Spam Filter ISP Forums : Blackhole on keywords

Blackhole on keywords : I ran into this issue and ended...

Tue, 22 Mar 2011 10:37:20 +0000

Author: dotme
Subject: 6920
Posted: 22 March 2011 at 10:37am

I ran into this issue and ended up writing a routine that deleted quarantined items that matched the keywords. One user was getting hammered (10+ per second) with identical emails, and they had 30,000 quarantined emails by 8am.

The routine didn't take a super log time to write, and it worked.

Blackhole on keywords : Thanks Roberto. You may have a...

Thu, 03 Mar 2011 17:35:55 +0000

Author: Bluefly
Subject: 6920
Posted: 03 March 2011 at 5:35pm

Thanks Roberto. You may have a good reason not to but I think it would be useful if the admin controlled filters took priority over the external ones. It would give the admin more granular control. Just a thought.

Blackhole on keywords : Bluefly,SpamFilter applies filters...

Wed, 02 Mar 2011 08:25:28 +0000

Author: LogSat
Subject: 6920
Posted: 02 March 2011 at 8:25am

Bluefly,

SpamFilter applies filters in a specific order, as documented here:

www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6726

As soon as a filter matches, to optimize performance, all other filters are skipped since the email has already been detected as spam. So in your example, as the "MAPS RBL" filter tags the email as spam, this filter acts before the blacklist keyword, causing the NULL option in the blacklist keyword to not being checked.

To remove all such emails (with the subject vigarra) you could schedule a query to run against the database to search for and delete such emails.

Blackhole on keywords : 1024x768 ...

Tue, 01 Mar 2011 20:00:23 +0000

Author: Bluefly
Subject: 6920
Posted: 01 March 2011 at 8:00pm

< ="-" ="text/; =utf-8">< name="ProgId" ="Word.">< name="Generator" ="Microsoft Word 12">< name="Originator" ="Microsoft Word 12">

I am having some problems getting the black list keyword filter to work. 
I currently have version 4.2.4.834 loaded using standard filters. 
I am trying to black hole emails with a subject keyword “VIGARRA”. 
I have ticked the box for matches to this filter NOT to be quarantined.

I have added the keyword to theblack list keyword filter. The list appears to be loaded as follows:

01/24/11 15:36:41:665 -- (6076) Reloadingfile for tblBL_Keywords: Lists\BlackText.txt (118 bytes)

The format of the keyword filteris as follows:

Subject:VIGARRA::NULL

I have also tried just using the word VIGARRA.

Emails with this subject keywordare being blocked for reasons other than black listed keywords, eg. IP in MAPSsearch etc. Consequently the emails are being quarantined. I do not want theseemails added to quarantine… just flushed. We're getting '000s of these things each day and they're just clutter.

Can someone let me know what I'm doing wrong or if more information is requried.