RE: "bout u" campaign

2017-07-13 Thread Charles Amstutz
Thanks, I was looking at the default RBL lists https://wiki.apache.org/spamassassin/DnsBlocklists But was looking for other things that are free for commercial use. I found this that is possible. http://0spam.fusionzero.com/ but don't know if wanyone had experience with it, or could make

Re: "bout u" campaign

2017-07-13 Thread RW
On Thu, 13 Jul 2017 09:33:04 -0400 Alex wrote: > On Thu, Jul 13, 2017 at 9:29 AM, Charles Amstutz > wrote: > > How do you use lashback? It says that it is free to use for > > commercial and non commercial use. How do I set it up? > > Drop this into your local.cf or

Re: "bout u" campaign

2017-07-13 Thread David Jones
On 07/13/2017 11:00 AM, Charles Amstutz wrote: Hello, For the inexeperienced, what is the difference between lashback and lastexternal. Infinite Systems Charles Amstutz | Systems Administrator charl...@infinitesys.com 402.477.2474

Re: "bout u" campaign

2017-07-13 Thread Alex
Hi, > header RCVD_IN_SENDERSCORE_0_29 > eval:check_rbl('senderscore0-lastexternal','score.senderscore.com.','^127\.0\.4\.([1-2]?[0-9])$') > describeRCVD_IN_SENDERSCORE_0_29Senderscore.org score of 0 > to 29 > score RCVD_IN_SENDERSCORE_0_295.2 > tflags

Email address as fullname in To: field

2017-07-13 Thread Philip Prindeville
I’m getting more and more email as: To: “joeb...@example.com” anyone know why there’s an increase in this? Did Exchange recently get broken so that it’s not populating the Addressbook properly? I noticed that even legitimate promotional mailers (like 1800petmeds.com) are

Re: "bout u" campaign

2017-07-13 Thread Dave Jones
On 07/13/2017 12:39 PM, Alex wrote: Hi, header RCVD_IN_SENDERSCORE_0_29 eval:check_rbl('senderscore0-lastexternal','score.senderscore.com.','^127\.0\.4\.([1-2]?[0-9])$') describeRCVD_IN_SENDERSCORE_0_29Senderscore.org score of 0 to 29 score

Re: "bout u" campaign

2017-07-13 Thread Dianne Skoll
On Wed, 12 Jul 2017 21:04:37 -0400 Alex wrote: > Has anyone else experienced a spam campaign with any one of the > following subjects: > - sometimes enjoy it wild, how bout you? > - sometimes like it ruff, what bout you? > - sumtimes enjoy it ruff, wat bout you? 144

Re: "bout u" campaign

2017-07-13 Thread David Jones
On 07/13/2017 10:56 AM, RW wrote: On Thu, 13 Jul 2017 09:33:04 -0400 Alex wrote: On Thu, Jul 13, 2017 at 9:29 AM, Charles Amstutz wrote: How do you use lashback? It says that it is free to use for commercial and non commercial use. How do I set it up? Drop this

Re: "bout u" campaign

2017-07-13 Thread RW
On Thu, 13 Jul 2017 16:00:14 + Charles Amstutz Top-Posted: > Hello, > > For the inexeperienced, what is the difference between lashback and > lastexternal. lashback is just a label, the difference is between eval:check_rbl('LASHBACK', ... and eval:check_rbl('LASHBACK-lastexternal',

RE: "bout u" campaign

2017-07-13 Thread John Hardin
On Thu, 13 Jul 2017, Charles Amstutz wrote: Hello, For the inexeperienced, what is the difference between lashback and lastexternal. "lashback" is a DNSBL "lastexternal" is which MTA gets checked against that DNSBL. In this case, the last MTA external to your network - the MTA that handed

RE: "bout u" campaign

2017-07-13 Thread Charles Amstutz
I'm starting mine out at 0.5 until I see what happens.     Infinite Systems     Charles Amstutz | Systems Administrator     charl...@infinitesys.com 402.477.2474     134 S 13th Street, Suite 302 | Lincoln, NE 68508   -Original Message-

Re: "bout u" campaign

2017-07-13 Thread Alex
Hi, On Thu, Jul 13, 2017 at 10:07 AM, Martin Gregorie wrote: > On Thu, 2017-07-13 at 12:59 +, Charles Amstutz wrote: >> I find it challenging to constantly keep up with campaign's. My >> guess with the phone number is to try to make it seem more >> legitimate. >> More

Re: "bout u" campaign

2017-07-13 Thread David Jones
On 07/12/2017 09:50 PM, Alex wrote: Hi, pretty high mainly due to DCC and BAYES_99. Are you paying for DCC? I think we're over their limit and they blacklisted us long ago, lol. I have my own DCC server joined into the DCC network. https://www.dcc-servers.net/dcc/ I guess I have well

RE: "bout u" campaign

2017-07-13 Thread Charles Amstutz
Thanks     Infinite Systems     Charles Amstutz | Systems Administrator     charl...@infinitesys.com 402.477.2474     134 S 13th Street, Suite 302 | Lincoln, NE 68508   -Original Message- From: Alex [mailto:mysqlstud...@gmail.com] Sent:

Re: "bout u" campaign

2017-07-13 Thread Martin Gregorie
On Thu, 2017-07-13 at 12:59 +, Charles Amstutz wrote: > I find it challenging to constantly keep up with campaign's.  My > guess with the phone number is to try to make it seem more > legitimate.  > More recent, I try to look for general characteristics and go for > that, in order to

Re: "bout u" campaign

2017-07-13 Thread @lbutlr
On Jul 12, 2017, at 8:18 PM, David Jones wrote: > -2.2 RCVD_IN_SENDERSCORE_90_100 Senderscore.org score of 90 to 100 I haven’t seen that before (or not that I’ve noticed). Is it part fo the base SA package or something that was added? -- Apple broke AppleScripting signatures

Re: "bout u" campaign

2017-07-13 Thread Alex
Hi, On Thu, Jul 13, 2017 at 12:01 PM, Dianne Skoll wrote: > On Wed, 12 Jul 2017 21:04:37 -0400 > Alex wrote: > >> Has anyone else experienced a spam campaign with any one of the >> following subjects: > >> - sometimes enjoy it wild, how bout you?

RE: "bout u" campaign

2017-07-13 Thread Charles Amstutz
As a follow up, it says how to do the DNS, just now how to list in the .cf files, maybe I can copy another blacklist syntax?     Infinite Systems     Charles Amstutz | Systems Administrator     charl...@infinitesys.com 402.477.2474     134 S 13th

Re: "bout u" campaign

2017-07-13 Thread Alex
On Thu, Jul 13, 2017 at 9:29 AM, Charles Amstutz wrote: > How do you use lashback? It says that it is free to use for commercial and > non commercial use. How do I set it up? Drop this into your local.cf or similar: header RCVD_IN_LASHBACK eval:check_rbl('LASHBACK',

RE: "bout u" campaign

2017-07-13 Thread Charles Amstutz
How do you use lashback? It says that it is free to use for commercial and non commercial use. How do I set it up?     Infinite Systems     Charles Amstutz | Systems Administrator     charl...@infinitesys.com 402.477.2474     134 S 13th Street,

RE: "bout u" campaign

2017-07-13 Thread Charles Amstutz
I find it challenging to constantly keep up with campaign's. My guess with the phone number is to try to make it seem more legitimate. More recent, I try to look for general characteristics and go for that, in order to futureproof rules. However, there are always legitimate emails being sent

Re: "bout u" campaign

2017-07-13 Thread David Jones
On 07/13/2017 12:56 PM, Dave Jones wrote: On 07/13/2017 12:39 PM, Alex wrote: Hi, header RCVD_IN_SENDERSCORE_0_29 eval:check_rbl('senderscore0-lastexternal','score.senderscore.com.','^127\.0\.4\.([1-2]?[0-9])$') describeRCVD_IN_SENDERSCORE_0_29Senderscore.org score

Re: Random word spams and wiki spams

2017-07-13 Thread Bill Cole
On 8 Jul 2017, at 15:26, Alex wrote: [Quoting me] 2. That MIME structure is pathological. It merits a specific hard rejection with a derisive text part. Anything generating FPs (never seen one...) needs spanking. I don't understand? The message is labeled as multipart/mixed but it only

Re: Random word spams and wiki spams

2017-07-13 Thread John Hardin
On Thu, 13 Jul 2017, Bill Cole wrote: In the places where I've been directed to implement quarantining, it has proven a worse support problem than outright rejection of actually legitimate mail could reasonably be. The problem is that it is effectively a silent ailure: mail arrives and is

Re: "bout u" campaign

2017-07-13 Thread Martin Gregorie
On Thu, 2017-07-13 at 13:26 -0400, Alex wrote: > Would you be willing to share a few examples? > You can download the script processor and documentation from here: http://www.libelle-systems.com/free/ Its called 'portmanteau' and is a .tgz compressed tar archive Contact me offlist if you want

Re: "bout u" campaign

2017-07-13 Thread Alex
Hi, >> Are you paying for DCC? I think we're over their limit and they >> blacklisted us long ago, lol. > > I have my own DCC server joined into the DCC network. > > https://www.dcc-servers.net/dcc/ So you only provide spam services for your own users? Or do you pay? > I am classifying about

RE: "bout u" campaign

2017-07-13 Thread Charles Amstutz
Hello, For the inexeperienced, what is the difference between lashback and lastexternal.     Infinite Systems     Charles Amstutz | Systems Administrator     charl...@infinitesys.com 402.477.2474     134 S 13th Street, Suite 302 | Lincoln, NE

Re: "bout u" campaign

2017-07-13 Thread RW
On Thu, 13 Jul 2017 15:56:59 + Charles Amstutz wrote: > Thanks, > > I was looking at the default RBL lists > > https://wiki.apache.org/spamassassin/DnsBlocklists > > But was looking for other things that are free for commercial use. I > found this that is possible. > >

Re: "bout u" campaign

2017-07-13 Thread Dave Jones
On 07/13/2017 12:03 PM, @lbutlr wrote: On Jul 12, 2017, at 8:18 PM, David Jones wrote: -2.2 RCVD_IN_SENDERSCORE_90_100 Senderscore.org score of 90 to 100 I haven’t seen that before (or not that I’ve noticed). Is it part fo the base SA package or something that was added?

Re: reason why sendmail w/ SA3.4.1 scantime=15.0, delay=00:01:06 w/ SquirrelMail?

2017-07-13 Thread Andrzej A. Filip
Robert Kudyba wrote: > Over the past few days sending mail via SquirrelMail has become glacial. The > load on the server is under 1. I've restarted the SA, sendmail and dovecot > processes several times. Here are > some logs I can provide any settings if desired. > > Jul 13

Re: reason why sendmail w/ SA3.4.1 scantime=15.0, delay=00:01:06 w/ SquirrelMail?

2017-07-13 Thread Robert Kudyba
> n*5s delay *may* indicate unresponsive DNS host(s)/resolver(s) in /etc/hots > [ at least it should be ruled out ] > Nah both are university DNS servers that are current. > > How long does it take to get SMTP greeting message when you start > "/usr/sbin/sendmail -bs" as a non root user? > [ Is

Re: reason why sendmail w/ SA3.4.1 scantime=15.0, delay=00:01:06 w/ SquirrelMail?

2017-07-13 Thread Andrzej A. Filip
Robert Kudyba wrote: > n*5s delay *may* indicate unresponsive DNS host(s)/resolver(s) in /etc/hots > [ at least it should be ruled out ] > > Nah both are university DNS servers that are current. > > How long does it take to get SMTP greeting message when you start >

reason why sendmail w/ SA3.4.1 scantime=15.0, delay=00:01:06 w/ SquirrelMail?

2017-07-13 Thread Robert Kudyba
Over the past few days sending mail via SquirrelMail has become glacial. The load on the server is under 1. I've restarted the SA, sendmail and dovecot processes several times. Here are some logs I can provide any settings if desired. Jul 13 23:03:24 storm sendmail[14504]: v6E33EOQ014504:

Re: "bout u" campaign

2017-07-13 Thread Alex
Hi, > I SHORTCIRCUIT any trustworthy sender with a legit unsubscribe process to > put control back in the hands/mouse of the end user. I also SHORTCIRCUIT > with whitelist_auth any domains (primarily subdomains) that are > system-generated and consistently score very low. Just now received this

Re: "bout u" campaign

2017-07-13 Thread Matus UHLAR - fantomas
On 12.07.17 22:50, Alex wrote: pretty high mainly due to DCC and BAYES_99. Are you paying for DCC? I think we're over their limit and they blacklisted us long ago, lol. Configure your own DCC server and connect to their network. It is not a paid service (paid is if you don't connect server