduld.bid/cider-diet Don't forget this place for take out too. ....Picked up some salads to go from here. I need to do that more often. They have a great selection and it was just... The prime rib is great, which by itself makes it worth going, the fish Friday is pretty good, avoid the meatloaf, it is dry and has a layer of bread in the... Love this place, great food :)))), lots of food for the money can't beat it when you want to eat a lot for a decent price First time we had been there. I really liked the atmosphere. Old West feel, which is neat. Food was excellent. Between the 4 of us, we had, ribs, chicken... We don't have many options in the Ahwatukee foothills. Restaurants often don't last long due to the smaller population in the area. Native has stayed alive... We stopped for lunch and were pleasantly surprised. The kids had cheese pizza that was fresh and will cooked. The Hawaiian pizza was delicious also. Lunch... We stayed ate835a761f47c01fcf41889383bd3c71f
Selbe Mail nicht erkannt:
Code: Selbe Mail nicht erkannt
Alles anzeigenReturn-Path: <jasmine_thompson@heduld.bid> Delivered-To: mail@domain.com Received: from localhost (localhost [127.0.0.1]) by mxe217.netcup.net (Postfix) with ESMTP id 9B0FF9A3C6 for <mail@domain.com>; Sun, 1 Oct 2017 04:22:23 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at mxe217.netcup.net X-Spam-Flag: NO X-Spam-Score: 4.504 X-Spam-Level: **** X-Spam-Status: No, score=4.504 tagged_above=-10 required=5 tests=[BAYES_99=3.5, BAYES_999=0.2, DIET_1=0.001, HTML_MESSAGE=0.001, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=no Received: from mxe217.netcup.net ([127.0.0.1]) by localhost (mxe217.netcup.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h0_tPpxSioCi for <mail@domain.com>; Sun, 1 Oct 2017 04:22:22 +0200 (CEST) X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 (only DNSBL check requested) Received: from heduld.bid (unknown [199.229.255.173]) by mxe217.netcup.net (Postfix) with ESMTP id B5B70999D0 for <mail@domain.com>; Sun, 1 Oct 2017 04:22:21 +0200 (CEST) Date: Sat, 30 Sep 2017 19:23:14 -0700 Content-Transfer-Encoding: 8bit Message-ID: <931780812922874-e835a761f47c01fcf41889383bd3c71f@heduld.bid> From: jasmine_thompson <jasmine_thompson@heduld.bid> Content-Type: multipart/alternative; boundary="9317808_12922874_9317808" Subject: Stanford student says of her discovery, "Eat, Drink and Still Shrink!" To: <mail@domain.com> Mime-Version: 1.0 --9317808_12922874_9317808 Content-Type: text/plain TV doctor features Stanford research student, mother of 2, Heather Nelson. She was able to eliminate 37lbs off her waist in 4 weeks without using more than 5-dollars. Learn What Grocery Item Speeds Weightloss >>>, Exclusively Here: http://cider.heduld.bid/cider-diet Don't forget this place for take out too. ....Picked up some salads to go from here. I need to do that more often. They have a great selection and it was just... The prime rib is great, which by itself makes it worth going, the fish Friday is pretty good, avoid the meatloaf, it is dry and has a layer of bread in the... Love this place, great food :)))), lots of food for the money can't beat it when you want to eat a lot for a decent price First time we had been there. I really liked the atmosphere. Old West feel, which is neat. Food was excellent. Between the 4 of us, we had, ribs, chicken... We don't have many options in the Ahwatukee foothills. Restaurants often don't last long due to the smaller population in the area. Native has stayed alive... We stopped for lunch and were pleasantly surprised. The kids had cheese pizza that was fresh and will cooked. The Hawaiian pizza was delicious also. Lunch... We stayed ate835a761f47c01fcf41889383bd3c71f
Gibt es hierfür eine Sinnvolle Erklärung?
-
Sieht man sehr schön am X-Spam-Status-Header: Eine Mail kam über einen bekannten Spam-Server, die andere nicht.
-
Sieht man sehr schön am X-Spam-Status-Header: Eine Mail kam über einen bekannten Spam-Server, die andere nicht.
....Die kommen beide von der selben IP 199.229.255.173...
Das von dir zitierte Flag sagt lediglich aus was SpamAssassin auf Grund der verschiedenen Analyse-Methoden (Bayes, DNSBL etc.) davon hält... und da dieser nur eine erkennt steht bei der anderen Mail logischerweise „X-Spam-Status: No“
Es scheint mir eher so als würde nicht immer ein kompletter Abgleich mit allen Methoden durchgeführt...
-
....Die kommen beide von der selben IP 199.229.255.173...
Das von dir zitierte Flag sagt lediglich aus was SpamAssassin auf Grund der verschiedenen Analyse-Methoden (Bayes, DNSBL etc.) davon hält... und da dieser nur eine erkennt steht bei der anderen Mail logischerweise „X-Spam-Status: No“
Es scheint mir eher so als würde nicht immer ein kompletter Abgleich mit allen Methoden durchgeführt...
Nö, im X-SPAM-STATUS stehen alle Regel, die zu einer Veränderung des Score geführt haben. Einmal wurde die IP bei Spamhaus gefunden, einmal nicht. Das kann an den drei Minuten Zeitunterschied liegen, oder an zu langsamen DNS-Lookups.