Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » Spam Assassin scoring of non English spam
  •  
MarkK

Messages: 454
Karma: 46
Send a private message to this user
Every once in a while, we get an all Asian character spam. They never seem to rank up any SA score.

Sometimes there is characters in the body of the message, sometimes not. In SA, the ok_locales looks at the body of the message to determine the language, but there is no body.

I have these settings in my personalized rule file.
ok_languages en es
ok_locales en

Any ideas on how to catch and rate these spams?

Mark K

===
THE EMAIL:
试用期短,难以看到新人的业绩,试用期内如 何评估考察? (<-- the subject)
庄璨槦 [elfzsyl<_at_>scamosciatoitaliano.it] (<-- From:)

Attached filename: 选人比用人更重要,哪种销售人员适合你?.xl s

===
HEADERS:
Return-Path: <elfzsyl<_at_>scamosciatoitaliano.it>
X-Envelope-To: spoof<_at_>{MyDomain}.com
X-Spam-Status: No, hits=0.0 required=5.0
tests=TOTAL_SCORE: 0.000
X-Spam-Level:
Received: from scamosciatoitaliano.it ([110.210.23.0])
by mail.{MyDomain}.com
for spoof<_at_>{MyDomain}.com;
Fri, 21 Mar 2014 08:57:54 -0700
Received: from vgoigjxhd (unknown [219.16.86.160])
by scamosciatoitaliano.it with SMTP id 82N3YEwGjHKPPdRJ.1
for <spoof<_at_>{MyDomain}.com>; Fri, 21 Mar 2014 23:57:53 +0800
Message-ID: <31588E7A94146492BC2166BC3801B87B@vgoigjxhd>
From: =?utf-8?B?5bqE55Ko5qem?= <elfzsyl<_at_>scamosciatoitaliano.it>
To: <spoof<_at_>{MyDomain}.com>
Subject: =?utf-8?B?6K+V55So5pyf55+t77yM6Zq+5Lul55yL5Yiw5paw5Lq655qE5L ia57up77yM6K+V55So5pyf5YaF5aaC?=
=?utf-8?B?5L2V6K+E5Lyw6ICD5a+f77yf?=
Date: Fri, 21 Mar 2014 23:57:46 +0800
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0471_016928D1.1F958C00"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6157

[Updated on: Fri, 21 March 2014 18:08]

  •  
freakinvibe

Messages: 1542
Karma: 62
Send a private message to this user
From your headers, it looks like SpamAssassin hasn't triggered at all.

We get lots of Chinese Spam with Chinese characters and they get rated as Spam. We have not amended any rules etc. Just the default SA settings:

Return-Path: <k106<_at_>k119.cn>
X-Spam-Status: Yes, hits=9.6 required=5.0
tests=DNSBL_B.BARRACUDACENTRAL.ORG: 2.00,BAYES_50: 1.567,DATE_IN_FUTURE_12_24: 3.199,
HTML_FONT_FACE_BAD: 0.981,HTML_FONT_SIZE_LARGE: 0.001,HTML_MESSAGE: 0.001,
MISSING_MIMEOLE: 1.899,TOTAL_SCORE: 9.648,autolearn=no
X-Spam-Flag: YES
X-Spam-Level: *********
Received: from baidu.com ([124.200.52.68])
by mail.inbe.net
for 2001ky<_at_>inbe.net;
Sat, 22 Mar 2014 11:31:39 +0100
From: k106<_at_>k119.cn
To: 2001ky<_at_>inbe.net
X-Original-Subject: =?gb2312?B?0rvK1rjftsvFrtDUubrO78P7taWjq8enzfLAz7Dlyta7+sP7w ryhoaGhoaGhoVtbbm9dXQ==?=
Subject: **SPAM** =?gb2312?B?0rvK1rjftsvFrtDUubrO78P7taWjq8enzfLAz7Dlyta7+sP7w ryhoaGhoaGhoVtbbm9dXQ==?=
Date: Sun, 23 Mar 2014 18:28:58 +0800
MIME-Version: 1.0
Message-ID: <139518446832a22a72f79fa1d84d0a3fcd3b93111e<_at_>k119.cn>
Priority: urgent
X-Priority: 1
X-MSMAIL-Priority: High

So I wonder if the mail you sent the headers of is too big to be rated with SA.

Dexion AG - The Blackberry Specialists in Switzerland
https://dexionag.ch
  •  
MarkK

Messages: 454
Karma: 46
Send a private message to this user
Looking at the last 3 of these that I have received, the attachments are all Excel files that are 1MB in size.

I don't see a Max Size setting for Spam Assassin, but I do see a Size limit in the Mail.cfg file.

<table name="SpamFilter">
<variable name="MessageSizeLimit">260</variable>

Any idea what the 260 is referring to?

  •  
Kedar

Messages: 1320
Karma: 48
Send a private message to this user
The MessageSizeLimit value defines maximum size of message checked by build-in SpamAssassin.
The default value is 128 (kB), so if your mailserver.cfg contains "260", some administrator changed it in the past.

The allowed range of values for MessageSizeLimit is from 50 to 10240, ie. from 50kB to 10MB.

I hope this helps.
  •  
MarkK

Messages: 454
Karma: 46
Send a private message to this user
Is that the limit of the size of the message itself, or does that include the size of attachments too? So a message with no text but a 1MB spreadsheet attachmen, would that be scanned with a setting of 128 (default) or my higher setting of 260?
  •  
freakinvibe

Messages: 1542
Karma: 62
Send a private message to this user
That's including attachments. So a mail with a 1MB attachment would not be scanned if you have a setting of 128.

Dexion AG - The Blackberry Specialists in Switzerland
https://dexionag.ch
Previous Topic: wich folder are posible for archiving
Next Topic: KOC: Move Message slow in Outlook 2010
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Sat Oct 21 01:28:32 CEST 2017

Total time taken to generate the page: 0.00429 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.