Hi all I have noticed that not all URI registrated for URI check is sent for test, below is one sample of the problem, (I have several of them) as you can in the log sevral uri:s is added to the "check que" but only one of them is rely sent for test (sparkasse.it) and one of them i blacklisted( 76.79.230.119 is listed at .uribl.com), sometimes nothing from the "check que" is sent for test
Jan-26-12 02:15:41 [Worker_1] Connected: 80.12.204.198:20040 > xxx.xxx.xxx.200:25 > xxx.xxx.xxx.198:125 Jan-26-12 02:15:42 [Worker_1] LDAP - found i...@domain.it in LDAPlist Jan-26-12 02:15:42 [Worker_1] 80.12.204.198 <serv...@isi-net.it> accepting triplet: (80.12.204.0,serv...@isi-net.it,i...@domain.it) on host assp.smtp01 waited: 3h 59m 36s Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it Message-Score: added 15 for Bad IP History, total score for this message is now 15 Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found URI isi-net.it Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: registered URI isi-net.it for check Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: registered URI isi-net.it for check Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found raw URI/URL @mwinf8902.myorangeoffice.com Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found URI mwinf8902.myorangeoffice.com Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: registered TLD URI myorangeoffice.com for check Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found raw URI/URL myorangeoffice.com Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found URI myorangeoffice.com Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: registered TLD URI myorangeoffice.com for check Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found raw URI/URL @sparkasse.it" Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found URI sparkasse.it Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: registered TLD URI sparkasse.it for check Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found raw URI/URL @isi-net.it> Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found URI isi-net.it Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: registered TLD URI isi-net.it for check Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found raw URI/URL http://76.79.230.119 Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: found URI 76.79.230.119 Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: registered IP-URI 76.79.230.119 for check Jan-26-12 02:15:47 [Worker_1] Sending DNS(TXT)-query to xxx.xxx.xxx.200 on multi.surbl.org for URIBL checks on sparkasse.it Jan-26-12 02:15:47 [Worker_1] Sending DNS(TXT)-query to xxx.xxx.xxx.200 on black.uribl.com for URIBL checks on sparkasse.it Jan-26-12 02:15:47 [Worker_1] Commencing URIBL checks on 'sparkasse.it' Jan-26-12 02:15:47 [Worker_1] Got 2 answers, 2 replies and 0 hits after 0 seconds for URIBL checks on 'sparkasse.it' Jan-26-12 02:15:47 [Worker_1] Got OK replies from (black.uribl.com) - NOTOK replies from () for URIBL on 'sparkasse.it' Jan-26-12 02:15:47 [Worker_1] Completed URIBL checks on 'sparkasse.it' Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it URIBL: lookup returned <1> for sparkasse.it - res: '' Jan-26-12 02:15:47 [Worker_1] [monitoring] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it HMM-Check has given less than 5 results - using monitoring mode only Jan-26-12 02:15:47 [Worker_1] [HMM][monitoring] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: HMM-Check has taken 0 seconds and has given 0 results Jan-26-12 02:15:47 [Worker_1] [HMM][monitoring] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: Bayesian-Check has taken 0 seconds Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it Bayesian Check [scoring] - Prob: 1.00000 / Confidence: 0.00000 => doubtful.spam Jan-26-12 02:15:47 [Worker_1] [HMM][monitoring] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: got different spam result for Bayesian and HMM : 1.00000 - 0.00000 Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it Message-Score: added 25 for Bayesian Probability: 1.00000, total score for this message is now 40 Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it PB-IP-Score for '80.12.204.198' is 100, added 25 for Bayesian Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it deleting spamming safelisted tuplet: (80.12.204.0,isi-net.it) age: 5s Jan-26-12 02:15:47 [Worker_1] [MessageLimit][lowlimit] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it [spam found] and possibly passing because messagescore(40) low [Sicurezza ISI NET] -> /usr/share/assp2/discarded/14000--1295069.eml Jan-26-12 02:15:47 [Worker_1] [Penalty][lowlimit] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it [spam found] and possibly passing because messagescore(40) low [Sicurezza ISI NET] Jan-26-12 02:15:47 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it spam found and passing () [Sicurezza ISI NET] Jan-26-12 02:15:48 [Worker_1] 80.12.204.198 <serv...@isi-net.it> to: i...@domain.it info: start damping on closing connection (8) ASSP version 2.1.2(12010) _________________________________________________________________________________________________________________________________________________ NOTICE: This email and any attachments are for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please notify the sender by reply email and destroy the original message. ------------------------------------------------------------------------------ Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
