Passed SPAM

[John Andersen]

On 8/8/2014 10:34 AM, Konstantin wrote:
> Hi,
> 
> Can someone please look why this message passed through, not rejected.
> Amavis installed as before-queue filter,  version 2.8.0-8.el6
> 
> I have "$final_spam_destiny       = D_REJECT" but it did not work for this message (and ~10 another today)
> 
> Aug  8 17:05:37 amavis[28337]: (28337-13) Passed SPAM {BouncedInbound,RelayedInbound,Quarantined}, [95.172.88.23]:57023 [46.20.217.70]
> <AmericanExpress at welcome.aexp.com <mailto:AmericanExpress at welcome.aexp.com>> -> <user1 at test.com <mailto:user1 at test.com>>,<user2 at test.com
> <mailto:user2 at test.com>> Message-ID: <G32SDP2967899210915995651292.MYCA at welcome.aexp.com
> <mailto:G32SDP2967899210915995651292.MYCA at welcome.aexp.com>>, mail_id: t5tozGThH_ep, Hits: *21.355..121.355*, size: 8333, queued_as:
> 3hVzBMbxP, Subject: "Security concern on your AmericanExpress Account", From:
> "American_Express_Customer_Service"_<AmericanExpress at welcome.aexp.com <mailto:AmericanExpress at welcome.aexp.com>>, Tests:
> [AM.WBL=100,AV:Heuristics.Phishing.Email.SpoofedDomain=0.1,POLICY_1=4,GEO_IL=0.001,HTML_MESSAGE=0.001,MIME_HTML_ONLY=1.105,URIBL_BLACK=1.7,URIBL_DBL_SPAM=2.5,URIBL_JP_SURBL=1.948,TW_SPAM=10],
> 481 ms
> 
> http://pastebin.com/r9Dbkk9U
> 
> Thanks.
> 
> -- 
> *This message was delivered using 100% recycledelectrons***.

Could it be that your amavisd.conf has $sa_mail_body_size_limit set too small
and large mails (usually with images attached) exceed this size.
These are simply not scanned even though there are headers erroneously indicating
that it was scanned?

-- 
_____________________________________
---This space for rent---