Re: Intermediate Relay checked against RBL

2008-11-21 Thread Cedric Knight, GreenNet
Oliver Welter [EMAIL PROTECTED] wrote: 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see http://www.spamcop.net/bl.shtml?82.113.121.16] 1.1 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server

Re: Intermediate Relay checked against RBL

2008-11-21 Thread Justin Mason
Cedric Knight, GreenNet writes: Oliver Welter [EMAIL PROTECTED] wrote: 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see http://www.spamcop.net/bl.shtml?82.113.121.16] 1.1 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web

Re: OT: Google alerts FP's

2008-11-21 Thread ram
On Tue, 2008-11-18 at 11:26 +0100, Matus UHLAR - fantomas wrote: On 17.11.08 18:15, Mark Martinec wrote: I have been using USER_IN_SPF_WHITELIST to whitelist mails from google alerts It had been working fine , but last 2-3 days I see that these mails dont get an SPF-pass. Seems guys

Re: Question training the Bayse filter

2008-11-21 Thread Thomas Zastrow
Karsten Bräckelmann schrieb: snip / In short: More details and evidence, please. :) guenther Dear Guenther, thanks and sorry for the late answer. In the meantime, I trained the filter with a lot mor ham and spam, and now it works quite well. It seems so, that I definiteley had

Re: OT: Google alerts FP's

2008-11-21 Thread Matus UHLAR - fantomas
On Tue, 2008-11-18 at 11:26 +0100, Matus UHLAR - fantomas wrote: On 17.11.08 18:15, Mark Martinec wrote: I have been using USER_IN_SPF_WHITELIST to whitelist mails from google alerts It had been working fine , but last 2-3 days I see that these mails dont get an SPF-pass. Seems

Re: Intermediate Relay checked against RBL

2008-11-21 Thread Matus UHLAR - fantomas
Oliver Welter [EMAIL PROTECTED] wrote: 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see http://www.spamcop.net/bl.shtml?82.113.121.16] 1.1 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web

Re: Use of blacklist_form

2008-11-21 Thread Ned Slider
Sujit Acharyya-Choudhury wrote: Google Anti-phishing-email-reply (http://code.google.com/p/anti-phishing-e-mail-reply) contains reply addresses being used in phishing campaigns. I would like to use blacklist_from and blacklist_to for these addresses. snip The correct URL is:

Re: Use of blacklist_form

2008-11-21 Thread McDonald, Dan
On Fri, 2008-11-21 at 12:01 +, Sujit Acharyya-Choudhury wrote: Google Anti-phishing-email-reply (http://code.google.com/p/anti-phishing-e-mail-reply) contains reply addresses being used in phishing campaigns. I would like to use blacklist_from and blacklist_to for these addresses. I was

RE: Use of blacklist_form

2008-11-21 Thread Sujit Acharyya-Choudhury
Also since we do not mark anything as Spam coming from our network (i.e. in local.cf we have trusted_networks 161.74/16) how do I ensure that reply_to these mail addresses will work? What I meant that how can I stop people replying to e-mails from our network, given that we don't tag them as

Use of blacklist_form

2008-11-21 Thread Sujit Acharyya-Choudhury
Google Anti-phishing-email-reply (http://code.google.com/p/anti-phishing-e-mail-reply) contains reply addresses being used in phishing campaigns. I would like to use blacklist_from and blacklist_to for these addresses. I was wondering whether blacklist_to and blacklist_form is still available in

Re: Is spam volume really down

2008-11-21 Thread Richard Bishop
Is this news true ( spams down by 75% ) http://www.securecomputing.net.au/News/128340%2cspam-volumes-drop-75-percent-in-a-day.aspx It seems that it is (at least from where I'm sitting). Spam caught on our filters dropped by around about 31% on 11/11/2008. Graphing the about of spam

Re: Use of blacklist_form

2008-11-21 Thread Kai Schaetzl
Sujit Acharyya-Choudhury wrote on Fri, 21 Nov 2008 13:00:06 -: Also since we do not mark anything as Spam coming from our network (i.e. in local.cf we have trusted_networks 161.74/16) That doesn't mean not mark as spam! What I meant that how can I stop people replying to e-mails from

RE: Use of blacklist_form

2008-11-21 Thread Sujit Acharyya-Choudhury
No I am talking about mails to our University with fake (or undesirable) address so that some of our users can reply-to them with their identities, i.e. usernames passwords and there by allowing the spammer to steal the identities. Regards Sujit Sujit Choudhury -Original Message-

Re: Use of blacklist_form

2008-11-21 Thread Steve Freegard
Sujit Acharyya-Choudhury wrote: No I am talking about mails to our University with fake (or undesirable) address so that some of our users can reply-to them with their identities, i.e. usernames passwords and there by allowing the spammer to steal the identities. What I meant that how can

Re: Use of blacklist_form

2008-11-21 Thread Kai Schaetzl
Sujit Acharyya-Choudhury wrote on Fri, 21 Nov 2008 14:01:27 -: No I am talking about mails to our University with fake (or undesirable) address so that some of our users can reply-to them with their identities, i.e. usernames passwords and there by allowing the spammer to steal the

Re: Is spam volume really down

2008-11-21 Thread Marc Perkel
I noticed the size of my black list dropped by more that 1/3 this last week.

rDNS problem

2008-11-21 Thread Jeff Koch
Hi All Hopefully another pair of eyes can help find the reason for this rDNS error. Here's SA header message: * 1.0 RDNS_NONE Delivered to trusted network by a host with no rDNS Received: from unknown (HELO cronus.intersessions.com) (74.220.16.65) As far as I can tell

Re: rDNS problem

2008-11-21 Thread Daniel J McDonald
On Fri, 2008-11-21 at 18:22 -0500, Jeff Koch wrote: Hi All Hopefully another pair of eyes can help find the reason for this rDNS error. Here's SA header message: * 1.0 RDNS_NONE Delivered to trusted network by a host with no rDNS Received: from unknown (HELO

Re: rDNS problem

2008-11-21 Thread Francis Russell
Jeff Koch wrote: Hopefully another pair of eyes can help find the reason for this rDNS error. Here's SA header message: * 1.0 RDNS_NONE Delivered to trusted network by a host with no rDNS Received: from unknown (HELO cronus.intersessions.com) (74.220.16.65) As far as I can tell

Re: rDNS problem

2008-11-21 Thread Benny Pedersen
On Sat, November 22, 2008 00:22, Jeff Koch wrote: As far as I can tell 'cronus.intersessions.com' has reverse setup and it matches 74.220.16.65. What am I missing? http://www.robtex.com/ip/74.220.16.65.html see the graph, no PTR, and no A there

Re: rDNS problem

2008-11-21 Thread Benny Pedersen
On Sat, November 22, 2008 00:31, Daniel J McDonald wrote: 74/8 was removed from the Bogon list in 2005, but maybe the recipient hasn't updated their bogon acl in bind... rdns have nothing to do with rbl -- Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: rDNS problem

2008-11-21 Thread Jeff Koch
Hi Benny: How do I correct this problem? When I run 'nslookup 74.220.16.65' from various machines it shows the correct answer. At 07:02 PM 11/21/2008, you wrote: On Sat, November 22, 2008 00:22, Jeff Koch wrote: As far as I can tell 'cronus.intersessions.com' has reverse setup and it

Re: rDNS problem

2008-11-21 Thread Francis Russell
RDNS_NONE is defined by the following rules: meta RDNS_NONE (__RDNS_NONE !__CGATE_RCVD) header __RDNS_NONEX-Spam-Relays-Untrusted =~ /^[^\]]+ rdns= / header __CGATE_RCVD Received =~ /by \S+ \(CommuniGate Pro/ OK, I'm going to have one more go. The RDNS_NONE rule is triggered

Re: rDNS problem

2008-11-21 Thread Benny Pedersen
On Sat, November 22, 2008 01:41, Jeff Koch wrote: How do I correct this problem? When I run 'nslookup 74.220.16.65' from various machines it shows the correct answer. your computer, your problem :) i showed 2 links, should i show more ? -- Benny Pedersen Need more webspace ?

Re: rDNS problem

2008-11-21 Thread Len Conrad
How do I correct this problem? When I run 'nslookup 74.220.16.65' from various machines it shows the correct answer. dig cronus.intersessions.com. @ns.intersessions.com. +short 74.220.16.65 dig -x 74.220.16.65 @ns.intersessions.com. +short cronus.intersessions.com. so there is PTR+A match.

Re: rDNS problem

2008-11-21 Thread Jeff Koch
Hi Benny: Reverse DNS seems to work via dig and nslookup but the links, although indicating a problem, were not terribly helpful in explaining the cause. Apparently, you know more than I do. Perhaps you could reveal a little more info so we can get this straightened out. I would really

Re: rDNS problem

2008-11-21 Thread mouss
Jeff Koch a écrit : Hi All Hopefully another pair of eyes can help find the reason for this rDNS error. Here's SA header message: * 1.0 RDNS_NONE Delivered to trusted network by a host with no rDNS Received: from unknown (HELO cronus.intersessions.com) (74.220.16.65) your

Re: rDNS problem (SOLVED)

2008-11-21 Thread Benny Pedersen
On Sat, November 22, 2008 02:23, mouss wrote: Jeff Koch a écrit : As far as I can tell 'cronus.intersessions.com' has reverse setup and it matches 74.220.16.65. there's no thing like cronus.intersessions.com has reverse setup. really. reverse is for an IP. What am I missing? a real MTA?

Re: rDNS problem

2008-11-21 Thread Matt Kettler
Jeff Koch wrote: Hi All Hopefully another pair of eyes can help find the reason for this rDNS error. Here's SA header message: * 1.0 RDNS_NONE Delivered to trusted network by a host with no rDNS Received: from unknown (HELO cronus.intersessions.com) (74.220.16.65) As far as I