TopPost: I'm having the same problem with the same program combo.... was about to as the list as well... just pops up once in a while....
At 01:07 PM 8.30.2003 -0400, Forrest Aldrich wrote: >OT question: I've recently been seeing these types of entries in my mail >log (sendmail 8.12.9+SA-2.55+SA-Milter) which I can't explain. It would >seem that spamd is getting something confused when analyzing inbound >messages from the spamassassin-talk list -- this isn't happening in any >other area of my server - does someone know why this is happening and how >to correct it. > >Thanks.... > > > ># grep h7UH09Dd012236 /var/log/mail/maillog > >Aug 30 13:00:16 forrie sm-mta[12236]: h7UH09Dd012236: >from=<[EMAIL PROTECTED]>, size=6991, class=-60, >nrcpts=1, msgid=<[EMAIL PROTECTED]>, >proto=ESMTP, daemon=MTA, relay=lists.sourceforge.net [66.35.250.206] > >Aug 30 13:00:47 forrie sm-mta[12236]: h7UH09Dd012236: Milter add: header: >X-Spam-Status: No, hits=-3.4 >required=5.0\n\ttests=EMAIL_ATTRIBUTION,IN_REP_TO,KNOWN_MAILING_LIST,\n\t >QUOTED_EMAIL_TEXT,REFERENCES,REPLY_WITH_QUOTES\n\tautolearn=ham version=2.55 > >Aug 30 13:00:47 forrie sm-mta[12236]: h7UH09Dd012236[1]: Milter delete: >header X-Spam-Report: -2.5/5.0\n\tThe original message has been attached >along with this report, so\n\tyou can recognize or block similar mail in >future.\n\tSee http://spamassassin.org/tag/ for more details.\n\tContent >preview: Hi, On 29 Aug 2003 19:15:15 +0100 Yorkshire >Dave\n\t<[EMAIL PROTECTED]> wrote: > On Sat, 2003-08-30 at >04:57,\n\tDragoncrest wrote: > > >Quite. They got pummelled to death by a >DDoS.\n\tSee: > > > > Yeah, stupid pathetic cowardly spammers (I can think >of\n\tsome much > > more colorful choice words for this, but I'll save >those\n\tfor later) are now > > fighting back by DDoS'ing all the >blacklists off\n\tthe planet just so they > > can continue to propagate >their crap. You'd\n\tfigure by now that they'd get > > the message that >neither they nor\n\ttheir garbage is wanted. But obviously not. > > > On a >good note\n\tthough, this simply means that the spammers are > > getting >desperate\n\tand ... > >Aug 30 13:00:47 forrie sm-mta[12236]: h7UH09Dd012236[2]: we're winning the >fight, slowly but surely. :D > > Does it really\n\tmean we're winning? or >is it just an escalation from > blocking/evading\n\tto DDoS'ing? How long >before some hot-headed > antispammer decides to\n\tfight fire with fire, >abuse with abuse, making > all of us look as bad\n\tas them, that's what >worries me. [...] \n\tContent analysis details: (-2.50 points, 5 >required)\n\tIN_REP_TO (-0.5 points) Has a In-Reply-To >header\n\tREFERENCES (-0.5 points) Has a valid-looking References >header\n\tEMAIL_ATTRIBUTION (-0.5 points) BODY: Contains what looks like >an email attribution\n\tQUOTED_EMAIL_TEXT (-0.5 points) BODY: Contains >what looks like a quoted email text\n\tREPLY_WITH_QUOTES (-0.5 points) >Reply with quoted text > >Aug 30 13:00:47 forrie RAVMilter[308]: scanning file ></var/spool/rav/sendmail/->(RAVh7UH09Dd012236)> > >Aug 30 13:00:48 forrie sm-mta[12236]: h7UH09Dd012236: Milter add: header: >X-RAVMilter-Version: 8.3.0(snapshot 20010925) (forrie.ne.client2.attbi.com) > >Aug 30 13:00:48 forrie RAVMilter[308]: File >"/var/spool/rav/sendmail/->(RAVh7UH09Dd012236)" unlinked > >Aug 30 13:00:53 forrie sendmail[12341]: h7UH09Dd012236: to="| >/usr/local/bin/procmail", ctladdr=<[EMAIL PROTECTED]> (6332/20), >delay=00:00:38, xdelay=00:00:00, mailer=prog, pri=232254, dsn=2.0.0, stat=Sent > > > >------------------------------------------------------- >This sf.net email is sponsored by:ThinkGeek >Welcome to geek heaven. >http://thinkgeek.com/sf >_______________________________________________ >Spamassassin-talk mailing list >[EMAIL PROTECTED] >https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > Best regards, Jack L. Stone, Administrator Sage American http://www.sage-american.com [EMAIL PROTECTED] ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
