Flashlight spam (and others)

@lbutlr kremels at kreme.com
Sat Dec 17 18:11:51 CET 2016

I keep getting a rash of multiples of flashlight spam and gift card spam, all of which go sailing right through amavisd/postfix. Has anyone figured out a way to have amavis be more aggressive in tagging spam like this? Obviously BAYES_00 doesn't help, but even without that this spam would not have gotten tagged. There are hundreds of these hitting the server every day. and dozens just to me.

I run these through sa-learn but the bayes score never changes.

Return-Path: <nighthawk_gear-kreme=kreme.com at webmasterbond.com>
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail.covisp.net
X-Spam-Status: No, score=0.3 required=5.0 tests=BAYES_00,DCC_CHECK,DKIM_SIGNED,
	T_DKIM_INVALID,T_REMOTE_IMAGE autolearn=no autolearn_force=no version=3.4.1
	* -4.0 BAYES_00 BODY: Bayes spam probability is 0 to 1%
	*      [score: 0.0005]
	*  1.6 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  1.1 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
	*  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
	*      valid
	*  0.7 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME
	*      headers
	*  0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
	*  0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
	*  0.0 T_REMOTE_IMAGE Message contains an external image
X-Original-To: kreme at covisp.net
Delivered-To: kreme at covisp.net
Received: from mail.covisp.net (localhost [])
	by mail.covisp.net (Postfix) with ESMTP id 3tdYyT1XkSzv9rl
	for <kreme at covisp.net>; Tue, 13 Dec 2016 15:18:57 -0700 (MST)
X-Virus-Scanned: amavisd-new at covisp.net
Authentication-Results: mail.covisp.net (amavisd-new);
	dkim=fail (1024-bit key) reason="fail (message has been altered)"
	header.d=webmasterbond.com; domainkeys=fail (1024-bit key)
	reason="fail (message has been altered)"
	header.from=nighthawk_gear at webmasterbond.com
Received: from mail.covisp.net ([])
	by mail.covisp.net (mail.covisp.net []) (amavisd-new, port 10024)
	with ESMTP id r-XqbA5JCtTg; Tue, 13 Dec 2016 15:18:56 -0700 (MST)
Received: from mail.webmasterbond.com (unknown [])
	by mail.covisp.net (Postfix) with ESMTP id 3tdYyS2Ml3zv9nS
	for <kreme at kreme.com>; Tue, 13 Dec 2016 15:18:56 -0700 (MST)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=webmasterbond.com;
 h=Date:From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; i=nighthawk_gear at webmasterbond.com;
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=webmasterbond.com;
Received: by mail.webmasterbond.com id ha1pt00001gf for <kreme at kreme.com>; Tue, 13 Dec 2016 16:17:04 -0600 (envelope-from <nighthawk_gear-kreme=kreme.com at webmasterbond.com>)
Date: Tue, 13 Dec 2016 16:17:04 -0600
From: "NightHawk Gear" <nighthawk_gear at webmasterbond.com>
To:   <kreme at kreme.com>
Subject: New LED flashlight technology released
Content-Type: multipart/alternative; 
X-SMTPAPI: {"category": "20161213-161042-880-4573"}
List-Unsubscribe: <http://www.webmasterbond.com/green/6488G9C11BKT1163qwlOgOFwlOgOzMig964/call>
Feedback-ID: 201612131610428804573
Message-ID: < at mail.webmasterbond.com>

More information about the amavis-users mailing list