Re: critsend (/gridsend?)... what's the(ir) trick?

2011-09-08 Thread John Hardin
On Thu, 8 Sep 2011, Michael Scheidell wrote: On 9/8/11 4:58 PM, Yanek wrote: Hello list, Please bear with me if it has been asked already, I searched the archives a bit and could not find any answer. post the email, full headers and all to pastebin.com, send the url here. we suspect you h

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread Jay Plesset
If each message is indeed a separate message, then no sane MTA could find them the "same" message. Each will have a unique message ID, and will have different envelope addresses. I certainly would not use an MTA that would combine such. jay plesset Oracle Messaging Server support. On 9/8/201

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread John Hardin
On Thu, 8 Sep 2011, Bowie Bailey wrote: On 9/8/2011 2:26 PM, Steve wrote: In any case, as it turns out, none of this helps me store a single inbound spam once - rather than duplicate it for each address in the envelope... which, to my thinking, remains a sane objective... Agreed. Although y

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread John Hardin
On Thu, 8 Sep 2011, Steve wrote: On 08/09/2011 17:04, Mark Martinec wrote: Sep 8 15:04:43 svr amavis[9242]: (09242-14) Passed SPAM, [208.30.118.112] [208.30.118.112] -> ,,, ,,, ,, Message-ID: <201109081759.8B7F082565A0D33F9A15@p00905q4tw>, mail_id: 0eFkT73PzE2y, Hits: 25.936, s

Re: critsend (/gridsend?)... what's the(ir) trick?

2011-09-08 Thread Michael Scheidell
On 9/8/11 4:58 PM, Yanek wrote: Hello list, Please bear with me if it has been asked already, I searched the archives a bit and could not find any answer. post the email, full headers and all to pastebin.com, send the url here. we suspect you have them whitelisted, and/or shortcut is enabled f

critsend (/gridsend?)... what's the(ir) trick?

2011-09-08 Thread Yanek
Hello list, Please bear with me if it has been asked already, I searched the archives a bit and could not find any answer. One of my email address is subscribed to a site that seems to use Critsend for its outgoing mails. Since I like to watch after the SA scores of all incoming mails, I've notic

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread Bowie Bailey
On 9/8/2011 2:26 PM, Steve wrote: > On 08/09/2011 19:13, Bowie Bailey wrote: >> Keep in mind that the "To:" header in an email is for decorative >> purposes only and has no relevance at all to where the email is >> delivered. In a normal email, the "To:" header will generally match >> with the dest

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread Steve
On 08/09/2011 19:13, Bowie Bailey wrote: > Keep in mind that the "To:" header in an email is for decorative > purposes only and has no relevance at all to where the email is > delivered. In a normal email, the "To:" header will generally match > with the destination, but with spam, anything goes. F

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread Bowie Bailey
On 9/8/2011 1:21 PM, Steve wrote: > > I understand. I'd expected the mail message header to reflect the > address to which the message was sent - as under "normal" > circumstances. It struck me as being odd that the email addresses the > originator specified would occur no-where in the messages po

Re: Anybody else getting hit by WannaBeBig forum notifications?

2011-09-08 Thread darxus
On 09/07, Michael Scheidell wrote: > I don't see anything in our larger installations, guess you just > must be blessed :-) Good to know, thanks. On 09/07, Axb wrote: > why not: > > blacklist_from *@wannabebigforums.com That does sound like a better option now, thanks. > And report to Racksp

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread Steve
On 08/09/2011 17:04, Mark Martinec wrote: > Sep 8 15:04:43 svr amavis[9242]: (09242-14) > Passed SPAM, [208.30.118.112] [208.30.118.112] >-> > ,,, > ,,, >,, > Message-ID: <201109081759.8B7F082565A0D33F9A15@p00905q4tw>, > mail_id: 0eFkT73PzE2y, Hits: 25.936, size: 1608, queued_as:

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread Mark Martinec
Steve, > I'm using a (mostly vanilla) Postfix/Amvisd configuration... > [...] > > If you look at your mail logs, do you actually see 9 messages being > > received? > I thought I did, but - now - I'm not so sure... because the log doesn't > match the messages I find via IMAP. (Really!) > > I've at

Re: CTYPE_NULL false-positive for Content-Type: multipart/related ?

2011-09-08 Thread Edward Prendergast
On 08/09/11 16:23, John Hardin wrote: On Thu, 8 Sep 2011, Edward Prendergast wrote: I'm seeing CTYPE_NULL triggering for certain messages from gmail. If I compare a message that doesn't trigger CTYPE_NULL: Content-Type: multipart/related; With one that does: Content-Type: multipart/related;

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread Steve
On 08/09/2011 14:21, Bowie Bailey wrote: > On 9/8/2011 5:07 AM, Steve wrote: >> This is the thing that was so very, very odd. The message is identical >> - including the headers. If I look at the first and last spam email in >> a 9-message block, then u to get the source, and paste them into >> fil

Re: CTYPE_NULL false-positive for Content-Type: multipart/related ?

2011-09-08 Thread John Hardin
On Thu, 8 Sep 2011, Edward Prendergast wrote: I'm seeing CTYPE_NULL triggering for certain messages from gmail. If I compare a message that doesn't trigger CTYPE_NULL: Content-Type: multipart/related; With one that does: Content-Type: multipart/related; CTYPE_NULL certainly shouldn't fire

CTYPE_NULL false-positive for Content-Type: multipart/related ?

2011-09-08 Thread Edward Prendergast
Hi, I'm seeing CTYPE_NULL triggering for certain messages from gmail. If I compare a message that doesn't trigger CTYPE_NULL: Content-Type: multipart/related; With one that does: Content-Type: multipart/related; I'm thinking it looks like a false positive rather than a legitimate hit? This

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread Bowie Bailey
On 9/8/2011 5:07 AM, Steve wrote: > This is the thing that was so very, very odd. The message is identical > - including the headers. If I look at the first and last spam email in > a 9-message block, then u to get the source, and paste them into > files... diff confirms that the messages are byte-

Re: Curious phenomenon with 9-repetitions of each spam...

2011-09-08 Thread Steve
On 07/09/2011 16:10, John Hardin wrote: >> I don't want to use greylisting as I often receive legitimate email from >> new contacts - often while I'm on the phone to them - so, introducing a >> delay is undesirable to me. > > Perhaps a hybrid approach, where you greylist only if the foreign IP > ap