Re: [SAtalk] X-Spam-Status question

2002-09-20 Thread Mike Leone
* Mike Burger ([EMAIL PROTECTED]) wrote this on 09 21, 02 at 00:50: > I have "X-Spam-Status" in every message that SA scans. SA scanning is different than when Amavisd-new calls SA modules to spam scan. Amavisd-new does not call all SA modules, such as adding the X-Spam-Status header for all ema

[SAtalk] DSBL poisoning?

2002-09-20 Thread Theo Van Dinter
Someone poisoning DSBL? Sep 21 00:30:45 eclectic sendmail[13924]: g8L4Uim5013924: ruleset=check_rcpt, arg1=<[EMAIL PROTECTED]>, relay=blount.mail.mindspring.net [207.69.200.226], reject=550 5.7.1 <[EMAIL PROTECTED]>... Rejected: 207.69.200.226 listed as open relay; see http://www.dsbl.org/ S

Re: [SAtalk] Whatever happened to SUBJ_FULL_OF_8BITS?

2002-09-20 Thread Daniel Quinlan
Rob McMillin <[EMAIL PROTECTED]> writes: > Whatever happened to the SUBJ_FULL_OF_8BITS test? It's no longer > present in 2.41. It seems to be right there (in the both 2.41 and the CVS tree). Dan --- This sf.net email is sponsored by:ThinkGe

Re: [SAtalk] X-Spam-Status question

2002-09-20 Thread Mike Burger
Aaahhh...oops...i'm not running through Amavis. Please ignore my last reply. On Sat, 21 Sep 2002, Mike Leone wrote: > * Avi Schwartz ([EMAIL PROTECTED]) wrote this on 09 20, 02 at 23:57: > > Is SA supposed to always insert a X-Spam-Status tag? > > > > I just started using SA + Postfix + amav

Re: [SAtalk] X-Spam-Status question

2002-09-20 Thread Mike Burger
I have "X-Spam-Status" in every message that SA scans. On 20 Sep 2002, Avi Schwartz wrote: > Is SA supposed to always insert a X-Spam-Status tag? > > I just started using SA + Postfix + amavisd-new and it seems to me that > SA does not insert this tag into non-spam messages. Is this correct? >

Re: [SAtalk] need domain transfer confirmation example emails

2002-09-20 Thread Mike Burger
Sure...if you think that netsol, etc, is spamming you, you'll ignore the useful info at the bottom...like "if you don't reply, we'll reject the transfer request". On Sat, 21 Sep 2002, Lars Hansson wrote: > On Fri, 20 Sep 2002 18:40:31 -0700 > Daniel Quinlan <[EMAIL PROTECTED]> wrote: > > > It

Re: [SAtalk] X-Spam-Status question

2002-09-20 Thread Mike Leone
* Avi Schwartz ([EMAIL PROTECTED]) wrote this on 09 20, 02 at 23:57: > Is SA supposed to always insert a X-Spam-Status tag? > > I just started using SA + Postfix + amavisd-new and it seems to me that > SA does not insert this tag into non-spam messages. Is this correct? Correct. Amavisd-new on

Re: [SAtalk] need domain transfer confirmation example emails

2002-09-20 Thread Daniel Quinlan
[ I'm still seeking examples... ] Lars Hansson <[EMAIL PROTECTED]> writes: > Huh?? What the? Did I read that right? > They're /actively/ trying to get their own mails tagged as spam or ignored? > That must be a new low. It appears the goal is to be ignored. Tagged as spam, I'm not as sure. ne

[SAtalk] X-Spam-Status question

2002-09-20 Thread Avi Schwartz
Is SA supposed to always insert a X-Spam-Status tag? I just started using SA + Postfix + amavisd-new and it seems to me that SA does not insert this tag into non-spam messages. Is this correct? The reason I am asking is that I received few email messages that were very obviously spam emails but

RE: [SAtalk] dependencies / pre-requisites for installation in FreeBSD

2002-09-20 Thread Quentin Krengel
Hey Doug: I forwarded the spamass-milter tarball to you, and my notes for installing on Debian in a separate email. The debian notes won't do much for you if you stick with BSD, as the debian packages take most of the work out of it for you. A few points of clarification for you: I am not usi

Re: [SAtalk] Wrong (false positives) Razor entries?!

2002-09-20 Thread Theodore Heise
On Fri, 20 Sep 2002, Justin Mason wrote: > Bugtraq messages do not trigger FPs half as frequently as e.g. > Lockergnome or ZDNet HTML newsletters. Some might consider tagged ZDNet HTML newsletters to be TPs. -- Theodore Heise <[EMAIL PROTECTED]> West Lafayette, IN, USA -

Re: [SAtalk] need domain transfer confirmation example emails

2002-09-20 Thread Lars Hansson
On Fri, 20 Sep 2002 18:40:31 -0700 Daniel Quinlan <[EMAIL PROTECTED]> wrote: > It seems that some of these messages are being filtered as spam. In the > case of networksolutions.com, it appears that they are putting the > transfer request below a large amount of marketing material in an attempt

Re: [SAtalk] dependencies / pre-requisites for installation in FreeBSD

2002-09-20 Thread Doug Young
Thanks for the link Quentin At first glance those articles refer to postfix rather than sendmail, but hopefully the info is at least partly relevant to standard sendmail setups - Original Message - From: "Quentin Krengel" <[EMAIL PROTECTED]> To: "'Quentin Krengel'" <[EMAIL PROTECTED]>;

Re: [SAtalk] dependencies / pre-requisites for installation in FreeBSD

2002-09-20 Thread Doug Young
Thanks for the response Quentin I'd gained the impression from various documentation that it is possible in theory to run spamassassin without procmail, but I've been finding both procmail & spamassassin a considerable struggle due to the sparse documentation. Appears the majority of texts assume

[SAtalk] need domain transfer confirmation example emails

2002-09-20 Thread Daniel Quinlan
[ Sorry for the cross-post, but my last request for examples (a fetchmail problem) did not get any responses, so I think I will try both lists for this one. ] If you have received a domain transfer confirmation email from networksolutions.com or register.com in the last 60 days, could you ple

Re: [SAtalk] Re: spam host (azoogle)

2002-09-20 Thread Jonathan Nichols
> > Have you noticed that spammers are trying to steer around the > lots-of-spaces-in-subject rule by instead using a combination of spaces, > underscores, and hyphens? > > Such cat and mouse games. > Yeah, I've noticed that.. and changing words like "remove" to "rem0ve" and "unsubscribe" to "uns

[SAtalk] Re: spam host (azoogle)

2002-09-20 Thread Ellen Clary
Oh them. Pesky aren't they? I was really annoyed when they started to sneak in with the single o version of their name (azogle). No, they don't forge headers. I just stuck them in my sendmail DISCARD access list and don't even bother with checking further. They're not the only one who often m

[SAtalk] Whatever happened to SUBJ_FULL_OF_8BITS?

2002-09-20 Thread Rob McMillin
Whatever happened to the SUBJ_FULL_OF_8BITS test? It's no longer present in 2.41. -- Palladium: First they came for the Linux desktop users, but I said nothing, because I wasn't a Linux desktop user... -- future prisoner in the Microsoft gulag

RE: [SAtalk] dependencies / pre-requisites for installation in FreeBSD

2002-09-20 Thread Quentin Krengel
Here's a four-part series at securityfocus.com regarding installing SA onto BSD. This is the last article - has links to the first three at the bottom; http://online.securityfocus.com/infocus/1611 Enjoy, - Quentin Krengel Krengel Technology Inc -

RE: [SAtalk] Teergrubing (stalling SMTP sessions ) was:"new" spam host

2002-09-20 Thread Robert Strickler
http://www.iks-jena.de/mitarb/lutz/usenet/teergrube.en.html I call this kind of delay introduction a "spambump", like speedbumps used to slow you down in a parking lot. It does not surprise me that someone else has already though of it. Basically it consist of sending a continuation instead of "

RE: [SAtalk] Fine Tuning SpamAssassin

2002-09-20 Thread Quentin Krengel
Hey Doug, Place your fine-tuning in local.cf (normally found in /etc/spamassassin) More information should be available regarding fine tuning in the main page found at "man Mail::SpamAssassin::Conf" on your system. Quentin Krengel Krengel Technology Inc Here are a few notes from a recent pos

Re: [SAtalk] "new" spam host

2002-09-20 Thread Jeremy Zawodny
On Fri, Sep 20, 2002 at 12:38:15PM -0700, Sidney Markowitz wrote: > Jeremy Zawodny" <[EMAIL PROTECTED]> wrote: > >Hasn't stopped them from attemping to deliver roughly 4,000 > > messages per day--every day. > > How many could they send if traffic from their ip address to the SMTP port > on your m

RE: [SAtalk] dependencies / pre-requisites for installation in FreeBSD

2002-09-20 Thread Quentin Krengel
I don't consider myself highly experienced, and can put together my newbie notes for getting SA going on Debian Linux if you want them. [It is considerably easier on Debian because one just "apt-get install spamassassin", reads the readme files that came with the Debian pack, makes a few small tw

Re: [SAtalk] doing business with eNom Inc, do or don't?

2002-09-20 Thread Matt Clauson
GANDI. www.gandi.net. "You own your domain name. Period. We just act as your agent." Since having been reccomended to them by a friend, I'll use nothing else. --mec --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven

Re: [SAtalk] "new" spam host

2002-09-20 Thread Sidney Markowitz
Jeremy Zawodny" <[EMAIL PROTECTED]> wrote: >Hasn't stopped them from attemping to deliver roughly 4,000 > messages per day--every day. How many could they send if traffic from their ip address to the SMTP port on your mail server's ip address went to an SMTP tarpit instead of being simply rejecte

Re: [SAtalk] "new" spam host

2002-09-20 Thread Jeremy Zawodny
On Fri, Sep 20, 2002 at 08:36:18AM -0700, Chris Petersen wrote: > azoogle.com should be added to the global "bad hosts" list. They don't > seem to forge their headers, so a simple from/body check should handle it. > > and here they go, off to my server's blacklist. Yeah, I've had them in the b

[SAtalk] AWL and score tendency

2002-09-20 Thread Justin Mason
OK, I've made the AWL now gradually lower scores for a From/IP address combo over time (in HEAD); I reckon this should be safe, now that we track IPs and the forged-From thing is not a problem any more. --j. --- This sf.net email is sponsored

Re: [SAtalk] doing business with eNom Inc, do or don't?

2002-09-20 Thread Simon Matthews
At 11:45 AM 9/20/02 -0400, Theo Van Dinter wrote: >On Wed, Sep 18, 2002 at 09:10:47PM -0700, Daniel Quinlan wrote: > > OpenSRS 100% Recommended (2 reviews) > >I have a friend who's a reseller for them, so not surprisingly all of >my domains are done through OpenSRS. No pro

[SAtalk] Autowhitelist change?

2002-09-20 Thread Simon Matthews
I would like to suggest a change to the auto-whitelist function. Currently, the AWL function can increase or decrease the score. However, since SPAMMERS almost never use the same email address for different spam runs, there is little to no value from increasing the spam score of an email from

[SAtalk] Re: "new" spam host

2002-09-20 Thread Dan Abernathy
I just blacklisted the azoogle.com domain this morning as well. Dan --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list

Re: [SAtalk] "new" spam host

2002-09-20 Thread ted
also azogle.com -- with just one o eric -- every passing minute is another chance to turn it all around - Original Message - From: "Chris Petersen" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, September 20, 2002 10:36 AM Subject: [SAtalk] "new" spam host azoogle.com shou

Re: [SAtalk] doing business with eNom Inc, do or don't?

2002-09-20 Thread Theo Van Dinter
On Wed, Sep 18, 2002 at 09:10:47PM -0700, Daniel Quinlan wrote: > networksolutions_com 0% Recommended (37 reviews) Good, they should die. I'm glad they're not recommended. (I had nothing but problems with them, as did everyone else I know of...) Two thumbs down. > Register_com

[SAtalk] "new" spam host

2002-09-20 Thread Chris Petersen
azoogle.com should be added to the global "bad hosts" list. They don't seem to forge their headers, so a simple from/body check should handle it. and here they go, off to my server's blacklist. -Chris --- This sf.net email is sponsored by:

Re: [SAtalk] My server died, fyi.

2002-09-20 Thread Theo Van Dinter
On Thursday, September 19, 2002, at 01:40 PM, Justin Mason wrote: > drat -- and I'd just gotten around to updating the downloads > page on SpamAssassin.org to point to it! ;) > get well soon, kluge.net... > heh heh heh. it's back online now. went out and bought myself a nice dual athlon to r

Re: [SAtalk] Wrong (false positives) Razor entries?!

2002-09-20 Thread Justin Mason
Matt Kettler said: > Bugtraq is particularly prone to being razored, as some people still have > razor auto-reporting based on spamassassin scores enabled. BTW, I can't be sure, but my theory is that the bugtraq-in-Razor thing is not anything to do with SpamAssassin; more likely is that some s

[SAtalk] Fine Tuning SpamAssassin

2002-09-20 Thread Doug Appleton
Hello Folks.. Because I am a new to the world of Linux, I was wondering whether you fine folks would be able to assist me some.. I have SA 2.31 ( yes, I know there is a newer version avaiable ) running, but I need to know some tricks of the trade to fine tuning SA... Whether a specific file

Re: [SAtalk] My server died, fyi.

2002-09-20 Thread Justin Mason
Theo Van Dinter said: > So if you've sent me mail wondering where the RPMs and such went, > that's what is going on. Technology sucks. ;( drat -- and I'd just gotten around to updating the downloads page on SpamAssassin.org to point to it! ;) get well soon, kluge.net... --j. -