Adminu has two Centos 6.10 servers with VestaCP on board. Operatives worth 1GB + SWAP on 4GB.

I connected Spamassassin and everything works fine on the first, all emails are checked, and on the second half of the explicit spam is checked, and half is not (no Spamassassin headers are stupid), but when I start checking for such a letter via ssh spamassassin -D < test-message.txt it shows that score 14 out of 3 is required - i.e. obvious spam.

The next question is why spamassassin does not read all the letters?

Config spamassassin (local.cf):

 required_hits 3 report_safe 0 ok_locales en ru rewrite_header Subject [SPAM] add_header spam Flag _YESNOCAPS_ add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_ add_header all Level _STARS(*)_ add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_ use_learner 0 use_auto_whitelist 0 use_bayes 1 use_bayes_rules 1 bayes_auto_learn 0 bayes_auto_expire 0

Config Exim

 ###################################################################### # # # Exim configuration file for Vesta Control Panel # # # ###################################################################### SPAMASSASSIN = yes SPAM_SCORE = 10 #CLAMD = yes disable_ipv6=true domainlist local_domains = dsearch;/etc/exim/domains/ domainlist relay_to_domains = dsearch;/etc/exim/domains/ hostlist relay_from_hosts = 127.0.0.1 hostlist whitelist = net-iplsearch;/etc/exim/white-blocks.conf hostlist spammers = net-iplsearch;/etc/exim/spam-blocks.conf no_local_from_check untrusted_set_sender = * acl_smtp_connect = acl_check_spammers acl_smtp_mail = acl_check_mail acl_smtp_rcpt = acl_check_rcpt acl_smtp_data = acl_check_data acl_smtp_mime = acl_check_mime .ifdef SPAMASSASSIN spamd_address = 127.0.0.1 783 .endif .ifdef CLAMD av_scanner = clamd: /var/run/clamav/clamd.sock .endif tls_advertise_hosts = * tls_certificate = /usr/local/vesta/ssl/certificate.crt tls_privatekey = /usr/local/vesta/ssl/certificate.key daemon_smtp_ports = 25 : 465 : 587 : 2525 tls_on_connect_ports = 465 never_users = root host_lookup = * rfc1413_hosts = * rfc1413_query_timeout = 5s ignore_bounce_errors_after = 2d timeout_frozen_after = 7d DKIM_DOMAIN = ${lc:${domain:$h_from:}} DKIM_FILE = /etc/exim/domains/${lc:${domain:$h_from:}}/dkim.pem DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}} ###################################################################### # ACL CONFIGURATION # # Specifies access control lists for incoming SMTP mail # ###################################################################### begin acl acl_check_spammers: accept hosts = +whitelist drop message = Your host in blacklist on this server. log_message = Host in blacklist hosts = +spammers accept acl_check_mail: deny condition = ${if eq{$sender_helo_name}{}} message = HELO required before MAIL drop message = Helo name contains a ip address (HELO was $sender_helo_name) and not is valid condition = ${if match{$sender_helo_name}{\N((\d{1,3}[.-]\d{1,3}[.-]\d{1,3}[.-]\d{1,3})|([0-9a-f]{8})|([0-9A-F]{8}))\N}{yes}{no}} condition = ${if match {${lookup dnsdb{>: defer_never,ptr=$sender_host_address}}\}{$sender_helo_name}{no}{yes}} delay = 45s drop condition = ${if isip{$sender_helo_name}} message = Access denied - Invalid HELO name (See RFC2821 4.1.3) drop condition = ${if eq{[$interface_address]}{$sender_helo_name}} message = $interface_address is _my_ address accept acl_check_rcpt: accept hosts = : deny message = Restricted characters in address domains = +local_domains local_parts = ^[.] : ^.*[@%!/|] deny message = Restricted characters in address domains = !+local_domains local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./ require verify = sender accept hosts = +relay_from_hosts control = submission accept authenticated = * control = submission/domain= deny message = Rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text hosts = !+whitelist dnslists = ${readfile {/etc/exim/dnsbl.conf}{:}} require message = relay not permitted domains = +local_domains : +relay_to_domains deny message = smtp auth requried sender_domains = +local_domains !authenticated = * require verify = recipient .ifdef CLAMD warn set acl_m0 = no warn condition = ${if exists {/etc/exim/domains/$domain/antivirus}{yes}{no}} set acl_m0 = yes .endif .ifdef SPAMASSASSIN warn set acl_m1 = no warn condition = ${if exists {/etc/exim/domains/$domain/antispam}{yes}{no}} set acl_m1 = yes .endif accept acl_check_data: .ifdef CLAMD deny message = Message contains a virus ($malware_name) and has been rejected malware = * condition = ${if eq{$acl_m0}{yes}{yes}{no}} .endif .ifdef SPAMASSASSIN warn !authenticated = * hosts = !+relay_from_hosts condition = ${if < {$message_size}{100K}} condition = ${if eq{$acl_m1}{yes}{yes}{no}} spam = nobody:true/defer_ok add_header = X-Spam-Score: $spam_score_int add_header = X-Spam-Bar: $spam_bar add_header = X-Spam-Report: $spam_report set acl_m2 = $spam_score_int warn condition = ${if !eq{$acl_m2}{} {yes}{no}} condition = ${if >{$acl_m2}{SPAM_SCORE} {yes}{no}} add_header = X-Spam-Status: Yes message = SpamAssassin detected spam (from $sender_address to $recipients). .endif accept acl_check_mime: deny message = Blacklisted file extension detected condition = ${if match {${lc:$mime_filename}}{\N(\.ade|\.adp|\.bat|\.chm|\.cmd|\.com|\.cpl|\.exe|\.hta|\.ins|\.isp|\.jse|\.lib|\.lnk|\.mde|\.msc|\.msp|\.mst|\.pif|\.scr|\.sct|\.shb|\.sys|\.vb|\.vbe|\.vbs|\.vxd|\.wsc|\.wsf|\.wsh)$\N}{1}{0}} accept ###################################################################### # AUTHENTICATION CONFIGURATION # ###################################################################### begin authenticators dovecot_plain: driver = dovecot public_name = PLAIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1 dovecot_login: driver = dovecot public_name = LOGIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1 ###################################################################### # ROUTERS CONFIGURATION # # Specifies how addresses are handled # ###################################################################### begin routers #smarthost: # driver = manualroute # domains = ! +local_domains # transport = remote_smtp # route_list = * smartrelay.vestacp.com # no_more # no_verify dnslookup: driver = dnslookup domains = !+local_domains transport = remote_smtp no_more userforward: driver = redirect check_local_user file = $home/.forward allow_filter no_verify no_expn check_ancestor file_transport = address_file pipe_transport = address_pipe reply_transport = address_reply procmail: driver = accept check_local_user require_files = ${local_part}:+${home}/.procmailrc:/usr/bin/procmail transport = procmail no_verify autoreplay: driver = accept require_files = /etc/exim/domains/$domain/autoreply.${local_part}.msg condition = ${if exists{/etc/exim/domains/$domain/autoreply.${local_part}.msg}{yes}{no}} retry_use_local_part transport = userautoreply unseen aliases: driver = redirect headers_add = X-redirected: yes data = ${extract{1}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/domains/$domain/aliases}}}} require_files = /etc/exim/domains/$domain/aliases redirect_router = dnslookup pipe_transport = address_pipe unseen localuser_fwd_only: driver = accept transport = devnull condition = ${if exists{/etc/exim/domains/$domain/fwd_only}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/fwd_only}{true}{false}}}} localuser_spam: driver = accept transport = local_spam_delivery condition = ${if eq {${if match{$h_X-Spam-Status:}{\N^Yes\N}{yes}{no}}} {${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}{yes}{no_such_user}}}} localuser: driver = accept transport = local_delivery condition = ${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}{true}{false}} catchall: driver = redirect headers_add = X-redirected: yes require_files = /etc/exim/domains/$domain/aliases data = ${extract{1}{:}{${lookup{*@$domain}lsearch{/etc/exim/domains/$domain/aliases}}}} file_transport = local_delivery redirect_router = dnslookup terminate_alias: driver = accept transport = devnull condition = ${lookup{$local_part@$domain}lsearch{/etc/exim/domains/$domain/aliases}{true}{false}} ###################################################################### # TRANSPORTS CONFIGURATION # ###################################################################### begin transports remote_smtp: driver = smtp #helo_data = $sender_address_domain dkim_domain = DKIM_DOMAIN dkim_selector = mail dkim_private_key = DKIM_PRIVATE_KEY dkim_canon = relaxed dkim_strict = 0 procmail: driver = pipe command = "/usr/bin/procmail -d $local_part" return_path_add delivery_date_add envelope_to_add user = $local_part initgroups return_output local_delivery: driver = appendfile maildir_format maildir_use_size_file user = ${extract{2}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}} group = mail create_directory directory_mode = 770 mode = 660 use_lockfile = no delivery_date_add envelope_to_add return_path_add directory = "${extract{5}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}/mail/$domain/$local_part" quota = ${extract{6}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}M quota_warn_threshold = 75% local_spam_delivery: driver = appendfile maildir_format maildir_use_size_file user = ${extract{2}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}} group = mail create_directory directory_mode = 770 mode = 660 use_lockfile = no delivery_date_add envelope_to_add return_path_add directory = "${extract{5}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}/mail/$domain/$local_part/.Spam" quota = ${extract{6}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}M quota_directory = "${extract{5}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}/mail/$domain/$local_part" quota_warn_threshold = 75% address_pipe: driver = pipe return_output address_file: driver = appendfile delivery_date_add envelope_to_add return_path_add address_reply: driver = autoreply userautoreply: driver = autoreply file = /etc/exim/domains/$domain/autoreply.${local_part}.msg from = "${local_part}@${domain}" headers = Content-Type: text/plain; charset=utf-8;\nContent-Transfer-Encoding: 8bit subject = "${if def:h_Subject: {Autoreply: \"${rfc2047:$h_Subject:}\"} {Autoreply Message}}" to = "${sender_address}" devnull: driver = appendfile file = /dev/null ###################################################################### # RETRY CONFIGURATION # ###################################################################### begin retry # Address or Domain Error Retries # ----------------- ----- ------- * * F,2h,15m; G,16h,1h,1.5; F,4d,6h ###################################################################### # REWRITE CONFIGURATION # ###################################################################### begin rewrite ######################################################################

The headlines of the letter that counted:

 Return-path: <reklama=expors.ru@mlgn2ca.com> Envelope-to: info@mydomain.com Delivery-date: Wed, 13 Mar 2019 09:46:41 +0200 Received: from mail44.em3.n.mlgn2ca.com ([80.233.244.44]) by server.myserver.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.91) (envelope-from <reklama=expors.ru@mlgn2ca.com>) id 1h3yas-0003GM-KA for info@mydomain.com; Wed, 13 Mar 2019 09:46:41 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=s3o18; d=mlgn2ca.com; h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:Sender:List-id:MIME-Version:Content-Type; i=reklama=3Dexpors.ru@mlgn2ca.com; bh=y6ODlLrCRV9qpTdyxqFIUGwKFrtvZg+NIE1VEGLcY4U=; b=l3kILPFNpLzMT61iAQKXgEYQzPhTKIdHYBMd1CnbVDfaOAB6pkaDczoj5YgdxHDTMLYnb1RIcxIZ OTuwxvFcxWXdsHH2Fj7TsMCGYmgDnNSksixYrKgOEin9CtYhqRBQehgKgceIXIpAQzkacWH/kclW 7mAqHvM7H3GMqaImVAdoH9mk+reN+FIvHntFKv6FeGEoeyfzl2l+Yw0Qc4WB6UpiNEMjsJRsvriM sN7dnfboOqWih2VpZVg+DDpi4gOgTrX0o1GFZBRRNNE4rHd9HdDBI+KIun7XzQiIVLejWQoFt2it 1fmOwq8AGK62orhn2kxCGTf2vfCeCVcLGNQYxg== Received: by mail44.em3.n.mlgn2ca.com id hh2qlc28kv88 for <info@mydomain.com>; Wed, 13 Mar 2019 09:45:56 +0200 (envelope-from <reklama=expors.ru@mlgn2ca.com>) Date: Wed, 13 Mar 2019 09:45:42 +0200 To: info@mydomain.com From: =?utf-8?B?0JLRi9GB0YLQsNCy0LrQsCBDUFM=?= <reklama@expors.ru> Reply-to: =?utf-8?B?0JLRi9GB0YLQsNCy0LrQsCBDUFM=?= <cps@expors.ru> Subject: =?utf-8?B?0J/RgNC+0LPRgNCw0LzQvNCwINCy0YvRgdGC0LDQstC60LggQ1BTIDIwMTk=?= Message-ID: <e081073e384955d1de54438267c2771b@mlgn2ca.com> X-Priority: 3 X-Mailer: Mailigen Mailer - **CID530f49b6f2749e77** X-Campaign: mailigen1a742220b1040be5bcb716e1e17a3b92.530f49b6 X-campaignid: mailigen1a742220b1040be5bcb716e1e17a3b92.530f49b6 X-Report-Abuse: Please report abuse for this campaign here: http://list.mlgn2ca.com/abuse/?u=1a742220b1040be5bcb716e1e17a3b92&id=530f49b6&e=f2749e77 List-Unsubscribe: <mailto:unsubscribe-reklama=expors.ru@mlgn2ca.com?subject=unsubscribe;1a742220b1040be5bcb716e1e17a3b92-530f49b6-f2749e77>, <http://list.mlgn2ca.com/unsubscribe?u=1a742220b1040be5bcb716e1e17a3b92&id=8539a322&e=f2749e77&c=530f49b6> Sender: "=?utf-8?B?0JLRi9GB0YLQsNCy0LrQsCBDUFM=?=" <reklama=expors.ru@mlgn2ca.com> Precedence: bulk Feedback-ID: 1a742220b1040be5bcb716e1e17a3b92:530f49b6:f2749e77:mailigen X-Feedback-ID: 1a742220b1040be5bcb716e1e17a3b92:530f49b6:f2749e77:mailigen X-Postmaster-MsgType: 530f49b6 List-id: 530f49b6 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_e1109ce545fb7e40f309b1d7c9d2ef82" X-Spam-Score: 118 X-Spam-Bar: +++++++++++ X-Spam-Report: Spam detection software, running on the system "server.myserver.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Мы выходим на финишную прямую подготовки нашей выставки CPS-2019 (Http://cps-expo.ru) (Http://cps-expo.ru), которая состоится ровно через две недели, 27-29 марта на территории Киностудии "АМЕДИА". Программа на сайте обновлена практически полностью, подробности на подходе. Главное, не забудьте зарегистрироваться на сайте (http://cps-expo.ru) выставки уже сейчас. (http://discountfoto.ru/) [...] Content analysis details: (11.8 points, 3.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [80.233.244.44 listed in list.dnswl.org] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: cps-expo.ru] 1.6 SUBJ_ALL_CAPS Subject is all capitals -0.4 RCVD_IN_IADB_LISTED RBL: Participates in the IADB system [80.233.244.44 listed in iadb.isipp.com] -0.2 RCVD_IN_IADB_RDNS RBL: IADB: Sender has reverse DNS record -0.0 RCVD_IN_IADB_DOPTIN_LT50 RBL: IADB: Confirmed opt-in used less than 50% of the time -2.2 RCVD_IN_IADB_VOUCHED RBL: ISIPP IADB lists as vouched-for sender -0.0 RCVD_IN_IADB_SPF RBL: IADB: Sender publishes SPF record -0.0 RCVD_IN_IADB_SENDERID RBL: IADB: Sender publishes Sender ID record -0.2 RCVD_IN_IADB_DK RBL: IADB: Sender publishes Domain Keys record 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily 7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE 7.0 RU_WENTOR_RASSILKA RU_WENTOR_RASSILKA X-Spam-Status: Yes X-ACL-Warn: SpamAssassin detected spam (from reklama=expors.ru@mlgn2ca.com to info@mydomain.com).

An example of a letter that did not count:

 Return-path: <ovvewcc@intestell.co.ua> Envelope-to: info@mydomain.com Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200 Received: from mail.intestell.co.ua ([176.9.103.48]) by server.myserver.com with esmtp (Exim 4.91) (envelope-from <ovvewcc@intestell.co.ua>) id 1h40Jt-0005E0-5j for info@mydomain.com; Wed, 13 Mar 2019 11:37:05 +0200 Received: from intestell.co.ua (unknown [195.216.190.7]) by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035; Wed, 13 Mar 2019 11:33:54 +0200 (EET) Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc> From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <ovvewcc@intestell.co.ua> To: <project@shakhtar.com> Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= Date: Wed, 13 Mar 2019 11:34:00 +0200 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0" X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Live Mail 14.0.8117.416 X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416

Then I save this email to a file and, through ssh, I start the scan and shows:

 Mar 13 12:23:44.520 [23577] dbg: rules: compiled meta tests Mar 13 12:23:44.521 [23577] dbg: check: is spam? score=14.94 required=3 Mar 13 12:23:44.521 [23577] dbg: check: tests=FROM_EXCESS_BASE64,HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED Mar 13 12:23:44.521 [23577] dbg: check: subtests=__ANY_IMAGE_ATTACH,__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__CTYPE_MULTIPART_ANY,__DC_IMG_HTML_RATIO,__DC_IMG_TEXT_RATIO,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,__DOS_RCVD_WED,__DOS_RELAYED_EXT,__ENV_AND_HDR_FROM_MATCH,__FB_NUM_PERCNT,__FROM_ENCODED_B64,__FROM_FULL_NAME,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_DATE,__HAS_FROM,__HAS_MESSAGE_ID,__HAS_MIMEOLE,__HAS_MSGID,__HAS_MSMAIL_PRI,__HAS_RCVD,__HAS_SUBJECT,__HAS_TO,__HAS_URI,__HAS_XMAIL,__HAS_X_MAILER,__HIGHBITS,__HTML_IMG_ONLY,__HTML_LENGTH_1536_2048,__HTML_LINK_IMAGE,__IMG_LE_300K,__JPEG_ATTACH,__JPEG_ATTACH_1,__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LCL__ENV_AND_HDR_FROM_MATCH,__LOCAL_PP_NONPPURL,__L_BODY_8BITS,__MIMEOLE_MS,__MIME_BASE64,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY,__MSGID_DOLLARS_MAYBE,__MSGID_DOLLARS_OK,__MSGID_NOFQDN2,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__NONEMPTY_BODY,__OE_MSGID_2,__ONE_IMG,__RCD_RDNS_MAIL,__RCD_RDNS_MAIL_MESSY,__RCVD_IN_DNSWL,__RP_MATCHES_RCVD,__RU_WENTOR_PHONE_KOI8,__RU_WENTOR_PHONE_UTF8,__RU_WENTOR_PHONE_WIN1251,__RU_WENTOR_RCPTS,__SANE_MSGID,__SA_RUS_HLINK,__SUBJECT_ENCODED_B64,__SUBJ_NOT_SHORT,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS,__TO___LOWER,__TVD_MIME_ATT_TP,__URI_MAILTO Mar 13 12:23:44.522 [23577] dbg: timing: total 6466 ms - init: 4879 (75.5%), parse: 10 (0.2%), extract_message_metadata: 62 (1.0%), poll_dns_idle: 0.91 (0.0%), get_uri_detail_list: 2 (0.0%), tests_pri_-1000: 28 (0.4%), compile_gen: 553 (8.5%), compile_eval: 22 (0.3%), tests_pri_-950: 7 (0.1%), tests_pri_-900: 8 (0.1%), tests_pri_-90: 5 (0.1%), tests_pri_0: 1322 (20.4%), dkim_load_modules: 59 (0.9%), check_dkim_signature: 7 (0.1%), check_dkim_adsp: 4 (0.1%), check_spf: 1.51 (0.0%), tests_pri_10: 7 (0.1%), check_dcc: 0.61 (0.0%), tests_pri_20: 7 (0.1%), tests_pri_30: 6 (0.1%), check_pyzor: 0.29 (0.0%), tests_pri_500: 89 (1.4%), tests_pri_1000: 6 (0.1%) Return-path: <ovvewcc@intestell.co.ua> X-Spam-Report: * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no * trust * [176.9.103.48 listed in list.dnswl.org] * 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. * See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block * for more information. * [URIs: veronika.in.ua] * 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words * 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area * 0.0 HTML_MESSAGE BODY: HTML included in message * 6.0 RU_WENTOR_2GT RAW: RU_WENTOR_2GT * 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image * 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily * 7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE X-Spam-Flag: YES X-Spam-Status: Yes, score=14.9 required=3.0 tests=FROM_EXCESS_BASE64, HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3, RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED autolearn=disabled version=3.3.1 X-Spam-Level: ************** X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on server.myserver.com Envelope-to: info@mydomain.com Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200 Received: from mail.intestell.co.ua ([176.9.103.48]) by server.myserver.com with esmtp (Exim 4.91) (envelope-from <ovvewcc@intestell.co.ua>) id 1h40Jt-0005E0-5j for info@mydomain.com; Wed, 13 Mar 2019 11:37:05 +0200 Received: from intestell.co.ua (unknown [195.216.190.7]) by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035; Wed, 13 Mar 2019 11:33:54 +0200 (EET) Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc> From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <ovvewcc@intestell.co.ua> To: <project@shakhtar.com> Subject: [SPAM] =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= Date: Wed, 13 Mar 2019 11:34:00 +0200 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0" X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Live Mail 14.0.8117.416 X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416 X-Spam-Prev-Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= This is a multi-part message in MIME format. ------=_NextPart_000_0006_01D4D98F.AD0120B0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01D4D98F.AD0120B0" ------=_NextPart_000_0007_01D4D98F.AD0120B0 Content-Type: text/plain; charset="windows-1251" Content-Transfer-Encoding: quoted-printable ANY_IMAGE_ATTACH, __ ANY_TEXT_ATTACH, __ ANY_TEXT_ATTACH_DOC, __ BODY_TEXT_LINE, __ BODY_TEXT_LINE, __ BODY_TEXT_LINE, __ BODY_TEXT_LINE, __ BODY_TEXT_LINE, __ BODY_TEXT_LINE, __ BODY_TEXT_LINE, __ BODY_TEXT_LINE, __ BODY_TEXT_LINE, __ CT, __ CTYPE_HAS_BOUNDARY, __ CTYPE_MULTIPART_ALT, __ CTYPE_MULTIPART_ANY, __ DC_IMG_HTML_RATIO, Mar 13 12:23:44.520 [23577] dbg: rules: compiled meta tests Mar 13 12:23:44.521 [23577] dbg: check: is spam? score=14.94 required=3 Mar 13 12:23:44.521 [23577] dbg: check: tests=FROM_EXCESS_BASE64,HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED Mar 13 12:23:44.521 [23577] dbg: check: subtests=__ANY_IMAGE_ATTACH,__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__CTYPE_MULTIPART_ANY,__DC_IMG_HTML_RATIO,__DC_IMG_TEXT_RATIO,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,__DOS_RCVD_WED,__DOS_RELAYED_EXT,__ENV_AND_HDR_FROM_MATCH,__FB_NUM_PERCNT,__FROM_ENCODED_B64,__FROM_FULL_NAME,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_DATE,__HAS_FROM,__HAS_MESSAGE_ID,__HAS_MIMEOLE,__HAS_MSGID,__HAS_MSMAIL_PRI,__HAS_RCVD,__HAS_SUBJECT,__HAS_TO,__HAS_URI,__HAS_XMAIL,__HAS_X_MAILER,__HIGHBITS,__HTML_IMG_ONLY,__HTML_LENGTH_1536_2048,__HTML_LINK_IMAGE,__IMG_LE_300K,__JPEG_ATTACH,__JPEG_ATTACH_1,__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LCL__ENV_AND_HDR_FROM_MATCH,__LOCAL_PP_NONPPURL,__L_BODY_8BITS,__MIMEOLE_MS,__MIME_BASE64,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY,__MSGID_DOLLARS_MAYBE,__MSGID_DOLLARS_OK,__MSGID_NOFQDN2,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__NONEMPTY_BODY,__OE_MSGID_2,__ONE_IMG,__RCD_RDNS_MAIL,__RCD_RDNS_MAIL_MESSY,__RCVD_IN_DNSWL,__RP_MATCHES_RCVD,__RU_WENTOR_PHONE_KOI8,__RU_WENTOR_PHONE_UTF8,__RU_WENTOR_PHONE_WIN1251,__RU_WENTOR_RCPTS,__SANE_MSGID,__SA_RUS_HLINK,__SUBJECT_ENCODED_B64,__SUBJ_NOT_SHORT,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS,__TO___LOWER,__TVD_MIME_ATT_TP,__URI_MAILTO Mar 13 12:23:44.522 [23577] dbg: timing: total 6466 ms - init: 4879 (75.5%), parse: 10 (0.2%), extract_message_metadata: 62 (1.0%), poll_dns_idle: 0.91 (0.0%), get_uri_detail_list: 2 (0.0%), tests_pri_-1000: 28 (0.4%), compile_gen: 553 (8.5%), compile_eval: 22 (0.3%), tests_pri_-950: 7 (0.1%), tests_pri_-900: 8 (0.1%), tests_pri_-90: 5 (0.1%), tests_pri_0: 1322 (20.4%), dkim_load_modules: 59 (0.9%), check_dkim_signature: 7 (0.1%), check_dkim_adsp: 4 (0.1%), check_spf: 1.51 (0.0%), tests_pri_10: 7 (0.1%), check_dcc: 0.61 (0.0%), tests_pri_20: 7 (0.1%), tests_pri_30: 6 (0.1%), check_pyzor: 0.29 (0.0%), tests_pri_500: 89 (1.4%), tests_pri_1000: 6 (0.1%) Return-path: <ovvewcc@intestell.co.ua> X-Spam-Report: * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no * trust * [176.9.103.48 listed in list.dnswl.org] * 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. * See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block * for more information. * [URIs: veronika.in.ua] * 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words * 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area * 0.0 HTML_MESSAGE BODY: HTML included in message * 6.0 RU_WENTOR_2GT RAW: RU_WENTOR_2GT * 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image * 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily * 7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE X-Spam-Flag: YES X-Spam-Status: Yes, score=14.9 required=3.0 tests=FROM_EXCESS_BASE64, HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3, RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED autolearn=disabled version=3.3.1 X-Spam-Level: ************** X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on server.myserver.com Envelope-to: info@mydomain.com Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200 Received: from mail.intestell.co.ua ([176.9.103.48]) by server.myserver.com with esmtp (Exim 4.91) (envelope-from <ovvewcc@intestell.co.ua>) id 1h40Jt-0005E0-5j for info@mydomain.com; Wed, 13 Mar 2019 11:37:05 +0200 Received: from intestell.co.ua (unknown [195.216.190.7]) by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035; Wed, 13 Mar 2019 11:33:54 +0200 (EET) Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc> From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <ovvewcc@intestell.co.ua> To: <project@shakhtar.com> Subject: [SPAM] =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= Date: Wed, 13 Mar 2019 11:34:00 +0200 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0" X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Live Mail 14.0.8117.416 X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416 X-Spam-Prev-Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= This is a multi-part message in MIME format. ------=_NextPart_000_0006_01D4D98F.AD0120B0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01D4D98F.AD0120B0" ------=_NextPart_000_0007_01D4D98F.AD0120B0 Content-Type: text/plain; charset="windows-1251" Content-Transfer-Encoding: quoted-printable __ DOS_RCVD_WED, __ DOS_RELAYED_EXT, __ ENV_AND_HDR_FROM_MATCH, __ FB_NUM_PERCNT, __ FROM_ENCODED_B64, __ FROM_FULL_NAME, __ HAS_ANY_EMAIL, __ HAS_ANY_URI, __ HAS_DATE, __ HAS_FROM, __ HAS_MESSAGE_ID, __ HAS_MIMEOLE, __ HAS_MSGID, __ HAS_MSMAIL_PRI, __ HAS_RCVD, __ HAS_SUBJECT, __ HAS_TO, __ HAS_URI, __ HAS_XMAIL, __ HAS_X_MAILER, __ HIGHBITS, __ HTML_IMG_ONLY, Mar 13 12:23:44.520 [23577] dbg: rules: compiled meta tests Mar 13 12:23:44.521 [23577] dbg: check: is spam? score=14.94 required=3 Mar 13 12:23:44.521 [23577] dbg: check: tests=FROM_EXCESS_BASE64,HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED Mar 13 12:23:44.521 [23577] dbg: check: subtests=__ANY_IMAGE_ATTACH,__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__CTYPE_MULTIPART_ANY,__DC_IMG_HTML_RATIO,__DC_IMG_TEXT_RATIO,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,__DOS_RCVD_WED,__DOS_RELAYED_EXT,__ENV_AND_HDR_FROM_MATCH,__FB_NUM_PERCNT,__FROM_ENCODED_B64,__FROM_FULL_NAME,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_DATE,__HAS_FROM,__HAS_MESSAGE_ID,__HAS_MIMEOLE,__HAS_MSGID,__HAS_MSMAIL_PRI,__HAS_RCVD,__HAS_SUBJECT,__HAS_TO,__HAS_URI,__HAS_XMAIL,__HAS_X_MAILER,__HIGHBITS,__HTML_IMG_ONLY,__HTML_LENGTH_1536_2048,__HTML_LINK_IMAGE,__IMG_LE_300K,__JPEG_ATTACH,__JPEG_ATTACH_1,__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LCL__ENV_AND_HDR_FROM_MATCH,__LOCAL_PP_NONPPURL,__L_BODY_8BITS,__MIMEOLE_MS,__MIME_BASE64,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY,__MSGID_DOLLARS_MAYBE,__MSGID_DOLLARS_OK,__MSGID_NOFQDN2,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__NONEMPTY_BODY,__OE_MSGID_2,__ONE_IMG,__RCD_RDNS_MAIL,__RCD_RDNS_MAIL_MESSY,__RCVD_IN_DNSWL,__RP_MATCHES_RCVD,__RU_WENTOR_PHONE_KOI8,__RU_WENTOR_PHONE_UTF8,__RU_WENTOR_PHONE_WIN1251,__RU_WENTOR_RCPTS,__SANE_MSGID,__SA_RUS_HLINK,__SUBJECT_ENCODED_B64,__SUBJ_NOT_SHORT,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS,__TO___LOWER,__TVD_MIME_ATT_TP,__URI_MAILTO Mar 13 12:23:44.522 [23577] dbg: timing: total 6466 ms - init: 4879 (75.5%), parse: 10 (0.2%), extract_message_metadata: 62 (1.0%), poll_dns_idle: 0.91 (0.0%), get_uri_detail_list: 2 (0.0%), tests_pri_-1000: 28 (0.4%), compile_gen: 553 (8.5%), compile_eval: 22 (0.3%), tests_pri_-950: 7 (0.1%), tests_pri_-900: 8 (0.1%), tests_pri_-90: 5 (0.1%), tests_pri_0: 1322 (20.4%), dkim_load_modules: 59 (0.9%), check_dkim_signature: 7 (0.1%), check_dkim_adsp: 4 (0.1%), check_spf: 1.51 (0.0%), tests_pri_10: 7 (0.1%), check_dcc: 0.61 (0.0%), tests_pri_20: 7 (0.1%), tests_pri_30: 6 (0.1%), check_pyzor: 0.29 (0.0%), tests_pri_500: 89 (1.4%), tests_pri_1000: 6 (0.1%) Return-path: <ovvewcc@intestell.co.ua> X-Spam-Report: * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no * trust * [176.9.103.48 listed in list.dnswl.org] * 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. * See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block * for more information. * [URIs: veronika.in.ua] * 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words * 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area * 0.0 HTML_MESSAGE BODY: HTML included in message * 6.0 RU_WENTOR_2GT RAW: RU_WENTOR_2GT * 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image * 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily * 7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE X-Spam-Flag: YES X-Spam-Status: Yes, score=14.9 required=3.0 tests=FROM_EXCESS_BASE64, HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3, RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED autolearn=disabled version=3.3.1 X-Spam-Level: ************** X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on server.myserver.com Envelope-to: info@mydomain.com Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200 Received: from mail.intestell.co.ua ([176.9.103.48]) by server.myserver.com with esmtp (Exim 4.91) (envelope-from <ovvewcc@intestell.co.ua>) id 1h40Jt-0005E0-5j for info@mydomain.com; Wed, 13 Mar 2019 11:37:05 +0200 Received: from intestell.co.ua (unknown [195.216.190.7]) by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035; Wed, 13 Mar 2019 11:33:54 +0200 (EET) Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc> From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <ovvewcc@intestell.co.ua> To: <project@shakhtar.com> Subject: [SPAM] =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= Date: Wed, 13 Mar 2019 11:34:00 +0200 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0" X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Live Mail 14.0.8117.416 X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416 X-Spam-Prev-Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= This is a multi-part message in MIME format. ------=_NextPart_000_0006_01D4D98F.AD0120B0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01D4D98F.AD0120B0" ------=_NextPart_000_0007_01D4D98F.AD0120B0 Content-Type: text/plain; charset="windows-1251" Content-Transfer-Encoding: quoted-printable __ JPEG_ATTACH, __ JPEG_ATTACH_1, __ LAST_EXTERNAL_RELAY_NO_AUTH, __ LAST_UNTRUSTED_RELAY_NO_AUTH, __ LCL__ENV_AND_HDR_FROM_MATCH, __ LOCAL_PP_NONPPURL, __ L_BODY_8BITS, __ MIMEOLE_MS, __ MIME_BASE64, __ MIME_HTML, __ MIME_QP, __ MIME_VERSI Mar 13 12:23:44.520 [23577] dbg: rules: compiled meta tests Mar 13 12:23:44.521 [23577] dbg: check: is spam? score=14.94 required=3 Mar 13 12:23:44.521 [23577] dbg: check: tests=FROM_EXCESS_BASE64,HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED Mar 13 12:23:44.521 [23577] dbg: check: subtests=__ANY_IMAGE_ATTACH,__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__CTYPE_MULTIPART_ANY,__DC_IMG_HTML_RATIO,__DC_IMG_TEXT_RATIO,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,__DOS_RCVD_WED,__DOS_RELAYED_EXT,__ENV_AND_HDR_FROM_MATCH,__FB_NUM_PERCNT,__FROM_ENCODED_B64,__FROM_FULL_NAME,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_DATE,__HAS_FROM,__HAS_MESSAGE_ID,__HAS_MIMEOLE,__HAS_MSGID,__HAS_MSMAIL_PRI,__HAS_RCVD,__HAS_SUBJECT,__HAS_TO,__HAS_URI,__HAS_XMAIL,__HAS_X_MAILER,__HIGHBITS,__HTML_IMG_ONLY,__HTML_LENGTH_1536_2048,__HTML_LINK_IMAGE,__IMG_LE_300K,__JPEG_ATTACH,__JPEG_ATTACH_1,__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LCL__ENV_AND_HDR_FROM_MATCH,__LOCAL_PP_NONPPURL,__L_BODY_8BITS,__MIMEOLE_MS,__MIME_BASE64,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY,__MSGID_DOLLARS_MAYBE,__MSGID_DOLLARS_OK,__MSGID_NOFQDN2,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__NONEMPTY_BODY,__OE_MSGID_2,__ONE_IMG,__RCD_RDNS_MAIL,__RCD_RDNS_MAIL_MESSY,__RCVD_IN_DNSWL,__RP_MATCHES_RCVD,__RU_WENTOR_PHONE_KOI8,__RU_WENTOR_PHONE_UTF8,__RU_WENTOR_PHONE_WIN1251,__RU_WENTOR_RCPTS,__SANE_MSGID,__SA_RUS_HLINK,__SUBJECT_ENCODED_B64,__SUBJ_NOT_SHORT,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS,__TO___LOWER,__TVD_MIME_ATT_TP,__URI_MAILTO Mar 13 12:23:44.522 [23577] dbg: timing: total 6466 ms - init: 4879 (75.5%), parse: 10 (0.2%), extract_message_metadata: 62 (1.0%), poll_dns_idle: 0.91 (0.0%), get_uri_detail_list: 2 (0.0%), tests_pri_-1000: 28 (0.4%), compile_gen: 553 (8.5%), compile_eval: 22 (0.3%), tests_pri_-950: 7 (0.1%), tests_pri_-900: 8 (0.1%), tests_pri_-90: 5 (0.1%), tests_pri_0: 1322 (20.4%), dkim_load_modules: 59 (0.9%), check_dkim_signature: 7 (0.1%), check_dkim_adsp: 4 (0.1%), check_spf: 1.51 (0.0%), tests_pri_10: 7 (0.1%), check_dcc: 0.61 (0.0%), tests_pri_20: 7 (0.1%), tests_pri_30: 6 (0.1%), check_pyzor: 0.29 (0.0%), tests_pri_500: 89 (1.4%), tests_pri_1000: 6 (0.1%) Return-path: <ovvewcc@intestell.co.ua> X-Spam-Report: * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no * trust * [176.9.103.48 listed in list.dnswl.org] * 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. * See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block * for more information. * [URIs: veronika.in.ua] * 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words * 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area * 0.0 HTML_MESSAGE BODY: HTML included in message * 6.0 RU_WENTOR_2GT RAW: RU_WENTOR_2GT * 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image * 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily * 7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE X-Spam-Flag: YES X-Spam-Status: Yes, score=14.9 required=3.0 tests=FROM_EXCESS_BASE64, HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3, RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED autolearn=disabled version=3.3.1 X-Spam-Level: ************** X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on server.myserver.com Envelope-to: info@mydomain.com Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200 Received: from mail.intestell.co.ua ([176.9.103.48]) by server.myserver.com with esmtp (Exim 4.91) (envelope-from <ovvewcc@intestell.co.ua>) id 1h40Jt-0005E0-5j for info@mydomain.com; Wed, 13 Mar 2019 11:37:05 +0200 Received: from intestell.co.ua (unknown [195.216.190.7]) by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035; Wed, 13 Mar 2019 11:33:54 +0200 (EET) Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc> From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <ovvewcc@intestell.co.ua> To: <project@shakhtar.com> Subject: [SPAM] =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= Date: Wed, 13 Mar 2019 11:34:00 +0200 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0" X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Live Mail 14.0.8117.416 X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416 X-Spam-Prev-Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= This is a multi-part message in MIME format. ------=_NextPart_000_0006_01D4D98F.AD0120B0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01D4D98F.AD0120B0" ------=_NextPart_000_0007_01D4D98F.AD0120B0 Content-Type: text/plain; charset="windows-1251" Content-Transfer-Encoding: quoted-printable __ MSGID_DOLLARS_MAYBE, __ MSGID_DOLLARS_OK, __ MSGID_NOFQDN2, __ MSGID_OK_HEX, __ MSGID_OK_HOST, __ MSGID_RANDY, __ NONEMPTY_BODY, __ OE_MSGID_2, __ ONE_IMG, __ RCD_RDNS_MAIL, __ RCD_RDNS_MAIL_MESSY, __ RCVD_IN_DNSWL, __ RP_MATCHES_RCVD, __ RU_WENTOR_PHONE_KOI8, __ RU_WENTOR_PHONE_UTF8, __ RU_WENTOR_PHONE_WIN1251, __ RU_WENTOR_RCPTS, __ SANE_MSGID, __ SA_RUS_HLINK, __ SUBJECT_ENCODED_B64, __ SUBJ_NOT_SHORT, __ TAG_EXISTS_BODY, Mar 13 12:23:44.520 [23577] dbg: rules: compiled meta tests Mar 13 12:23:44.521 [23577] dbg: check: is spam? score=14.94 required=3 Mar 13 12:23:44.521 [23577] dbg: check: tests=FROM_EXCESS_BASE64,HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED Mar 13 12:23:44.521 [23577] dbg: check: subtests=__ANY_IMAGE_ATTACH,__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__CTYPE_MULTIPART_ANY,__DC_IMG_HTML_RATIO,__DC_IMG_TEXT_RATIO,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,__DOS_RCVD_WED,__DOS_RELAYED_EXT,__ENV_AND_HDR_FROM_MATCH,__FB_NUM_PERCNT,__FROM_ENCODED_B64,__FROM_FULL_NAME,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_DATE,__HAS_FROM,__HAS_MESSAGE_ID,__HAS_MIMEOLE,__HAS_MSGID,__HAS_MSMAIL_PRI,__HAS_RCVD,__HAS_SUBJECT,__HAS_TO,__HAS_URI,__HAS_XMAIL,__HAS_X_MAILER,__HIGHBITS,__HTML_IMG_ONLY,__HTML_LENGTH_1536_2048,__HTML_LINK_IMAGE,__IMG_LE_300K,__JPEG_ATTACH,__JPEG_ATTACH_1,__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LCL__ENV_AND_HDR_FROM_MATCH,__LOCAL_PP_NONPPURL,__L_BODY_8BITS,__MIMEOLE_MS,__MIME_BASE64,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY,__MSGID_DOLLARS_MAYBE,__MSGID_DOLLARS_OK,__MSGID_NOFQDN2,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__NONEMPTY_BODY,__OE_MSGID_2,__ONE_IMG,__RCD_RDNS_MAIL,__RCD_RDNS_MAIL_MESSY,__RCVD_IN_DNSWL,__RP_MATCHES_RCVD,__RU_WENTOR_PHONE_KOI8,__RU_WENTOR_PHONE_UTF8,__RU_WENTOR_PHONE_WIN1251,__RU_WENTOR_RCPTS,__SANE_MSGID,__SA_RUS_HLINK,__SUBJECT_ENCODED_B64,__SUBJ_NOT_SHORT,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS,__TO___LOWER,__TVD_MIME_ATT_TP,__URI_MAILTO Mar 13 12:23:44.522 [23577] dbg: timing: total 6466 ms - init: 4879 (75.5%), parse: 10 (0.2%), extract_message_metadata: 62 (1.0%), poll_dns_idle: 0.91 (0.0%), get_uri_detail_list: 2 (0.0%), tests_pri_-1000: 28 (0.4%), compile_gen: 553 (8.5%), compile_eval: 22 (0.3%), tests_pri_-950: 7 (0.1%), tests_pri_-900: 8 (0.1%), tests_pri_-90: 5 (0.1%), tests_pri_0: 1322 (20.4%), dkim_load_modules: 59 (0.9%), check_dkim_signature: 7 (0.1%), check_dkim_adsp: 4 (0.1%), check_spf: 1.51 (0.0%), tests_pri_10: 7 (0.1%), check_dcc: 0.61 (0.0%), tests_pri_20: 7 (0.1%), tests_pri_30: 6 (0.1%), check_pyzor: 0.29 (0.0%), tests_pri_500: 89 (1.4%), tests_pri_1000: 6 (0.1%) Return-path: <ovvewcc@intestell.co.ua> X-Spam-Report: * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no * trust * [176.9.103.48 listed in list.dnswl.org] * 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. * See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block * for more information. * [URIs: veronika.in.ua] * 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words * 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area * 0.0 HTML_MESSAGE BODY: HTML included in message * 6.0 RU_WENTOR_2GT RAW: RU_WENTOR_2GT * 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image * 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily * 7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE X-Spam-Flag: YES X-Spam-Status: Yes, score=14.9 required=3.0 tests=FROM_EXCESS_BASE64, HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3, RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED autolearn=disabled version=3.3.1 X-Spam-Level: ************** X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on server.myserver.com Envelope-to: info@mydomain.com Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200 Received: from mail.intestell.co.ua ([176.9.103.48]) by server.myserver.com with esmtp (Exim 4.91) (envelope-from <ovvewcc@intestell.co.ua>) id 1h40Jt-0005E0-5j for info@mydomain.com; Wed, 13 Mar 2019 11:37:05 +0200 Received: from intestell.co.ua (unknown [195.216.190.7]) by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035; Wed, 13 Mar 2019 11:33:54 +0200 (EET) Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc> From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <ovvewcc@intestell.co.ua> To: <project@shakhtar.com> Subject: [SPAM] =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= Date: Wed, 13 Mar 2019 11:34:00 +0200 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0" X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Live Mail 14.0.8117.416 X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416 X-Spam-Prev-Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?= This is a multi-part message in MIME format. ------=_NextPart_000_0006_01D4D98F.AD0120B0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01D4D98F.AD0120B0" ------=_NextPart_000_0007_01D4D98F.AD0120B0 Content-Type: text/plain; charset="windows-1251" Content-Transfer-Encoding: quoted-printable

Based on all this, as I understand it, the rules are set up correctly, but why doesn’t spamassasin put its headings on every letter? Explicit spam, even he understands. If you need additional logs - be sure to bring.

    1 answer 1

    As it turned out, Spamassasin does not check letters> 100K by default.

    Solution: change deadline in exim

    condition = $ {if <{$ message_size} {100K}}

    Change to

    condition = $ {if <{$ message_size} {100000K}}