RE: Big trouble

2007-03-29 Thread Rocco Scappatura
There is another discussion on this list about rules that catch these sorts of messages. Check that out for ideas. For what it is worth these are the rules I get: Content analysis details: (10.5 points, 5.0 required) pts rule name description

RE: Big trouble

2007-03-29 Thread Rocco Scappatura
2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on bogons IP block [102.176.29.76 listed in combined-HIB.dnsiplists.completewhois.com] I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOIS_HIJACKED, which are

Re: Big trouble

2007-03-29 Thread Anthony Peacock
Hi, Rocco Scappatura wrote: There is another discussion on this list about rules that catch these sorts of messages. Check that out for ideas. For what it is worth these are the rules I get: Content analysis details: (10.5 points, 5.0 required) pts rule name description

Re: Big trouble

2007-03-29 Thread Mark Martinec
Rocco, 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? I don't understand.. maybe my remark is wrong, but I [do] get this score for the rules above I said '3.2.0-rc1', didn't I? Btw, I got 1800 messages hitting

Re: Big trouble

2007-03-29 Thread Justin Mason
Mark Martinec writes: Rocco, 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? I don't understand.. maybe my remark is wrong, but I [do] get this score for the rules above I said '3.2.0-rc1', didn't I?

Re: Big trouble

2007-03-29 Thread Theo Van Dinter
On Thu, Mar 29, 2007 at 12:37:56PM +0100, Justin Mason wrote: Could it be that the combined-HIB.dnsiplists.completewhois.com chokes under the load of a GA/perceptron run and stops responding? I've seen it unresponsive yesterday for about half an hour. odd. I guess that's a possibility...

Big trouble

2007-03-28 Thread Rocco Scappatura
Since some day, It's increased the number of spams which SA doesn't block. Every time I'm going to analyse the message: 1) Save the message in mbox format 'message.mbox' 2) su - amavis -c spamassassin -t message.mbox And I get that the score is greater the 5.0 and often I get: 1.6

Re: Big trouble

2007-03-28 Thread -- [ UxBoD ] --
What MTA are you using ? On Wed, 28 Mar 2007 12:06:55 +0200, Rocco Scappatura [EMAIL PROTECTED] wrote: Since some day, It's increased the number of spams which SA doesn't block. Every time I'm going to analyse the message: 1) Save the message in mbox format 'message.mbox' 2) su - amavis

Re: Big trouble

2007-03-28 Thread Anthony Peacock
Hi Rocco, Rocco Scappatura wrote: Since some day, It's increased the number of spams which SA doesn't block. Every time I'm going to analyse the message: 1) Save the message in mbox format 'message.mbox' 2) su - amavis -c spamassassin -t message.mbox And I get that the score is greater the

RE: Big trouble

2007-03-28 Thread Rocco Scappatura
What MTA are you using ? Postfix+MySQL+Amavisd-new rocsca

RE: Big trouble

2007-03-28 Thread -- [ UxBoD ] --
If you wish to reject at MTA level then please read http://www.postfix.org/uce.html under the section Client hostname/address restrictions as you are able to specify a list of RBLs. Regards, UxBoD On Wed, 28 Mar 2007 12:20:16 +0200, Rocco Scappatura [EMAIL PROTECTED] wrote: What MTA are you

Re: Big trouble

2007-03-28 Thread Anthony Peacock
Hi, Rocco Scappatura wrote: Before anyone can you give you a hint on how to block the messages, we would need to see what the messages are. Same form as before, save the message (with full headers) and place it somewhere where we can download it. http://www.rocsca.it/INBOX There is

RE: Big trouble

2007-03-28 Thread Rocco Scappatura
Before anyone can you give you a hint on how to block the messages, we would need to see what the messages are. Same form as before, save the message (with full headers) and place it somewhere where we can download it. http://www.rocsca.it/INBOX rocsca

Re: Big trouble

2007-03-28 Thread Mark Martinec
2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on bogons IP block [102.176.29.76 listed in combined-HIB.dnsiplists.completewhois.com] I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOIS_HIJACKED, which are nonzero)

Re: Big trouble

2007-03-28 Thread Mark Martinec
2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on bogons IP block [102.176.29.76 listed in combined-HIB.dnsiplists.completewhois.com] I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOIS_HIJACKED... almost

Re: Big trouble

2007-03-28 Thread Justin Mason
Mark Martinec writes: 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on bogons IP block [102.176.29.76 listed in combined-HIB.dnsiplists.completewhois.com] I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? (unlike RCVD_IN_WHOIS_INVALID and