How To Improve SPAM Filtering using Runbox Filters - Page 4

ALG · 27 Feb 2005, 01:45 AM

Quote:

RFC? [/b]

RFC = Request for Comments
This is part of the system before an issue becomes a standard.

~AL~

xii · 17 Oct 2005, 03:34 AM

I have a procmail filter that -- amongst other things -- filters international character sets and brute force attempts to a 'grey' folder. Combined with spamassassin, it surely stops a lot of email that normally would have ended up in my mailbox. I haven't taken a good look at how it can be implemented with RB yet, as there's no support for rules with multiple conditions, but here are some character sets that could be filtered into a 'grey' folder (regexp):

Code:

^Content-Type:.*charset=\"(koi8-r|iso-2022-jp|windows-1251|big5)\"
^Subject:.*=\?(koi8-r|iso-2022-jp|windows-1251|big5)\?

... it works best if you combine it with a check for spamassassin scores that are high, but not high enough for the message to be marked as spam. You probably could make custom spamassassin rules for this, too.

If you get a lot of brute force spam, a rule like this can help you (regexp):

Code:

!^(From|Reply-To):.*(postmaster|yourname(+[a-zA-Z0-9]*)?)@[0-9a-zA-Z.]*.com
^(To|Cc):.*<?[a-zA-Z0-9.%+-]*@runbox.com>?,.*<?[a-zA-Z0-9.%+-]*@runbox.com>?,.*<?[a-zA-Z0-9.%+-]*@runbox.com>?

... the point being that any email received that was sent to at least 3 people at RB at the same time, is spam. That is assuming you don't know 3 other people at RB, ofcourse.

I just post it for what it is, it might help some to write a filter rule to stop these kinds of spam.

PS: Runbox does not support procmail (yet?), so don't go looking for it in the settings.

dariusdjc · 16 Jun 2006, 10:11 AM

I have done exactly as you have posted at the begining of the thread, but for some reason the part below is not working for me:

(3) Create a "NotInWhiteList" folder and a filter defined as:

Order: 999
Messages where: "Header" "doesn't contain" "USER_IN_WHITELIST"
will be: "saved to folder" "NotInWhiteList"

I am receiving e-mails, some spam in my inbox. They are not re-directed to NotInWhiteList folder. I have double checked to see if I had any spelling mistakes that may be causing this glitch, but i can't seem to figure it out. Any help is appreciated. THanks.

dariusdjc · 16 Jun 2006, 10:14 AM

almost forgot. regarding my post above, I have added all my users I wish to receive mail from to my inbox to my white list.

carverrn · 16 Jun 2006, 10:41 PM

dariusdjc,

If they are not being delivered to the "NotInWhiteList", what folder are they going to?

Regards,
Rich

dariusdjc · 24 Jun 2006, 09:29 AM

Rich,

They are going to my inbox.

carverrn · 24 Jun 2006, 10:04 PM

Take a look at the headers of these messages. Look for the "X-Spam-Status" header. It will look something like this:

Code:

X-Spam-Status: No, score=-98.8 required=5.0 tests=HTML_10_20,HTML_MESSAGE,
    UPPERCASE_50_75,USER_IN_WHITELIST autolearn=disabled version=3.0.3

Does it have the USER_IN_WHITELIST like this one does?

If so then either the "From:" address or domain is in your Whitelist. Then you need to check your Whitelist.

If not you should check your filters. Check to USER_IN_WHITELIST filter to make sure it's configured right. Check to make sure you don't have another filter that moves messages to your "Inbox" that could be moving these messages.

If you can't find anything then you'll need to contact Support-at-Runbox-dot-Com to see if they can take a look at your filters directly.

Regards,
Rich

dariusdjc · 26 Jun 2006, 01:06 PM

thanks for your help. If I can't get it to work i will ask runbox for help.

ltwally · 22 May 2008, 05:16 AM

Rich,

Your SPAM folder method has one very ugly flaw: emptying the folder. At least the Trash bin has an "(Empty)" link next to it. Deleting the entire contents of any other folder is far less fun.

This is especially true while using webmail - which you lot insist is the only way to train the anti-spam.

-ltwally

carverrn · 22 May 2008, 07:41 AM

Actually, the designated "spam" folder does have an "(empty)" link just like the Trash folder. This was implemented a while ago.

In addition, any folder that is used with a filter can not be deleted but trying to delete it will empty the folder. This isn't really a feature but a side-effect. If you select the folder and click the folder "Delete" button you will get a warning about deleting the folder and all it's contents. If you continue, all the messages in the folder will be deleted but the folder will remain. You will see an error message indicating that the folder could not be deleted because it is used by a filter.

And yes, unfortunately, the only way to train the DSPAM trainable spam filter is from the Runbox Mail Manager (RMM) web interface.

Regards,
Rich

ltwally · 29 Jun 2008, 08:04 AM

Why not just create an "official" Spam / Junkmail folder, like many other systems do? Leaving Trash for user-deleted content just seems to work all-around better.

carverrn · 29 Jun 2008, 09:08 AM

New accounts do have a Spam folder created automatically but you can still designate your own spam folder.

Regards,
Rich

ltwally · 1 Jul 2008, 04:43 AM

I see that I have a Junk folder, these days. Not real sure where it came from...

But it lacks an "empty" command, in the webmail, as the Trash folder has.

ltwally · 1 Jul 2008, 04:48 AM

I'm looking at setting up a more advanced spam filter that will just delete stuff that is almost certain to be spam, using this (http://www.emaildiscussions.com/show...9&postcount=41) as a guidline. I'll just set the filter to delete instead of move to a folder. (Trying to keep track of all that crap is just too much of a headache.)

My question: At what level does SpamAssassin currently decide that a message is spam?

carverrn · 1 Jul 2008, 06:09 AM

Any thing with a spam score greater than or equal to 4 is flagged as SPAM by SpamAssassin.

You can test the headers for

"X-Spam-Level: ****" for 4 or greater

or use

"X-Spam-Level: *****" for 5 or greater

or

"X-Spam-Level: ******" for 6 or greater

and so on.

Regards,
Rich

17 Oct 2005, 03:34 AM	#47
xii Junior Member Join Date: Oct 2005 Posts: 3	I have a procmail filter that -- amongst other things -- filters international character sets and brute force attempts to a 'grey' folder. Combined with spamassassin, it surely stops a lot of email that normally would have ended up in my mailbox. I haven't taken a good look at how it can be implemented with RB yet, as there's no support for rules with multiple conditions, but here are some character sets that could be filtered into a 'grey' folder (regexp): Code: ^Content-Type:.charset=\"(koi8-r\|iso-2022-jp\|windows-1251\|big5)\" ^Subject:.=\?(koi8-r\|iso-2022-jp\|windows-1251\|big5)\? ... it works best if you combine it with a check for spamassassin scores that are high, but not high enough for the message to be marked as spam. You probably could make custom spamassassin rules for this, too. If you get a lot of brute force spam, a rule like this can help you (regexp): Code: !^(From\|Reply-To):.(postmaster\|yourname(+[a-zA-Z0-9])?)@[0-9a-zA-Z.].com ^(To\|Cc):.<?[a-zA-Z0-9.%+-]@runbox.com>?,.<?[a-zA-Z0-9.%+-]@runbox.com>?,.<?[a-zA-Z0-9.%+-]*@runbox.com>? ... the point being that any email received that was sent to at least 3 people at RB at the same time, is spam. That is assuming you don't know 3 other people at RB, ofcourse. I just post it for what it is, it might help some to write a filter rule to stop these kinds of spam. PS: Runbox does not support procmail (yet?), so don't go looking for it in the settings.

24 Jun 2006, 10:04 PM	#52
carverrn Intergalactic Postmaster Join Date: Jan 2002 Location: Chicago, IL Posts: 5,606 Representative of: Runbox.com	Take a look at the headers of these messages. Look for the "X-Spam-Status" header. It will look something like this: Code: X-Spam-Status: No, score=-98.8 required=5.0 tests=HTML_10_20,HTML_MESSAGE, UPPERCASE_50_75,USER_IN_WHITELIST autolearn=disabled version=3.0.3 Does it have the USER_IN_WHITELIST like this one does? If so then either the "From:" address or domain is in your Whitelist. Then you need to check your Whitelist. If not you should check your filters. Check to USER_IN_WHITELIST filter to make sure it's configured right. Check to make sure you don't have another filter that moves messages to your "Inbox" that could be moving these messages. If you can't find anything then you'll need to contact Support-at-Runbox-dot-Com to see if they can take a look at your filters directly. Regards, Rich

16 Jun 2006, 10:11 AM	#48
dariusdjc Junior Member Join Date: Jun 2006 Posts: 4	I have done exactly as you have posted at the begining of the thread, but for some reason the part below is not working for me: (3) Create a "NotInWhiteList" folder and a filter defined as: Order: 999 Messages where: "Header" "doesn't contain" "USER_IN_WHITELIST" will be: "saved to folder" "NotInWhiteList" I am receiving e-mails, some spam in my inbox. They are not re-directed to NotInWhiteList folder. I have double checked to see if I had any spelling mistakes that may be causing this glitch, but i can't seem to figure it out. Any help is appreciated. THanks.

16 Jun 2006, 10:14 AM	#49
dariusdjc Junior Member Join Date: Jun 2006 Posts: 4	almost forgot. regarding my post above, I have added all my users I wish to receive mail from to my inbox to my white list.

16 Jun 2006, 10:41 PM	#50
carverrn Intergalactic Postmaster Join Date: Jan 2002 Location: Chicago, IL Posts: 5,606 Representative of: Runbox.com	dariusdjc, If they are not being delivered to the "NotInWhiteList", what folder are they going to? Regards, Rich

24 Jun 2006, 09:29 AM	#51
dariusdjc Junior Member Join Date: Jun 2006 Posts: 4	Rich, They are going to my inbox.

26 Jun 2006, 01:06 PM	#53
dariusdjc Junior Member Join Date: Jun 2006 Posts: 4	thanks for your help. If I can't get it to work i will ask runbox for help.

22 May 2008, 05:16 AM	#54
ltwally Member Join Date: Mar 2005 Posts: 76	Rich, Your SPAM folder method has one very ugly flaw: emptying the folder. At least the Trash bin has an "(Empty)" link next to it. Deleting the entire contents of any other folder is far less fun. This is especially true while using webmail - which you lot insist is the only way to train the anti-spam. -ltwally

22 May 2008, 07:41 AM	#55
carverrn Intergalactic Postmaster Join Date: Jan 2002 Location: Chicago, IL Posts: 5,606 Representative of: Runbox.com	Actually, the designated "spam" folder does have an "(empty)" link just like the Trash folder. This was implemented a while ago. In addition, any folder that is used with a filter can not be deleted but trying to delete it will empty the folder. This isn't really a feature but a side-effect. If you select the folder and click the folder "Delete" button you will get a warning about deleting the folder and all it's contents. If you continue, all the messages in the folder will be deleted but the folder will remain. You will see an error message indicating that the folder could not be deleted because it is used by a filter. And yes, unfortunately, the only way to train the DSPAM trainable spam filter is from the Runbox Mail Manager (RMM) web interface. Regards, Rich

29 Jun 2008, 08:04 AM	#56
ltwally Member Join Date: Mar 2005 Posts: 76	Why not just create an "official" Spam / Junkmail folder, like many other systems do? Leaving Trash for user-deleted content just seems to work all-around better.

29 Jun 2008, 09:08 AM	#57
carverrn Intergalactic Postmaster Join Date: Jan 2002 Location: Chicago, IL Posts: 5,606 Representative of: Runbox.com	New accounts do have a Spam folder created automatically but you can still designate your own spam folder. Regards, Rich

1 Jul 2008, 04:43 AM	#58
ltwally Member Join Date: Mar 2005 Posts: 76	I see that I have a Junk folder, these days. Not real sure where it came from... But it lacks an "empty" command, in the webmail, as the Trash folder has.

1 Jul 2008, 04:48 AM	#59
ltwally Member Join Date: Mar 2005 Posts: 76	I'm looking at setting up a more advanced spam filter that will just delete stuff that is almost certain to be spam, using this (http://www.emaildiscussions.com/show...9&postcount=41) as a guidline. I'll just set the filter to delete instead of move to a folder. (Trying to keep track of all that crap is just too much of a headache.) My question: At what level does SpamAssassin currently decide that a message is spam?

1 Jul 2008, 06:09 AM	#60
carverrn Intergalactic Postmaster Join Date: Jan 2002 Location: Chicago, IL Posts: 5,606 Representative of: Runbox.com	Any thing with a spam score greater than or equal to 4 is flagged as SPAM by SpamAssassin. You can test the headers for "X-Spam-Level: **" for 4 or greater or use "X-Spam-Level: *" for 5 or greater or "X-Spam-Level: ****" for 6 or greater and so on. Regards, Rich