Re: whitelist_from questions
Le 26/07/2009 04:00, McDonald, Dan a écrit : >From: Robert [mailto:list...@abbacomm.net] >> There are no doubt lots of ways, but how about: >> >> egrep 'whitelist_from[^_]' local.cf | awk '{FS="@"; print $2" >> TXT";}' | xargs dig | grep "v=spf1" >what is this supposed to do? select all of your whitelist_from entries, parse out the domain part, dig the TXT record for each domain, then display only the ones that have a v=spf1 notation. That would give you a list of all of the domains in your whitelist_from that could be migrated to whitelist_from_spf ... provided, as Matus pointed out, all your whitelist_from entries are nicely formatted one address per line, and provided you don't have any domain wildcards. If those two conditions aren't met then you'll have to do some extra mangling to extract the domains properly. It also only looks for TXT RRs, so if any of the target domains are using only SPF RRs it won't find them. John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages- www.tradoc.fr
Re: Rules
On 27/07/09 6:35 AM, "twofers" wrote: > Performing Cunnilringus -- An Art of Pleasure.www.onlyviagra net > > I thought a "sex" rule would have fired as well as something for > pleasure.www.onlyviagra net > > This is pretty basic and straight forward isn't it? This is a tough row to ho, and I've not gone down this road in a while but cunillingus is misspelt, potentially leading to the lack of reaction. By your rules. -- Neil Schwartzman Director, Accreditation Security & Standards Certified | Safelist Return Path Inc. 0142002038 The opinions contained herein are my personal stance and may not reflect the viewpoint of Return Path Inc.
Re: Avoid processing of email with specific headers
Hi Mouss, thanks for your answer. In my installation, I've got a firewall with antispam features. The target I want to achieve is to bypass SA check when a message has been already tagged as spam by the firewall. I'll try posting the question on the postfix-users list. Bye, -Pietro. 2009/7/25 mouss > Pietro a écrit : > > In my installation, SA is called by Postfix. Any idea? Thanks in advance. > > > > This is really a postfix question. Follow up on the postfix-users list > if needed. > > you can skip filtering using header_checks. for example > /^X-Spam-Status: Yes/ FILTER smtp:[127.0.0.1]:10025 > > assuming you have an smtpd listening on port 10025 (with filtering > disabled). > > but make sure not to give spammers a free ride: don't skip filtering > just because you see "X-Spam-Status: No...". > > > While I am in, using amavisd-new is preferred over running SA directly > from postfix. > >
DNSWL-Check does not work....
Hi, I found that my SA 3.2.5 do NOT perform the checks agains DNSWL. The debug contains: [8845] dbg: plugin: loading Mail::SpamAssassin::Plugin::DNSEval from @INC [8845] dbg: dns: is DNS available? 1 [8845] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted All other RBL-checks are done fine, but no DNSWL. Any ideas? Kind Regards Christian
Re: DNSWL-Check does not work....
On Mon, 27 Jul 2009 14:03:13 +0200 Christian Kuehn wrote: > [8845] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted > > > All other RBL-checks are done fine, but no DNSWL. Are you sure your trusted network is correct?
Re: DNSWL-Check does not work....
RW schrieb: > On Mon, 27 Jul 2009 14:03:13 +0200 > Christian Kuehn wrote: > >> [8845] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted >> >> >> All other RBL-checks are done fine, but no DNSWL. > > Are you sure your trusted network is correct? Yes, correct settings! -- Christian Kühn (Technical Consultant) == MCS MOORBEK COMPUTER SYSTEME GmbH Essener Bogen 17 - 22419 Hamburg - Germany Tel +49 (0)40 53773 0 - Fax: +49 (0)40 53773 200 E-Mail: christian.ku...@mcs.de Web: http://www.mcs.de Eingetragen im Handelsregister Hamburg B62933 Geschäftsführer: Kai Brandes & Eckard Kabel GPG 8B52 41A1 4B8F 4DE7 9064 2073 6168 137A 3DDA 0F36 ==
Re: Catch-22 unsubscribing from this list.
> > On Sat, 25 Jul 2009 18:07:12 -0400 > > "Michael W. Cocke" wrote: > > > >> There doesn't seem to be a web interface to subscribe/unscribe from > >> this list. The email address > >> "users-unsubscr...@spamassassin.apache.org" complains that my IP > >> address is dynamic (which is why I use dyndns.org, thank you very > >> much.) > On 07/26/09 20:01, quoth RW: > > Presumably it's complaining that you are sending "direct to mx" from a > > dynamic IP address. If you run a mail server on an dynamic address, you > > should send your outgoing mail through a smarthost. On 26.07.09 22:43, Steven W. Orr wrote: > I'd be curious to hear more on this. I have a server running at home. My > ISP gives me a so-called "static address" that I pay extra for. It's > really just an IP address from their pool of dynamic addresses so it > registers as really coming from a dynamic address. Somehow I got lucky and > got a reverse dns record so if you look my ip up you'll see me and not my > ISP. The rest is done through zoneedit.com which does a fabulous job. by a "static address" I assume that the address will be always assigned to you, and only to you. If your ISP taked money for something else, I'd like to see exactly what that is, however it seems that yous ISP forgot to exclude static address list off the dynamic block. We have a few pools of dynamic addresses, marked as dynamic in DNS, WHOIS records, and in PBL/SORBS/MAPS dynamic lists. If customer asks/pays for static address, he'll get address from other ranges, statically assigned to him, and we even can change DNS to his wish if he fullfille basic requirement of the requested name pointing to the IP. DNS names there are usually generic, but static as indicated in DNS and WHOIS (and, of course, not listed in PBL/SORBS/MAPS dynamic address lists). -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. The early bird may get the worm, but the second mouse gets the cheese.
Re: your mail
> On Sat, 25 Jul 2009, Michael W. Cocke wrote: > > There doesn't seem to be a web interface to subscribe/unscribe from > > this list. The email address > > "users-unsubscr...@spamassassin.apache.org" complains that my IP > > address is dynamic (which is why I use dyndns.org, thank you very > > much.) And on that subject, am I the only person who thinks that > > blocking by IP address block is inefficient, brute force, and prone to > > both false positives and false negatives? On 26.07.09 22:09, r...@ausics.net wrote: > If you are sending out from your dynamic home connection, you are going to > have bigger problems, most of the big ISP's and many many many others > block at MTA level for your type of connections, either get a static IP > *and* a real PTR entry, or use your ISP as smarthost. > > Nothing wrong with the way this list is setup apart from it uses qmail, > but we wont go into that :) by "ISP" we of course mean the company you receive mail through, not the company you are connecting through, unless you are using address hosted in the same company. For example, if you use gmail.com address, you should use gmail's SMTP servers. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. I drive way too fast to worry about cholesterol.
Re: DNSWL-Check does not work....
On 27.07.09 14:03, Christian Kuehn wrote: > I found that my SA 3.2.5 do NOT perform the checks agains DNSWL. > The debug contains: > > [8845] dbg: plugin: loading Mail::SpamAssassin::Plugin::DNSEval from @INC > [8845] dbg: dns: is DNS available? 1 > [8845] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted > > All other RBL-checks are done fine, but no DNSWL. did you try manually query dnswl servers? It's possible that they blocked lookups from you for some reason... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. I intend to live forever - so far so good.
Re: DNSWL-Check does not work....
Matus UHLAR - fantomas schrieb: > On 27.07.09 14:03, Christian Kuehn wrote: >> I found that my SA 3.2.5 do NOT perform the checks agains DNSWL. >> The debug contains: >> >> [8845] dbg: plugin: loading Mail::SpamAssassin::Plugin::DNSEval from @INC >> [8845] dbg: dns: is DNS available? 1 >> [8845] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted >> >> All other RBL-checks are done fine, but no DNSWL. > > did you try manually query dnswl servers? It's possible that they blocked > lookups from you for some reason... Nope, the requests via dig work fine and successful. ;; QUESTION SECTION: ;231.168.211.66.list.dnswl.org. IN A ;; ANSWER SECTION: 231.168.211.66.list.dnswl.org. 30068 IN A 127.0.2.2 -- Christian Kühn (Technical Consultant) == MCS MOORBEK COMPUTER SYSTEME GmbH Essener Bogen 17 - 22419 Hamburg - Germany Tel +49 (0)40 53773 0 - Fax: +49 (0)40 53773 200 E-Mail: christian.ku...@mcs.de Web: http://www.mcs.de Eingetragen im Handelsregister Hamburg B62933 Geschäftsführer: Kai Brandes & Eckard Kabel GPG 8B52 41A1 4B8F 4DE7 9064 2073 6168 137A 3DDA 0F36 ==
Re: Rules
On Mon, 27 Jul 2009, twofers wrote: Can someone explain to me why one of the rule sets downloaded using SA-Update could not fire on: ?Subject: cenogenetic ? and the body having only and nothing else but: ?Performing Cunnilringus -- An Art of Pleasure.www.onlyviagra net ? I thought a "sex" rule would have fired as well as something for pleasure.www.onlyviagra net ?This is pretty basic and straight forward isn't it? It's basic modulo an infinite variety of misspellings. The more open you are to misspellings, the more likely you'll have FPs. The URI obfu rules are not yet in the base rule set, you have to add one of the variants to your local ruleset manually - and, if you're using mine from the SA sandbox, you have to get the patched ReplaceTags plugin as my URI obfu rule tickles a bug in Replacetags. http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf?view=log http://svn.apache.org/viewvc/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/ReplaceTags.pm?view=log -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- False is the idea of utility that sacrifices a thousand real advantages for one imaginary or trifling inconvenience; that would take fire from men because it burns, and water because one may drown in it; that has no remedy for evils except destruction. The laws that forbid the carrying of arms are laws of such a nature. They disarm only those who are neither inclined nor determined to commit crime. -- Cesare Beccaria, quoted by Thomas Jefferson --- 9 days until the 274th anniversary of John Peter Zenger's acquittal
Re: Low Scoring Lotto Spam
rich...@buzzhost.co.uk wrote: http://pastebin.com/m2cbc0965 This is scoring way low. Coming in from Hotmail (I would love to blacklist these but some people just insist on using it). 10 in the last hour. Lart'd Hotmail abuse, but the content does not seem to be catching ? I get hits against JM_SOUGHT_FRAUD_3 and a couple DNSBLs I've configured catch the originating IP address. Nothing on the standard SA rulesets though. X-Spam-Status: Yes, score=8.0 required=5.0 tests=BAYES_50,HTML_MESSAGE, JM_SOUGHT_FRAUD_3,RCVD_IN_UCEPROTECT2,RCVD_IN_UCEPROTECT3, RCVD_IN_UCE_COMBINED autolearn=disabled version=3.2.5 X-Spam-Report: * 3.0 RCVD_IN_UCEPROTECT2 RBL: Received via a relay in * dnsbl-2.uceprotect.net * [81.202.69.68 listed in dnsbl-2.uceprotect.net] * 2.0 RCVD_IN_UCEPROTECT3 RBL: Received via a relay in * dnsbl-3.uceprotect.net * [81.202.69.68 listed in dnsbl-3.uceprotect.net] * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% * [score: 0.5001] * 0.0 RCVD_IN_UCE_COMBINED Received via a relay in UCEProtect * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns
Re: Low Scoring Lotto Spam
> http://pastebin.com/m2cbc0965 > > This is scoring way low. Coming in from Hotmail (I would > love to blacklist these but some people just insist on > using it). > > 10 in the last hour. Lart'd Hotmail abuse, but the > content does not seem to be catching ? Content analysis details: (6.2 points, 5.0 required) pts rule name description -- -- 1.0 HTML_MESSAGE BODY: HTML included in message 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% [score: 0.4920] 2.2 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/) 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns
Re: Low Scoring Lotto Spam
On Mon, 2009-07-27 at 14:51 +0100, rich...@buzzhost.co.uk wrote: > http://pastebin.com/m2cbc0965 > > This is scoring way low. Coming in from Hotmail (I would love to > blacklist these but some people just insist on using it). Scores a healthy 13 here. Mostly using custom rules. X-Spam-Report: * 1.8 MILLION_EURO BODY: Talks about millions of Euros * 0.0 RELAY_US Relayed through United States * 0.5 FREEMAIL_FROM From-address is freemail domain * (laszlomezesesp68[at]msn.com) * 2.0 FREEMAIL_REPLYTO Different freemail address found in Reply-To or * Body than From (laszlomezesesp68[at]msn.com, * urbanizacion70[at]aol.com) * 0.0 HTML_MESSAGE BODY: HTML included in message * 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns * 0.5 FREEMAIL_REPLYFREE Sent from non-freemail address, replies go to * freemail address * 3.0 AE_DETAILS_WITH_MONEY Has form and mentions much money * 2.5 AE_DETAILS_WITH_EMAIL Has form and gives handy email to send it back * to Freemail.pm and the JM_SOUGHT rules should be easy enough for you to find. I also used these local rules (some shamelessly copied off this forum): body MILLION_EURO /\b(million|hundred.{0.40}\bthousand)\b.{0,40}\b(euro|pound)s?\b/i describe MILLION_EURO Talks about millions of Euros score MILLION_EURO 2.391 1.777 1.501 1.528 body__TRMB_YOUR_NAME /(^|\W)(your(\s+|\s+\w+\s+)names?|last.name:|full.names?|surname|Prenom|fullname|names? in full|with your.? Serial No|Confirmation Email Serial|Names?(\s+:|:)|Receiver name)(_|\W)/i body__TRMB_YOUR_ADDRESS /(^|\W)((your|home|residential)(\s+|\s+\w+\s+)add(re|ere)ss|Adresse|Location|Country:|(contact|full) address|Marital Status:|Occupation:|your current telephone|(tel|phone):(|\s+)([^0-9\+])|Tel:|Phone:___|Telephone (number|\#:)(|\s+)([^0-9\+]))(\W|_)/i body__TRMB_YOUR_AGE /(^|\W)(Your age|age:|age.)(\W|_)/i body__TRMB_YOUR_OCCUPATION /(^|\W)((Your |)occupation|Profession)(\W|_)/i body__TRMB_YOUR_BLOBBY_DETAILS /(^|\W)(FULL NAMES?.*ADDRESS.*PHONE NUM|PHONE AND FAX NUMBER|your telephone.fax|your full Contact Details|send us your fullnames? and address|your mobile numbers?|Please reply if you are willing to help me save|send the following informations?|Provide your email address.? Phone Number)/i body__TRMB_OTHER_DETAILS/\W(with your Full Contact informations?|contact the application desk)\W/i meta__TRMB_YOUR_DETAILS ((__TRMB_YOUR_NAME || __TRMB_OTHER_DETAILS) && (__TRMB_YOUR_ADDRESS || __TRMB_YOUR_AGE || __TRMB_YOUR_OCCUPATION) || __TRMB_YOUR_BLOBBY_DETAILS ) metaAE_DETAILS_WITH_MONEY __TRMB_YOUR_DETAILS && (MILLION_EURO || MILLION_USD || US_DOLLARS_3 || NA_DOLLARS || FRT_DOLLAR || AE_GBP || __FRAUD_DBI) describe AE_DETAILS_WITH_MONEY Has form and mentions much money metaAE_DETAILS_WITH_EMAIL __TRMB_YOUR_DETAILS && __HAS_ANY_EMAIL describe AE_DETAILS_WITH_EMAIL Has form and gives handy email to send it back to score AE_DETAILS_WITH_MONEY 3.0 score AE_DETAILS_WITH_EMAIL 2.5 -- Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX www.austinenergy.com signature.asc Description: This is a digitally signed message part
Re: Low Scoring Lotto Spam
Jari Fredriksson wrote: Content analysis details: (6.2 points, 5.0 required) pts rule name description -- -- 1.0 HTML_MESSAGE BODY: HTML included in message 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% [score: 0.4920] 2.2 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/) 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns I get roughly the same... Content analysis details: (0.4 points, 7.0 required) pts rule name description -- -- 0.0 HTML_MESSAGE BODY: HTML included in message -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1% [score: 0.] 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns -- Dan Schaefer Web Developer/Systems Analyst Performance Administration Corp.
Re: Low Scoring Lotto Spam
> On Mon, 2009-07-27 at 14:51 +0100, rich...@buzzhost.co.uk wrote: > I also used these local rules (some shamelessly copied off this > forum): > > body MILLION_EURO > /\b(million|hundred.{0.40}\bthousand)\b.{0,40}\b(euro|pound)s?\b/i > describe MILLION_EURO Talks about millions of Euros > score MILLION_EURO 2.391 1.777 1.501 1.528 > > body__TRMB_YOUR_NAME > /(^|\W)(your(\s+|\s+\w+\s+)names?|last.name:|full.names?|surname|Prenom|fullname|names? > in full|with your.? Serial No|Confirmation Email > Serial|Names?(\s+:|:)|Receiver name)(_|\W)/i > body__TRMB_YOUR_ADDRESS > /(^|\W)((your|home|residential)(\s+|\s+\w+\s+)add(re|ere)ss|Adresse|Location|Country:|(contact|full) > address|Marital Status:|Occupation:|your current > telephone|(tel|phone):(|\s+)([^0-9\+])|Tel:|Phone:___|Telephone > (number|\#:)(|\s+)([^0-9\+]))(\W|_)/i > body__TRMB_YOUR_AGE /(^|\W)(Your > age|age:|age.)(\W|_)/i > body__TRMB_YOUR_OCCUPATION /(^|\W)((Your > |)occupation|Profession)(\W|_)/i > body__TRMB_YOUR_BLOBBY_DETAILS /(^|\W)(FULL > NAMES?.*ADDRESS.*PHONE NUM|PHONE AND FAX NUMBER|your telephone.fax|your > full Contact Details|send us your fullnames? and address|your mobile > numbers?|Please reply if you are willing to help me save|send the > following informations?|Provide your email address.? Phone Number)/i > body__TRMB_OTHER_DETAILS/\W(with your Full Contact > informations?|contact the application desk)\W/i > > meta__TRMB_YOUR_DETAILS ((__TRMB_YOUR_NAME || > __TRMB_OTHER_DETAILS) && (__TRMB_YOUR_ADDRESS || __TRMB_YOUR_AGE || > __TRMB_YOUR_OCCUPATION) || __TRMB_YOUR_BLOBBY_DETAILS ) > > meta AE_DETAILS_WITH_MONEY __TRMB_YOUR_DETAILS && (MILLION_EURO || > MILLION_USD || US_DOLLARS_3 || NA_DOLLARS || FRT_DOLLAR || AE_GBP || > __FRAUD_DBI) > describe AE_DETAILS_WITH_MONEYHas form and mentions much money > meta AE_DETAILS_WITH_EMAIL __TRMB_YOUR_DETAILS && __HAS_ANY_EMAIL > describe AE_DETAILS_WITH_EMAIL Has form and gives handy email to send it > back to > > score AE_DETAILS_WITH_MONEY 3.0 > score AE_DETAILS_WITH_EMAIL 2.5 Thanks there! Much better now, but I wonder what happened to my AWL. It was not there in my last post.. Content analysis details: (9.7 points, 5.0 required) pts rule name description -- -- 1.5 MILLION_EURO BODY: Talks about millions of Euros 1.0 HTML_MESSAGE BODY: HTML included in message 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% [score: 0.4920] 2.2 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/) 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns 3.0 AE_DETAILS_WITH_MONEY Has form and mentions much money 2.5 AE_DETAILS_WITH_EMAIL Has form and gives handy email to send it back to -3.5 AWLAWL: From: address is in the auto white-list
Re: Low Scoring Lotto Spam
On Mon, 2009-07-27 at 17:31 +0300, Jari Fredriksson wrote: > Thanks there! Much better now, but I wonder what happened to my AWL. It > was not there in my last post.. Yes, which is exactly what AWL is. You just piped the message through SA a second time. Previously, it was the first time you saw a mail from that address and net-block pair. Now you did a second time, so there's some history for AWL... Notice how the previous score 6.2 == 9.7 - 3.5 matches quite nicely? Oh, and yes, 2 * 3.5 is exactly the difference in score you just added... ;) > Content analysis details: (9.7 points, 5.0 required) > -3.5 AWLAWL: From: address is in the auto white-list -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: DNSWL-Check does not work....
On Mon, July 27, 2009 14:03, Christian Kuehn wrote: > [8845] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted > All other RBL-checks are done fine, but no DNSWL. > Any ideas? is there trusted ip in the mail ? spamassassin 2>&1 -D -t msg | grep trusted | less if yes is the ip that are trusted listed in dnswl ? maybe the ip is listed local with trusted_networks ? -- xpoint
Re: DNSWL-Check does not work....
On Mon, July 27, 2009 15:14, Matus UHLAR - fantomas wrote: > did you try manually query dnswl servers? It's possible that they blocked > lookups from you for some reason... try the web so -- xpoint
Re: DNSWL-Check does not work....
Benny Pedersen schrieb: > On Mon, July 27, 2009 14:03, Christian Kuehn wrote: > >> [8845] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted >> All other RBL-checks are done fine, but no DNSWL. >> Any ideas? > > is there trusted ip in the mail ? > > spamassassin 2>&1 -D -t msg | grep trusted | less > > if yes is the ip that are trusted listed in dnswl ? > > maybe the ip is listed local with trusted_networks ? > > [30132] dbg: conf: trusted_networks are not configured; it is recommended that you configure trusted_networks manually [30132] dbg: received-header: relay 66.211.168.231 trusted? no internal? no msa? no [30132] dbg: received-header: relay 10.243.56.55 trusted? no internal? no msa? no [30132] dbg: received-header: relay 10.243.57.25 trusted? no internal? no msa? no [30132] dbg: metadata: X-Spam-Relays-Untrusted: [ ip=66.211.168.231 rdns=mx1.phx.paypal.com helo=mx1.phx.paypal.com by=mx.gay-web.de ident= envfrom=webf...@paypal.de intl=0 id=1MVMj4-0005wc-9c auth= msa=0 ] [ ip=10.243.56.55 rdns= helo=dub-entot-001.corp.ebay.com by=oma-entot-002.corp.ebay.com ident= envfrom= intl=0 id= auth= msa=0 ] [ ip=10.243.57.25 rdns= helo=DUB-KAAAS-006 by=dub-entot-001.corp.ebay.com ident= envfrom= intl=0 id= auth= msa=0 ] [30132] dbg: dns: checking RBL sa-other.bondedsender.org., set bsp-untrusted [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: checking RBL plus.bondedsender.org., set ssc-firsttrusted [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: checking RBL sa-accredit.habeas.com., set habeas-firsttrusted [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: checking RBL sa-trusted.bondedsender.org., set bsp-firsttrusted [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: launching DNS TXT query for 231.168.211.66.sa-trusted.bondedsender.org. in background [30132] dbg: async: starting: DNSBL-TXT, dns:TXT:231.168.211.66.sa-trusted.bondedsender.org. (timeout 15.0s, min 3.0s) [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: dns: checking RBL iadb.isipp.com., set iadb-firsttrusted [30132] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: [30132] dbg: async: completed in 0.326 s: DNSBL-TXT, dns:TXT:231.168.211.66.sa-trusted.bondedsender.org. [30132] dbg: async: timing: 0.326 . dns:TXT:231.168.211.66.sa-trusted.bondedsender.org. No trusted network, the IP was detected but no start of dns-check -- Christian Kühn (Technical Consultant) == MCS MOORBEK COMPUTER SYSTEME GmbH Essener Bogen 17 - 22419 Hamburg - Germany Tel +49 (0)40 53773 0 - Fax: +49 (0)40 53773 200 E-Mail: christian.ku...@mcs.de Web: http://www.mcs.de Eingetragen im Handelsregister Hamburg B62933 Geschäftsführer: Kai Brandes & Eckard Kabel GPG 8B52 41A1 4B8F 4DE7 9064 2073 6168 137A 3DDA 0F36 ==
Re: DNSWL-Check does not work....
On Mon, July 27, 2009 15:21, Christian Kuehn wrote: >> did you try manually query dnswl servers? It's possible that they blocked >> lookups from you for some reason... > Nope, the requests via dig work fine and successful. next step is spamassassin 2>&1 -D -t msg | less any trusted lines ? -- xpoint
Re: DNSWL-Check does not work....
Benny Pedersen schrieb: > On Mon, July 27, 2009 15:21, Christian Kuehn wrote: > >>> did you try manually query dnswl servers? It's possible that they blocked >>> lookups from you for some reason... >> Nope, the requests via dig work fine and successful. > > next step is spamassassin 2>&1 -D -t msg | less > > any trusted lines ? > Nope [30132] dbg: received-header: relay 66.211.168.231 trusted? no internal? no msa? no [30132] dbg: received-header: relay 10.243.56.55 trusted? no internal? no msa? no [30132] dbg: received-header: relay 10.243.57.25 trusted? no internal? no msa? no -- Christian Kühn (Technical Consultant) == MCS MOORBEK COMPUTER SYSTEME GmbH Essener Bogen 17 - 22419 Hamburg - Germany Tel +49 (0)40 53773 0 - Fax: +49 (0)40 53773 200 E-Mail: christian.ku...@mcs.de Web: http://www.mcs.de Eingetragen im Handelsregister Hamburg B62933 Geschäftsführer: Kai Brandes & Eckard Kabel GPG 8B52 41A1 4B8F 4DE7 9064 2073 6168 137A 3DDA 0F36 ==
Re: DNSWL-Check does not work....
On Mon, July 27, 2009 17:17, Christian Kuehn wrote: > [30132] dbg: conf: trusted_networks are not configured; it is > recommended that you configure trusted_networks manually this might be the error, unsure if it is, but try add your wan ip's to trusted_networks, and imho also to msa_networks trusted_networks must also have a list of all ips that forward mails to you, this will help on spf forwarded emails to not being detected as spf fail -- xpoint
Re: DNSWL-Check does not work....
Benny Pedersen schrieb: > On Mon, July 27, 2009 17:17, Christian Kuehn wrote: > >> [30132] dbg: conf: trusted_networks are not configured; it is >> recommended that you configure trusted_networks manually > > this might be the error, unsure if it is, but try add your wan ip's to > trusted_networks, and imho also to msa_networks > > trusted_networks must also have a list of all ips that forward mails to you, > this will help on spf forwarded emails to not being > detected as spf fail > Not the problem, now with trusted_networks and internal_networks set correctly: ian:~ # spamassassin 2>&1 -D -t paypal.txt | grep trusted [4177] dbg: received-header: relay 66.211.168.231 trusted? no internal? no msa? no [4177] dbg: received-header: relay 10.243.56.55 trusted? no internal? no msa? no [4177] dbg: received-header: relay 10.243.57.25 trusted? no internal? no msa? no [4177] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted [4177] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, 10.243.57.25 untrusted: 66.211.168.231 originating: But no DNS-check furthermore -- Christian Kühn (Technical Consultant) == MCS MOORBEK COMPUTER SYSTEME GmbH Essener Bogen 17 - 22419 Hamburg - Germany Tel +49 (0)40 53773 0 - Fax: +49 (0)40 53773 200 E-Mail: christian.ku...@mcs.de Web: http://www.mcs.de Eingetragen im Handelsregister Hamburg B62933 Geschäftsführer: Kai Brandes & Eckard Kabel GPG 8B52 41A1 4B8F 4DE7 9064 2073 6168 137A 3DDA 0F36 ==
Re: DNSWL-Check does not work....
Benny Pedersen schrieb: > On Mon, July 27, 2009 17:17, Christian Kuehn wrote: > >> [30132] dbg: conf: trusted_networks are not configured; it is >> recommended that you configure trusted_networks manually > > this might be the error, unsure if it is, but try add your wan ip's to > trusted_networks, and imho also to msa_networks > > trusted_networks must also have a list of all ips that forward mails to you, > this will help on spf forwarded emails to not being > detected as spf fail > Just found that "spamassassin -t file.txt" works fine, but cat file.txt |spamc fails. The spamd dont check the dnswl. -- Christian Kühn (Technical Consultant) == MCS MOORBEK COMPUTER SYSTEME GmbH Essener Bogen 17 - 22419 Hamburg - Germany Tel +49 (0)40 53773 0 - Fax: +49 (0)40 53773 200 E-Mail: christian.ku...@mcs.de Web: http://www.mcs.de Eingetragen im Handelsregister Hamburg B62933 Geschäftsführer: Kai Brandes & Eckard Kabel GPG 8B52 41A1 4B8F 4DE7 9064 2073 6168 137A 3DDA 0F36 ==
Re: Low Scoring Lotto Spam
Hi, > * 3.0 RCVD_IN_UCEPROTECT2 RBL: Received via a relay in > * dnsbl-2.uceprotect.net > * [81.202.69.68 listed in dnsbl-2.uceprotect.net] > * 2.0 RCVD_IN_UCEPROTECT3 RBL: Received via a relay in > * dnsbl-3.uceprotect.net > * [81.202.69.68 listed in dnsbl-3.uceprotect.net] How successful have you been with the UCEPROTECT lists? Seems like a nice project. How come more people aren't using it? IOW, you seemed to be the only one of the four or five people that posted their output from this lotto spam. Why such a disparity in the rules that people use? Thanks, Alex
Re: DNSWL-Check does not work....
On Mon, July 27, 2009 18:02, Christian Kuehn wrote: > [4177] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted > [4177] dbg: dns: IPs found: full-external: 66.211.168.231, 10.243.56.55, > 10.243.57.25 untrusted: 66.211.168.231 originating: > But no DNS-check furthermore okay make a bug on this one so, it does not make sense to test firsttrusted for a whitelist, not the bug ? also add rfc1918 to your internal_networks IP address 66.211.168.231 is listed at dnswl.org with the following details: Domain: paypal.com; Category: Financial Services (127.0.2.x); Country: US Suggest change for this DNSWL entry. -- xpoint
RE: DNSWL-Check does not work....
> > On Mon, July 27, 2009 17:17, Christian Kuehn wrote: > > > >> [30132] dbg: conf: trusted_networks are not configured; it is > >> recommended that you configure trusted_networks manually > > > > this might be the error, unsure if it is, but try add your > wan ip's to > > trusted_networks, and imho also to msa_networks > > > > trusted_networks must also have a list of all ips that > forward mails > > to you, this will help on spf forwarded emails to not being > detected > > as spf fail > > > > Not the problem, now with trusted_networks and internal_networks set > correctly: > > ian:~ # spamassassin 2>&1 -D -t paypal.txt | grep trusted > [4177] dbg: received-header: relay 66.211.168.231 trusted? no > internal? snip > > > But no DNS-check furthermore > -- > Christian Kühn Christian, i may be "way off base (TM)" here yet the only thing that caught my eye was "paypal.txt" if you are having problems with email from Paypal and DNS issues, many times it is because paypal had certain types of monster DNS records and sometimes various software has to be patched to deal with it again, this may or may not be the or a part of the issue depending on what your overall network systems software picture is. - rh
Re: Low Scoring Lotto Spam
MySQL Student wrote: Hi, * 3.0 RCVD_IN_UCEPROTECT2 RBL: Received via a relay in * dnsbl-2.uceprotect.net * [81.202.69.68 listed in dnsbl-2.uceprotect.net] * 2.0 RCVD_IN_UCEPROTECT3 RBL: Received via a relay in * dnsbl-3.uceprotect.net * [81.202.69.68 listed in dnsbl-3.uceprotect.net] How successful have you been with the UCEPROTECT lists? Seems like a nice project. How come more people aren't using it? I find it quite useful, but do understand their listing policy before using it, and score each list appropriately for your mail flow. I use it to check all relay IPs, not just last external, which is why it hits on this example, but do expect FPs used in this way from senders on particularly spammy ISPs. For me it hits more low scoring spam than it does legit mail so it's worth a few points. I have had one user on another open source mailing list whose mail it blocks every time who I've had to manually whitelist, but other than that I've not really noticed it causing any legitimate mail to be quarantined (note that doesn't mean the rule doesn't misfire, only that negatively scoring rules in my setup, such as bayes, counteract and prevent the mail from being classified as spam).
Re: {SPAM?} Rules
I found the only ruleset that catches this to be: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf?revision=795578 And then only the last two rules fired. On Jul 27, 2009, at 6:35 AM, twofers wrote: This is pretty basic and straight forward isn't it? Wes This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Re: {SPAM?} Rules
On Mon, 27 Jul 2009, Mike Wallace wrote: I found the only ruleset that catches this to be: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf?revision=795578 And then only the last two rules fired. That's old. Lose the ?revision... bit to see the current version. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- Ignorance doesn't make stuff not exist. -- Bucky Katt --- 9 days until the 274th anniversary of John Peter Zenger's acquittal
Re: Low Scoring Lotto Spam
On Mon, 2009-07-27 at 17:31 +0300, Jari Fredriksson wrote: > > On Mon, 2009-07-27 at 14:51 +0100, rich...@buzzhost.co.uk wrote: > > I also used these local rules (some shamelessly copied off this > > forum): > > body__TRMB_YOUR_NAME > > /(^|\W)(your(\s+|\s+\w+\s+)names?|last.name:|full.names?|surname|Prenom|fullname|names? > > in full|with your.? Serial No|Confirmation Email > > Serial|Names?(\s+:|:)|Receiver name)(_|\W)/i After I splatted these rules here, I saw that they were pretty in-efficient perl-wise, and matched a bit much logic wise. I've tightened them up, and I think this is better, but I'd appreciate suggestions: body__TRMB_YOUR_NAME /\b(?:your.{0,10}\bnames?|last.name:|full.names?|surname|Prenom|fullname|names? in full|with your.? Serial No|Confirmation Email Serial|Names?\s?:|Receiver name)_{0,40}\b/i body__TRMB_YOUR_ADDRESS /\b(?:your|home|residen|contact|full|current).{0,20}\b(?:add[er]{2,4}sse?|location|country|marital status|occupation)_{0,40}\b/i body__TRMB_YOUR_PHONE /\b(?:telephone|tel|phone)\s?(?:num(?:ber)?|\#)?[[:space:][:punct:]]{1,5}\D/i body__TRMB_YOUR_AGE /\b(?:your\s)?age\s?[[:punct:]]{1,40}\b/i body__TRMB_YOUR_OCCUPATION /\b(?:your\s)?(?:occupation|profession)_{0,30}\b/i body__TRMB_YOUR_BLOBBY_DETAILS /\b(?:full names?.{1,20}address.{1,20}phone num|phone and fax number|your telephone.fax|your full contact details|send us your fullnames? and address|your mobile numbers?|please reply if you are willing to help me save|send the following informations?|provide your email address.? phone number)/i body__TRMB_OTHER_DETAILS/\b(?:with your full contact informations?|contact the application desk)\b/i meta__TRMB_YOUR_DETAILS ((__TRMB_YOUR_NAME || __TRMB_OTHER_DETAILS) && (__TRMB_YOUR_ADDRESS || __TRMB_YOUR_PHONE || __TRMB_YOUR_AGE || __TRMB_YOUR_OCCUPATION) || __TRMB_YOUR_BLOBBY_DETAILS ) metaAE_DETAILS_WITH_MONEY __TRMB_YOUR_DETAILS && (MILLION_EURO || MILLION_USD || US_DOLLARS_3 || NA_DOLLARS || FRT_DOLLAR || AE_GBP || __FRAUD_DBI) describe AE_DETAILS_WITH_MONEY Has form and mentions much money metaAE_DETAILS_WITH_EMAIL __TRMB_YOUR_DETAILS && __HAS_ANY_EMAIL describe AE_DETAILS_WITH_EMAIL Has form and gives handy email to send it back to score AE_DETAILS_WITH_MONEY 2.0 score AE_DETAILS_WITH_EMAIL 2.5 -- Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX www.austinenergy.com
Re: Rules
John, the current version doesn't trap that type of URI and that's why I am using the older version and mentioned it. I have collected 13 examples of obfuscated URIs that I can send you. Mike - Original Message - From: "John Hardin" To: "Mike Wallace" Cc: "twofers" , users@spamassassin.apache.org Sent: Monday, July 27, 2009 4:48:52 PM GMT -05:00 US/Canada Eastern Subject: Re: {SPAM?} Rules On Mon, 27 Jul 2009, Mike Wallace wrote: > I found the only ruleset that catches this to be: > > http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf?revision=795578 > > > And then only the last two rules fired. That's old. Lose the ?revision... bit to see the current version. -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- Ignorance doesn't make stuff not exist. -- Bucky Katt --- 9 days until the 274th anniversary of John Peter Zenger's acquittal This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Re: Rules
On Mon, 27 Jul 2009, Mike Wallace wrote: John, the current version doesn't trap that type of URI and that's why I am using the older version and mentioned it. That's odd, because I added that sample line to my testbed and it did hit: [31850] dbg: rules: ran body rule URI_OBFU_WWW ==> got hit: "www.onlyviagra net" I have collected 13 examples of obfuscated URIs that I can send you. Please send them - thanks. Also, I just committed a minor update, you might want to grab the rule from svn again. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- An entitlement beneficiary is a person or special interest group who didn't earn your money, but demands the right to take your money because they *want* it.-- John McKay, _The Welfare State: No Mercy for the Middle Class_ --- 9 days until the 274th anniversary of John Peter Zenger's acquittal
Re: Low Scoring Lotto Spam
On Mon, 27 Jul 2009, Daniel J McDonald wrote: On Mon, 2009-07-27 at 17:31 +0300, Jari Fredriksson wrote: On Mon, 2009-07-27 at 14:51 +0100, rich...@buzzhost.co.uk wrote: I also used these local rules (some shamelessly copied off this forum): body__TRMB_YOUR_NAME /(^|\W)(your(\s+|\s+\w+\s+)names?|last.name:|full.names?|surname|Prenom|fullname|names? in full|with your.? Serial No|Confirmation Email Serial|Names?(\s+:|:)|Receiver name)(_|\W)/i After I splatted these rules here, I saw that they were pretty in-efficient perl-wise, and matched a bit much logic wise. I've tightened them up, and I think this is better, but I'd appreciate suggestions: body__TRMB_YOUR_NAME /\b(?:your.{0,10}\bnames?|last.name:|full.names?|surname|Prenom|fullname|names? in full|with your.? Serial No|Confirmation Email Serial|Names?\s?:|Receiver name)_{0,40}\b/i body__TRMB_YOUR_ADDRESS /\b(?:your|home|residen|contact|full|current).{0,20}\b(?:add[er]{2,4}sse?|location|country|marital status|occupation)_{0,40}\b/i body__TRMB_YOUR_PHONE /\b(?:telephone|tel|phone)\s?(?:num(?:ber)?|\#)?[[:space:][:punct:]]{1,5}\D/i body__TRMB_YOUR_AGE /\b(?:your\s)?age\s?[[:punct:]]{1,40}\b/i body__TRMB_YOUR_OCCUPATION /\b(?:your\s)?(?:occupation|profession)_{0,30}\b/i body__TRMB_YOUR_BLOBBY_DETAILS /\b(?:full names?.{1,20}address.{1,20}phone num|phone and fax number|your telephone.fax|your full contact details|send us your fullnames? and address|your mobile numbers?|please reply if you are willing to help me save|send the following informations?|provide your email address.? phone number)/i body__TRMB_OTHER_DETAILS/\b(?:with your full contact informations?|contact the application desk)\b/i meta__TRMB_YOUR_DETAILS ((__TRMB_YOUR_NAME || __TRMB_OTHER_DETAILS) && (__TRMB_YOUR_ADDRESS || __TRMB_YOUR_PHONE || __TRMB_YOUR_AGE || __TRMB_YOUR_OCCUPATION) || __TRMB_YOUR_BLOBBY_DETAILS ) metaAE_DETAILS_WITH_MONEY __TRMB_YOUR_DETAILS && (MILLION_EURO || MILLION_USD || US_DOLLARS_3 || NA_DOLLARS || FRT_DOLLAR || AE_GBP || __FRAUD_DBI) describe AE_DETAILS_WITH_MONEY Has form and mentions much money metaAE_DETAILS_WITH_EMAIL __TRMB_YOUR_DETAILS && __HAS_ANY_EMAIL describe AE_DETAILS_WITH_EMAIL Has form and gives handy email to send it back to score AE_DETAILS_WITH_MONEY 2.0 score AE_DETAILS_WITH_EMAIL 2.5 How about: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf?view=log -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- ...much of our country's counterterrorism security spending is not designed to protect us from the terrorists, but instead to protect our public officials from criticism when another attack occurs. -- Bruce Schneier --- 9 days until the 274th anniversary of John Peter Zenger's acquittal
Re: whitelist_from questions
Hi, I'm looking an email that appears to be one of the users from the whitelist, but instead was from: From probesqt...@segunitb1.freeserve.co.uk Mon Jul 27 19:49:19 2009 Why can't a comparison be made between the "From:" info and the actual sender? Is this because of virtual domains and/or users? Thanks, Alex
Re: Low Scoring Lotto Spam
On Mon, 2009-07-27 at 14:51 +0100, rich...@buzzhost.co.uk wrote: > http://pastebin.com/m2cbc0965 > > This is scoring way low. Coming in from Hotmail (I would love to > blacklist these but some people just insist on using it). > > 10 in the last hour. Lart'd Hotmail abuse, but the content does not seem > to be catching ? > X-Spam-Status: Yes, score=13.0 required=5.0 tests=BAYES_60=2.002, DCC_CHECK_NEGATIVE=-0.0001,FREEMAIL_FROM=0.5,FREEMAIL_REPLYTO=2, HTML_MESSAGE=0.001,JM_SOUGHT_FRAUD_2=3,JM_SOUGHT_FRAUD_3=3,KAM_LOTTO1=0.5, KHOP_RCVD_UNTRUST=1,RCVD_IN_JMF_YE=0.01,RELAY_ES=0.01,SAGREY=1 autolearn=disabled version=3.2.5 Content analysis details: (13.0 points, 5.0 required) pts rule name description -- -- 0.0 RCVD_IN_JMF_YE RBL: Relay listed in JunkEmailFilter YELLOW (varies) [65.55.116.112 listed in hostkarma.junkemailfilter.com] 0.0 RELAY_ES Relayed through Spain 0.5 FREEMAIL_FROM Sender email is freemail (laszlomezesesp68[at]msn.com) 2.0 FREEMAIL_REPLYTO Reply-To is different freemail than From or body (laszlomezesesp68[at]msn.com, urbanizacion70[at]aol.com) 2.0 BAYES_60 BODY: Bayesian spam probability is 60 to 80% [score: 0.7866] 0.0 HTML_MESSAGE BODY: HTML included in message -0.0 DCC_CHECK_NEGATIVE Not listed in DCC [localhost 1201; Body=1 Fuz1=21] [Fuz2=35] 3.0 JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns 0.5 KAM_LOTTO1 Likely to be an e-Lotto Scam Email 3.0 JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns 1.0 KHOP_RCVD_UNTRUST DNS-whitelisted sender is not verified 1.0 SAGREY Adds 1.0 to spam from first-time senders -- KeyID 0xE372A7DA98E6705C signature.asc Description: This is a digitally signed message part
Re: your mail
On Mon, 27 Jul 2009, Matus UHLAR - fantomas wrote: On Sat, 25 Jul 2009, Michael W. Cocke wrote: There doesn't seem to be a web interface to subscribe/unscribe from this list. The email address "users-unsubscr...@spamassassin.apache.org" complains that my IP address is dynamic (which is why I use dyndns.org, thank you very much.) And on that subject, am I the only person who thinks that blocking by IP address block is inefficient, brute force, and prone to both false positives and false negatives? On 26.07.09 22:09, r...@ausics.net wrote: If you are sending out from your dynamic home connection, you are going to have bigger problems, most of the big ISP's and many many many others block at MTA level for your type of connections, either get a static IP *and* a real PTR entry, or use your ISP as smarthost. Nothing wrong with the way this list is setup apart from it uses qmail, but we wont go into that :) by "ISP" we of course mean the company you receive mail through, not the company you are connecting through, unless you are using address hosted in the same company. Actually, if he is a connection customer of foobar.com, he should use foobar.coms SMTP server as his smarthost, as they will allow their customers to relay through them, that way most servers will only care about mail.foobar.com -- Res -Beware of programmers who carry screwdrivers
Re: whitelist_from questions
MySQL Student wrote: > Hi, > > I'm looking an email that appears to be one of the users from the > whitelist, but instead was from: > >From probesqt...@segunitb1.freeserve.co.uk Mon Jul 27 19:49:19 2009 > > Why can't a comparison be made between the "From:" info and the actual > sender? Is this because of virtual domains and/or users? > It's not done because this mismatch happens for nearly every mailing list in existence (including this one). Every message you get from this mailing list is "From:" the poster, but the envelope is from the apache list server's bounce handler. The To: header and Rcpt to: mismatch for similar reasons (To: will be the list, but RCPT TO will be your mailbox).