Print Page | Close Window

Attachments not blacklisted

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7110
Printed Date: 27 December 2024 at 1:37am


Topic: Attachments not blacklisted
Posted By: Tomm
Subject: Attachments not blacklisted
Date Posted: 26 March 2015 at 12:00am
Hi All,

We've recently started blacklisting by attachment matching "*.zip" due to a spate of new spam with viruses in zip files.

However, emails with zip attachments are still getting through, the log entry is "Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering"

That test email was only 3MB altogether. The size listed on the Configuration Tab for "Max email size in KB" is 30480.

Please help me understand this.

Version is 4.7.0.126


Replies:
Posted By: LogSat
Date Posted: 26 March 2015 at 12:31am
Tomm,

We're not able to replicate the issue - sending a test email with a .zip attachment that is 4MB in size, with the SpamFilter.ini containing this value:

MaxMsgSizeForSpamFiltering=30480

does result in the email being quarantined:

03/26/15 00:22:59:187 -- (18662720) Connection from: 10.211.55.7  -  Originating country : N/A
03/26/15 00:22:59:328 -- (18662720) Received MAIL FROM: roberto4@test.logsat.com
03/26/15 00:22:59:328 -- (18662720) Received RCPT TO: roberto5@netwide.net
03/26/15 00:23:02:343 -- (18662720) Found Keywords: [Found prohibited attachment: complete network spam 2-16-15.zip]
03/26/15 00:23:02:343 -- (18662720) EMail from roberto4@test.logsat.com to roberto5@netwide.net matches content filter rules - rejected.
03/26/15 00:23:03:218 -- (18662720) Starting quarantine procedures
03/26/15 00:23:03:234 -- (18662720) Created thread (18558800) to add email to quarantine
03/26/15 00:23:03:234 -- (18558800) Adding to Quarantine file:QrtnBEAD2701-839F-40DA-9F95-11DEEA02E79C.tmp
03/26/15 00:23:03:250 -- (18662720) Disconnect
03/26/15 00:23:03:484 -- (18558800) EMail from roberto4@test.logsat.com to roberto5@netwide.net was received and quarantined. Size: 3980 KB, 4075520 bytes

Can you please zip us the following so we can take a better look:

• SpamFilter's activity logfile for today (or a day this happened)

• The email that was delivered - please include the email as an attachment, not forwarding it to us "inline" via email so as to retain the original message format

• Your SpamFilter.ini file

• The \SpamFilter\Domains directory structure (if the files containing any of your blacklists/whitelists are outside that directory tree, please include those as well.


If the zipped file is over 8MB in size, please try to upload the file to our repository - I'll send you the URL/password in a separate PM.

 

Thanks,


Roberto Franceschetti

LogSat Software



-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: yapadu
Date Posted: 05 April 2015 at 9:06am
Tomm,

I don't know how you are calculating the size of the message, but if you are sending a 3 meg attachment it will actually be larger than that.  The email client will convert it into a MIME encoded string and the size will increase by 30% or more, which would take it over your 30480 for sure.



-------------
--------------------------------------------------------------
I am a user of SF, not an employee. Use any advice offered at your own risk.


Print Page | Close Window