Re: Trying out a new concept

2008-09-24 Thread Paweł Sasin
> I don't know how this will work but I'm building the data now. For > those of you who are familiar with Day old bread lists to detect new > domains, as you know there's a lag time in the data and they often > don't have data from all the registries. So - here's a different > solution. > > What I

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread Jeremy
"RobertH" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] \ It hits significantly more spam than zen.spamhaus.org On my primary mx, today I had 94 mails that hit a zen list but not brbl, 591 that hit a zen list and brbl, and 8042 that hit brbl but not zen. I am checking -lastexter

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread Yet Another Ninja
On 9/23/2008 5:25 PM, Rob McEwen wrote: Yet Another Ninja wrote: FIW: 12 hr stats / tiny traffic trap box - no ham I use a couple of DNSWLs to reject traffic from potential hammy IPs RANKRULE NAME COUNT %OFMAIL %OFSPAM %OFHAM 1RCVD_BARRACUDA 19721 83.30

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread Dave Koontz
Joseph Brennan wrote ... (9/23/2008 2:37 PM): > No, they don't, really. They 'may' do that (see below). Try it. > > Effective immediately: AOL > 220- may no longer accept connections from IP addresses which > 220 have no reverse-DNS (PTR record) assigned. According to AOL's Poli

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread Dave Koontz
Just an update. I contacted Barracuda and they have resolved their rDNS issue. They also provided a link so that those that did not receive their original confirmation emails can have it resent. Original Message Subject: RE: BarracudaCentral Contact Date: Tue, 23 Sep 2008 15:13:

Not receiving posts

2008-09-24 Thread Chris
I've noticed since Sunday I've not seen any new posts to the list. Looking at the archives I see that there are in fact quite a few that for some reason haven't made it to me. Wondering if Embarq is blocking things again. Apologies if this is received at the list twice. -- Chris KeyID 0xE372A7

Not receiving posts

2008-09-24 Thread Chris
I've noticed since Sunday I've not seen any new posts to the list. Looking at the archives I see that there are in fact quite a few that for some reason haven't made it to me. Wondering if Embarq is blocking things again. -- Chris KeyID 0xE372A7DA98E6705C pgpzc7aERyCt4.pgp Description: PGP si

Re: Trying out a new concept

2008-09-24 Thread Ken A
Marc Perkel wrote: Blaine Fleming wrote: John Hardin wrote: Why is it so flippin' difficult to get a feed of newly-registered domain names? Because the TLDs hate giving people access to the data and certainly won't provide a feed without a bunch of cash involved. Even worse, all the ccTL

spam messages subject not tagged

2008-09-24 Thread Didier Rebeix
Hi there, I have 'rewrite_header Subject ===SPAM===' in my local.cf but some spam messages are not tagged and some others are ! Here are X-Spam-Status and Subject headers for these untagged messages : X-Spam-Status: Yes, hits=5.7 required=5.0 tests=AWL=-4.347,BAYES_50=0.001, DO

Re: spam messages subject not tagged

2008-09-24 Thread Matus UHLAR - fantomas
On 24.09.08 15:53, Didier Rebeix wrote: > I have 'rewrite_header Subject ===SPAM===' in my > local.cf but some spam messages are not tagged and some > others are ! > > Here are X-Spam-Status and Subject headers for these > untagged messages : > > X-Spam-Status: Yes, hits=5.7 required=5.0

Re: spamassassin taks ten minutes for a message

2008-09-24 Thread Michelle Konzack
Hi Bob, Am 2008-09-20 18:22:25, schrieb Bob Proulx: > I don't really know and hopefully others will have better > suggestions. But the first thing I would try is to run spamassassin > in local mode. > >Options: > -L, --local Local tests only (no online tests

Re: spamassassin taks ten minutes for a message

2008-09-24 Thread Michelle Konzack
Am 2008-09-21 08:56:15, schrieb Matt Kettler: > It looks like spamassassin is attempting to perform a bayes expiry, and > you keep killing it before it can finish. It does need to do that once > in a while, and it is slow. I was not killing it, I was only watching the logfiles using tail in

Re: spamassassin taks ten minutes for a message

2008-09-24 Thread John Hardin
On Tue, 23 Sep 2008, Michelle Konzack wrote: Am 2008-09-21 08:56:15, schrieb Matt Kettler: It looks like spamassassin is attempting to perform a bayes expiry, and you keep killing it before it can finish. It does need to do that once in a while, and it is slow. I was not killing it, I was o

MATCH_WORDS false positives

2008-09-24 Thread Alan Lehman
I've seen a few false positives that hit MATCH_WORDS_5. Can someone point me to this rule so I can try to determine what is causing the hit? George Butler Associates, Inc. Creating Remarkable Solutions for a Higher Quality of Life Alan Lehman, P.E. Electrical/Critical Facilities Group One Renner

Re: MATCH_WORDS false positives

2008-09-24 Thread Theo Van Dinter
On Wed, Sep 24, 2008 at 01:52:27PM -0500, Alan Lehman wrote: > I've seen a few false positives that hit MATCH_WORDS_5. Can someone > point me to this rule so I can try to determine what is causing the hit? As far as I can see, there is no such rule in the standard or updates rulesets. Perhaps it'

RE: MATCH_WORDS false positives

2008-09-24 Thread Bowie Bailey
Alan Lehman wrote: > I've seen a few false positives that hit MATCH_WORDS_5. Can someone > point me to this rule so I can try to determine what is causing the > hit? I don't have that rule on my system, so it must not be a default rule or from one of the several SARE rule sets that I use. Try gr

RE: MATCH_WORDS false positives

2008-09-24 Thread Alan Lehman
> > On Wed, Sep 24, 2008 at 01:52:27PM -0500, Alan Lehman wrote: > > I've seen a few false positives that hit MATCH_WORDS_5. Can someone > > point me to this rule so I can try to determine what is causing the > hit? > > As far as I can see, there is no such rule in the standard or updates > rules

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread up
On Tue, 23 Sep 2008, McDonald, Dan wrote: On Tue, 2008-09-23 at 17:21 -0400, [EMAIL PROTECTED] wrote: Getting back to the subject...can anyone enlighten us to the efficacy of this DNSBL? For example, how does it compare to zen.spamhaus.org, It hits significantly more spam than zen.spamhaus.o

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread Aaron Wolfe
On Wed, Sep 24, 2008 at 5:41 PM, <[EMAIL PROTECTED]> wrote: > On Tue, 23 Sep 2008, McDonald, Dan wrote: > >> On Tue, 2008-09-23 at 17:21 -0400, [EMAIL PROTECTED] wrote: >>> >>> Getting back to the subject...can anyone enlighten us to the efficacy of >>> this DNSBL? For example, how does it compar

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread up
On Wed, 24 Sep 2008, [EMAIL PROTECTED] wrote: I was actually hoping to use it like I use zen.spamhaus.org and dul.sorbs.net and just reject emails listed on those. It is very rare that I get a false positive from either, but their efficacy isn't what it used to be, either. So, I just configur

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread mouss
[EMAIL PROTECTED] wrote: On Wed, 24 Sep 2008, [EMAIL PROTECTED] wrote: I was actually hoping to use it like I use zen.spamhaus.org and dul.sorbs.net and just reject emails listed on those. It is very rare that I get a false positive from either, but their efficacy isn't what it used to be, e

Re: Trying out a new concept

2008-09-24 Thread Matthias Leisi
Marc Perkel schrieb: > And I don't yet know if it will work. I'm still building the list. I > just wanted to throw the concept out there and see if it sparks > innovation. It might turn out to be a dead end. I don't think if this is really innovative (my own recollection goes back to an experim

Re: Trying out a new concept

2008-09-24 Thread Matthias Leisi
Karl Pearson schrieb: > So, what about doing a whois query and 'grep' for the setup date? You Good luck with parsing the myriad of output formats from the different whois services. And good luck going after those that do not publish a setup date (like eg the .de ccTLD). -- Matthias

Re: spam messages subject not tagged

2008-09-24 Thread Matt Kettler
Didier Rebeix wrote: > Hi there, > > I have 'rewrite_header Subject ===SPAM===' in my > local.cf but some spam messages are not tagged and some > others are ! > > Here are X-Spam-Status and Subject headers for these > untagged messages : > > X-Spam-Status: Yes, hits=5.7 required=5.0 tests=A

dsbl.org down for good

2008-09-24 Thread Jason Haar
I just saw this mentioned on the Qmail list, and as I can still see dsbl.org rules throughout SA, I thought others probably want to know "DSBL is GONE and highly unlikely to return. Please remove it from your mail server configuration" http://www.dsbl.org/ -- Cheers Jason Haar Information S

Re: dsbl.org down for good

2008-09-24 Thread Daryl C. W. O'Shea
Thanks Jason! I've opened bug 5988. Regards, Daryl

error in /var/log/maillog

2008-09-24 Thread Alangchang Zuuzuu
Hi,users@spamassassin.apache.org I found error in /var/log/maillog like this : Sep 24 14:43:17 vm1gw1 spamd[22124]: spamd: connection from localhost.localdomain [127.0.0.1] at port 42746 Sep 24 14:43:17 vm1gw1 spamd[22124]: spamd: setuid to nobody succeeded Sep 24 14:43:17 vm1gw1

RE: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread Rasmus Haslund
>anyway, >- zen is widely used. so even if it has an FP, the originator will have problems sending to >a lot of places, and has enough incentives to get delisted. In other words, the FPs caused by zen are "passed to the originator" and are no more "our FPs"! (I hope you see what I mean). > - we do

Re: spamassassin taks ten minutes for a message

2008-09-24 Thread Matus UHLAR - fantomas
> Am 2008-09-20 18:22:25, schrieb Bob Proulx: > > I don't really know and hopefully others will have better > > suggestions. But the first thing I would try is to run spamassassin > > in local mode. > > > >Options: > > -L, --local Local tests only (no online