Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread mouss
Andy Spiegl wrote: [snip] But I do agree with Karsten (or Guenther?) that we shouldn't raise the score. yes, vbounce does FP. Let's test: nobody wrote: > I will be on vacation from 1/2/2345 to 6/7/8901. will vbounce tag this message? But my problem is that I cannot explain to all of my u

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Andy Spiegl
On 2008-11-03, 13:02, Bob Kinney wrote: > We set up server side filters for SPAM that users can enable or > disable, is this something you could do in your environment? Uhmmm...not easily I think. We're using a combination of postfix and AMaViS. I'd have to plug procmail inbetween somehow... Than

Re: had it with spaces spam and idiots at hotmail

2008-11-03 Thread mouss
RobertH wrote: this looks for it, assigns some reasonable scores, and if (add your favorite shortcut) bumps it up another 5. uri ST_SPACES /\.spaces\.live\.com/$ score ST_SPACES 5 3 4 2 meta ST_SPACES_BUMP (ST_SPACES && (RCVD_IN_BL_SPAMCOP_NET || RCVD_IN_XBL || RCVD_IN_BL_SPAMCOP_NE

Re: Problems with the email adress of our company

2008-11-03 Thread mouss
Kelson wrote: Per Jessen wrote: I guess it's a matter of opinion, but an email address is a significant part of a corporate identity - you don't go around changing it ad-hoc, and you certainly try to avoid having one domain in your email-address and another on your brochures and businesscards.

Re: Problems with the email adress of our company

2008-11-03 Thread Kelson
Per Jessen wrote: I guess it's a matter of opinion, but an email address is a significant part of a corporate identity - you don't go around changing it ad-hoc, and you certainly try to avoid having one domain in your email-address and another on your brochures and businesscards. Exactly. Tha

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Bob Kinney
Uhmm... interesting. What exactly might cause this? I tried to trigger this behaviour bouncing and forwarding mails from different accounts but never saw the __BOUNCE_RPATH_NULL tag. Might just be our mail server software. It's something we've worked around. But I do agree with Karsten (or G

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Karsten Bräckelmann
On Mon, 2008-11-03 at 15:57 +0100, Andy Spiegl wrote: > Shouldn't the vbounce ruleset help here? Yes, it does. :) > I'm asking because me and my users have the same problem and I am > currently considering giving the ANY_BOUNCE_MESSAGE a higher score > but I am not sure yet whether it's a good i

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Andy Spiegl
On 2008-11-03, 10:13, Bob Kinney wrote: > but had one unfortunate side effect: E-mail forwarded from another > account to an account on our servers was considered a "bounce" > because it hit __BOUNCE_RPATH_NULL. Uhmm... interesting. What exactly might cause this? I tried to trigger this behaviou

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Bob Kinney
We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the present time, my mailbox is filled with backscatter; getting around 10 a minute since 4:30 today. I have postfix backscatter rules in postfix of zimbra, http://www.postfix.org/BACKSCATTER_README.html#real but still getting p

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Andy Spiegl
On 2008-10-29, 18:44, Chris Arnold wrote: > We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin > built-in. At the present time, my mailbox is filled with > backscatter; getting around 10 a minute since 4:30 today. I have > postfix backscatter rules in postfix of zimbra, > http://www.postfix.

Re: Phishing rules?

2008-11-03 Thread Benny Pedersen
On Mon, November 3, 2008 12:02, Martin Gregorie wrote: > ^http:.*\.spaces\.live\.com\/$ > in its body but the From: header identifies a completely unrelated > address. Would a rule that tags messages with this From and URI combo be > useful or would it generate too many FPs? http://www.nabble.com

Re: Phishing rules?

2008-11-03 Thread mouss
Jeff Chan wrote: On Thursday, October 30, 2008, 12:56:53 PM, Micah Anderson wrote: I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: [...] I've got spamassassin 3.2.5 with URIBL plugin loaded (which I understand pulls in the 25

Re: Phishing rules?

2008-11-03 Thread mouss
Micah Anderson wrote: * Kelson <[EMAIL PROTECTED]> [2008-10-30 17:29-0400]: Micah Anderson wrote: reject_rbl_client list.dsbl.org, DSBL has shut down, and you should remove the query from your list. It won't help with the phishing, but it'll free up some network resources. In

Re: Phishing rules?

2008-11-03 Thread Sahil Tandon
Joseph Brennan <[EMAIL PROTECTED]> wrote: >> We get some legitimate email from @live.com users. > > But they don't set a Reply-to header. That's the test. But that wasn't his question; he asked whether any legitimate mail flows from live.com. That was my answer. :) -- Sahil Tandon <[EMAIL PRO

Re: Problems with the email adress of our company

2008-11-03 Thread Per Jessen
mouss wrote: > Per Jessen wrote: >> >>>From the business point of view, one also has to consider the cost >> involved in changing all the stationery, website, businesscards, >> brochures, etc etc etc ... >> > > it is not necessary to change these. a second domain name that points > to the "prim

Re: Phishing rules?

2008-11-03 Thread Martin Gregorie
On Sun, 2008-11-02 at 22:36 -0500, Micah Anderson wrote: > Joseph Brennan <[EMAIL PROTECTED]> writes: > > >> Reply-to: [EMAIL PROTECTED] > > > > > > First pass: > > > > header LOCAL_REPLYTO_LIVE Reply-to =~ /[EMAIL PROTECTED]/ > > score LOCAL_REPLYTO_LIVE8.0 > > > > Maybe scoring 8.0 for

Re: bayes SQL delays

2008-11-03 Thread Michael Parker
On Nov 2, 2008, at 12:55 PM, Micah Anderson wrote: I have spamd setup to use bayes in a mysql database, works fine. I've turned off auto-expiry and instead run a cronjob to expire in the middle of the night (removes about 40k tokens on a run). I've made the DB innoDB so it can handle lockin

Re: Getting hammered by backscatter

2008-11-03 Thread Matthew Newton
Hi, On Wed, 29 Oct 2008, Chris Arnold wrote: > We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the > present time, my mailbox is filled with backscatter; getting around 10 a > minute since 4:30 today. I have postfix backscatter rules in postfix of > zimbra, http://www.post

RE: SARE Update: 90_2tld.cf

2008-11-03 Thread Martin.Hepworth
Don't see this on a web site any where..the URL works but there's mention/documentation of if I can find. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Yet Another Ninja [mailto:[EMAIL PROTECTED] > Sent: 01 November 20

Re: prefork: oops! no idle kids in need_to_del_server?

2008-11-03 Thread Per Jessen
SM wrote: > At 10:18 02-11-2008, Per Jessen wrote: >>OK, this is beginning to be annoying - I've seen it 4-5 times in the >>last week. I'll probably have to cobble up a quick spamd >>auto-restart. Is no-one else running spamd and using SIGHUP for >>reloading the config? > > The configuration r