Words in body are not filtered

Hi, I'm getting a lot of spam lately and I'm trying to filter them out but it looks like filtering "Body contains" doesn't work. The filter is Coves Suite in "Body contains" and the Action is Discard. This is the email source

From - Mon Aug 17 05:39:56 2020
X-Account-Key: account1
X-UIDL: UID10296-1563577131
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                 
Return-Path: 
Delivered-To: contact@mydomainname.com
Received: from p1.supportedns.com
    by p1.supportedns.com with LMTP
    id wJkkInWXOV8cWAAAr3lXIA
    (envelope-from )
    for ; Sun, 16 Aug 2020 16:30:45 -0400
Return-path: 
Envelope-to: contact@mydomainname.com
Delivery-date: Sun, 16 Aug 2020 16:30:45 -0400
Received: from [23.231.110.236] (port=38479 helo=mail.tationous.cyou)
    by p1.supportedns.com with esmtp (Exim 4.93)
    (envelope-from )
    id 1k7PIf-0003SB-Bi
    for contact@mydomainname.com; Sun, 16 Aug 2020 16:30:45 -0400
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=tationous.cyou;
 h=Date:From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; i=vincent_morris@tationous.cyou;
 bh=EhTDkkes+jZyK1cX2ZdFN7+OdUk=;
 b=Nfa7Vdxg3yzKyIlBTPSW50/LwT3wGFO2Yzfy4H7RSrhoSTzhSIXhzu5DxJMo9xnujQaefA4C3Ml0
   l+SBCvZOWo9AH3QRFW2E2XHRT6PuPwERECQ8ZzS8O2rWJKCdUpXgrcpSHmGR5t+RpzVfcqLlkGn0
   NUiNMaycyuwV9bRhwPw=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=tationous.cyou;
 b=s7f2Rq6EkNVBQfh370dxQgFcAhBWUFAROh7NIeexSMgFaLKRRHeuQL6QxqwWdaEl4nLs05wFjCVy
   8E9TG2hX1FFkKp/D/rdOj4VwzBdbAtUgSMj26ZXzNAen8NWhrhywsRbfojazaM4ODvTCk9Vfe4n8
   kM2/E56VOfU12nLX8qo=;
Received: by mail.tationous.cyou id h76bn20001gv for ; Sun, 16 Aug 2020 16:24:24 -0400 (envelope-from )
Date: Sun, 16 Aug 2020 16:24:24 -0400
From: "BuzzBGone" 
To:   
Subject: [spam] Amazing new mosquito-killing device!
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_Part_11281_1140410215.1597609441701"
List-Unsubscribe: 
Message-ID: <0.0.0.67.1D6740B3B5B1F20.206EA6@mail.tationous.cyou>
X-Spam-Status: No, score=4.6
X-Spam-Score: 46
X-Spam-Bar: ++++
X-Ham-Report: Spam detection software, running on the system "p1.supportedns.com", has
 identified this incoming email as possible spam.  The original message
 has been attached to this so you can view it (if it isn't spam) or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content analysis details:   (4.6 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: tationous.cyou]
  1.9 URIBL_ABUSE_SURBL      Contains an URL listed in the ABUSE SURBL
                             blocklist
                             [URIs: tationous.cyou]
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.7 MPART_ALT_DIFF         BODY: HTML and text parts are different
  0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
                             identical to background
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76
                             chars
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.0 MIME_HTML_ONLY_MULTI   Multipart message only has text/html MIME
                             parts
  2.0 RDNS_NONE              Delivered to internal network by a host with no rDNS
X-Spam-Flag: NO
X-BitdefenderWKS-SpamStamp: Build: [Engines: 2.15.12.1318, Stamp: 3],
 Multi: [Enabled, t: (0.000009,0.011616)], BW: [Enabled, t:
 (0.000021)], RTDA: [Enabled, t: (0.098401), Hit: Yes, Details:
 v2.7.142; Id: 14.1i74631.1efsmsatb.d10lq;
 fz(102439f7e76469b9928bd58220ca7ad4c881:849;);
 fipr(10695a6673efcd8a8e1a1d0bed6071865bdc_new:849;); url(3);
 fdom(b6c2911b78198e5b8051513a973fbc4f:1000;)], total: 1000(775)
X-BitdefenderWKS-Spam: Yes - 1000

------=_Part_11281_1140410215.1597609441701
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable


 =20
 =20
 
  =20
   =20
   =20
   =20
   =20
    }=20
   
        =20
    =20
     =20
      =20
       =20
      =20
     =20
    
                =20
        =20
         =20
          =20
           =20
          =20
         =20
        
             
             Take Back Your=
 Yard With Buzz B-Gone!=20
             
 Buzz B-Gone uses <=
span style=3D"font-weight: bold;"> harmless UV light  to attract ins=
ects under its dome, where a powerful 360° suction fan pulls them in an=
d traps them! Place it anywhere in or around your home to create a  100% bug-free zone. =20
              =20
              =20
              =20
               =
 =20
        =20
        =20
         =20
          =20
           =20
          =20
         =20
         
             No More Nasty =
Bug Bites!=20
             
 
               You and your family c=
an finally be safe from the itchy bumps and dangerous diseases that mosquit=
os and other biting bugs carry.=20
              =20
              =20
               
 Buzz B-Gone Works indoors and outside! 
  
 Get yo=
urs today for 40% off 
 =20
        =20
    
=20
    Unsubscribe Here 
 201 Marisol Coves Suite 766, West Oriefurt, NV 49420
    
=20
    
=20
    
=20
    
  =20
    
     Va cada =
diga obra sera ja amas tens. Es confesso elegante sr momentos ja. Esforco h=
a inundar victima sentira encanto lh ja obrigue. As levantadas postaspelo p=
rojectado as. Penetrou ternuras amoravel os se. Ama uma sentada lei impediu=
 coragem linguas. Enlace me sequer deixes mo massas os. Succumbas magnifico=
 pechincha expremido tem iii admittido affeicoes. 
 
 Vejo b=
om peso mim lhes. Bem hei apaixonada tal certamente finalmente obedeceres t=
er aspiracoes apresental. Conviccao necessita revelando allumiada pe se do.=
 Mesmos muitas dia duvido serena minimo gracas nas. Es le creio de puras co=
rpo disse. Senhora coberta sou dragoes objecto ora dezoito que. Loucos supp=
oe os ha namoro ca. Ja ia impede afinal na espere recebo. Um herdamos estim=
ava objectou esforcos voltados da exercida. 
      =
 
    =20
   =20
   =20
 


------=_Part_11281_1140410215.1597609441701--

When I paste the email source to test it I get these results

 Sub-condition is false: not first_delivery
 Condition is false: not first_delivery and error_message
 Sub-condition is false: $message_body contains Buzz B-GONE
 Sub-condition is false: $message_body contains Coves Suite 766
 Sub-condition is false: $message_body contains Buzz B-GONE or $message_body contains Coves Suite 766
 Condition is false: ($message_body contains Buzz B-GONE or $message_body contains Coves Suite 766)
 Condition is false: $message_body contains Coves Suite

Return-path copied from sender
Sender      = host@p1.supportedns.com
Recipient   = host@p1.supportedns.com
Testing Exim filter file "/home/path/etc/mydomainname.com/contact/filter"

Headers charset "UTF-8"
Filtering did not set up a significant delivery.
Normal delivery will occur.

Why are these emails not discarded? Thanks for any help

rlerner

August 17, 2020 22:17

Having same problem. I tried copy/pasting the offending line of text just after the body tag and the filter recognized it. [In my case] the issue seems to be the filter not scanning through to the end of a 9,000+ character email where it would find the offending text and intercept delivery. Suggest you try pasting Buzz B-GONE into the test filter box after the tag and see if you get same result. I also tried increasing the SA scan size limit in WHM above the default 1MB but no joy.

cPanelLauren

August 17, 2020 22:32

Unless you use regex to specify the filter is case sensitive. You're telling it to filter if it contains BUZZ B-GONE but the email has Buzz B-Gone, but why it's not picking up the Coves Suite 766 I'm unsure without seeing the actual filter.

August 18, 2020 01:08

Having same/similar issue, but in this case the problem seems to be that the key words for the filter don't get picked up if they are at the end of the email. When I use Test Filter on with spam that ends with: Click here.or send post-mail To 118 Second Ave. New York, NY 10118 Condition is false: $message_body contains send post-mail To Filtering did not set up a significant delivery. Normal delivery will occur. If I copy/paste that end line from the spam, and place it directly under the tag in the test filter block: Condition is true: $message_body contains send post-mail To Save message to: /dev/null 0660 Filtering set up at least one significant delivery or other action. No other deliveries will occur. It's not a case-sensitive issue. Seems like the scan does not go all the way through the email. The spam was just over 9,000 characters and my SA limit is 1,000kb should be more than enough.

August 19, 2020 19:16

The character limit that exim will reach for scanning emails for filter content is set to 5000 by default on cPanel servers. You can change this by going to cPanel>>Service Configuration>>Exim Configuration Manager -> Advanced Editor and edit the message_body_visible
setting

August 19, 2020 19:31

Changed message_body_visible setting under cPanel>>Service Configuration>>Exim Configuration Manager -> Advanced Editor. This solution fixed the issue. Thank you very much!

Words in body are not filtered

Comments

Didn't find what you were looking for?