Spam Filter ISP Support - Keywords Filter

Keywords Filter

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7088
Printed Date: 26 December 2024 at 7:36am

Topic: Keywords Filter

Posted By: flessendop
Subject: Keywords Filter
Date Posted: 25 June 2014 at 8:14am

Hello,

I got a problem with my keyword filter.

Here are some words in it:

Ruby,Palace

ruby palace

BreakingBulls

Trading Wall

MomentumOTC

PennyStockReporting

The most undervalued company this year

casinogames

USATODAY.COM

LifeHealthPro

NYTimes.com

Eat This, Not That

TD Ameritrade

Scottrade

Investors

Newsdesk

RealInvestments

Ameritrade

The Bloomberg.com Team

Update your profile

Financial News

Our New Stock Alert!

USMarketAdvisor

BREAKING NEWS

Most of emails with this in the content isn't be blocked

How can i change this so we don't get the spam ?

Version 4.5.1.98 ( REGISTERED )

With regards,

Pascal

Replies:

Posted By: LogSat
Date Posted: 25 June 2014 at 9:10pm

Pascal,

Could you please zip us the following so we can take a look:

• Two or three emails with the content that you think should have triggered a match with one of your keywords

• SpamFilter's activity logfile for the day the above emails were received

• Your SpamFilter.ini file

• The \SpamFilter\Domains directory structure (if the files containing any of your blacklists/whitelists are outside that directory tree, please include those as well.

If the zip is smaller than 8MB, you can email it to us at support at logsat.com. If the zipped file is over 8MB in size, I'll send you via PM a URL where you can upload the files to us.

Please ensure you send us the original emails, with their headers and body unaltered, as we'll need to see the source of the emails to determine what happened. Usually forwarding the emails as attachments rather than inline suffices.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: flessendop
Date Posted: 26 June 2014 at 3:43am

I send an e-mail to u.

Posted By: LogSat
Date Posted: 26 June 2014 at 7:42am

Pascal,

We received your files. Missing from both same emails are all the headers added by SpamFilter, which indicate that the email was never processed by SpamFilter to begin with. These are the SpamFilter headers (which usually start with an X-SF- prefix) to look for:

X-SF-RX-Return-Path: 

X-SF-HELO-Domain: 

X-SF-Originating-IP: 

The emails processed by SpamFilter will also have a "Received" header similar to this:

Received: from 212.54.nnn.nnn by mail.netwide.net (SpamFilter ISP); Thu, 26 Jun 2014 02:54:55 -0400

Checking the MX record for your domain, I see that you have 4 entries in there with different priorities. SpamFilter is installed on the server with priority 10:

nnnnnnnnn.nl. 86400 IN MX 10 mail.nnnnnnn.nl

However there are also entries with priorities 15, 20 and 25. On the servers with priorities 15 and 20 you don't have SpamFilter running, but rather have a "Microsoft ESMTP MAIL Service" listening for SMTP traffic. Please note that spammers will often ignore the RFC and send their spam emails directly to secondary MX records, knowing that they are often not as protected as the primary MX records.

You can verify this is exactly what happened in your case by looking at this Received header for one of your email samples:

Received: from 184.189.11.37.dynamic.jazztel.es (37.11.189.184) by

aaaaaaaa.bbbbbb.nl (192.168.50.253) with Microsoft SMTP Server id 14.3.123.3;

Thu, 26 Jun 2014 08:51:27 +0200

I've altered the host name to protect your privacy, but if you look at the original email you will see that aaaaaaaa.bbbbbb.nl is the secondary MX server with priority 20 in your DNS (which is not protected by SpamFilter).

To resolve this you would either need to install SpamFilter on all your secondary MX servers (please note that a new license is required for each of them), or install another anti spam solution, or remove the secondary MX records from the DNS.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: flessendop
Date Posted: 26 June 2014 at 9:36am

So when i delete MX15 and MX20 the problem must be solved ?

Posted By: LogSat
Date Posted: 26 June 2014 at 5:04pm

Yes, as far as spammers bypassing your SpamFilter server and sending emails to the secondaries, that would definitely put a stop to it.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP