Re: Poor James McCalla....

2006-01-05 Thread Gene Heskett
On Friday 06 January 2006 01:11, jdow wrote: >Seems he's been tagged for $11.2 BILLION for sending 280 million >spams to a small Iowa based ISP. >http://www.theinquirer.net/?article=28733 >http://www.qctimes.net/articles/2006/01/04/news/local/doc43bb692ac9e86 >281138542.txt#top > >And he's apparent

Re: Poor James McCalla....

2006-01-05 Thread M. Lewis
Poor Baby. jdow wrote: Seems he's been tagged for $11.2 BILLION for sending 280 million spams to a small Iowa based ISP. http://www.theinquirer.net/?article=28733 http://www.qctimes.net/articles/2006/01/04/news/local/doc43bb692ac9e86281138542.txt#top And he's apparently unknown to Rokso!

Poor James McCalla....

2006-01-05 Thread jdow
Seems he's been tagged for $11.2 BILLION for sending 280 million spams to a small Iowa based ISP. http://www.theinquirer.net/?article=28733 http://www.qctimes.net/articles/2006/01/04/news/local/doc43bb692ac9e86281138542.txt#top And he's apparently unknown to Rokso! {O.O}

Connections in CLOSE_WAIT

2006-01-05 Thread Mun Fai Lee
Hi I'm running SpamAssassin 3.0.2 on a dedicated linux server. Spamd is running as a daemon and allowing connections from 4 mail servers. Every few hours, spamd will just stop responding, without any errors in its logfiles. Whenever this happends I run a netstat -an on the server and I see lots

Re: lookup scores

2006-01-05 Thread Ken A
Bowie Bailey wrote: Kris Deugau wrote: Ken A wrote: Is there any way to ask spamassassin what the score of a particular rule is? I have rules here and there, and would like to be able to easily look up the score of a rule without grepping all over the place. Pass a mail that you know triggers

Re: OT- empty froms

2006-01-05 Thread [EMAIL PROTECTED]
This isnt backscatter though. The only message body is the spam, no info about bouncing at all. Im familiar with the backscatter as my users: [EMAIL PROTECTED] really gets a ton of it (duh). This is just spam coming in from nobody with 2 from lines and a body that is pure junk, not mailer daemon

RE: lookup scores

2006-01-05 Thread Bowie Bailey
Kris Deugau wrote: > Ken A wrote: > > Is there any way to ask spamassassin what the score of a particular > > rule is? I have rules here and there, and would like to be able to > > easily look up the score of a rule without grepping all over the > > place. > > Pass a mail that you know triggers th

Re: OT- empty froms

2006-01-05 Thread Matt Kettler
[EMAIL PROTECTED] wrote: > This is slightly off topic, but im sure everyone here might have thoughts on > it. > > I have over 9300 instances of empty "from" lines so far this week, for > example: > > Jan 5 16:36:46 mail sendmail[7568]: k05LajgX007568: from=<>, size=1578, > class=0, nrcpts=1, msg

Re: OT- empty froms

2006-01-05 Thread Rick Macdougall
[EMAIL PROTECTED] wrote: This is slightly off topic, but im sure everyone here might have thoughts on it. I have over 9300 instances of empty "from" lines so far this week, for example: Jan 5 16:36:46 mail sendmail[7568]: k05LajgX007568: from=<>, size=1578, class=0, nrcpts=1, msgid=, proto=SMT

Re: lookup scores

2006-01-05 Thread Matt Kettler
Ken A wrote: > Is there any way to ask spamassassin what the score of a particular rule > is? I have rules here and there, and would like to be able to easily > look up the score of a rule without grepping all over the place. > Ideas? Well, for the "stock rules" that come with SA you only need to

OT- empty froms

2006-01-05 Thread [EMAIL PROTECTED]
This is slightly off topic, but im sure everyone here might have thoughts on it. I have over 9300 instances of empty "from" lines so far this week, for example: Jan 5 16:36:46 mail sendmail[7568]: k05LajgX007568: from=<>, size=1578, class=0, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, relay=pool-1

Re: lookup scores

2006-01-05 Thread Kris Deugau
Ken A wrote: > Is there any way to ask spamassassin what the score of a particular > rule is? I have rules here and there, and would like to be able to > easily look up the score of a rule without grepping all over the > place. Pass a mail that you know triggers the rule in question through spamas

lookup scores

2006-01-05 Thread Ken A
Is there any way to ask spamassassin what the score of a particular rule is? I have rules here and there, and would like to be able to easily look up the score of a rule without grepping all over the place. Ideas? Thanks, Ken

Re: Kinda O/T: Block Return-Path: <> mail?

2006-01-05 Thread Matt Kettler
Evan Platt wrote: > At 12:23 PM 1/5/2006, you wrote: > >> Well, bounce warnings are in fact valid email.. >> >> For example, if you accidentally sent mail to "[EMAIL PROTECTED]" >> you'd get a >> bounce back, and you'd probably want to know about it. > > > Ok, I should have clarified.. There's a

Re: Kinda O/T: Block Return-Path: <> mail?

2006-01-05 Thread Ralf Hildebrandt
* Evan Platt <[EMAIL PROTECTED]>: > I'm getting quite a bit of spam with > Return-Path: <> > in the headers. > > Will I likely see valid e-mail with this? Yes, bounces. > Searching my previous mail, it appears to all be bounce warnings. Yes, legitimate mail > If so, what's the best way to jus

Re: Kinda O/T: Block Return-Path: <> mail?

2006-01-05 Thread Evan Platt
At 12:23 PM 1/5/2006, you wrote: Well, bounce warnings are in fact valid email.. For example, if you accidentally sent mail to "[EMAIL PROTECTED]" you'd get a bounce back, and you'd probably want to know about it. Ok, I should have clarified.. There's a FEW I'm seeing with the null return p

Re: Kinda O/T: Block Return-Path: <> mail?

2006-01-05 Thread Matt Kettler
Evan Platt wrote: > I'm getting quite a bit of spam with > Return-Path: <> > in the headers. > > Will I likely see valid e-mail with this? Searching my previous mail, it > appears to all be bounce warnings. Well, bounce warnings are in fact valid email.. For example, if you accidentally sent mai

Kinda O/T: Block Return-Path: <> mail?

2006-01-05 Thread Evan Platt
I'm getting quite a bit of spam with Return-Path: <> in the headers. Will I likely see valid e-mail with this? Searching my previous mail, it appears to all be bounce warnings. If so, what's the best way to just blackhole this? I have postfix, and put /Return-Path: <>/ Reject in the header_che

Re: SA ignores mail from outside of the domain

2006-01-05 Thread Frank Bures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Just for the records. I found the problem. Typo in SWITCHRC statement in /etc/procmailrc Thanks for the help. Frank Bures, Dept. of Chemistry, University of Toronto, M5S 3H6 [EMAIL PROTECTED] http://www.chem.utoronto.ca PGP public key: http://pgp.

Re: SA ignores mail from outside of the domain

2006-01-05 Thread Gregory P. Ennis
On Thu, 2006-01-05 at 13:36 -0500, Frank Bures wrote: > > My configuration: > > Quad Opteron 2GHz with 8GB RAM. > RHEL 4 > spamassassin-3.0.4-1.el4 > procmail-3.22-14 > > My version of spamd does not recognize option --round-robin > Frank, Looks like I was not much help. I have not had any

Re: dealing with SPF and external authenticated users

2006-01-05 Thread Jason Haar
Leonardo Rodrigues Magalhães wrote: > >Hello Guys, > >I have SA running with amavisd/postfix. I also have several > external users with dinamic IP addresses which are allowed to relay > using my server because they authenticate, i have SASL running. > >The problem is that right after pu

Re: SA ignores mail from outside of the domain

2006-01-05 Thread Frank Bures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 05 Jan 2006 12:08:53 -0600, Gregory P. Ennis wrote: >On Thu, 2006-01-05 at 11:31 -0500, Frank Bures wrote: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> On Thu, 05 Jan 2006 09:40:27 -0600, Gregory P. Ennis wrote: >> >> >On Thu, 200

Re: clamav and spamassasin...

2006-01-05 Thread Matt Kettler
Screaming Eagle wrote: > I just got spamassassin 3.x to work with sendmail. I want to know how to > integrate clamav with it. > > Thanks. If you want to directly integrate clamav in to spamassassin: http://wiki.apache.org/spamassassin/ClamAVPlugin I personally don't go that route, I use MailSc

clamav and spamassasin...

2006-01-05 Thread Screaming Eagle
I just got spamassassin 3.x to work with sendmail. I want to know how to integrate clamav with it. Thanks.

Re: SA ignores mail from outside of the domain

2006-01-05 Thread Gregory P. Ennis
On Thu, 2006-01-05 at 11:31 -0500, Frank Bures wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On Thu, 05 Jan 2006 09:40:27 -0600, Gregory P. Ennis wrote: > > >On Thu, 2006-01-05 at 10:32 -0500, Frank Bures wrote: > >> -BEGIN PGP SIGNED MESSAGE- > >> Hash: SHA1 > >> > >> On

Re: where is required_score being set ...

2006-01-05 Thread Matt Kettler
Screaming Eagle wrote: > All, > I have set required_score to 8.0 and restarted spamd. But new email > coming in is showing a require of 4.5: > > X-Spam-Status: No, score=1.2 required=4.5 tests=ALL_TRUSTED,BAYES_00 > autolearn=no > version=3.1.0 It could be in a user_prefs file, or any other conf

where is required_score being set ...

2006-01-05 Thread Screaming Eagle
All, I have set required_score to 8.0 and restarted spamd. But new email coming in is showing a require of 4.5: X-Spam-Status: No, score=1.2 required=4.5 tests=ALL_TRUSTED,BAYES_00  autolearn=no version=3.1.0

Re: SA ignores mail from outside of the domain

2006-01-05 Thread Frank Bures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 05 Jan 2006 09:40:27 -0600, Gregory P. Ennis wrote: >On Thu, 2006-01-05 at 10:32 -0500, Frank Bures wrote: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> On Thu, 5 Jan 2006 07:11:42 -0800, Loren Wilton wrote: >> >> >Probably you h

Re: URI's and geocities subwebs..

2006-01-05 Thread Matt Kettler
Billy Huddleston wrote: > Is their a way to get the URI's to look at stuff like this?? I'm seeing > more and more spam with these kinds of things in them to get by URI > detection.. > > http://asia.geocities.com/april19781matt1487 > Do you mean URIBL's? Not likely without major change.. URIBL

[now OT] Re: Google search as spam URI

2006-01-05 Thread Ron Johnson
Chris Santerre writes: > > Hah! Am I reading that right? Translate English to English! I give them 1 > point for coming up with that one. > OT, but I recall reading that there are at least two "English to English" translation books published. Guides for people who've learned English and are havi

Re: SA ignores mail from outside of the domain

2006-01-05 Thread Gregory P. Ennis
On Thu, 2006-01-05 at 10:32 -0500, Frank Bures wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On Thu, 5 Jan 2006 07:11:42 -0800, Loren Wilton wrote: > > >Probably you haven't set trusted_networks and/or internal_networks > >correctly, and you are getting ALL_TRUSTED firing on the in

Re: SA ignores mail from outside of the domain

2006-01-05 Thread Frank Bures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 5 Jan 2006 07:11:42 -0800, Loren Wilton wrote: >Probably you haven't set trusted_networks and/or internal_networks >correctly, and you are getting ALL_TRUSTED firing on the incoming mail from >some of the boxes. This will add some negative po

Re: SA ignores mail from outside of the domain

2006-01-05 Thread Loren Wilton
Probably you haven't set trusted_networks and/or internal_networks correctly, and you are getting ALL_TRUSTED firing on the incoming mail from some of the boxes. This will add some negative points, and possibly result in the mail not being marked as spam. Depending on what you are using to call S

Re: SA ignores mail from outside of the domain

2006-01-05 Thread Frank Bures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thu, 05 Jan 2006 07:32:55 -0500 (EST), Frank Bures wrote: >I am testing SA for several test users on my mail server. > >Everything was going OK when suddenly SA started to ignore any mail coming >outside of my own domain. So any mails sent by any

RE: SA ignores mail from outside of the domain

2006-01-05 Thread Bowie Bailey
Frank Bures wrote: > > I am testing SA for several test users on my mail server. > > Everything was going OK when suddenly SA started to ignore any mail > coming outside of my own domain. So any mails sent by any of my > machines contain "X-Spam" in their headers, any mails coming from > outside

no bayes check applied in MTA

2006-01-05 Thread Paco Yepes
Hello. Im using postfix 2.1.5 + spamassassin 3.1.0a-2 + amavisd-new 20030616p10-5 In the last weeks the size of false-negatives (fn) is grow significatelly. All this fn do not have scores of type BAYES_XX (and I think that is not normal). When I check the same message (fn) with spamc, then the m

Re: URI's and geocities subwebs..

2006-01-05 Thread Jon Kvebaek
Quoting Billy Huddleston <[EMAIL PROTECTED]>: > Is their a way to get the URI's to look at stuff like this?? I'm > seeing more and more spam with these kinds of things in them to get > by URI detection.. > > http://asia.geocities.com/april19781matt1487 I am seeing a lot of them as well, and now

SA ignores mail from outside of the domain

2006-01-05 Thread Frank Bures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I am testing SA for several test users on my mail server. Everything was going OK when suddenly SA started to ignore any mail coming outside of my own domain. So any mails sent by any of my machines contain "X-Spam" in their headers, any mails comi

dealing with SPF and external authenticated users

2006-01-05 Thread Leonardo Rodrigues Magalhães
Hello Guys, I have SA running with amavisd/postfix. I also have several external users with dinamic IP addresses which are allowed to relay using my server because they authenticate, i have SASL running. The problem is that right after publishing my SPF informations and enabling SA