The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

any thoughts on how this landed in the inbox ?

Discussion in 'E-mail Discussions' started by keat63, Mar 6, 2015.

  1. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    Code:
     
    Return-path: <suprawoto@sby.prima.net.id>
    Envelope-to: [email]email@domain.co.uk[/email]
    Delivery-date: Fri, 06 Mar 2015 16:54:19 +0000
    Received: from mail.sby.prima.net.id ([202.57.9.19]:51935 helo=mail.dev2.coba.sby.prima.net.id)
    	by leeds.stlservers.co.uk with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
    	(Exim 4.85)
    	(envelope-from <suprawoto@sby.prima.net.id>)
    	id 1YTvVw-0004aK-L8
    	for [email]email@domain.co.uk[/email]; Fri, 06 Mar 2015 16:54:18 +0000
    Received: (qmail 12444 invoked by uid 89); 6 Mar 2015 15:23:12 -0000
    Received: by simscan 1.4.0 ppid: 9560, pid: 12355, t: 1.8726s
             scanners: attach: 1.4.0 clamav: 0.97/m:53/d:12784 spam: 3.2.5
    X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
    	mail.dev2.coba.sby.prima.net.id
    X-Spam-Level: 
    X-Spam-Status: No, score=-2.2 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00,
    	MISSING_MID,PYZOR_CHECK autolearn=no version=3.2.5
    Received: from unknown (HELO SERVER) (suprawoto@sby.prima.net.id@110.142.231.188)
      by mail.dev2.coba.sby.prima.net.id with ESMTPA; 6 Mar 2015 15:23:10 -0000
    From: "Pedro Quezada" <suprawoto@sby.prima.net.id>
    To: [email]email@domain.co.uk[/email]
    MIME-Version: 1.0
    Reply-To: [email]spammer@gmail.com[/email]
    Date: Sat, 7 Mar 2015 01:22:57 +1000
    Content-Type: text/plain
    Content-Transfer-Encoding: quoted-printable
    X-Spam-Status: Yes, score=5.3
    X-Spam-Score: 53
    X-Spam-Bar: +++++
    X-Spam-Report: Spam detection software, running on the system "host.myserver.co.uk",
     has identified this incoming email as possible spam.  The original
     message has been attached to this so you can view it or label
     similar future email.  If you have any questions, see
     root\@localhost for details.
     
     Content preview:  Hi, You have received a donation of 750,000 USD; reply to
       [email]spammer@gmail.com[/email] for details. [...] 
     
     Content analysis details:   (5.3 points, 5.0 required)
     
      pts rule name              description
     ---- ---------------------- --------------------------------------------------
     -0.0 T_RP_MATCHES_RCVD      Envelope sender domain matches handover relay
                                 domain
      2.7 RCVD_IN_PSBL           RBL: Received via a relay in PSBL
                                 [202.57.9.19 listed in psbl.surriel.com]
      0.1 MISSING_MID            Missing Message-Id: header
      0.0 LOTS_OF_MONEY          Huge... sums of money
      2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
    X-Spam-Flag: YES
    Subject: ***SPAM*** Donation
    
    Hi,
    
    You have received a donation of 750,000 USD; reply to pedrro.quezada@g=
    mail.com for details.
    
     
    #1 keat63, Mar 6, 2015
    Last edited: Mar 6, 2015
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  3. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    Actually, I did tinker with auto delete yesterday. I configured auto delete to 10.
    But left spam config for 5.
    I assumed anything above 5 would go to spam, and anything above 10 would be deleted ?

    also to add to this, the spam folder did actually have spam (until i deleted it), so it seems to be working.
    Just not sure how this one landed in the inbox, especially considering it's marked as "Spam"
     
    #3 keat63, Mar 6, 2015
    Last edited: Mar 6, 2015
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    In "WHM Home » Server Configuration » Tweak Settings", under the "Mail" tab, you can enable the following option to ensure users can configure the ability to move messages marked as SPAM to a SPAM box:

    "Enable Apache SpamAssassin™ Spam Box delivery for messages marked as spam (user configurable)"

    Then, make sure the "Spam Box" option is enabled under the "Apache SpamAssassin" area of cPanel.

    Thank you.
     
  5. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    These are already enabled and spam assassin has been working OK, to a certain extent.
    I'm confused, given it has a score of 5.3 and has been identified as spam, that it landed in the inbox.

    Code:
    X-Spam-Report: Spam detection software, has identified this incoming email as possible spam.  
     Content analysis details:   (5.3 points, 5.0 required)
    
     
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Feel free to open a support ticket using the link in my signature so we can take a closer look as to why those options are not respected. You can post the ticket number here so we can update this thread with the outcome.

    Thank you.
     
  7. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    I guess considering it was only 1 event, maybe i'll wait to see if it becomes frequent before wasting any ones time.
     

Share This Page