Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Keywords Filter
  FAQ FAQ  Forum Search   Register Register  Login Login

Keywords Filter

 Post Reply Post Reply
Author
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Topic: Keywords Filter
    Posted: 26 June 2014 at 5:04pm
Yes, as far as spammers bypassing your SpamFilter server and sending emails to the secondaries, that would definitely put a stop to it.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
flessendop View Drop Down
Newbie
Newbie


Joined: 10 April 2014
Status: Offline
Points: 7
Post Options Post Options   Thanks (0) Thanks(0)   Quote flessendop Quote  Post ReplyReply Direct Link To This Post Posted: 26 June 2014 at 9:36am
So when i delete MX15 and MX20 the problem must be solved  ?

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 26 June 2014 at 7:42am
Pascal,

We received your files. Missing from both same emails are all the headers added by SpamFilter, which indicate that the email was never processed by SpamFilter to begin with. These are the SpamFilter headers (which usually start with an X-SF- prefix) to look for:

X-SF-RX-Return-Path: 
X-SF-HELO-Domain: 
X-SF-Originating-IP: 

The emails processed by SpamFilter will also have a "Received" header similar to this:

Received: from 212.54.nnn.nnn by mail.netwide.net (SpamFilter ISP); Thu, 26 Jun 2014 02:54:55 -0400


Checking the MX record for your domain, I see that you have 4 entries in there with different priorities. SpamFilter is installed on the server with priority 10:

nnnnnnnnn.nl.  86400  IN  MX  10   mail.nnnnnnn.nl

However there are also entries with priorities 15, 20 and 25. On the servers with priorities 15 and 20 you don't have SpamFilter running, but rather have a "Microsoft ESMTP MAIL Service" listening for SMTP traffic. Please note that spammers will often ignore the RFC and send their spam emails directly to secondary MX records, knowing that they are often not as protected as the primary MX records.

You can verify this is exactly what happened in your case by looking at this Received header for one of your email samples:

Received: from 184.189.11.37.dynamic.jazztel.es (37.11.189.184) by

 aaaaaaaa.bbbbbb.nl (192.168.50.253) with Microsoft SMTP Server id 14.3.123.3;

 Thu, 26 Jun 2014 08:51:27 +0200


I've altered the host name to protect your privacy, but if you look at the original email you will see that aaaaaaaa.bbbbbb.nl is the secondary MX server with priority 20 in your DNS (which is not protected by SpamFilter).

To resolve this you would either need to install SpamFilter on all your secondary MX servers (please note that a new license is required for each of them), or install another anti spam solution, or remove the secondary MX records from the DNS.

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
flessendop View Drop Down
Newbie
Newbie


Joined: 10 April 2014
Status: Offline
Points: 7
Post Options Post Options   Thanks (0) Thanks(0)   Quote flessendop Quote  Post ReplyReply Direct Link To This Post Posted: 26 June 2014 at 3:43am
I send an e-mail to u.
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 25 June 2014 at 9:10pm
Pascal,

Could you please zip us the following so we can take a look:

• Two or three emails with the content that you think should have triggered a match with one of your keywords

• SpamFilter's activity logfile for the day the above emails were received

• Your SpamFilter.ini file

• The \SpamFilter\Domains directory structure (if the files containing any of your blacklists/whitelists are outside that directory tree, please include those as well.


If the zip is smaller than 8MB, you can email it to us at support at logsat.com. If the zipped file is over 8MB in size, I'll send you via PM a URL where you can upload the files to us.

 

Please ensure you send us the original emails, with their headers and body unaltered, as we'll need to see the source of the emails to determine what happened. Usually forwarding the emails as attachments rather than inline suffices. 

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
flessendop View Drop Down
Newbie
Newbie


Joined: 10 April 2014
Status: Offline
Points: 7
Post Options Post Options   Thanks (0) Thanks(0)   Quote flessendop Quote  Post ReplyReply Direct Link To This Post Posted: 25 June 2014 at 8:14am
Hello,

I got a problem with my keyword filter.

Here are some words in it:

Ruby,Palace
ruby palace
BreakingBulls
Trading Wall
MomentumOTC
PennyStockReporting
The most undervalued company this year
casinogames
USATODAY.COM
LifeHealthPro
NYTimes.com
Eat This, Not That
TD Ameritrade
Scottrade
Investors
Newsdesk
RealInvestments
Ameritrade
The Bloomberg.com Team
Update your profile
Financial News
Our New Stock Alert!
USMarketAdvisor
BREAKING NEWS

Most of emails with this in the content isn't be blocked 

How can i change this so we don't get the spam ?

Version 4.5.1.98 ( REGISTERED )

With regards,

Pascal


Edited by flessendop - 25 June 2014 at 8:15am
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.047 seconds.