This could be a DNS problem returning a .2 (positive response) for all
queries.
what DNS are you using for your queries?
On 7/20/2008 4:03 PM, Yves Goergen wrote:
Hello,
I just received an e-mail with the following report:
X-Spam-Report: Content analysis details:
0.0 URIBL_RED
Skip wrote:
mouss wrote:
Skip wrote:
[snip]
Anyway, please bear with me as I do have a few more questions. In
this thread before, some people thought I should look at a possible
DNS problem, or perhaps my system is exceeding the daily threshold
for spamhaus. All they say at the spamhaus
mouss wrote:
Skip wrote:
mouss wrote:
Skip wrote:
[snip]
Anyway, please bear with me as I do have a few more questions. In
this thread before, some people thought I should look at a possible
DNS problem, or perhaps my system is exceeding the daily threshold
for spamhaus. All they say
I see that the UNDESIRED_LANGUAGE_BODY test has gone away from 3.0 to 3.1.
Is there another method somewhere for testing for other languages now?
--
Tim Boyer
Denman Tire Corporation
[EMAIL PROTECTED]
@pelorus.org
Reply-To: users@spamassassin.apache.org
X-Rcpt-To: users@spamassassin.apache.org
Skip wrote on Mon, 21 Jul 2008 06:57:22 -0400:
I'm
pretty sure all they do is stop serving up web pages when you get a in
CPU exceeded situation. I don't think they'd turn off internal DNS
Tim Boyer wrote:
I see that the UNDESIRED_LANGUAGE_BODY test has gone away from 3.0 to 3.1.
Is there another method somewhere for testing for other languages now?
Um, what makes you think it's gone? It's been made into a plugin, but
it's still there.
It's now the TextCat plugin, and works
Um, what makes you think it's gone?
[EMAIL PROTECTED] updates_spamassassin_org]# fgrep UNDESIRED_LANGUAGE_BODY *
[EMAIL PROTECTED] updates_spamassassin_org]#
and I apparently made a silly assumption. Didn't notice anything in the
release notes.
It's been made into a plugin, but
I didn't see anything on the www, so after a lil investigation, it appears
that on a centos 4.6 box with SA 3.2.5, that the default compiled SA ruleset
is in
/var/lib/spamassassin/compiled
And below...
Question(s)
So, to go back to standard SA processing config, basically I just need to
admin
Robert - elists writes:
I didn't see anything on the www, so after a lil investigation, it appears
that on a centos 4.6 box with SA 3.2.5, that the default compiled SA ruleset
is in
/var/lib/spamassassin/compiled
And below...
Question(s)
So, to go back to standard SA processing
Robert - elists wrote:
I didn't see anything on the www, so after a lil investigation, it
appears
that on a centos 4.6 box with SA 3.2.5, that the default compiled SA
ruleset
is in
/var/lib/spamassassin/compiled
And below...
Question(s)
So, to go back to standard SA
Robert - elists writes:
Robert - elists wrote:
I didn't see anything on the www, so after a lil investigation, it
appears
that on a centos 4.6 box with SA 3.2.5, that the default compiled SA
ruleset
is in
/var/lib/spamassassin/compiled
And below...
I saw this error a couple times over the weekend. Is this something I
should worry about?
Use of uninitialized value in hash element at
/usr/lib/perl5/vendor_perl/5.8.5/Mail/SpamAssassin/Logger/Syslog.pm
It seems to relate to this bit of code:
local $SIG{'PIPE'} = sub {
Skip wrote:
mouss wrote:
Skip wrote:
mouss wrote:
Skip wrote:
[snip]
Anyway, please bear with me as I do have a few more questions. In
this thread before, some people thought I should look at a possible
DNS problem, or perhaps my system is exceeding the daily threshold
for spamhaus.
This is really not a SpamAssassin issue, but since this list is
populated by people who are interested in spammer behavior, I'm
throwing it out for comment. If it's too far off topic, my
apologies and I'll let it go at that.
At $DAYJOB I run a mail server and a name server for several
On 20.07.2008 22:42 CE(S)T, Karsten Bräckelmann wrote:
Run such a message through 'spamassassin' again, to see what it reports
*now*. Do you still see these strange, multiple URIBL hits?
spamassassin message out
It still reports that.
Also, check other email (including spam!) for
On 20.07.2008 16:18 CE(S)T, Yet Another Ninja wrote:
This could be a DNS problem returning a .2 (positive response) for all
queries.
what DNS are you using for your queries?
What do you mean? My mail server uses the DNS servers of the computing
centre. What SpamAssassin does, I don't know.
Is there a way to tell Spamassassin to add the detailed X-Spam-Report
to every message rather then just those that have X-Spam-Status:
Yes? Reason being is I want an easier way to study junk messages
that get by Spamassassin.
Matt
Christopher Bort wrote:
This is really not a SpamAssassin issue, but since this list is
populated by people who are interested in spammer behavior, I'm throwing
it out for comment. If it's too far off topic, my apologies and I'll let
it go at that.
At $DAYJOB I run a mail server and a name
Christopher Bort wrote:
This is really not a SpamAssassin issue, but since this list is
populated by people who are interested in spammer behavior, I'm throwing
it out for comment. If it's too far off topic, my apologies and I'll let
it go at that.
At $DAYJOB I run a mail server and a name
Matt wrote:
Is there a way to tell Spamassassin to add the detailed X-Spam-Report
to every message rather then just those that have X-Spam-Status:
Yes? Reason being is I want an easier way to study junk messages
that get by Spamassassin.
this depends on how you are running spamassassin. with
Yves Goergen wrote:
On 20.07.2008 22:42 CE(S)T, Karsten Bräckelmann wrote:
Run such a message through 'spamassassin' again, to see what it reports
*now*. Do you still see these strange, multiple URIBL hits?
spamassassin message out
It still reports that.
Also, check other email
Matt wrote:
Is there a way to tell Spamassassin to add the detailed X-Spam-Report
to every message rather then just those that have X-Spam-Status:
Yes? Reason being is I want an easier way to study junk messages
that get by Spamassassin.
Add this to your local.cf or user_prefs file:
Hello list.
I want to start using URIBL tests, so I added
urirhssub URIBL_BLACK multi.uribl.com.A 2
bodyURIBL_BLACK eval:check_uridnsbl('URIBL_BLACK')
describeURIBL_BLACK Contains an URL listed in the URIBL blacklist
tflags URIBL_BLACK net
score
On 21.07.2008 22:10 CE(S)T, mouss wrote:
view source (CTRL-U) and copy-paste to a file on your server. then run
# spamassassin -t message.eml
Look through each single message from all my folders that I have
received within the last two weeks, view the source, copy it into a
file, upload it
On 07/21/08 13:04, [EMAIL PROTECTED] (mouss) wrote:
Christopher Bort wrote:
For a while now, I've been seeing attempts to send mail to the
home server for addresses in $DAYJOB domains. This is not a
problem since the volume is low and they are being properly
rejected as third-party relay
Christopher Bort wrote:
In all of the relay attempts I'm seeing on this mail server, the
recipient addresses are in domains for which the server is an NS.
They are looking for any connection possible. A nameserver is an
association. They will hope that perhaps it allows mail. Unlikely to
the
Yves Goergen schrieb:
# cat /etc/resolv.conf
nameserver 213.133.100.100
nameserver 213.133.99.99
nameserver 213.133.98.98
nameserver 213.133.98.97
Ah, Hetzner. I had a lot less problems since I started to run my own:
main:~ cat /etc/resolv.conf
nameserver 127.0.0.1
#nameserver
On Mon, 2008-07-21 at 21:50 +0200, Yves Goergen wrote:
On 20.07.2008 22:42 CE(S)T, Karsten Bräckelmann wrote:
Run such a message through 'spamassassin' again, to see what it reports
*now*. Do you still see these strange, multiple URIBL hits?
spamassassin message out
It still
On Mon, 2008-07-21 at 23:17 +0200, Matthias Leisi wrote:
Yves Goergen schrieb:
What do you mean? My mail server uses the DNS servers of the computing
centre. What SpamAssassin does, I don't know. The IP addresses are:
The same as everyone else... Sic.
# cat /etc/resolv.conf
On Mon, 21 Jul 2008, [ISO-8859-2] Micha? J?czalik wrote:
Hello,
I've noticed a huge increase of spam rate in past 2-3 weeks. Most of it
are messages with some quite normal Subject:, often (but not neccesarily)
referring to some fake event (i.e. some politician stabbed to death) and
there's
I thought you guys would like a little humor. Here's what I sent my
host and what I got in response. *sigh*
Maybe tomorrow I'll have better luck with them.
FROM: [EMAIL PROTECTED]
SITE: pelorus.org
ADDR: 68.231.250.115
Why would I be getting this on box106?
[EMAIL PROTECTED] [~]# host
On Mon, 2008-07-21 at 22:50 +0200, Michał Jęczalik wrote:
Hello,
I've noticed a huge increase of spam rate in past 2-3 weeks. Most of it
are messages with some quite normal Subject:, often (but not neccesarily)
referring to some fake event (i.e. some politician stabbed to death) and
On Mon, 2008-07-21 at 17:58 -0400, Skip wrote:
I thought you guys would like a little humor. Here's what I sent my
host and what I got in response. *sigh*
Maybe tomorrow I'll have better luck with them.
FROM: [EMAIL PROTECTED]
SITE: pelorus.org
ADDR: 68.231.250.115
Why would I be
At 14:58 21-07-2008, Skip wrote:
I thought you guys would like a little humor. Here's what I sent my
host and what I got in response. *sigh*
What response did you expect? :-)
Regards,
-sm
Christopher Bort wrote:
This is really not a SpamAssassin issue, but since this list is
populated by people who are interested in spammer behavior, I'm
throwing it out for comment. If it's too far off topic, my apologies
and I'll let it go at that.
At $DAYJOB I run a mail server and a name
On 07/21/08 14:09, [EMAIL PROTECTED] (Bob Proulx) wrote:
Christopher Bort wrote:
In all of the relay attempts I'm seeing on this mail server, the
recipient addresses are in domains for which the server is an NS.
They are looking for any connection possible. A nameserver is an
association.
Christopher Bort wrote:
Bob Proulx wrote:
You are trying to apply logic to a situation to which no reason can be
applied. Spammers do not operate with a sanity of reason and logic.
There is intelligence. But bludgeoning others for their own gain only
makes sense to them and not to
On Mon, 2008-07-21 at 12:30 -0700, Christopher Bort wrote:
For a while now, I've been seeing attempts to send mail to the
home server for addresses in $DAYJOB domains. This is not a
problem since the volume is low and they are being properly
rejected as third-party relay attempts
On Mon, 2008-07-21 at 14:01 -0700, Christopher Bort wrote:
I suppose they could
be looking for back doors, but that seems like it would be a
very low probability undertaking.
Other people's CPU cycles and net bandwidth are cheap (at least for
spammers). If they hit one in fifty thousand as
Yves Goergen wrote:
On 21.07.2008 22:10 CE(S)T, mouss wrote:
view source (CTRL-U) and copy-paste to a file on your server. then run
# spamassassin -t message.eml
Look through each single message from all my folders that I have
received within the last two weeks, view the source, copy it
Karsten Bräckelmann wrote:
On Mon, 2008-07-21 at 17:58 -0400, Skip wrote:
I thought you guys would like a little humor. Here's what I sent my
host and what I got in response. *sigh*
Maybe tomorrow I'll have better luck with them.
FROM: [EMAIL PROTECTED]
SITE: pelorus.org
ADDR:
Skip wrote:
[snip]
Anyway, forget them. I am on my own again. I ran a few other
commands. What do you think of this?
[EMAIL PROTECTED] [~]# host 2.0.0.127.yahoo.com
Host 2.0.0.127.yahoo.com not found: 3(NXDOMAIN)
[EMAIL PROTECTED] [~]# host 2.0.0.127.google.com
Host 2.0.0.127.google.com
Christopher Bort wrote:
This is really not a SpamAssassin issue, but since this list is
populated by people who are interested in spammer behavior, I'm
throwing it out for comment. If it's too far off topic, my apologies
and I'll let it go at that.
At $DAYJOB I run a mail server and a name
Karsten Bräckelmann wrote:
On Mon, 2008-07-21 at 23:17 +0200, Matthias Leisi wrote:
Yves Goergen schrieb:
What do you mean? My mail server uses the DNS servers of the computing
centre. What SpamAssassin does, I don't know. The IP addresses are:
The same as everyone
44 matches
Mail list logo
