Re: [Assp-test] Does Message Score build from Bomb matches override a DKIMNP match??

2021-10-18 Thread K Post
Sorry for making you angry, though I'm not sure how I have this time.  I'm
agreeing with you.  No need for your reply, I certainly don't want to upset
you or make it sound like I'm arguing.  I was simply suggesting a
language addition to the GUI (or the "manual" as you call it) to help add
clarity that NoProcessing does NOT override nonBaysian/HMM scoring by
default and to look at !!!NWLI!!! at the bottom of the gui for more
information.  That way, someone doesn't see "NoProcessing" and completely
incorrectly assume that it actually does not process the message at all.


On Mon, Oct 18, 2021 at 1:20 PM Thomas Eckardt 
wrote:

> >Note: Messages flagged as "no processing" will not contribute to the
> corpus
> there is no option to store noprocessing in the corpus folders
>
> >will not be scored based on Bayesian/HMM detection.
> not true - config option
>
>
> >However, by default, "Penalty Box" / Bomb scroing will still take place.
> NOT by default - EVERYTIME - nothing else is written in the manual
>
> See !!!NWLI!!! option to override this default behavior.
>
> nonsense
>
>
> THERE IS NO OTHER WAY to get knowledge about ASSP than reading the manual
> completely! I recommend to do this more than twice!
> It is useless to stumble around the configuration options and try to
> understand something.
>
> I'm angry  and I stop here - otherwise I would
> lose my way and my composure
>
>
>
> Thomas
>
> NWLI will get an improvement and a small fix in the next version.
>
>
>
>
> Von:    "K Post" 
> An:    "ASSP development mailing list" <
> assp-test@lists.sourceforge.net>
> Datum:18.10.2021 17:26
> Betreff:Re: [Assp-test] Does Message Score build from Bomb
> matches override a DKIMNP match??
> --
>
>
>
> Well that'll do it!  I incorrectly thought all these years that "no
> processing" actually meant NO processing.Looking back, the NWLI options
> have only been a choice for 11 years   I'm surprised I never caught
> this happening (correctly) before.
>
> I agree that it the gui doesn't say anywhere that noProcessing isn't
> processed by the penaltybox, but it's literally called NoProcessing, not
> less processing, etc, hence my confusion.
>
> GUI says:
> Mail solely to or from any of these addresses are proxied without
> processing. The envelope sender and recipients are checked. Like a more
> efficient version of Spam-Lovers & redlist combined. Accepts specific
> addresses (*u...@domain.com* ), user parts (user) or
> entire domains (@*domain.com* <http://domain.com/>). Wildcards are
> supported (fribo*@*domain.com* <http://domain.com/>). If you register TO
> addresses here, all recipients for a single mail must be marked as
> noprocessing to flag the mail as "noprocessing".
>
> My money says that 90%+ of the admins using ASSP have the same
> misperception as I do on this.  I suggest we add:
> Note: Messages flagged as "no processing" will not contribute to the
> corpus and will not be scored based on Bayesian/HMM detection.  However, by
> default, "Penalty Box" / Bomb scroing will still take place.  See !!!NWLI!!!
> option to override this default behavior.
>
>
>
>
>
>
>
> On Sun, Oct 17, 2021 at 4:25 AM Thomas Eckardt <
> *thomas.ecka...@thockar.com* > wrote:
> >*(not sure why this line is in the log twice)*
>
> because the string was found twice
>
>
> >*msg rejected, even though no processing*
>
> I can't find anything in the manual, which states that 'noprocessing'
> mails are not processed by the penaltybox
>
> Scores are added by the bomb feature, because assp is configured to score
> noprocessing mails.
> bombReNP
> or
> =>NWLI is used (N at least for this regex)
>
> Thomas
>
>
>
>
>
> Von:"K Post" <*nntp.p...@gmail.com* >
> An:"ASSP development mailing list" <
> *assp-test@lists.sourceforge.net* >
> Datum:17.10.2021 02:02
> Betreff:[Assp-test] Does Message Score build from Bomb matches
> override a DKIMNP match??
> --
>
>
>
> I had an inbound message rejected by ASSP, where the DKIM signature
> matched DKIMNP. I would have thought that if there's a DKIMNP match, that
> the message will just be passed and saved in discarded.
>
> Also, Senderbase is white for the network that it came from. so that
> should have reduced the score by a lot.
>
> There was a bombDataRE match. seemingly twice for the same line. and also
> in BombData.  I've got

Re: [Assp-test] Does Message Score build from Bomb matches override a DKIMNP match??

2021-10-18 Thread Thomas Eckardt
>Note: Messages flagged as "no processing" will not contribute to the 
corpus
there is no option to store noprocessing in the corpus folders

>will not be scored based on Bayesian/HMM detection.  
not true - config option


>However, by default, "Penalty Box" / Bomb scroing will still take place.
NOT by default - EVERYTIME - nothing else is written in the manual

See !!!NWLI!!! option to override this default behavior.

nonsense


THERE IS NO OTHER WAY to get knowledge about ASSP than reading the manual 
completely! I recommend to do this more than twice!
It is useless to stumble around the configuration options and try to 
understand something.

I'm angry  and I stop here - otherwise I would 
lose my way and my composure



Thomas

NWLI will get an improvement and a small fix in the next version.




Von:"K Post" 
An: "ASSP development mailing list" 
Datum:  18.10.2021 17:26
Betreff:    Re: [Assp-test] Does Message Score build from Bomb matches 
override a DKIMNP match??



Well that'll do it!  I incorrectly thought all these years that "no 
processing" actually meant NO processing.Looking back, the NWLI 
options have only been a choice for 11 years   I'm surprised I never 
caught this happening (correctly) before.

I agree that it the gui doesn't say anywhere that noProcessing isn't 
processed by the penaltybox, but it's literally called NoProcessing, not 
less processing, etc, hence my confusion.

GUI says:
Mail solely to or from any of these addresses are proxied without 
processing. The envelope sender and recipients are checked. Like a more 
efficient version of Spam-Lovers & redlist combined. Accepts specific 
addresses (u...@domain.com), user parts (user) or entire domains (@
domain.com). Wildcards are supported (fribo*@domain.com). If you register 
TO addresses here, all recipients for a single mail must be marked as 
noprocessing to flag the mail as "noprocessing".

My money says that 90%+ of the admins using ASSP have the same 
misperception as I do on this.  I suggest we add:
Note: Messages flagged as "no processing" will not contribute to the 
corpus and will not be scored based on Bayesian/HMM detection.  However, 
by default, "Penalty Box" / Bomb scroing will still take place.  See 
!!!NWLI!!! option to override this default behavior.







On Sun, Oct 17, 2021 at 4:25 AM Thomas Eckardt  wrote:
>(not sure why this line is in the log twice) 

because the string was found twice 


>msg rejected, even though no processing

I can't find anything in the manual, which states that 'noprocessing' 
mails are not processed by the penaltybox 

Scores are added by the bomb feature, because assp is configured to score 
noprocessing mails. 
bombReNP 
or 
=>NWLI is used (N at least for this regex) 

Thomas 





Von:"K Post"  
An:"ASSP development mailing list" <
assp-test@lists.sourceforge.net> 
Datum:17.10.2021 02:02 
Betreff:[Assp-test] Does Message Score build from Bomb matches 
override a DKIMNP match?? 



I had an inbound message rejected by ASSP, where the DKIM signature 
matched DKIMNP. I would have thought that if there's a DKIMNP match, that 
the message will just be passed and saved in discarded.   

Also, Senderbase is white for the network that it came from. so that 
should have reduced the score by a lot.   

There was a bombDataRE match. seemingly twice for the same line. and also 
in BombData.  I've got Dear Friend, in both files by mistake, that'll be 
fixed, but that pushed the score above 50, so it was rejected.  Shouldn't 
DKIMNP override the rejection though? 

Here's the log, with my notes: 

msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org DKIM-Signature found
Info: enhanced Originated IP detection ignored IP's: 102.xxx.yyy.85 
(connected IP) , 10.11.74.34
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org info: found DKIM signature identity '@
bounce.TheirDomain.com'
@bounce.TheirDomain.com @bounce.TheirDomain.com,u...@ourchairty.org 
matches .TheirDomain.com in DKIMNPAddresses
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org [scoring] DKIM signature verified-OK - header-passed - 
identity is: @bounce.TheirDomain.com - sender policy is: neutral - author 
policy s: neutral - state changed to: noprocessing
Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with 
'dear friend,' - weight is 0.5   <-- we get a lot of Dear Friend, garbage, 
so I have it in BombData with a 50% score
Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with 
'dear friend,' - weight is 0.5(not sure why this line is in the log 
twice)
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org spambomb Regex: bombDataRe 'PB 18: for Dear Friend,'
msg11890-19574 [BombData] 102.xxx.yyy.85 <
bounce_ab...@bounce.theirdomain.com> to: u...@ourc

Re: [Assp-test] Does Message Score build from Bomb matches override a DKIMNP match??

2021-10-18 Thread K Post
I guess I should have written
. !!!N-W-L-I-!!! option to override this default behavior

On Mon, Oct 18, 2021 at 11:24 AM K Post  wrote:

> Well that'll do it!  I incorrectly thought all these years that "no
> processing" actually meant NO processing.Looking back, the NWLI options
> have only been a choice for 11 years   I'm surprised I never caught
> this happening (correctly) before.
>
> I agree that it the gui doesn't say anywhere that noProcessing isn't
> processed by the penaltybox, but it's literally called NoProcessing, not
> less processing, etc, hence my confusion.
>
> GUI says:
>
> Mail solely to or from any of these addresses are proxied without
> processing. The envelope sender and recipients are checked. Like a more
> efficient version of Spam-Lovers & redlist combined. Accepts specific
> addresses (u...@domain.com), user parts (user) or entire domains (@
> domain.com). Wildcards are supported (fribo*@domain.com). If you register
> TO addresses here, all recipients for a single mail must be marked as
> noprocessing to flag the mail as "noprocessing".
>
>
> My money says that 90%+ of the admins using ASSP have the same
> misperception as I do on this.  I suggest we add:
>
> Note: Messages flagged as "no processing" will not contribute to the
> corpus and will not be scored based on Bayesian/HMM detection.  However, by
> default, "Penalty Box" / Bomb scroing will still take place.  See !!!NWLI!!!
> option to override this default behavior.
>
>
>
>
>
>
>
>
> On Sun, Oct 17, 2021 at 4:25 AM Thomas Eckardt 
> wrote:
>
>> >*(not sure why this line is in the log twice)*
>>
>> because the string was found twice
>>
>>
>> >*msg rejected, even though no processing*
>>
>> I can't find anything in the manual, which states that 'noprocessing'
>> mails are not processed by the penaltybox
>>
>> Scores are added by the bomb feature, because assp is configured to score
>> noprocessing mails.
>> bombReNP
>> or
>> =>NWLI is used (N at least for this regex)
>>
>> Thomas
>>
>>
>>
>>
>>
>> Von:"K Post" 
>> An:"ASSP development mailing list" <
>> assp-test@lists.sourceforge.net>
>> Datum:17.10.2021 02:02
>> Betreff:[Assp-test] Does Message Score build from Bomb matches
>> override a DKIMNP match??
>> --
>>
>>
>>
>> I had an inbound message rejected by ASSP, where the DKIM signature
>> matched DKIMNP. I would have thought that if there's a DKIMNP match, that
>> the message will just be passed and saved in discarded.
>>
>> Also, Senderbase is white for the network that it came from. so that
>> should have reduced the score by a lot.
>>
>> There was a bombDataRE match. seemingly twice for the same line. and also
>> in BombData.  I've got Dear Friend, in both files by mistake, that'll be
>> fixed, but that pushed the score above 50, so it was rejected.  Shouldn't
>> DKIMNP override the rejection though?
>>
>> Here's the log, with my notes:
>>
>> msg11890-19574 102.xxx.yyy.85 <*bounce_ab...@bounce.theirdomain.com*
>> > to: u...@ourchairty.org 
>> *DKIM-Signature
>> found*
>> Info: enhanced Originated IP detection ignored IP's: 102.xxx.yyy.85
>> (connected IP) , 10.11.74.34
>> msg11890-19574 102.xxx.yyy.85 <*bounce_ab...@bounce.theirdomain.com*
>> > to: u...@ourchairty.org info:
>> found DKIM signature identity '@*bounce.TheirDomain.com*
>> <http://bounce.theirdomain.com/>'
>> @*bounce.TheirDomain.com* <http://bounce.theirdomain.com/> @
>> *bounce.TheirDomain.com* <http://bounce.theirdomain.com/>
>> ,u...@ourchairty.org matches *.TheirDomain.com in DKIMNPAddresses*
>> msg11890-19574 102.xxx.yyy.85 <*bounce_ab...@bounce.theirdomain.com*
>> > to: u...@ourchairty.org [scoring]
>> DKIM signature verified-OK - header-passed - identity is: @
>> *bounce.TheirDomain.com* <http://bounce.theirdomain.com/> - sender
>> policy is: neutral - author policy s: neutral - *state changed to:
>> noprocessing*
>> Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with
>> 'dear friend,' - weight is 0.5   *<-- we get a lot of Dear Friend,
>> garbage, so I have it in BombData with a 50% score*
>> Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with
>> 'dear friend,' - weight is 0.5*(not sure why this line is in the log
>> twice)*
>> msg11890-19574 102.xxx.yyy.85 <

Re: [Assp-test] Does Message Score build from Bomb matches override a DKIMNP match??

2021-10-18 Thread K Post
Well that'll do it!  I incorrectly thought all these years that "no
processing" actually meant NO processing.Looking back, the NWLI options
have only been a choice for 11 years   I'm surprised I never caught
this happening (correctly) before.

I agree that it the gui doesn't say anywhere that noProcessing isn't
processed by the penaltybox, but it's literally called NoProcessing, not
less processing, etc, hence my confusion.

GUI says:

Mail solely to or from any of these addresses are proxied without
processing. The envelope sender and recipients are checked. Like a more
efficient version of Spam-Lovers & redlist combined. Accepts specific
addresses (u...@domain.com), user parts (user) or entire domains (@
domain.com). Wildcards are supported (fribo*@domain.com). If you register
TO addresses here, all recipients for a single mail must be marked as
noprocessing to flag the mail as "noprocessing".


My money says that 90%+ of the admins using ASSP have the same
misperception as I do on this.  I suggest we add:

Note: Messages flagged as "no processing" will not contribute to the corpus
and will not be scored based on Bayesian/HMM detection.  However, by
default, "Penalty Box" / Bomb scroing will still take place.  See !!!NWLI!!!
option to override this default behavior.








On Sun, Oct 17, 2021 at 4:25 AM Thomas Eckardt 
wrote:

> >*(not sure why this line is in the log twice)*
>
> because the string was found twice
>
>
> >*msg rejected, even though no processing*
>
> I can't find anything in the manual, which states that 'noprocessing'
> mails are not processed by the penaltybox
>
> Scores are added by the bomb feature, because assp is configured to score
> noprocessing mails.
> bombReNP
> or
> =>NWLI is used (N at least for this regex)
>
> Thomas
>
>
>
>
>
> Von:"K Post" 
> An:        "ASSP development mailing list" <
> assp-test@lists.sourceforge.net>
> Datum:17.10.2021 02:02
> Betreff:[Assp-test] Does Message Score build from Bomb matches
> override a DKIMNP match??
> --
>
>
>
> I had an inbound message rejected by ASSP, where the DKIM signature
> matched DKIMNP. I would have thought that if there's a DKIMNP match, that
> the message will just be passed and saved in discarded.
>
> Also, Senderbase is white for the network that it came from. so that
> should have reduced the score by a lot.
>
> There was a bombDataRE match. seemingly twice for the same line. and also
> in BombData.  I've got Dear Friend, in both files by mistake, that'll be
> fixed, but that pushed the score above 50, so it was rejected.  Shouldn't
> DKIMNP override the rejection though?
>
> Here's the log, with my notes:
>
> msg11890-19574 102.xxx.yyy.85 <*bounce_ab...@bounce.theirdomain.com*
> > to: u...@ourchairty.org *DKIM-Signature
> found*
> Info: enhanced Originated IP detection ignored IP's: 102.xxx.yyy.85
> (connected IP) , 10.11.74.34
> msg11890-19574 102.xxx.yyy.85 <*bounce_ab...@bounce.theirdomain.com*
> > to: u...@ourchairty.org info:
> found DKIM signature identity '@*bounce.TheirDomain.com*
> <http://bounce.theirdomain.com/>'
> @*bounce.TheirDomain.com* <http://bounce.theirdomain.com/> @
> *bounce.TheirDomain.com* <http://bounce.theirdomain.com/>
> ,u...@ourchairty.org matches *.TheirDomain.com in DKIMNPAddresses*
> msg11890-19574 102.xxx.yyy.85 <*bounce_ab...@bounce.theirdomain.com*
> > to: u...@ourchairty.org [scoring]
> DKIM signature verified-OK - header-passed - identity is: @
> *bounce.TheirDomain.com* <http://bounce.theirdomain.com/> - sender policy
> is: neutral - author policy s: neutral - *state changed to: noprocessing*
> Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with
> 'dear friend,' - weight is 0.5   *<-- we get a lot of Dear Friend,
> garbage, so I have it in BombData with a 50% score*
> Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with
> 'dear friend,' - weight is 0.5*(not sure why this line is in the log
> twice)*
> msg11890-19574 102.xxx.yyy.85 <*bounce_ab...@bounce.theirdomain.com*
> > to: u...@ourchairty.org spambomb
> Regex: bombDataRe 'PB 18: for Dear Friend,'
> msg11890-19574 [BombData] 102.xxx.yyy.85 <
> *bounce_ab...@bounce.theirdomain.com*
> > to: u...@ourchairty.org [scoring]
> (BombData 'Dear Friend,')
> msg11890-19574 102.xxx.yyy.85 <*bounce_ab...@bounce.theirdomain.com*
> > to: u...@ourchairty.org
> Message-Score: added 18 for Regex: bombDataRe 'PB 18: for Dear Friend,'
> BombData: 'Dear Friend,', total score for this message is now 18
> msg11890-19574 102.xxx.yyy.85 <*bounce_ab...@bounce.their

Re: [Assp-test] Does Message Score build from Bomb matches override a DKIMNP match??

2021-10-17 Thread Thomas Eckardt
>(not sure why this line is in the log twice)

because the string was found twice


>msg rejected, even though no processing

I can't find anything in the manual, which states that 'noprocessing' 
mails are not processed by the penaltybox

Scores are added by the bomb feature, because assp is configured to score 
noprocessing mails.
bombReNP
or
=>NWLI is used (N at least for this regex)

Thomas





Von:"K Post" 
An: "ASSP development mailing list" 
Datum:  17.10.2021 02:02
Betreff:    [Assp-test] Does Message Score build from Bomb matches 
override a DKIMNP match??



I had an inbound message rejected by ASSP, where the DKIM signature 
matched DKIMNP. I would have thought that if there's a DKIMNP match, that 
the message will just be passed and saved in discarded.  

Also, Senderbase is white for the network that it came from. so that 
should have reduced the score by a lot.  

There was a bombDataRE match. seemingly twice for the same line. and also 
in BombData.  I've got Dear Friend, in both files by mistake, that'll be 
fixed, but that pushed the score above 50, so it was rejected.  Shouldn't 
DKIMNP override the rejection though?

Here's the log, with my notes:

msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org DKIM-Signature found
Info: enhanced Originated IP detection ignored IP's: 102.xxx.yyy.85 
(connected IP) , 10.11.74.34
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org info: found DKIM signature identity '@
bounce.TheirDomain.com'
@bounce.TheirDomain.com @bounce.TheirDomain.com,u...@ourchairty.org 
matches .TheirDomain.com in DKIMNPAddresses
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org [scoring] DKIM signature verified-OK - header-passed - 
identity is: @bounce.TheirDomain.com - sender policy is: neutral - author 
policy s: neutral - state changed to: noprocessing
Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with 
'dear friend,' - weight is 0.5   <-- we get a lot of Dear Friend, garbage, 
so I have it in BombData with a 50% score
Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with 
'dear friend,' - weight is 0.5(not sure why this line is in the log 
twice)
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org spambomb Regex: bombDataRe 'PB 18: for Dear Friend,'
msg11890-19574 [BombData] 102.xxx.yyy.85 <
bounce_ab...@bounce.theirdomain.com> to: u...@ourchairty.org [scoring] 
(BombData 'Dear Friend,')
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org Message-Score: added 18 for Regex: bombDataRe 'PB 18: 
for Dear Friend,' BombData: 'Dear Friend,', total score for this message 
is now 18
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org spambomb Regex: bombRe 'PB 35: for Dear Friend'
msg11890-19574 [BombData][bombRe] 102.xxx.yyy.85 <
bounce_ab...@bounce.theirdomain.com> to: u...@ourchairty.org [scoring] 
(bombRe 'Dear Friend')
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org Message-Score: added 35 for Regex: bombRe 'PB 35: for 
Dear Friend' bombRe: 'Dear Friend', total score for this message is now 53
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org deleting spamming safelisted tuplet: (102.xxx.yyy.0,
bounce.TheirDomain.com) age: 1s
msg11890-19574 [MessageLimit] 102.xxx.yyy.85 <
bounce_ab...@bounce.theirdomain.com> to: u...@ourchairty.org [spam found] 
(MessageScore 53, limit 50) [Our  Newsletter October 15th 2021] -> 
messages/discarded/Our__Newsletter_October_15th_2021--254778.txt;
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org [SMTP Error] 554 5.7.1 [PE] rejected msg [PR] 
[msg11890-19574 212EA668]  <-- msg rejected, even though no processing
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org info: PB-IP-Score for '102.xxx.yyy.0' is 53, added 53 
in this session
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org finished message - received DATA size: 138.82 kByte - 
sent DATA size: 0 Byte
msg11890-19574 102.xxx.yyy.85  to: 
u...@ourchairty.org disconnected: session:212EA668 102.xxx.yyy.85 - 
processing time 2 seconds

___
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test




DISCLAIMER:
***
This email and any files transmitted with it may be confidential, legally 
privileged and protected in law and are intended solely for the use of the 

individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no 
known virus in this email!
***


___
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test


[Assp-test] Does Message Score build from Bomb matches override a DKIMNP match??

2021-10-16 Thread K Post
I had an inbound message rejected by ASSP, where the DKIM signature matched
DKIMNP. I would have thought that if there's a DKIMNP match, that the
message will just be passed and saved in discarded.

Also, Senderbase is white for the network that it came from. so that should
have reduced the score by a lot.

There was a bombDataRE match. seemingly twice for the same line. and also
in BombData.  I've got Dear Friend, in both files by mistake, that'll be
fixed, but that pushed the score above 50, so it was rejected.  Shouldn't
DKIMNP override the rejection though?

Here's the log, with my notes:

msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org *DKIM-Signature found*
Info: enhanced Originated IP detection ignored IP's: 102.xxx.yyy.85
(connected IP) , 10.11.74.34
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org info: found DKIM signature identity '@
bounce.TheirDomain.com'
@bounce.TheirDomain.com @bounce.TheirDomain.com,u...@ourchairty.org
matches *.TheirDomain.com
in DKIMNPAddresses*
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org [scoring] DKIM signature verified-OK - header-passed -
identity is: @bounce.TheirDomain.com - sender policy is: neutral - author
policy s: neutral - *state changed to: noprocessing*
Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with
'dear friend,' - weight is 0.5   *<-- we get a lot of Dear Friend, garbage,
so I have it in BombData with a 50% score*
Info: weighted regex (bombDataRe) result found for 'Dear Friend,' - with
'dear friend,' - weight is 0.5*(not sure why this line is in the log
twice)*
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org spambomb Regex: bombDataRe 'PB 18: for Dear Friend,'
msg11890-19574 [BombData] 102.xxx.yyy.85 <
bounce_ab...@bounce.theirdomain.com> to: u...@ourchairty.org [scoring]
(BombData 'Dear Friend,')
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org Message-Score: added 18 for Regex: bombDataRe 'PB 18:
for Dear Friend,' BombData: 'Dear Friend,', total score for this message is
now 18
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org spambomb Regex: bombRe 'PB 35: for Dear Friend'
msg11890-19574 [BombData][bombRe] 102.xxx.yyy.85 <
bounce_ab...@bounce.theirdomain.com> to: u...@ourchairty.org [scoring]
(bombRe 'Dear Friend')
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org Message-Score: added 35 for Regex: bombRe 'PB 35: for
Dear Friend' bombRe: 'Dear Friend', total score for this message is now 53
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org deleting spamming safelisted tuplet: (102.xxx.yyy.0,
bounce.TheirDomain.com) age: 1s
msg11890-19574 [MessageLimit] 102.xxx.yyy.85 <
bounce_ab...@bounce.theirdomain.com> to: u...@ourchairty.org [spam
found] (*MessageScore
53, limit 50*) [Our  Newsletter October 15th 2021] ->
messages/discarded/Our__Newsletter_October_15th_2021--254778.txt;
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org* [SMTP Error] 554 5.7.1* [PE] rejected msg [PR]
[msg11890-19574 212EA668]  *<-- msg rejected, even though no processing*
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org info: PB-IP-Score for '102.xxx.yyy.0' is 53, added 53
in this session
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org finished message - received DATA size: 138.82 kByte -
sent DATA size: 0 Byte
msg11890-19574 102.xxx.yyy.85  to:
u...@ourchairty.org disconnected: session:212EA668 102.xxx.yyy.85 -
processing time 2 seconds
___
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test