Re: How to report 120,000 spams a day

2008-03-10 Thread Sandy S
Tuc at T-B-O-H.NET wrote: Hi, Everyone keeps telling me to push the userlist out to the MX. This isn't possible, since everything is handled in virtusertable. So then they tell me to push the virtusertable out to the MX's. So I've asked multiple people multiple times how using sendmail o

Re: SA 3.1.7 children hang but don't die

2006-10-19 Thread Sandy S
> >> I'll second this, SA 3.1.5 & FuzzyOCR on RHEL-AS4 > >> > >> I've been seeing this off & on ever since I added FuzzyOCR. > >> Logs seem to correlate to FuzzyOCR processing a gif image during a > >> peak of messages. Get FuzzyOcr.log message: > >> FuzzyOcr received timeout after running "10

Re: SA 3.1.7 children hang but don't die

2006-10-18 Thread Sandy S
- Original Message - From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> To: "Sandy S" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]>; "Chris Lear" <[EMAIL PROTECTED]>; ; <[EMAIL PROTECTED]> Sent: Wednesday, October 18, 2006 1:29

Re: SA 3.1.7 children hang but don't die

2006-10-18 Thread Sandy S
- Original Message - From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: "Sandy S" <[EMAIL PROTECTED]>; "Chris Lear" <[EMAIL PROTECTED]>; ; <[EMAIL PROTECTED]> Sent: Wednesday, October 18, 2006 1:09

Re: SA 3.1.7 children hang but don't die

2006-10-18 Thread Sandy S
- Original Message - From: "George R. Kasica" <[EMAIL PROTECTED]> To: "Chris Lear" <[EMAIL PROTECTED]> Cc: Sent: Wednesday, October 18, 2006 10:04 AM Subject: Re: SA 3.1.7 children hang but don't die > >* George R. Kasica wrote (18/10/06 14:55): > >> I'm noticing in 3.1.7 here that SA c

Re: Been getting alot of these lately.. anyone else?

2006-10-16 Thread Sandy S
Found a bunch of these in my mailbox this morning, too. This rule seems to catch them all so far (until the spammer changes his wording) body WORK_FROM_HOME_BA /(?:Learn|Find out) how to (?:make|generate) 1.5 - 3.5k (?:daily|(?:per|a) day) from (?:your )?(?:home|house)/i score WORK_FROM_HOME_

Re: sudden deluge of university spams

2006-06-22 Thread Sandy S
- Original Message - From: "Ramprasad" <[EMAIL PROTECTED]> To: "Chris Santerre" <[EMAIL PROTECTED]> Cc: Sent: Thursday, June 22, 2006 10:46 AM Subject: RE: sudden deluge of university spams > > > There's a reason. The amount of permutations is ridiculous. But SARE > > has Evilnumbers w

Re: All image spam

2006-03-08 Thread Sandy S
- Original Message - From: "Larry Rosenman" To: "'Sandy S'" <[EMAIL PROTECTED]>; Sent: Wednesday, March 08, 2006 10:13 AM Subject: RE: All image spam > Sandy S wrote: > > We're also being bombarded with these and I noticed that the

Re: All image spam

2006-03-08 Thread Sandy S
esn't have a clue as to how to submit messages with all the headers intact and doesn't understand why they should anyway, and privacy issues prevent us from gathering a corpus of ham ourselves) Thanks, Sandy S

Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Sandy S
- Original Message - From: "Doc Schneider" <[EMAIL PROTECTED]> To: "Sandy S" <[EMAIL PROTECTED]> Cc: Sent: Thursday, February 23, 2006 2:24 PM Subject: Re: Updated Pump and Dump rules. 2006-02-23 > Sandy S wrote: > > - Original Message

Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Sandy S
- Original Message - From: "Doc Schneider" <[EMAIL PROTECTED]> To: Sent: Thursday, February 23, 2006 12:06 AM Subject: Updated Pump and Dump rules. 2006-02-23 > I just committed version 01.00.08 of this ruleset to: > > http://rulesemporium.com/rules/70_sare_stocks.cf > > It should appea

Re: Apparently Recieved by my server...

2005-11-11 Thread Sandy S
> [EMAIL PROTECTED] wrote: > > The following email to me gets through by their spoofing my IP even though > > it clearly comes from somewhere else. I remember someone mentioning a > > trusted_networks-like setting that used something like a > > apparently_received_from name or something similar. Ho

Spamd Children Not Dying

2005-11-07 Thread Sandy S.
We're running SpamAssassin version 3.1.0 on FreeBSD. Up till now it's been running like a top, but over the weekend (after a particularly large run of spam), it suddenly stopped processing messages. The logs showed many lines like: Nov 5 05:03:04 teal spamd[28234]: prefork: write of ping failed

Re: Sorta OT - was: RE: Out of Office AutoReply

2005-10-27 Thread Sandy S.
- Original Message - From: "Daniel Watts" <[EMAIL PROTECTED]> To: "Kevin W. Gagel" <[EMAIL PROTECTED]>; Sent: Wednesday, October 26, 2005 4:32 AM Subject: Re: Sorta OT - was: RE: Out of Office AutoReply > > > > > > >>Why don't they just set someone in their organization to > >>cover th

Re: Help with install and config

2005-10-19 Thread Sandy S.
- Original Message - From: "Liam-PrintingAutomation,Inc." <[EMAIL PROTECTED]> To: Sent: Tuesday, October 18, 2005 8:00 PM Subject: Re: Help with install and config > Rick Macdougall wrote: > > > > > Hi, > > > > Well you need to call spamassassin (or spamc, that's a better option) > >

Re: Setting up a rejection limit

2005-05-23 Thread Sandy S
- Original Message - From: "guenther" <[EMAIL PROTECTED]> To: "The Doctor" <[EMAIL PROTECTED]> Cc: Sent: Sunday, May 22, 2005 8:27 AM Subject: Re: Setting up a rejection limit > On Sun, 2005-05-22 at 07:03 -0600, The Doctor wrote: > > How can one use user_prefs to tell spamassassin to

Re: ALL_TRUSTED rule hit, but haven't set any trusted networks

2005-03-04 Thread Sandy S
- Original Message - From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> To: "Matt Kettler" <[EMAIL PROTECTED]> Cc: "Matthew Newton" <[EMAIL PROTECTED]>; Sent: Friday, March 04, 2005 10:57 AM Subject: Re: ALL_TRUSTED rule hit, but haven't set any trusted networks > Matt Kettler wrote: > > A

Re: "Not found: pass = SPF_PASS"

2005-02-14 Thread Sandy S
Eric Hall wrote: > Symptomatically, SA runs but SPF apparently does not. SA reports that it > cannot determine the envelope sender, and when it drops down to host-level > parsing, the process ends abruptly. > Do you use Sendmail? If so, you may have to configure it to expose the sender address.

Re: more ALL_TRUSTED issues?

2005-02-10 Thread Sandy S
Alan - I ran into this same issue earlier - the IP address your message came from is incorrectly marked in the current version of Spamassassin as being a reserved IP address. It sounds like this issue has been fixed in future versions of Spamassassin, but meanwhile you can use the fix

Re: ALL_TRUSTED hitting because of "has reserved IP"?

2005-01-12 Thread Sandy S
> [snip] > > > debug: looking up A records for 'merlin.boreal.org' > > debug: A records for 'merlin.boreal.org': 216.70.16.15 > > debug: received-header: 'from' 71.8.49.195 has reserved IP > > This is definitely weird; 71.0.0.0/8 is NOT special in any way I know > of. > > > Notice that the IP t

ALL_TRUSTED hitting because of "has reserved IP"?

2005-01-12 Thread Sandy S
I know there's been a lot of talk on the ALL_TRUSTED rule, but I don't remember seeing this issue and couldn't find it in a search of the list archives. We've gotten several spams recently that made it through because they hit the ALL_TRUSTED rule. We have a standard setup and haven't had trouble

Re: Frustration...

2004-11-04 Thread Sandy S
Lisa wrote: > Also, I'm not sure how I'm supposed to feed it spam. I have Sendmail/Qpopper > and most of my users pick up their mail using Outlook Express. I understand > I can't just forward spam to a spam mailbox and run sa-learn on that as the > forwarding will not get the original headers. > We

Re: ***SPAM*** Problems with URIDNSBL Under Spamassassin 3.0?

2004-09-27 Thread Sandy S
Thanks for the feedback - I've created the attachment with a sample spam. Sandy - Original Message - From: "Theo Van Dinter" <[EMAIL PROTECTED]> To: "Jeff Chan" <[EMAIL PROTECTED]> Cc: Sent: Monday, September 27, 2004 11:26 AM Subject: Re: ***SPAM*** Problems with URIDNSBL Under Spamassa

Re: ***SPAM*** Problems with URIDNSBL Under Spamassassin 3.0?

2004-09-27 Thread Sandy S.
7;m reading the dig output correctly, it isn't finding the tvuu.wneiis-planet.info domain, although wneiis-planet.info is listed. But from other posts on this list it's obvious that it is being correctly flagged on other systems. Is this an issue with SURBL or with Spamassassin? If it's a problem with the way Spamassassin is extracting the URL's I'll submit it to bugzilla, but I want to be sure I'm on the right track before I do. Thanks much for your help! Sandy S.

Re: ***SPAM*** Problems with URIDNSBL Under Spamassassin 3.0?

2004-09-23 Thread Sandy S
- Original Message - From: "Ulysses Cruz" <[EMAIL PROTECTED]> To: Sent: Thursday, September 23, 2004 1:21 PM Subject: Re: ***SPAM*** Problems with URIDNSBL Under Spamassassin 3.0? > On Thu, Sep 23, 2004 at 01:10:40PM -0500, Sandy S whispered: > > Ulysses - &

Re: ***SPAM*** Problems with URIDNSBL Under Spamassassin 3.0?

2004-09-23 Thread Sandy S
- Original Message - From: "Ulysses Cruz" <[EMAIL PROTECTED]> To: Sent: Thursday, September 23, 2004 1:03 PM Subject: Re: ***SPAM*** Problems with URIDNSBL Under Spamassassin 3.0? > On Thu, Sep 23, 2004 at 12:44:39PM -0500, Sandy S. whispered: > > Thanks f

Re: {Spam?} Problems with URIDNSBL Under Spamassassin 3.0?

2004-09-23 Thread Sandy S
- Original Message - From: "Ken Goods" <[EMAIL PROTECTED]> To: "'Sandy S'" <[EMAIL PROTECTED]>; Sent: Thursday, September 23, 2004 12:37 PM Subject: RE: {Spam?} Problems with URIDNSBL Under Spamassassin 3.0? > Sandy S scribbled on Thursday,

Re: ***SPAM*** Problems with URIDNSBL Under Spamassassin 3.0?

2004-09-23 Thread Sandy S.
- Original Message - From: "Ulysses Cruz" <[EMAIL PROTECTED]> To: Sent: Thursday, September 23, 2004 12:22 PM Subject: Re: ***SPAM*** Problems with URIDNSBL Under Spamassassin 3.0? > On Thu, Sep 23, 2004 at 10:52:03AM -0500, Sandy S whispered: > > I'm

Problems with URIDNSBL Under Spamassassin 3.0?

2004-09-23 Thread Sandy S
is a bug or is there something I missed as I was RTFMing? Thanks for any help on this! Sandy S.