Re: Spam levels up or down?

2006-09-03 Thread Nigel Frankcom
On Sat, 2 Sep 2006 22:13:28 -0400, David Cary Hart [EMAIL PROTECTED] wrote: On Sat, 02 Sep 2006 02:28:14 -0800, John Andersen [EMAIL PROTECTED] opined: The Register is running an article saying spam is back up to 81% of all email traffic due to newer versions of the Mocbot worm. If anything,

Re: Re: Spam levels up or down?

2006-09-03 Thread Nigel Frankcom
On Sat, 2 Sep 2006 10:25:40 -0700 (PDT), John D. Hardin [EMAIL PROTECTED] wrote: On Sat, 2 Sep 2006, jdow wrote: Hm, I have a suspicion that the spam is being targeted quite differently then. Until the end of June I used to get about 250 to 300 spams a day. I am down to 90 to 150 per day now.

Re: Spam levels up or down?

2006-09-03 Thread John Andersen
On Sunday 03 September 2006 01:03, Nigel Frankcom wrote: On Sat, 2 Sep 2006 10:25:40 -0700 (PDT), John D. Hardin [EMAIL PROTECTED] wrote: On Sat, 2 Sep 2006, jdow wrote: Hm, I have a suspicion that the spam is being targeted quite differently then. Until the end of June I used to get about

Re: OS X Server spam still getting through :-(

2006-09-03 Thread mikemacfr
OK, but isn't spamd the settings file for spamassassin? How does spamassassin know how to work if spamd is not used when amavis is doing the routing? And if spamassissin is still the anti-spammer where do I tell it that it's not doing it's job properly? Thanks by the way for all the feedback so

Re: Spam levels up or down?

2006-09-03 Thread Nigel Frankcom
On Sun, 03 Sep 2006 01:10:25 -0800, John Andersen [EMAIL PROTECTED] wrote: On Sunday 03 September 2006 01:03, Nigel Frankcom wrote: On Sat, 2 Sep 2006 10:25:40 -0700 (PDT), John D. Hardin [EMAIL PROTECTED] wrote: On Sat, 2 Sep 2006, jdow wrote: Hm, I have a suspicion that the spam is being

Re: OS X Server spam still getting through :-(

2006-09-03 Thread mikemacfr
John, I was just in on your post about spam levels. Do this stats from our server give you (or anyone else) any clue about whats causing spam to get through? http://65.170.183.59:16080/amavis-stats/ Mike John Andersen wrote: On Saturday 02 September 2006 15:18, mikemacfr wrote: I'm a

Re: Spam levels up or down?

2006-09-03 Thread Justin Mason
John Andersen writes: On Sunday 03 September 2006 01:03, Nigel Frankcom wrote: On Sat, 2 Sep 2006 10:25:40 -0700 (PDT), John D. Hardin [EMAIL PROTECTED] wrote: On Sat, 2 Sep 2006, jdow wrote: Hm, I have a suspicion that the spam is being targeted quite differently then. Until the

Re: Spam levels up or down?

2006-09-03 Thread jdow
From: Nigel Frankcom [EMAIL PROTECTED] On Sun, 03 Sep 2006 01:10:25 -0800, John Andersen [EMAIL PROTECTED] wrote: On Sunday 03 September 2006 01:03, Nigel Frankcom wrote: On Sat, 2 Sep 2006 10:25:40 -0700 (PDT), John D. Hardin [EMAIL PROTECTED] wrote: On Sat, 2 Sep 2006, jdow wrote: Hm, I

Re: Spam levels up or down?

2006-09-03 Thread Nigel Frankcom
On Sun, 3 Sep 2006 04:22:07 -0700, jdow [EMAIL PROTECTED] wrote: From: Nigel Frankcom [EMAIL PROTECTED] On Sun, 03 Sep 2006 01:10:25 -0800, John Andersen [EMAIL PROTECTED] wrote: On Sunday 03 September 2006 01:03, Nigel Frankcom wrote: On Sat, 2 Sep 2006 10:25:40 -0700 (PDT), John D. Hardin

Live Messenger Invitation with forged Received header?

2006-09-03 Thread Andreas Pettersson
I need some help with understanding why some of the below rules triggered on these headers.. Received: from baym-sm1.msgr.hotmail.com ([207.46.1.190]) by mail.mydomain.com with esmtp (envelope-from [EMAIL PROTECTED]) id 1GJcP7-00063q-JH for [EMAIL PROTECTED]; Sat, 02 Sep 2006

Re: OS X Server spam still getting through :-(

2006-09-03 Thread Loren Wilton
OK, but isn't spamd the settings file for spamassassin? How does spamassassin know how to work if spamd is not used when amavis is doing the routing? And if spamassissin is still the anti-spammer where do I tell it that it's not doing SA is a really big bunch of perl modules that process one

Re: OS X Server spam still getting through :-(

2006-09-03 Thread Loren Wilton
Do this stats from our server give you (or anyone else) any clue about whats causing spam to get through? http://65.170.183.59:16080/amavis-stats/ This can only be a guess without more data. However it is obvious your mail volume is up greatly in the past two months, and the spam detection

Re: Live Messenger Invitation with forged Received header?

2006-09-03 Thread jdow
From: Andreas Pettersson [EMAIL PROTECTED] I need some help with understanding why some of the below rules triggered on these headers.. Received: from baym-sm1.msgr.hotmail.com ([207.46.1.190]) by mail.mydomain.com with esmtp (envelope-from [EMAIL PROTECTED]) id 1GJcP7-00063q-JH

RE: Running on Debian stable

2006-09-03 Thread Miles Fidelman
Hi Folks, Just came across this thread in the archives, and I have the same basic question re. upgrading to a newer version of spamassassin on Debian stable. But... unlike Raymond Wan, I'm accessing spamassassin with postfix and amavisd-new. The current install is already set up to run

RE: Running on Debian stable

2006-09-03 Thread Gary V
Hi Folks, Just came across this thread in the archives, and I have the same basic question re. upgrading to a newer version of spamassassin on Debian stable. But... unlike Raymond Wan, I'm accessing spamassassin with postfix and amavisd-new. The current install is already set up to run

Blog Blaster spams

2006-09-03 Thread John D. Hardin
Just got a spam for a blog spamming tool named Blog Blaster. It didn't score high enough to be auto-discarded, so I added some rules. I case anybody else is interested: describe BBLAST_01 Blog Blaster body BBLAST_01 /Blog\s+Blaster/ scoreBBLAST_01 1.00 describe BBLAST_02 Blog Blaster

Re: Running on Debian stable

2006-09-03 Thread Miles Fidelman
Thanks Gary! Any advantages to installing from testing? Seems like backports would be just a bit safer. Miles Gary V wrote: Hi Folks, Just came across this thread in the archives, and I have the same basic question re. upgrading to a newer version of spamassassin on Debian stable.

Re: OS X Server spam still getting through :-(

2006-09-03 Thread John Andersen
On Sunday 03 September 2006 01:14, mikemacfr wrote: OK, but isn't spamd the settings file for spamassassin? No. How does spamassassin know how to work if spamd is not used when amavis is doing the routing? Amavis calls spamassassin directly. Mike, with all due respect, these questions

Re: Running on Debian stable

2006-09-03 Thread Bob Proulx
Miles Fidelman wrote: Any advantages to installing from testing? Seems like backports would be just a bit safer. Since there is a good backport available and maintained there is really no advantage to pulling in the testing version. The backport one would be safer in the sense of being less

Re: catching fake usernames?

2006-09-03 Thread mouss
Rick Roe wrote: I get a lot of spam whose From addresses are users that don't exist on my system (random names like [EMAIL PROTECTED], [EMAIL PROTECTED], etc). I recently set up a scheme to manually blacklist all From addresses on my domains and un-blacklist the fifty or so real addresses mail

Re: catching fake usernames?

2006-09-03 Thread mouss
John Andersen wrote: On Wednesday 30 August 2006 21:25, Benny Pedersen wrote: On Thu, August 31, 2006 05:41, Rick Roe wrote: like there should be a simpler, more automatic way to do this. Am I missing something? in postfix main.cf smtpd_reject_unlisted_sender = yes

Re: Running on Debian stable

2006-09-03 Thread Gary V
Miles Fidelman wrote: Any advantages to installing from testing? Seems like backports would be just a bit safer. Since there is a good backport available and maintained there is really no advantage to pulling in the testing version. The backport one would be safer in the sense of being less

Re: Running on Debian stable

2006-09-03 Thread Jules M
Am 04.09.2006 um 01:51 schrieb Gary V: Since there is a good backport available and maintained there is really no advantage to pulling in the testing version. The backport one would be safer in the sense of being less likely to have your system get into a confusing state of mismatched

Re: Running on Debian stable

2006-09-03 Thread Gary V
I agree. The only advantage as of today is sarge-backports is at 3.1.3 and test/unstable is at 3.1.4. Hopefully that will not be the case for long, and when sarge-backports gets a little more up to date, upgrading from this point is trivial. Gary V Debian Volatile Sloppy repository

problem with ImageInfo

2006-09-03 Thread printer
hi, I placed 70_imageinfo.cf in the spamassassin directory and got the error message of: failed to create instance of plugin Mail::SpamAssassin::Plugin::ImageInfo: Can't locate object method new via package Mail::SpamAssassin::Plugin::ImageInfo (perhaps you forgot to load

Re: Running on Debian stable

2006-09-03 Thread Miles Fidelman
Hi Folks, So far, so good - thanks for all the input! I did the basic upgrade from backports, reloaded amavis and postfix, and all seems to be working just fine (note that I discovered that I also had to upgrade spamc, separately, from backports). One follow-up question: Gary V wrote: If

Sa-learn --ham vs spamassassin -report

2006-09-03 Thread Michael Scheidell
I am working an a program that accepts spamassassin 'TELL' (learning) reports (see the new 'spamassassin coach' for outlook and thunderbird) Sa coach sends stream to spamd with 'TELL' protocol. It then calls the equivalent of 'spamassassin -r' (for spam) or '-z for ham' or -f for forget. Do I

Re: Running on Debian stable

2006-09-03 Thread Gary V
Hi Folks, So far, so good - thanks for all the input! I did the basic upgrade from backports, reloaded amavis and postfix, and all seems to be working just fine (note that I discovered that I also had to upgrade spamc, separately, from backports). One follow-up question: Gary V wrote: If

Re: Running on Debian stable

2006-09-03 Thread Miles Fidelman
Found it, changed it, seems to work like a charm. Now let's see if the new rules actually catch more spam than the basic stable install. :-) Thanks again Miles Gary V wrote: The patch is for newer versions of amavisd-new. You can manually add the necessary line. edit

Re: Running on Debian stable

2006-09-03 Thread Gary V
Found it, changed it, seems to work like a charm. Now let's see if the new rules actually catch more spam than the basic stable install. :-) Thanks again Miles I never took the time to set up RulesDuJour or study which SARE rules might be the most appropriate for me. This thread was

Re: Sa-learn --ham vs spamassassin -report

2006-09-03 Thread Theo Van Dinter
On Sun, Sep 03, 2006 at 10:27:55PM -0400, Michael Scheidell wrote: Sa coach sends stream to spamd with 'TELL' protocol. It then calls the equivalent of 'spamassassin -r' (for spam) or '-z for ham' or -f for forget. Do I need to call sa-learn --ham and sa-learn --spam also? No. If I call

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

2006-09-03 Thread Christian Purnomo
: On Fri, 1 Sep 2006, Christian Purnomo wrote: : : I am having so much trouble at present that some people are using my : email address to send their spam messages, in return I get hundreds and : hundres of non-delivery email + other misc reply such as out of office. Thanks All who have

Re: catching fake usernames?

2006-09-03 Thread hamann . w
Rick Roe wrote: I get a lot of spam whose From addresses are users that don't exist on my system (random names like [EMAIL PROTECTED], [EMAIL PROTECTED], etc). I recently set up a scheme to manually blacklist all From addresses on my domains and un-blacklist the fifty or so real