Re: Spam bounceback attack

2007-04-08 Thread Loren Wilton
One issue is that I have fast_spamassassin turned on so I don't get to filter on specific rules that a mail hits. Do you use this and if so, do you know if you have to filter based on the rule getting hit? This is the Qmail thing that throws away the SA markup, isn't it? I'm not running vbounce

Re: Spam bounceback attack

2007-04-08 Thread Bill Landry
J. wrote the following on 4/8/2007 4:11 PM -0800: > --- Bill Landry <[EMAIL PROTECTED]> wrote: > > >> Also, have you taken a look at the SA "vbounce" ruleset? See: >> >> http://wiki.apache.org/spamassassin/VBounceRuleset >> > > One issue is that I have fast_spamassassin turned on so I

Re: Spam bounceback attack

2007-04-08 Thread J.
--- Bill Landry <[EMAIL PROTECTED]> wrote: > Also, have you taken a look at the SA "vbounce" ruleset? See: > > http://wiki.apache.org/spamassassin/VBounceRuleset One issue is that I have fast_spamassassin turned on so I don't get to filter on specific rules that a mail hits. Do you use thi

Re: Spam bounceback attack

2007-04-08 Thread J.
--- Bill Landry <[EMAIL PROTECTED]> wrote: > J. wrote the following on 4/8/2007 11:14 AM -0800: > > Not sure if this is connected to my agressive smtp connection > rejection > > campaign over the past week, but we've been hit for the first time > in > > many months with a backscatter spam attack.

Re: procmailrc question

2007-04-08 Thread Gene Heskett
On Sunday 08 April 2007, John D. Hardin wrote: >On Sun, 8 Apr 2007, Gene Heskett wrote: >> Greetings; >> >> trigger phrases of the ip address, presented in the form of >> >> * ^X-Originating-IP: "from \[xxx\.xxx\.xxx\.xxx\]" >> >> don't seem to be working. >> >> Is my syntax for the use of the '\'

Re: Spam bounceback attack

2007-04-08 Thread Matt Kettler
J. wrote: > Not sure if this is connected to my agressive smtp connection rejection > campaign over the past week, but we've been hit for the first time in > many months with a backscatter spam attack. Spammer(s) use random > addresses with our domain for their spamming so we get the flood > (13000

Re: Spam bounceback attack

2007-04-08 Thread Bill Landry
J. wrote the following on 4/8/2007 11:14 AM -0800: > Not sure if this is connected to my agressive smtp connection rejection > campaign over the past week, but we've been hit for the first time in > many months with a backscatter spam attack. Spammer(s) use random > addresses with our domain for th

Spam bounceback attack

2007-04-08 Thread J.
Not sure if this is connected to my agressive smtp connection rejection campaign over the past week, but we've been hit for the first time in many months with a backscatter spam attack. Spammer(s) use random addresses with our domain for their spamming so we get the flood (13000+ since midnight) of

Re: procmailrc question

2007-04-08 Thread John D. Hardin
On Sun, 8 Apr 2007, Gene Heskett wrote: > Greetings; > > trigger phrases of the ip address, presented in the form of > > * ^X-Originating-IP: "from \[xxx\.xxx\.xxx\.xxx\]" > > don't seem to be working. > > Is my syntax for the use of the '\' escape wrong? No, but I question the quotes - are t

Re: Rule debugging

2007-04-08 Thread J.
--- "John D. Hardin" <[EMAIL PROTECTED]> wrote: > On Sat, 7 Apr 2007, J. wrote: > > > --- "John D. Hardin" <[EMAIL PROTECTED]> wrote: > > > > > You might want to look at this instead of trying to hand-roll > > > obfuscation rules: > > > > > > http://www.impsec.org/~jhardin/antispam/obfusc.pl

Re: procmailrc question

2007-04-08 Thread Bob Proulx
Gene Heskett wrote: > Subject: Re: procmailrc question Procmail questions are offtopic for the spamassassin list. You should ask those in a procmail users forum. However I can't resist... > trigger phrases of the ip address, presented in the form of > > * ^X-Originating-IP: "from \[xxx\.xxx\.x

procmailrc question

2007-04-08 Thread Gene Heskett
Greetings; trigger phrases of the ip address, presented in the form of * ^X-Originating-IP: "from \[xxx\.xxx\.xxx\.xxx\]" don't seem to be working. Is my syntax for the use of the '\' escape wrong? -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, an

Re: Rule debugging

2007-04-08 Thread John D. Hardin
On Sat, 7 Apr 2007, J. wrote: > --- "John D. Hardin" <[EMAIL PROTECTED]> wrote: > > > You might want to look at this instead of trying to hand-roll > > obfuscation rules: > > > > http://www.impsec.org/~jhardin/antispam/obfusc.pl > > Thanks John. I have no idea what the program does but it does