RE: simple script idea for checking reputation disagreement

2009-04-04 Thread RobertH
> > > 0.2 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from > dynamic IP > > address > > [209.92.22.130 listed in > dnsbl.sorbs.net] > > That would be incorrect. The IP is static, not dynamic. > > whois://209.92.22@whois.arin.net > PaeTec Communication

Re: need help - procmail & spamassassin

2009-04-04 Thread Matt Kettler
Jeff Mincy wrote: >From: "sebast...@debianfan.de" >Date: Sun, 05 Apr 2009 01:56:38 +0200 > >Hello, > >i am filtering mails with spamassassin & procmail. > > This is more of a procmail question, so it doesn't actually belong here. > It's related to using SpamAssassin,

Re: need help - procmail & spamassassin

2009-04-04 Thread René Berber
sebastian wrote: > i am filtering mails with spamassassin & procmail. > > > The header of message > > X-Spam-Level: ** > > I want to sort mails into some different directories. > [snip] > :0: > * ^X-Spam-Level: .*\(\*\*\*\*\*\*\*\*\*\* -^^ You are quoting a

Re: need help - procmail & spamassassin

2009-04-04 Thread Jeff Mincy
From: "sebast...@debianfan.de" Date: Sun, 05 Apr 2009 01:56:38 +0200 Hello, i am filtering mails with spamassassin & procmail. This is more of a procmail question, so it doesn't actually belong here. The header of message X-Spam-Level: ** I

need help - procmail & spamassassin

2009-04-04 Thread sebast...@debianfan.de
Hello, i am filtering mails with spamassassin & procmail. The header of message X-Spam-Level: ** I want to sort mails into some different directories. 10 or more --> directory 10 9 --> directory 9 and so one But - nothing happens - the mails are all in the /Maildir/new

Re: simple script idea for checking reputation disagreement

2009-04-04 Thread Duane Hill
Actually, disregard. I see what you are stating. On Sat, 4 Apr 2009, Duane Hill wrote: On Sat, 4 Apr 2009, Neil Schwartzman wrote: On 04/04/09 4:22 PM, "RobertH" wrote: 0.2 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address [209.92.22.13

Re: simple script idea for checking reputation disagreement

2009-04-04 Thread Duane Hill
On Sat, 4 Apr 2009, Neil Schwartzman wrote: On 04/04/09 4:22 PM, "RobertH" wrote: 0.2 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address [209.92.22.130 listed in dnsbl.sorbs.net] That would be incorrect. The IP is static, not dynamic. wh

Re: simple script idea for checking reputation disagreement

2009-04-04 Thread Neil Schwartzman
On 04/04/09 4:22 PM, "RobertH" wrote: > 0.2 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP > address > [209.92.22.130 listed in dnsbl.sorbs.net] That would be incorrect. The IP is static, not dynamic. whois://209.92.22@whois.arin.net PaeTec C

RE: simple script idea for checking reputation disagreement

2009-04-04 Thread RobertH
michael, i had to reply to this one as i was having a hard time replying to your email and bottom posting. here was the scoring on that particular email. although it isnt really strict "reputation" issue, i found it interesting that JMF had it whitelisted and Barracuda tells it more like it is..

RE: Ways to block bouncebacks?

2009-04-04 Thread Mark
-Original Message- From: LuKreme [mailto:krem...@kreme.com] Sent: zaterdag 4 april 2009 19:47 To: users@spamassassin.apache.org Subject: Re: Ways to block bouncebacks? On 4-Apr-2009, at 04:07, Mark wrote: > > Consider using SRS. I wrote a (now somewhat older) doc about it, at: > > > > htt

Re: RFC's suck

2009-04-04 Thread Nix
On 3 Apr 2009, n...@esperi.org.uk stated: > (Worst *video* of a talk, from the POV of actual videoing, that I've > ever seen. Almost solid black screen plus encoding artifacts. Focus on > the screen, ye gods!) I hasten to point out (a little late) that the talk itself was excellent and hiliarious,

Re: webmail phishing?

2009-04-04 Thread Rick Macdougall
info-spamassassin-t...@cs.utexas.edu wrote: Hi, Before I try to roll my own, does anyone have a set of rules or a plugin designed to detect all these webmail account phishes. You know -- the kind that pretend to be a webmail administrator who informs the user his/her webmail account is being u

Re: Ways to block bouncebacks?

2009-04-04 Thread LuKreme
On 4-Apr-2009, at 04:07, Mark wrote: Consider using SRS. I wrote a (now somewhat older) doc about it, at: http://srs-socketmap.info/sendmailsrs.htm But it gives you an idea. There's good C implementations for it, these days, and it will definitely stop ALL fake bounce, with no FPs. I've read

Re: webmail phishing?

2009-04-04 Thread Benny Pedersen
On Sat, April 4, 2009 18:04, info-spamassassin-t...@cs.utexas.edu wrote: > But at a large university we have an ever-renewing crop of > naive users. http://www.clamav.org/ here i have over 1 million sigs now, maybe i am naive to ? help get more here http://www.clamav.net/sendvirus/ :-) http://ww

Re: simple script idea for checking reputation disagreement

2009-04-04 Thread Neil Schwartzman
On 04/04/09 12:00 PM, "Michael Scheidell" wrote: > one company has a list of 'COI' (supposed to be confirmed opt in). they have > begun a process (see the wiki) of canceling client who claimed COI but > obviously didn't. > that 'reputation' score has more to do with contract ($$) than actual real

webmail phishing?

2009-04-04 Thread info-spamassassin-talk
Hi, Before I try to roll my own, does anyone have a set of rules or a plugin designed to detect all these webmail account phishes. You know -- the kind that pretend to be a webmail administrator who informs the user his/her webmail account is being upgraded or has exceeded quota or whatever .. A

Re: simple script idea for checking reputation disagreement

2009-04-04 Thread Neil Schwartzman
On 04/04/09 11:31 AM, "RobertH" wrote: > > greetings... > > i am working at re-learning and applying SA fine tuning. > > in doing so, i have some across some real life SA scoring anomalies. > > it is interesting because one public reputaion service rule offering says to > score "positive",

Re: simple script idea for checking reputation disagreement

2009-04-04 Thread Michael Scheidell
which ones? remember, DCC is 'bulk', not spam. someone could have a BAD DCC reputation (using the commercial reputation filter) as 99% 'bulk', even if it was 100%, double confirmed, bonded opt in. some others judge reputation based on customer contracts (they get paid for it). sometimes legi

simple script idea for checking reputation disagreement

2009-04-04 Thread RobertH
greetings... i am working at re-learning and applying SA fine tuning. in doing so, i have some across some real life SA scoring anomalies. it is interesting because one public reputaion service rule offering says to score "positive", i.e. spammy, spam, or blacklist, and another public reputatio

Re: Ways to block bouncebacks?

2009-04-04 Thread Karsten Bräckelmann
On Sat, 2009-04-04 at 10:45 +0100, Jeremy Morton wrote: > I'm running Spamassassin on my server because of my cPanel installation > and have been for ages. It's been working GREAT for blocking spam, and > I'm happy about that. However, of late, I've been joe-jobbed majorly, > and I'm receiving

RE: Ways to block bouncebacks?

2009-04-04 Thread Mark
Consider using SRS. I wrote a (now somewhat older) doc about it, at: http://srs-socketmap.info/sendmailsrs.htm But it gives you an idea. There's good C implementations for it, these days, and it will definitely stop ALL fake bounce, with no FPs. - Mark -Original Message- From: Jeremy M

Re: [OT] Re: SpamAssassin is EXTREMLY slow

2009-04-04 Thread Matus UHLAR - fantomas
> On Wed, Apr 1, 2009 at 5:52 PM, John Hardin wrote: > > How fast are non-SA DNS queries on that box? If they take ten seconds to > > return an answer, SA is not the culprit. On 01.04.09 17:53, alexus wrote: > without dns they are 0.1 - 1.5s, with DNS they are ~7s by "non-SA DNS" he did not mean

Ways to block bouncebacks?

2009-04-04 Thread Jeremy Morton
Hi, I'm running Spamassassin on my server because of my cPanel installation and have been for ages. It's been working GREAT for blocking spam, and I'm happy about that. However, of late, I've been joe-jobbed majorly, and I'm receiving thousands of bounceback messages in probably 20+ differe