Anti-Spam SMTP Proxy Server

Email Archive: assp-test (read-only)

2007:	_Jan	_Feb	_Mar	_Apr	_May	_Jun	_Jul	_Aug (400)	_Sep (619)	_Oct (540)	_Nov (426)	_Dec (204)
2008:	_Jan (662)	_Feb (332)	_Mar (335)	_Apr (284)	_May (193)	_Jun (201)	_Jul (264)	_Aug (283)	_Sep (167)	_Oct (193)	_Nov (155)	_Dec (298)
2009:	_Jan (336)	_Feb (402)	_Mar (788)	_Apr (673)	_May (227)	_Jun (182)	_Jul (337)	_Aug (219)	_Sep (490)	_Oct (527)	_Nov (385)	_Dec (391)
2010:	_Jan (257)	_Feb (188)	_Mar (253)	_Apr (190)	_May (217)	_Jun (171)	_Jul (83)	_Aug (158)	_Sep (215)	_Oct (221)	_Nov (102)	_Dec (159)
2011:	_Jan (245)	_Feb (119)	_Mar (167)	_Apr (112)	_May (158)	_Jun (149)	_Jul (164)	_Aug (116)	_Sep (109)	_Oct (310)	_Nov (288)	_Dec (265)
2012:	_Jan (212)	_Feb (187)	_Mar (289)	_Apr (229)	_May (117)	_Jun (70)	_Jul (108)	_Aug (212)	_Sep (164)	_Oct (90)	_Nov (58)	_Dec (69)
2013:	_Jan (85)	_Feb (56)	_Mar (115)	_Apr (55)	_May (29)	_Jun	_Jul	_Aug	_Sep	_Oct	_Nov	_Dec


S	M	T	W	T	F	S
						1

2	3	4	5	6	7	8
(1)	(8)	(27)	(30)	(17)	(44)	(30)
9	10	11	12	13	14	15
(5)	(30)	(36)	(20)	(72)	(29)	(14)
16	17	18	19	20	21	22
(5)	(12)	(16)	(20)	(23)	(23)	(8)
23	24	25	26	27	28	29
(2)	(35)	(25)	(27)	(22)	(21)	(3)
30
(14)

[Assp-test] Message is not tagged

From: Brunner Markus <MBrunner@st...> - 2007-10-01 06:52

Attachments: Message as HTML

I am running 1.3.4 fc16. I got a message with the following ASSP message
header:

X-Assp-Delay: not delayed (white IP); 30 Sep 2007 20:49:52 +0200
X-Assp-Re-Red: windows-1251
X-Assp-Message/IP-Score: 5 (BombHeader 'windows-1251')
X-Assp-Message/IP-Score: 15 (PTR invalid 'smtp28.orange.fr')
X-Assp-Received-SPF: softfail - client-ip=3D80.12.242.101;
envelope-from=3Dushenkoa@...;
	helo=3Dsmtp28.orange.fr;
X-Assp-Message/IP-Score: 10 (SPF softfail)
X-Assp-Received-DNSBL: pass
X-Assp-Message/IP-Score: 5 (BombRaw: 'me-wanadoo.net (localhost [127.0')
X-Assp-Received-URIBL: pass
X-Assp-Bayes-Confidence: 0.00000
X-Assp-Spam-Prob: 0.00011
X-Assp-Spam-Level: **********
X-Assp-Envelope-From: ushenkoa@...
X-Assp-Intended-For: mbrunner@...
Return-Path: ushenkoa@...


DoBombHeaderRe:=3D1
DoBombRe:=3D1
bombTestMode:=3D1

But Message is not Tagged as SPAM. Any Suggestions ?

Regards Markus

[Assp-test] SenderBase

From: Mike O'Connor <assp@pi...> - 2007-09-30 11:34

Hi Guys

I wanted to ask if any thought has been given to supporting SenderBase
in ASSP ?

There is a cpan module for it at

http://search.cpan.org/dist/Net-SenderBase/lib/Net/SenderBase.pm

A number of ISP in Australia are using the hardware products which use
this system, and it does seem to work very well.

I'm thinking it might be a better initial filter than greylist delaying.

Cheers
Mike

Re: [Assp-test] SenderBase

From: Fritz Borgstedt <fb@iw...> - 2007-09-30 15:41

>I'm thinking it might be a better initial filter than greylist
>delaying.

Why?

Re: [Assp-test] SenderBase

From: Mike O'Connor <assp@pi...> - 2007-09-30 23:59

Hi Fritz

After doing some more reading I think I might be wrong about the
senderbase stuff being the actual part of the system which gives the
same result as the greylisting.

Still it would be interesting if a method of using this data could be
worked out.

Mike

assp@... wrote:
> Fritz Borgstedt wrote:
>   
>>> I'm thinking it might be a better initial filter than greylist
>>> delaying.
>>>     
>>>       
>> Why?
>>
>>
>>   
>>     
> Because I've seen the stats from a hardware box which uses this system
> (at local ISP) and it stops close to the same percentage of email as
> delaying does on an ISP I help manage which uses greylisting (not assp
> at this time)
>
> The major issue with have with delaying, is the that customer complain
> about the delay. Even after explaining how it reduced the amount of spam
> and how they can whitelist address there still not happy.
>
> I'd like to see it as an option that all, then it could be tested.
>
> It could be implemented with out the cpan module, a manual dig below
> shows the results.
>
> dig 11.246.33.203.test.senderbase.org txt
>
> 11.246.33.203.test.senderbase.org. 20220 IN TXT
> "0-0=1|1=OEG Australia|3=1.0|4=2530111|
> 6=1140495479|7=1|8=256|20=mail.|
> 21=pineview.net|22=Y|24=1.0|25=1098072227
> 41=1.0|43=0.3|44=0.16|45=N|46=24|48=24|49=1.00|
> 50=Kersbrook|51=05|53=AU|
> 54=138.85|55=-34.7833"
>
>
>     0 => 'version_number',
>     1 => 'org_name',
>     2 => 'org_daily_magnitude',
>     3 => 'org_monthly_magnitude',
>     4 => 'org_id',
>     5 => 'org_category',
>     6 => 'org_first_message',
>     7 => 'org_domains_count',
>     8 => 'org_ip_controlled_count',
>     9 => 'org_ip_used_count',
>     10 => 'org_fortune_1000',
>
>     20 => 'hostname',
>     21 => 'domain_name',
>     22 => 'hostname_matches_ip',
>     23 => 'domain_daily_magnitude',
>     24 => 'domain_monthly_magnitude',
>     25 => 'domain_first_message',
>     26 => 'domain_rating',
>
>     40 => 'ip_daily_magnitude',
>     41 => 'ip_monthly_magnitude',
>     43 => 'ip_average_magnitude',
>     44 => 'ip_30_day_volume_percent',
>     45 => 'ip_in_bonded_sender',
>     46 => 'ip_cidr_range',
>     47 => 'ip_blacklist_score',
>
>     50 => 'ip_city',
>     51 => 'ip_state',
>     52 => 'ip_postal_code',
>     53 => 'ip_country',
>     54 => 'ip_longitude',
>     55 => 'ip_latitude',
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
>

Re: [Assp-test] SenderBase

From: Fritz Borgstedt <fb@iw...> - 2007-10-01 06:15

>Because I've seen the stats from a hardware box which uses this system
>(at local ISP) and it stops close to the same percentage of email as
>delaying does on an ISP I help manage which uses greylisting (not assp
>at this time)

May be it is an idea to try ASSP first and make recommendations later ?

Re: [Assp-test] SenderBase

From: Fritz Borgstedt <fb@iw...> - 2007-10-01 06:17

>Still it would be interesting if a method of using this data could be
>worked out.

There is not so much, SenderBase can help.

We use in ASSP   missing orgnames and country codes  for scoring.

Re: [Assp-test] SenderBase

From: <assp@pi...> - 2007-09-30 23:41

Fritz Borgstedt wrote:
>> I'm thinking it might be a better initial filter than greylist
>> delaying.
>>     
>
> Why?
>
>
>   
Because I've seen the stats from a hardware box which uses this system
(at local ISP) and it stops close to the same percentage of email as
delaying does on an ISP I help manage which uses greylisting (not assp
at this time)

The major issue with have with delaying, is the that customer complain
about the delay. Even after explaining how it reduced the amount of spam
and how they can whitelist address there still not happy.

I'd like to see it as an option that all, then it could be tested.

It could be implemented with out the cpan module, a manual dig below
shows the results.

dig 11.246.33.203.test.senderbase.org txt

11.246.33.203.test.senderbase.org. 20220 IN TXT
"0-0=1|1=OEG Australia|3=1.0|4=2530111|
6=1140495479|7=1|8=256|20=mail.|
21=pineview.net|22=Y|24=1.0|25=1098072227
41=1.0|43=0.3|44=0.16|45=N|46=24|48=24|49=1.00|
50=Kersbrook|51=05|53=AU|
54=138.85|55=-34.7833"


    0 => 'version_number',
    1 => 'org_name',
    2 => 'org_daily_magnitude',
    3 => 'org_monthly_magnitude',
    4 => 'org_id',
    5 => 'org_category',
    6 => 'org_first_message',
    7 => 'org_domains_count',
    8 => 'org_ip_controlled_count',
    9 => 'org_ip_used_count',
    10 => 'org_fortune_1000',

    20 => 'hostname',
    21 => 'domain_name',
    22 => 'hostname_matches_ip',
    23 => 'domain_daily_magnitude',
    24 => 'domain_monthly_magnitude',
    25 => 'domain_first_message',
    26 => 'domain_rating',

    40 => 'ip_daily_magnitude',
    41 => 'ip_monthly_magnitude',
    43 => 'ip_average_magnitude',
    44 => 'ip_30_day_volume_percent',
    45 => 'ip_in_bonded_sender',
    46 => 'ip_cidr_range',
    47 => 'ip_blacklist_score',

    50 => 'ip_city',
    51 => 'ip_state',
    52 => 'ip_postal_code',
    53 => 'ip_country',
    54 => 'ip_longitude',
    55 => 'ip_latitude',

[Assp-test] Exclude a from address for sendAllSpam setting

From: Steve Thompson <steve@sw...> - 2007-09-29 16:47

Attachments: Message as HTML

Running (fc15)
 
I don't know if this is currently possible, but how would I go about
excluding a certain FROM address from being copied to my sendAllSpam
address?
 
I am having message forwarded from my ISP email account and their spam
filtering is not very good.  I am getting alot of undeliverable notification
messages from my ISP being forwarded to me by them because when they send
certain messages, they either are caught by URIBL or Bomb.  Then I get the
undeliverable notification sent to me and it is tagged [BombHeader].   have
already set my mail server to delete messages from the address that it is
sent from so my users don't see those messages.  They don't need to know
that a spam message sent from our ISP was rejected by ASSP.  But, my problem
is that ASSP forwards me a copy of all spam and when my ISP undeliverable
notifications messages are caught by Bomb, ASSP copies me spam message.  The
address that the undeliverable notification messages come from is
MAILER-DAEMON@... <mailto:MAILER-DAEMON@....> .
 
Hope all that makes sense.
 
It is just really annoying to see over 50 of these undeliverable
notification messages a day in my sendAllSpam account.  
 
Maybe this should be a feature request if it is not currently available.
 
Thanks,
Steve T