Re: getting tons of SPAM

Hello Benny, I tried to find a legitimate way to reject or drop spam email. I was getting tons of very spammy emails, with very low score. I take very serious your advise and suggestions. I joined this forum because I want to listen to experts. going through the configuration files I realize I had

Re: getting tons of SPAM

On October 20, 2014 4:51:35 PM Axb wrote: use Postfix access tables (hash/pcre/regex) If he reject he will not listen to what he ask for, pointless

Re: getting tons of SPAM

On October 20, 2014 4:48:51 PM motty cruz wrote: here are the RBLs I am using: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net is there a way to block *.eu and *.link ? Would you listen to my advise if you block eu

Re: getting tons of SPAM

Am 20.10.2014 um 17:17 schrieb John Wilcock: > Le 20/10/2014 17:03, Reindl Harald a écrit : >> Am 20.10.2014 um 17:00 schrieb motty cruz: >>> yes you're right I am trying to "reject" emails that end with *.eu and >>> *.link. can I do a wild card *.eu? *.link? >> >> http://www.postfix.org/access.5.h

Re: getting tons of SPAM

Le 20/10/2014 17:03, Reindl Harald a écrit : Am 20.10.2014 um 17:00 schrieb motty cruz: yes you're right I am trying to "reject" emails that end with *.eu and *.link. can I do a wild card *.eu? *.link? http://www.postfix.org/access.5.html http://www.postfix.org/regexp_table.5.html http://www.p

Re: getting tons of SPAM

Am 20.10.2014 um 17:00 schrieb motty cruz: yes you're right I am trying to "reject" emails that end with *.eu and *.link. can I do a wild card *.eu? *.link? http://www.postfix.org/access.5.html http://www.postfix.org/regexp_table.5.html http://www.postfix.org/pcre_table.5.html On Mon, Oct 2

Re: getting tons of SPAM

Hello Axb, yes you're right I am trying to "reject" emails that end with *.eu and *.link. can I do a wild card *.eu? *.link? Thanks, On Mon, Oct 20, 2014 at 7:51 AM, Axb wrote: > On 10/20/2014 04:48 PM, motty cruz wrote: > >> here are the RBLs I am using: >> reject_rbl_client b.barracuda

Re: getting tons of SPAM

On 10/20/2014 04:48 PM, motty cruz wrote: here are the RBLs I am using: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net is there a way to block *.eu and *.link ? block means *reject*, right? use Postfix access ta

Re: getting tons of SPAM

here are the RBLs I am using: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net is there a way to block *.eu and *.link ? here is part of local.cf # Set the threshold at which a message is considered spam (default: 5.0)

Re: getting tons of SPAM

Am 17.10.2014 um 00:24 schrieb Benny Pedersen: On October 16, 2014 11:23:57 PM motty cruz wrote: I tried to post a sample but got rejected: Good, thats means that its local problem Here is goes again, the header: tests=[BAYES_99=4.5, BAYES_999=0.2, HTML_MESSAGE=0.001, T_RP_MATCHES_RCVD=-0

Re: getting tons of SPAM

On October 16, 2014 11:23:57 PM motty cruz wrote: I tried to post a sample but got rejected: Good, thats means that its local problem Here is goes again, the header: tests=[BAYES_99=4.5, BAYES_999=0.2, HTML_MESSAGE=0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no What plugins is loaded ? Wel

Re: getting tons of SPAM

On October 16, 2014 10:09:02 PM motty cruz wrote: Received: from 8lzdz8gkn.hath.eu (8lzdz8gkn.hath.eu [191.96.30.8]) X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: 4.691 X-Spam-Level: X-Spam-Status: No, score=4.691 tagged_above=-999 required=6.2 tests=[BAYES

Re: getting tons of SPAM

On 2. jul. 2014 23.11.00 CEST, motty cruz wrote: >X-Virus-Scanned: amavisd-new at fqdn.com Amavis does not run as root so using another user-prefs file ># sa-learn --dump magic Runned as root? >Error Opening file /usr/local/share/GeoIP/GeoIPv6.dat Multiple perl installs? Or fix perl module t

Re: getting tons of SPAM

On Wed, 2014-07-02 at 14:11 -0700, motty cruz wrote: > bayan filter is not running: according to header, Yes. As I pointed out to you yesterday. http://markmail.org/message/atqa6lv2mgplxlhg I also mentioned the most likely cause for the BAYES_* rule hits missing. No reaction on your part, thoug

Re: getting tons of SPAM

On Wed, 2 Jul 2014, Jeremy McSpadden wrote: pastebin .. and do not edit the message, do not remove headers or email addresses Though you *can* mangle your own domain if you want to keep that private. Please use "example.com" for that. -- John Hardin KA7OHZhttp://www.imp

Re: getting tons of SPAM

From: John Hardin Date: Wed, 2 Jul 2014 14:45:07 -0700 (PDT) On Wed, 2 Jul 2014, motty cruz wrote: > bayan filter is not running: according to header, > > X-Virus-Scanned: amavisd-new at fqdn.com > X-Spam-Flag: NO > X-Spam-Score: -0.009 > X-Spam-Level: > X-Spa

Re: getting tons of SPAM

pastebin .. and do not edit the message, do not remove headers or email addresses -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955

Re: getting tons of SPAM

looks like gmail won't allow out going email with sample of spam emails, On Wed, Jul 2, 2014 at 2:45 PM, John Hardin wrote: > On Wed, 2 Jul 2014, motty cruz wrote: > > bayan filter is not running: according to header, >> >> X-Virus-Scanned: amavisd-new at fqdn.com >> X-Spam-Flag: NO >> X-Spa

Re: getting tons of SPAM

On Wed, 2 Jul 2014, motty cruz wrote: bayan filter is not running: according to header, X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: -0.009 X-Spam-Level: X-Spam-Status: No, score=-0.009 tagged_above=-999 required=5.3 tests=[HTML_MESSAGE=0.001, T_RP_MATCHES_RCVD=

Re: getting tons of SPAM

bayan filter is not running: according to header, X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: -0.009 X-Spam-Level: X-Spam-Status: No, score=-0.009 tagged_above=-999 required=5.3 tests=[HTML_MESSAGE=0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable Rec

Re: getting tons of SPAM

whereis sa-update sa-update: /usr/local/bin/sa-update Yeah. You're a /usr/*local*/bin guy. At age 51, I'm I've become a /usr/bin guy. LOL. :-)

Re: getting tons of SPAM

On 07/02/2014 05:32 PM, Steve Bergman wrote: On 07/02/2014 10:10 AM, Axb wrote: writing rules for the stuff SA tends to miss seems like a good place to start off. Well, there's a full time job, eh? Hope it pays well, because its tedious, eternal, and thankless. It pays quite well. Tuning

Re: getting tons of SPAM

> There used to be a nightly (?) set of rules that were designed just for > current spam, or does my memory serve me false? The name escapes me but > it ceased some time back. Are you thinking of the "sought" rule-set, which was generated and updated every 4 hours from SA spamtraps? It's still

Re: getting tons of SPAM

There used to be a nightly (?) set of rules that were designed just for current spam, or does my memory serve me false? The name escapes me but it ceased some time back. ==John ff who finds spamhaus+clamAV+spamassassin_with_Bayes works well enough On Wed, 2 Jul 2014, Steve Bergman wrote:

Re: getting tons of SPAM

On 07/02/2014 10:10 AM, Axb wrote: writing rules for the stuff SA tends to miss seems like a good place to start off. Well, there's a full time job, eh? Hope it pays well, because its tedious, eternal, and thankless. Spam is always changing. Seems like it might be better for a central org

Re: getting tons of SPAM

On 02.07.14 07:52, motty cruz wrote: I am using the following RBLs : reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client all.spamrats.com any other suggestions? spam still flowing: any suggestions?

Re: getting tons of SPAM

On 07/02/2014 04:52 PM, motty cruz wrote: header.from=sentineli...@e.safenet-inc.com header.d= e.safenet-inc.com very low score for spammy email. any suggestions? writing rules for the stuff SA tends to miss seems like a good place to start off. and if you come asking for help wi

Re: getting tons of SPAM

On 07/02/2014 09:52 AM, motty cruz wrote: I am using the following RBLs : reject_rbl_client b.barracudacentral.org , reject_rbl_client zen.spamhaus.org , reject_rbl_client bl.spamcop.net , re

Re: getting tons of SPAM

I am using the following RBLs : reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client all.spamrats.com any other suggestions? spam still flowing: X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag:

Re: getting tons of SPAM

I am using the following RBLs: On Tue, Jul 1, 2014 at 10:08 PM, Steve Bergman wrote: > On 07/01/2014 11:15 PM, Daniel Staal wrote: > > You probably can. ;) But I'm sure Windstream didn't get you every >> piece of mail immediately after it was sent - just as soon as they could >> after they

Re: getting tons of SPAM

On 07/01/2014 11:15 PM, Daniel Staal wrote: You probably can. ;) But I'm sure Windstream didn't get you every piece of mail immediately after it was sent - just as soon as they could after they got it. Yeah. I'm conservatively holding myself to higher standards than is perhaps warranted. Bu

Re: getting tons of SPAM

On 07/01/2014 11:09 PM, John Hardin wrote: FWIW, I did not say, and did not have in mind a web-email form when I made my suggestion. I had in mind a more-direct interface to the trouble ticket management system. Of course, I may be assuming a more-sophisticated operation than is the case. Jo

Re: getting tons of SPAM

--As of July 1, 2014 9:40:05 PM -0500, Steve Bergman is alleged to have said: 95+% of the time, email is immediate, true. More like 99%+ of the time. When it's not, I hear about it. But it is not uncommon for mail to be delayed for hours or days either, It's uncommon enough that when it d

Re: getting tons of SPAM

On Tue, 1 Jul 2014, Steve Bergman wrote: I'm not at all sure what you're talking about regarding email vs web form reliability. What are the links in that chain? The email client can malfunction in some way. But then again, so can a browser. The sending server can malfunction in some way. But

Re: getting tons of SPAM

On 07/01/2014 10:11 PM, Daniel Reynolds wrote: It seems to me that grey listing could be useful for small non time critical email servers, such as hobbyist setups, but for business, grey listing is not the way to go. Indeed. We should always remember that our workloads are *not* the only ones

Re: getting tons of SPAM

It seems to me that grey listing could be useful for small non time critical email servers, such as hobbyist setups, but for business, grey listing is not the way to go. On Jul 1, 2014 10:48 PM, "Steve Bergman" wrote: > I said: > > > Have fun in your ivory tower. > > > Please permit me to retroac

Re: getting tons of SPAM

I said: > Have fun in your ivory tower. Please permit me to retroactively back this line out of my previous post. The smiley on the next line was intended to cover it. But it just came out sounding nasty. My amigdala's been acting up lately. ;-) -Steve

Re: getting tons of SPAM

95+% of the time, email is immediate, true. More like 99%+ of the time. When it's not, I hear about it. But it is not uncommon for mail to be delayed for hours or days either, It's uncommon enough that when it does happen I get a phone call about a user "not being able to receive email".

Re: getting tons of SPAM

--As of July 1, 2014 7:39:43 PM -0500, Steve Bergman is alleged to have said: On 07/01/2014 05:07 PM, motty cruz wrote: If it needs to be *instant*, have them visit a web page to enter service requests. Because there's not way that web-based email forms can be abused. Please. The whole del

Re: getting tons of SPAM

On 07/01/2014 05:07 PM, motty cruz wrote: If it needs to be *instant*, have them visit a web page to enter service requests. Because there's not way that web-based email forms can be abused. Please. The whole delay thing is about the ridiculous greylisting kluge. There are plenty of other sp

Bayes, Manual and Auto Learning Strategies (was: Re: getting tons of SPAM)

On Tue, 2014-07-01 at 18:43 -0500, Steve Bergman wrote: > On 07/01/2014 06:09 PM, RW wrote: > > I'm sceptical about the use of Dovecot-Antispam with Spamassassin. > > The problem is that it trains on SpamAssassin errors rather than Bayes > > errors. It may be possible to get sufficient spam this wa

Re: getting tons of SPAM

On Tue, 2014-07-01 at 12:33 -0700, motty cruz wrote: > I trained SA with about 700 SPAM emails and with about 258 HAM > emails. > X-Spam-Status: No, score=0.003 tagged_above=-999 required=5.3 > tests=[DKIM_SIGNED=0.001, HTML_IMAGE_RATIO_06=0.001, > HTML_MESSAGE=0.001, T_DKIM_INVALID=0.01, >

Re: getting tons of SPAM

On 07/01/2014 06:09 PM, RW wrote:> > I'm sceptical about the use of Dovecot-Antispam with Spamassassin. > The problem is that it trains on SpamAssassin errors rather than Bayes > errors. It may be possible to get sufficient spam this way, but ham > is learned very slowly through avoidable FPs. >

Re: getting tons of SPAM

On 07/01/2014 05:35 PM, Antony Stone wrote: This may be true, but in the example that you give, tech support should really have provided a better (ie: more reliable) mechanism for contact than email if the customer is entitled to (expect) a prompt response. There are multiple methods. But cust

Re: getting tons of SPAM

On Tue, 01 Jul 2014 14:06:14 -0500 Steve Bergman wrote: > What SA really needs if for its own Bayesian filter to kick in. But > to be used at all, you need at least 200 ham and 200 spam messages > registered with it. > > i.e. if you have to have a way to train the filter. I don't really > have

Re: getting tons of SPAM

On Wednesday 02 July 2014 at 00:12:07, Steve Bergman wrote: > In short... try to explain that email isn't an instant messaging system > to a customer with a dead fryer at 11AM emailing for a tech to help > before the lunch crowd arrives. That's how email is used in the real > world. And no amount

Re: getting tons of SPAM

On 07/01/2014 04:31 PM, Martin Gregorie wrote: I know what can happen, and also that those complaints can arise from a total misunderstanding of what e-mail is designed to do: that it is *not* an instant messaging medium but it is a reliable one despite delivering over sometimes flaky networks

Re: getting tons of SPAM

Today I build a new Spam filter with latest release, I leave all default configuration except a few changes, for now seem to be doing better at blocking really spammy emails. Thanks for all your help, On Tue, Jul 1, 2014 at 2:39 PM, John Hardin wrote: > On Tue, 1 Jul 2014, Martin Gregorie wro

Re: getting tons of SPAM

On Tue, 1 Jul 2014, Martin Gregorie wrote: On Tue, 2014-07-01 at 15:37 -0500, Steve Bergman wrote: On 07/01/2014 03:29 PM, Martin Gregorie wrote: On Tue, 2014-07-01 at 19:17 +, Jeremy McSpadden wrote: No mention of RBLs or greylisting ... Quite. When my ISP switched on greylisting my

Re: getting tons of SPAM

On Tue, 2014-07-01 at 15:37 -0500, Steve Bergman wrote: > > On 07/01/2014 03:29 PM, Martin Gregorie wrote: > > On Tue, 2014-07-01 at 19:17 +, Jeremy McSpadden wrote: > >> No mention of RBLs or greylisting ... > >> > > Quite. > > > > When my ISP switched on greylisting my mail immediately went

Re: getting tons of SPAM

On 07/01/2014 04:00 PM, motty cruz wrote: yes I guest I could change the variable delay, I will do a quick search to see how would affect users. some users are very sensitive to this issues. What mail server and version of it are you using? There was a good suggestion made about postscreen, e

Re: getting tons of SPAM

yes I guest I could change the variable delay, I will do a quick search to see how would affect users. some users are very sensitive to this issues. Thanks a bunch, On Tue, Jul 1, 2014 at 1:37 PM, Steve Bergman wrote: > > > On 07/01/2014 03:29 PM, Martin Gregorie wrote: > >> On Tue, 2014-07-0

Re: getting tons of SPAM

On 07/01/2014 03:29 PM, Martin Gregorie wrote: On Tue, 2014-07-01 at 19:17 +, Jeremy McSpadden wrote: No mention of RBLs or greylisting ... Quite. When my ISP switched on greylisting my mail immediately went from a spam:ham ratio of 80:20 to one of 20:80 But the variable delay, which

Re: getting tons of SPAM

On Tue, 2014-07-01 at 19:17 +, Jeremy McSpadden wrote: > No mention of RBLs or greylisting ... > Quite. When my ISP switched on greylisting my mail immediately went from a spam:ham ratio of 80:20 to one of 20:80, which pretty much where it has stayed ever since. The soam:ham ratio is reporte

Re: getting tons of SPAM

On 07/01/2014 02:33 PM, motty cruz wrote: I trained SA with about 700 SPAM emails and with about 258 HAM emails. In case I missed this, are you the single user, or does this server handle many mail accounts? I have many, and took the conservative approach of giving each user their own filedb

Re: getting tons of SPAM

On 07/01/2014 02:23 PM, Axb wrote: nor, if using Postfix, postscreen Indeed. I've looked at that. It's probably better than the sleep. But it's not yet an option for us. And at 7000 emails per day or whatever we get, I'm not sure there's that much difference. (There may be. I haven't looke

Re: getting tons of SPAM

Hello Jeremy, I have the following rbl main.cfg in postfix: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client all.spamrats.com RBL are very nice, helping me block lots of SPAM but a lot of spam are

Re: getting tons of SPAM

nor, if using Postfix, postscreen On 07/01/2014 09:17 PM, Jeremy McSpadden wrote: No mention of RBLs or greylisting ... -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 O

Re: getting tons of SPAM

No mention of RBLs or greylisting ... -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jul 1, 2014, at 2:06 PM, "Steve Bergman" mailto:sbergma...@gmail.com>> wrote: Hey

Re: getting tons of SPAM

Hey motty cruz, I just moved our 100 users over from our ISP's mail servers to our own. Apparently, the ISP's mail servers were doing remarkably well. Because it turns out that we get some 5000 spams a day, and users were getting essentially no spam. Then I upgraded us to a new OS on our Deb

Re: getting tons of SPAM

maybe I missed your questions, was this your questions " Did you use default configs for spamassassin and amavis?" because if it is, I replied immediately, here is my response again, "yes I was using default configurations except for language scores I added some time ago. " Thanks, On Tue, Jul

Re: getting tons of SPAM

On 27.06.14 07:50, motty cruz wrote: X-Quarantine-ID: <4QFxoaNchYOk> X-Virus-Scanned: amavisd-new at fqdn.com X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: unexpected end of header On Fri, Jun 27, 2014 at 8:16 AM, Matus UHLAR - fantomas wrote: This might explain much. seems

Re: getting tons of SPAM

Hello, I am trying to manipulate spamassassin scores, I am getting lots of SPAM with very low score. X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: 0.003 X-Spam-Level: X-Spam-Status: No, score=0.003 tagged_above=-999 required=5.3 tests=[DKIM_SIGNED=0.001, HTML_IMAGE

Re: getting tons of SPAM

On 27.06.14 07:50, motty cruz wrote: I can't figureout why spammy email get very little score, X-Quarantine-ID: <4QFxoaNchYOk> X-Virus-Scanned: amavisd-new at fqdn.com X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: unexpected end of header This might explain much. seems that t

Re: getting tons of SPAM

Thank you, I can't figureout why spammy email get very little score, X-Quarantine-ID: <4QFxoaNchYOk> X-Virus-Scanned: amavisd-new at fqdn.com X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: unexpected end of header X-Spam-Flag: NO X-Spam-Score: 0.102 X-Spam-Level: X-Spam-Status: No,

Re: getting tons of SPAM

On 06/26/2014 04:23 PM, motty cruz wrote: as you can see, looks like Amavisd did not scan, spamassassing should have stop this email. yes, it really looked in the original mail that amavis did not scan it. The question is why it did not scan it. check the logs to see the reason - if amavis doe

Re: getting tons of SPAM

Thank you all, here is another header of a very spammy email: X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: 2.301 X-Spam-Level: ** X-Spam-Status: No, score=2.301 tagged_above=-999 required=5.3 tests=[AWL=-0.006, BODY_8BITS=1.5, DKIM_SIGNED=0.001, HTML_IMAG

Re: getting tons of SPAM

motty cruz skrev den 2014-06-26 17:02: I apologize, I did not articulate my questions correctly. Spamassassin is enable but did not block spam, I know my configuration is wrong. I was wondering if someone can help me figure out.  ... ## Optional Score Increase last 4.0 increase to 4.5 score B

Re: getting tons of SPAM

On Thu, 26 Jun 2014 08:20:35 -0700 (PDT) John Hardin wrote: > On Thu, 26 Jun 2014, motty cruz wrote: > > > ## Optional Score Increase last 4.0 increase to 4.5 > > score BAYES_50 1.800 > > Do you seriously want to give 1.8 points for bayes not having any > opinion on the spamminess of the message

Re: getting tons of SPAM

... A catchall ? -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jun 26, 2014, at 9:24 AM, "motty cruz" mailto:motty.c...@gmail.com>> wrote: X-Original-To: catch...@fq

Re: getting tons of SPAM

On Thu, 26 Jun 2014, motty cruz wrote: ## Optional Score Increase last 4.0 increase to 4.5 score BAYES_50 1.800 Do you seriously want to give 1.8 points for bayes not having any opinion on the spamminess of the message? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardi

Re: getting tons of SPAM

I apologize, I did not articulate my questions correctly. Spamassassin is enable but did not block spam, I know my configuration is wrong. I was wondering if someone can help me figure out. local.cf # languages allow ifplugin Mail::SpamAssassin::Plugin::TextCat ok_languagesen es ok_locales

Re: getting tons of SPAM

On 06/26/2014 04:23 PM, motty cruz wrote: as you can see, looks like Amavisd did not scan, spamassassing should have stop this email. If Amavisd did not scan, you need to fix that before asking the SA list for help.

Re: getting tons of SPAM

On 26/06/2014 15:23, motty cruz wrote: Hello, I am getting a lot of spam, I don't know how to effectevily stop it, now I realize I can't stop it 100%, as you can see, looks like Amavisd did not scan, spamassassing should have stop this email. Have you tried using spamassassin? -- Regards