Re: Big trouble

2007-03-29 Thread Theo Van Dinter
On Thu, Mar 29, 2007 at 12:37:56PM +0100, Justin Mason wrote: > > Could it be that the combined-HIB.dnsiplists.completewhois.com > > chokes under the load of a GA/perceptron run and stops responding? > > I've seen it unresponsive yesterday for about half an hour. > > odd. I guess that's a possibil

Re: Big trouble

2007-03-29 Thread Justin Mason
Mark Martinec writes: > Rocco, > > > > > 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on > > > I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? > > > > I don't understand.. maybe my remark is wrong, > > but I [do] get this score for the rules above > > I said '3.2.0-rc1

Re: Big trouble

2007-03-29 Thread Mark Martinec
Rocco, > > > 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on > > I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? > > I don't understand.. maybe my remark is wrong, > but I [do] get this score for the rules above I said '3.2.0-rc1', didn't I? Btw, I got 1800 messages hi

Re: Big trouble

2007-03-29 Thread Anthony Peacock
Hi, Rocco Scappatura wrote: There is another discussion on this list about rules that catch these sorts of messages. Check that out for ideas. For what it is worth these are the rules I get: Content analysis details: (10.5 points, 5.0 required) pts rule name description ---

RE: Big trouble

2007-03-29 Thread Rocco Scappatura
> > 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on > bogons IP block > > [102.176.29.76 listed in > > combined-HIB.dnsiplists.completewhois.com] > > I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? > (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOIS_HIJACKED, >

RE: Big trouble

2007-03-29 Thread Rocco Scappatura
> There is another discussion on this list about rules that > catch these sorts of messages. Check that out for ideas. > > For what it is worth these are the rules I get: > > Content analysis details: (10.5 points, 5.0 required) > > pts rule name description > ---

Re: Big trouble

2007-03-28 Thread Justin Mason
Mark Martinec writes: > > > > 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: > > > > sender on bogons IP block [102.176.29.76 listed in > > > > combined-HIB.dnsiplists.completewhois.com] > > > I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? > > > (unlike RCVD_IN_WHOIS_INVALID a

Re: Big trouble

2007-03-28 Thread Mark Martinec
> > > 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: > > > sender on bogons IP block [102.176.29.76 listed in > > > combined-HIB.dnsiplists.completewhois.com] > > I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? > > (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOIS_HIJACKED... > >

Re: Big trouble

2007-03-28 Thread Justin Mason
Mark Martinec writes: > > 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on bogons IP block > > [102.176.29.76 listed in combined-HIB.dnsiplists.completewhois.com] > > I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? > (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOI

Re: Big trouble

2007-03-28 Thread Mark Martinec
> 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on bogons IP block > [102.176.29.76 listed in combined-HIB.dnsiplists.completewhois.com] I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOIS_HIJACKED, which are nonzero) r

RE: Big trouble

2007-03-28 Thread Rocco Scappatura
> Before anyone can you give you a hint on how to block the > messages, we would need to see what the messages are. > > Same form as before, save the message (with full headers) and > place it somewhere where we can download it. http://www.rocsca.it/INBOX rocsca

Re: Big trouble

2007-03-28 Thread Anthony Peacock
Hi, Rocco Scappatura wrote: Before anyone can you give you a hint on how to block the messages, we would need to see what the messages are. Same form as before, save the message (with full headers) and place it somewhere where we can download it. http://www.rocsca.it/INBOX There is anothe

RE: Big trouble

2007-03-28 Thread -- [ UxBoD ] --
If you wish to reject at MTA level then please read http://www.postfix.org/uce.html under the section "Client hostname/address restrictions" as you are able to specify a list of RBLs. Regards, UxBoD On Wed, 28 Mar 2007 12:20:16 +0200, "Rocco Scappatura" <[EMAIL PROTECTED]> wrote: >> What MTA

RE: Big trouble

2007-03-28 Thread Rocco Scappatura
> What MTA are you using ? Postfix+MySQL+Amavisd-new rocsca

Re: Big trouble

2007-03-28 Thread Anthony Peacock
Hi Rocco, Rocco Scappatura wrote: Since some day, It's increased the number of spams which SA doesn't block. Every time I'm going to analyse the message: 1) Save the message in mbox format 'message.mbox' 2) su - amavis -c "spamassassin -t < message.mbox" And I get that the score is greater th

Re: Big trouble

2007-03-28 Thread -- [ UxBoD ] --
What MTA are you using ? On Wed, 28 Mar 2007 12:06:55 +0200, "Rocco Scappatura" <[EMAIL PROTECTED]> wrote: > Since some day, It's increased the number of spams which SA doesn't > block. > > Every time I'm going to analyse the message: > > 1) Save the message in mbox format 'message.mbox' > 2) s

Big trouble

2007-03-28 Thread Rocco Scappatura
Since some day, It's increased the number of spams which SA doesn't block. Every time I'm going to analyse the message: 1) Save the message in mbox format 'message.mbox' 2) su - amavis -c "spamassassin -t < message.mbox" And I get that the score is greater the 5.0 and often I get: 1.6 RCVD_IN_