Spam again.

[Dr Peter Young]

Has anyone else found, as I have, that a small amount of spam seems to
be bypassing the spam filters once more?

For instance, here is the header of one which the Hermes spam filters
have just caught (forwarded from an address that the son uses, FWIW):

[quote]

Return-Path: <***@epscn.com>
Received: from jenna.orpheusnet.co.uk (jenna.orpheusnet.co.uk
[82.138.249.177])
by orac.orpheusnet.co.uk (8.14.1/8.13.1) with ESMTP id
lAHEFgZ9022070
for <***@ormail.co.uk>; Sat, 17 Nov 2007 14:16:33 GMT
Received: from victoria.sitehq5.com (ns1.sitehq5.com [67.15.84.42])
by jenna.orpheusnet.co.uk (8.13.1/8.13.1) with ESMTP id
lAHEGIjc019304
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256
verify=NO)
for <***@ormail.co.uk>; Sat, 17 Nov 2007 14:16:22 GMT
Received: from [122.162.218.233] (port=4977 helo=(i5)
by victoria.sitehq5.com with smtp (Exim 4.63)
(envelope-from <***@epscn.com>)
id 1ItOT4-0007Vh-I1
for ***@robinstrust.org; Sat, 17 Nov 2007 14:16:19 +0000
Received: from 211.150.100.32 (HELO mx01.263xmail.com)
by robinstrust.org with esmtp (KUKOXDKAWHCX QXRRE)
id yRifI-vTsr1B-MV
for ***@robinstrust.org; Sat, 17 Nov 2007 19:46:21 +0530
Message-ID: <5a7501c82924$6d5b2370$***@Jaime>
From: "Jaime H. Cano" <***@epscn.com>
To: "Brittney H. Hathaway" <***@robinstrust.org>
Subject: Ordinary men have ordinary sex. Megadik will make you an
outstanding lover!
Date: Sat, 17 Nov 2007 19:46:21 +0530
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_23155_5ADD_01C82952.87135F70"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-AntiAbuse: This header was added to track abuse, please include it
with any abuse report
X-AntiAbuse: Primary Hostname - victoria.sitehq5.com
X-AntiAbuse: Original Domain - robinstrust.org
X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12]
X-AntiAbuse: Sender Address Domain - epscn.com
X-Source:
X-Source-Args:
X-Source-Dir:

[unquote]

With best wishes,

Peter.

[Peter Paddison]

Post by Dr Peter Young
Has anyone else found, as I have, that a small amount of spam seems to
be bypassing the spam filters once more?

Yes. I have received a few spam items almost daily and have wondered when
there would be an oficial reaction or something from one of the regulars. I
put Dr.Peter Young in the latter category.

I cannot add to what has been said as I destroy them as soon as I see the
"topic". I had expected some formal comment as I thought there was constant
monitoring.

Peter

[Dr Peter Young]

Post by Peter Paddison

Post by Dr Peter Young
Has anyone else found, as I have, that a small amount of spam seems to
be bypassing the spam filters once more?

Yes. I have received a few spam items almost daily and have wondered when
there would be an oficial reaction or something from one of the regulars. I
put Dr.Peter Young in the latter category.
I cannot add to what has been said as I destroy them as soon as I see the
"topic". I had expected some formal comment as I thought there was constant
monitoring.

FWIW it seems a lot better today. Thanks if someone did something :-)

With best wishes,

Peter.

[Adrian Crafer]

Post by Dr Peter Young

Post by Peter Paddison

Post by Dr Peter Young
Has anyone else found, as I have, that a small amount of spam seems to
be bypassing the spam filters once more?

Yes. I have received a few spam items almost daily and have wondered when
there would be an oficial reaction or something from one of the regulars. I
put Dr.Peter Young in the latter category.
I cannot add to what has been said as I destroy them as soon as I see the
"topic". I had expected some formal comment as I thought there was constant
monitoring.

FWIW it seems a lot better today. Thanks if someone did something :-)
With best wishes,
Peter.

Seemed much the same to me today, a general rise in spam.

I also thought that when Paul reorganised the news group software he
announced that MI5 Persecution had been blocked. There seems to have
been a lot of it about this week.

Adrian Crafer

[Dr Peter Young]

Post by Adrian Crafer

Post by Dr Peter Young

Post by Peter Paddison

Post by Dr Peter Young
Has anyone else found, as I have, that a small amount of spam seems to
be bypassing the spam filters once more?

Yes. I have received a few spam items almost daily and have wondered when
there would be an oficial reaction or something from one of the regulars. I
put Dr.Peter Young in the latter category.
I cannot add to what has been said as I destroy them as soon as I see the
"topic". I had expected some formal comment as I thought there was constant
monitoring.

FWIW it seems a lot better today. Thanks if someone did something :-)
With best wishes,
Peter.

Seemed much the same to me today, a general rise in spam.
I also thought that when Paul reorganised the news group software he
announced that MI5 Persecution had been blocked. There seems to have
been a lot of it about this week.

If you're using NewsHound, a change in the GlobalRules file easily
keeps this nutter out.

With best wishes,

Peter.

[Michael Harding]

Post by Dr Peter Young

Post by Adrian Crafer
Seemed much the same to me today, a general rise in spam.
I also thought that when Paul reorganised the news group software
he announced that MI5 Persecution had been blocked. There seems
to have been a lot of it about this week.

If you're using NewsHound, a change in the GlobalRules file easily
keeps this nutter out.

Dr Peter revealed to me how to vaccinate GlobalRules against the MI5
man. And it worked!

[ Recollection of the story of the man on the train who read his
newspaper then put it to one side. "May I have you newspaper?" asked
another passenger. "Yes of course. I've finished with it."
The other passenger took the newspaper, then started tearing it up and
throwing the pieces through the window. "Look, it was my paper, so I
think I'm entitled to ask why you're doing that." "It's to keep the
lions at bay." "But there are no lions round here." "I know - it
just shows how effective this method is." ]

Yes it works. I think.

Michael Harding

[Paul Vigay]

Post by Adrian Crafer
Seemed much the same to me today, a general rise in spam.

As explained in the past, it tends to fluctuate over time. It's a never
ending job filtering spam.

As my sysadmin commented to me during the week when I asked him about
spam...

"What usually happens:

1. We update all our spam detection systems.
2. Spammers devise new ways to bypass spam detection methods.
3. GO TO 1."

:-(

Post by Adrian Crafer
I also thought that when Paul reorganised the news group software he
announced that MI5 Persecution had been blocked. There seems to have
been a lot of it about this week.

Yes. So did I. I'm not sure what happened a couple of days ago, but I'm
getting it here too. The spam filters are still in place, so I can't quite
see how it's sneaking through. I could setup filtering in NewsHound but
I've deliberately not, simply because I want to see what's getting past the
server filtering.

I'm a bit puzzled by this, and I wasted half of this morning trying to work
out why it's arriving. I'm still a bit mystified! :-(

Paul

[Dr Peter Young]

On 18 Nov 2007 Paul Vigay

Post by Paul Vigay

Post by Adrian Crafer
Seemed much the same to me today, a general rise in spam.

As explained in the past, it tends to fluctuate over time. It's a never
ending job filtering spam.
As my sysadmin commented to me during the week when I asked him about
spam...
1. We update all our spam detection systems.
2. Spammers devise new ways to bypass spam detection methods.
3. GO TO 1."

Sorry to be a continuing pain, but all is still not well. The good
news is that there is definitely less spam coming. The bad news is
that this morning there were five messages in my mailbox, of which two
were spam and of which three, including both spams, showed no evidence
of having been seen by the filters. I di accept that there will always
be spam, and I do appreciate all the efforts to filter it, but if the
filters don't see the spam, then something is definitely wrong
somewhere.

With best wishes,

Peter.

[Paul Vigay]

In a dim and distant universe <***@pnyoung.ormail.co.uk>,
Dr Peter Young <***@ormail.co.uk> muttered:
[Snippety snip]

Sorry to be a continuing pain, but all is still not well. The good news
is that there is definitely less spam coming. The bad news is that this
morning there were five messages in my mailbox, of which two were spam
and of which three, including both spams, showed no evidence of having
been seen by the filters. I di accept that there will always be spam,
and I do appreciate all the efforts to filter it, but if the filters
don't see the spam, then something is definitely wrong somewhere.

Do you have an example of a message which got through that you can bounce
onto support - so that I can examine the headers.

Paul

[Dr Peter Young]

On 19 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

Sorry to be a continuing pain, but all is still not well. The good news
is that there is definitely less spam coming. The bad news is that this
morning there were five messages in my mailbox, of which two were spam
and of which three, including both spams, showed no evidence of having
been seen by the filters. I di accept that there will always be spam,
and I do appreciate all the efforts to filter it, but if the filters
don't see the spam, then something is definitely wrong somewhere.

Do you have an example of a message which got through that you can bounce
onto support - so that I can examine the headers.

Certainly; today's ones I deleted from WebMail, but I posted one
yesterday here. I'll send it to support in case the aliens hijacked it
from your machine :-)

I'll also send the headers one of the non-spam messages that escaped
the filters this morning, if I can track it down.

With best wishes,

Peter.

[Adrian Crafer]

Post by Dr Peter Young
On 19 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

Sorry to be a continuing pain, but all is still not well. The good news
is that there is definitely less spam coming. The bad news is that this
morning there were five messages in my mailbox, of which two were spam
and of which three, including both spams, showed no evidence of having
been seen by the filters. I di accept that there will always be spam,
and I do appreciate all the efforts to filter it, but if the filters
don't see the spam, then something is definitely wrong somewhere.

Do you have an example of a message which got through that you can bounce
onto support - so that I can examine the headers.

Certainly; today's ones I deleted from WebMail, but I posted one
yesterday here. I'll send it to support in case the aliens hijacked it
from your machine :-)
I'll also send the headers one of the non-spam messages that escaped
the filters this morning, if I can track it down.

Looking at a header of some spam today I noted the following:

X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-3.0 (gan.orpheusnet.co.uk [194.93.128.78]); Wed, 21
Nov 2007 06:13:43 +0000 (GMT)
X--MailScanner: Found to be clean
X--MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=4.166,
required 5, RAZOR2_CF_RANGE_51_100 0.50,
RAZOR2_CF_RANGE_E4_51_100 1.50, RAZOR2_CHECK 0.50,
SARE_SUB_TERM_LIFE 1.67)
X--MailScanner-SpamScore: 4


Obviously gan bit relates to orpheus, is the Razor stuff something
added by the sender as a smoke screen to imply that it is ok? Does it
affect orpheus scanning if it is. I note a reference to white and grey
list, with an implication that emails are not being matched against
the grey list to speed them up is that correct? If this is the case
how much would the grey list check slow the emails down?

Adrian

[Paul Vigay]

In a dim and distant universe <***@orpheusnet.co.uk>,
Adrian Crafer <***@orpheusmail.co.uk> muttered:
[Snippety snip]

Obviously gan bit relates to orpheus, is the Razor stuff something added
by the sender as a smoke screen to imply that it is ok? Does it affect
orpheus scanning if it is. I note a reference to white and grey list,
with an implication that emails are not being matched against the grey
list to speed them up is that correct? If this is the case how much
would the grey list check slow the emails down?

It doesn't. :-)

The grey listing was some experimental code my sysadmin was working on over
the past couple of days. It's currently disabled, so shouldn't be on the
main servers.

Unfortunately a spam score of between 4 and 5 generally indicates spam, but
dropping the threshold to 4 would mean that genuine emails could
potentially get blocked, so it's best to keep it slightly higher and let
end users do the remaining bit of filtering to remove spams that do get
through.

It's impossible to eliminate *all* spam through automatic filtering alone,
without running into the possibility of accidentally blocking the odd
genuine email, which I regard as unacceptable.

[Colin Matthews]

Post by Paul Vigay
Unfortunately a spam score of between 4 and 5 generally indicates
spam, but dropping the threshold to 4 would mean that genuine
emails could potentially get blocked, so it's best to keep it
slightly higher and let end users do the remaining bit of filtering
to remove spams that do get through.

A quick check through 4000 mails this year (Pluto is rather good at
this!) revealed 8 genuine emails scoring over 4 - including 3 from my
wife. The highest score was 4.897, a rather important mail that I can
see no reason for being so over-rated.

Colin

[Dr Peter Young]

On 21 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

Obviously gan bit relates to orpheus, is the Razor stuff something added
by the sender as a smoke screen to imply that it is ok? Does it affect
orpheus scanning if it is. I note a reference to white and grey list,
with an implication that emails are not being matched against the grey
list to speed them up is that correct? If this is the case how much
would the grey list check slow the emails down?

It doesn't. :-)
The grey listing was some experimental code my sysadmin was working on over
the past couple of days. It's currently disabled, so shouldn't be on the
main servers.

Not so, Sir, but far otherwise! From the headers of a message dated
today at 11:06:

X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-4.0 (jenna.orpheusnet.co.uk [82.138.249.180]); Wed, 21
Nov 2007 11:24:01 +0000 (GMT)
X--MailScanner: Found to be clean
X--MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=-2.599,
required 5, autolearn=not spam, BAYES_00 -2.60)
X-MailScanner-From: owner-***@livtech.co.uk

At least the X--MailScanner lines are appearing once more; they seemed
to have disappeared altogether yesterday.

Post by Paul Vigay
Unfortunately a spam score of between 4 and 5 generally indicates spam, but
dropping the threshold to 4 would mean that genuine emails could
potentially get blocked, so it's best to keep it slightly higher and let
end users do the remaining bit of filtering to remove spams that do get
through.

A hint to Hermes users: I've set a Hermes spam filter to pick up
anything with an Orpheus score of 4, and I have the filters set to
list spam, from where I can then delete it. So far, no ham messages
have been picked up by this.

Post by Paul Vigay
It's impossible to eliminate *all* spam through automatic filtering alone,
without running into the possibility of accidentally blocking the odd
genuine email, which I regard as unacceptable.

Fully understood and accepted.

With best wishes,

Peter.

[Paul Vigay]

In a dim and distant universe <***@pnyoung.ormail.co.uk>,
Dr Peter Young <***@ormail.co.uk> muttered:
[Snippety snip]

Post by Dr Peter Young
Not so, Sir, but far otherwise! From the headers of a message dated
X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-4.0 (jenna.orpheusnet.co.uk [82.138.249.180]); Wed, 21

Hmm. I'm guessing Jenna is configured slightly differently, as that's my
sysadmin's development server. It's also our offsite backup server (ie.
hosted in a different location in case the main data centre in London gets
hit by a low flying banana). It shouldn't delay anything, so the header
above looks ok to me.

[Dr Peter Young]

On 21 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

Post by Dr Peter Young
Not so, Sir, but far otherwise! From the headers of a message dated
X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-4.0 (jenna.orpheusnet.co.uk [82.138.249.180]); Wed, 21

Hmm. I'm guessing Jenna is configured slightly differently,

[snip]

Up to a point; I've just had one in, again forwarded from an address
that the son uses (but I wouldn't have thought that this would make a
difference), which is, with full headers:

Return-Path: <Gigi-***@anhaengerbau-groskorth.com>
Received: from dayna.orpheusnet.co.uk (dayna.orpheusnet.co.uk
[194.93.128.106])
by orac.orpheusnet.co.uk (8.14.1/8.13.1) with ESMTP id
lALIPKdH017424
for <***@ormail.co.uk>; Wed, 21 Nov 2007 18:26:16 GMT
Received: from victoria.sitehq5.com (ns1.sitehq5.com [67.15.84.42])
by dayna.orpheusnet.co.uk (8.13.1/8.13.1) with ESMTP id
lALIPdnQ005591
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256
verify=NO)
for <***@ormail.co.uk>; Wed, 21 Nov 2007 18:25:41 GMT
Received: from [213.145.123.97] (port=1961)
by victoria.sitehq5.com with esmtp (Exim 4.63)
(envelope-from <Gigi-***@anhaengerbau-groskorth.com>)
id 1IuuGa-0007fx-JL
for ***@robinstrust.org; Wed, 21 Nov 2007 18:25:41 +0000
Received: from GALATASARAY ([177.148.127.112] helo=GALATASARAY)
by [213.145.123.97] ( sendmail 8.13.3/8.13.1) with esmtpa id
1etuPB-000AWY-qL
for ***@robinstrust.org; Wed, 21 Nov 2007 20:25:47 +0200
Date: Wed, 21 Nov 2007 20:25:24 +0200
From: "Gigi Howald" <Gigi-***@anhaengerbau-groskorth.com>
Reply-To: "Gigi Howald" <Gigi-***@anhaengerbau-groskorth.com>
Message-ID: <***@anhaengerbau-groskorth.com>
To: <***@robinstrust.org>
Subject: tainidep
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="windows-1251";
reply-type=original
X-AntiAbuse: This header was added to track abuse, please include it
with any abuse report
X-AntiAbuse: Primary Hostname - victoria.sitehq5.com
X-AntiAbuse: Original Domain - robinstrust.org
X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12]
X-AntiAbuse: Sender Address Domain - anhaengerbau-groskorth.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-4.0 (dayna.orpheusnet.co.uk [194.93.128.106]); Wed, 21
Nov 2007 18:25:41 +0000 (GMT)

Wassup chair
Use in case of emergency. Ciolis and Viogra
http://herwhole.com

Gigi Howald

So dayna seems to be bypassing the proper filters too.

Sorry to be a pain, but I hope this might give some leads towards a
solution.

With best wishes,

Peter.

[Adrian Crafer]

Post by Dr Peter Young
On 21 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

Post by Dr Peter Young
Not so, Sir, but far otherwise! From the headers of a message dated
X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-4.0 (jenna.orpheusnet.co.uk [82.138.249.180]); Wed, 21

Hmm. I'm guessing Jenna is configured slightly differently,

[snip]

Post by Dr Peter Young
So dayna seems to be bypassing the proper filters too.
Sorry to be a pain, but I hope this might give some leads towards a
solution.

One I received at least two lots of spam this morning that had also
not been filtered by dayna, and also one from vila. The dayna one
appears to have acquired a may be forged comment, but I am not sure
where they are put on.

Return-Path: <***@backweb.com>
Received: from dayna.orpheusnet.co.uk (dayna.orpheusnet.co.uk
[194.93.128.106])
by orac.orpheusnet.co.uk (8.14.1/8.13.1) with ESMTP id
lAM2TsNl031770
for <***@swindonhistoriccastings.co.uk>; Thu, 22 Nov
2007 02:30:42 GMT
Received: from unilever.com (202.57.172.73.ppp-bkk.ego.co.th
[202.57.172.73] (may be forged))
by dayna.orpheusnet.co.uk (8.13.1/8.13.1) with ESMTP id
lAM2UF5t011928
for <***@swindonhistoriccastings.co.uk>; Thu, 22 Nov
2007 02:30:19 GMT
In-Reply-To: <062e01c8281c$8250d8aa$***@ms3n511>
Reply-To: "Charles S. Sellers" <***@backweb.com>
From: "Charles S. Sellers" <***@backweb.com>
To: ***@swindonhistoriccastings.co.uk
Subject: increase your wife/gf 1-2 CUP-size LargerBreast Boobies
w6qez72pd9jni1sbtk
X-Sender: <***@backweb.com>
Sender: <***@backweb.com>
Date: Wed, 21 Nov 2007 18:52:41 -0700
Message-ID: <***@backweb.com>
Content-Type: text/plain;
charset="iso-8859-2"
Content-Transfer-Encoding: 8bit
X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-4.0 (dayna.orpheusnet.co.uk [194.93.128.106]); Thu, 22
Nov 2007 02:30:21 +0000 (GMT)

And

Return-Path: <***@advertsingencore.com>
Received: from vila.orpheusnet.co.uk (vila.orpheusnet.co.uk
[194.93.128.82])
by orac.orpheusnet.co.uk (8.14.1/8.13.1) with ESMTP id
lALNTndF018833
for <***@argonet.co.uk>; Wed, 21 Nov 2007 23:30:42 GMT
Received: from mail.advertsingencore.com (mail.advertsingencore.com
[64.187.123.5])
by vila.orpheusnet.co.uk (8.14.1/8.14.1) with ESMTP id
lALNTdEr025780
for <***@argonet.co.uk>; Wed, 21 Nov 2007 23:29:59 GMT
Received: by mail.advertsingencore.com (qmail 412 by uid 77) id
h8ivok01g74a; Wed, 21 Nov 2007 18:23:51 -0500 (envelope-from
<***@advertsingencore.com>)
Date: Wed, 21 Nov 2007 18:23:35 -0500
From: "Homeland Security" <***@advertsingencore.com>
Subject: Affordable, reliable home security
To: ***@argonet.co.uk
Message-ID: <***@advertsingencore.com>
Date: Wed, 21 Nov 2007 18:23:35 -0500 (EST)
Mime-Version: 1.0
Content-Type: text/html; charset=us-ascii;
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-3.0 (vila.orpheusnet.co.uk [194.93.128.82]); Wed, 21
Nov 2007 23:30:00 +0000 (GMT)

Hopefully the further examples might help with a solution.

Adrian Crafer

[Nick Roberts]

Post by Paul Vigay
[Snippety snip]

Post by Dr Peter Young
Not so, Sir, but far otherwise! From the headers of a message dated
X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-4.0 (jenna.orpheusnet.co.uk [82.138.249.180]); Wed, 21

Hmm. I'm guessing Jenna is configured slightly differently, as that's
my sysadmin's development server. It's also our offsite backup server
(ie. hosted in a different location in case the main data centre in
London gets hit by a low flying banana). It shouldn't delay anything,
so the header above looks ok to me.

I'm also getting X-Greylist on emails via:
vila x 5 spam emails with X-Greylist
gan x 3 "
dayna x 6 "
& jenna x 2 "

of which only the 3 from gan also showed the mailscanner headers. As
far as I can see, there was only 1 spam email that _didn't_ have the
Greylist header.

[Dr Peter Young]

On 21 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

Obviously gan bit relates to orpheus, is the Razor stuff something added
by the sender as a smoke screen to imply that it is ok? Does it affect
orpheus scanning if it is. I note a reference to white and grey list,
with an implication that emails are not being matched against the grey
list to speed them up is that correct? If this is the case how much
would the grey list check slow the emails down?

It doesn't. :-)
The grey listing was some experimental code my sysadmin was working on over
the past couple of days. It's currently disabled, so shouldn't be on the
main servers.

Sorry to bang on about this, but all is still not well. This morning,
13 out of 30 messages in my mailbox were spam. Of these 13, 10 had
only the "greylist" header, and only 3 had the "proper" Orpheus spam
filter headers. I think something is still wrong somewhere,

With best wishes,

Peter.

[Nick Roberts]

Post by Dr Peter Young
On 21 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

Post by Adrian Crafer
Obviously gan bit relates to orpheus, is the Razor stuff
something added by the sender as a smoke screen to imply that it
is ok? Does it affect orpheus scanning if it is. I note a
reference to white and grey list, with an implication that emails
are not being matched against the grey list to speed them up is
that correct? If this is the case how much would the grey list
check slow the emails down?

It doesn't. :-)
The grey listing was some experimental code my sysadmin was working
on over the past couple of days. It's currently disabled, so
shouldn't be on the main servers.

Sorry to bang on about this, but all is still not well. This morning,
13 out of 30 messages in my mailbox were spam. Of these 13, 10 had
only the "greylist" header, and only 3 had the "proper" Orpheus spam
filter headers. I think something is still wrong somewhere,

Yep, I fully concur.

I have just downloaded a batch of email including 22 spam. Of these,
only those from gan (3 of them) had X--MailScanner headers.

Of the 16 emails in the same download that we not spam, only 5 had
X--MailScanner headers: 3 from gan and 2 from jenna

So out of 38 emails, a grand total of 8 of them had MailScanner
headers, which looks a bit questionable.

[Adrian Crafer]

Post by Nick Roberts

Post by Dr Peter Young
On 21 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

[snip]

Post by Nick Roberts

Post by Dr Peter Young
Sorry to bang on about this, but all is still not well. This morning,
13 out of 30 messages in my mailbox were spam. Of these 13, 10 had
only the "greylist" header, and only 3 had the "proper" Orpheus spam
filter headers. I think something is still wrong somewhere,

Yep, I fully concur.
I have just downloaded a batch of email including 22 spam. Of these,
only those from gan (3 of them) had X--MailScanner headers.
Of the 16 emails in the same download that we not spam, only 5 had
X--MailScanner headers: 3 from gan and 2 from jenna
So out of 38 emails, a grand total of 8 of them had MailScanner
headers, which looks a bit questionable.

Of the mail downloaded today 13 were spam all with no scanner
information aprt from the white/grey list bits.

The legitimate emails which had come via gan had the correct spam
stamp header as well as the white list stuff. Other emails via the
other servers as per the spam only had the white list info in the
headers.

Adrian Crafer

[Dr Peter Young]

Post by Dr Peter Young

Post by Nick Roberts

Post by Dr Peter Young
On 21 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

[snip]

Post by Nick Roberts

Post by Dr Peter Young
Sorry to bang on about this, but all is still not well. This morning,
13 out of 30 messages in my mailbox were spam. Of these 13, 10 had
only the "greylist" header, and only 3 had the "proper" Orpheus spam
filter headers. I think something is still wrong somewhere,

Yep, I fully concur.
I have just downloaded a batch of email including 22 spam. Of these,
only those from gan (3 of them) had X--MailScanner headers.
Of the 16 emails in the same download that we not spam, only 5 had
X--MailScanner headers: 3 from gan and 2 from jenna
So out of 38 emails, a grand total of 8 of them had MailScanner
headers, which looks a bit questionable.

Of the mail downloaded today 13 were spam all with no scanner
information aprt from the white/grey list bits.
The legitimate emails which had come via gan had the correct spam
stamp header as well as the white list stuff. Other emails via the
other servers as per the spam only had the white list info in the
headers.

Slightly better here this morning; 12 out of 23 messages were spam,
and of these 12, 6 had only the "greylist" header.

We do all understand how difficult it is to weed out all spam, but it
would be nice of the filters got a chance :-(

With best wishes,

Peter.

[Dr Peter Young]

On 24 Nov 2007 Dr Peter Young <***@ormail.co.uk> wrote:

[snip]

Post by Dr Peter Young
We do all understand how difficult it is to weed out all spam, but it
would be nice of the filters got a chance :-(

Sorry, me yet again. This morning 25 messages, 16 spam, proper filter
headers (i.e. other than the the greylist ones) on only one of the
spam messages. Is this going to be fixed?

With best wishes,

Peter.

[Russell Hafter News]

Post by Dr Peter Young
[snip]

Post by Dr Peter Young
We do all understand how difficult it is to weed out
all spam, but it would be nice of the filters got a
chance :-(

Sorry, me yet again. This morning 25 messages, 16 spam,
proper filter headers (i.e. other than the the greylist
ones) on only one of the spam messages. Is this going to
be fixed?

I have not been studying my spam in any detail recently - I
have better things to do when e-mail is downloaded
header-only under GPRS on a hand held - but there did seem
to a sudden big increase on Wednesday / Thursday.

Being now back in the UK I have just had a look at one at
random that just came in:

here are the headers...

Return-Path: <***@assaereo.it>
Received: from dayna.orpheusnet.co.uk
(dayna.orpheusnet.co.uk [194.93.128.106])
by orac.orpheusnet.co.uk (8.14.1/8.13.1) with ESMTP id
lAPBkHWD013359
for <***@walking-in-germany.co.uk>; Sun, 25 Nov 2007
11:47:07 GMT
Received: from [81.88.249.86] ([81.88.241.226])
by dayna.orpheusnet.co.uk (8.13.1/8.13.1) with ESMTP id
lAPBkGts029150
for <***@walking-in-germany.co.uk>; Sun, 25 Nov 2007
11:46:18 GMT
Received: from galetti ([153.188.197.107] helo=galetti)
by [81.88.249.86] ( sendmail 8.13.3/8.13.1) with esmtpa id
1HMbek-000EZC-cI
for ***@walking-in-germany.co.uk; Sun, 25 Nov 2007
12:47:00 +0100
Message-ID: <000e01c82f58$cd4b70c0$***@galetti>
From: "Tami Hehar" <***@assaereo.it>
To: <***@walking-in-germany.co.uk>
Subject: bastino
Date: Sun, 25 Nov 2007 12:46:22 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0009_01C82F61.2F0FD8C0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3028
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-4.0 (dayna.orpheusnet.co.uk
[194.93.128.106]); Sun, 25 Nov 2007 11:46:18 +0000 (GMT)

No obvious filtering there...

[J Peachey]

Post by Dr Peter Young
[snip]

Post by Dr Peter Young
We do all understand how difficult it is to weed out all spam, but it
would be nice of the filters got a chance :-(

Sorry, me yet again. This morning 25 messages, 16 spam, proper filter
headers (i.e. other than the the greylist ones) on only one of the
spam messages. Is this going to be fixed?

Hmm. I don't normally worry about the spam levels. But tonight I had
169 emails, 75 of which are spam. This is up from the usual level of
8-10 spam per download.

Thank goodness for broadband.

John

[Dr Peter Young]

Post by J Peachey

Post by Dr Peter Young
[snip]

Post by Dr Peter Young
We do all understand how difficult it is to weed out all spam, but it
would be nice of the filters got a chance :-(

Sorry, me yet again. This morning 25 messages, 16 spam, proper filter
headers (i.e. other than the the greylist ones) on only one of the
spam messages. Is this going to be fixed?

Hmm. I don't normally worry about the spam levels. But tonight I had
169 emails, 75 of which are spam. This is up from the usual level of
8-10 spam per download.
Thank goodness for broadband.

Amen to that!

Again, this is written in sorrow, not anger, but now that Paul is back
from the show (and I hope it was successful), I'm sure that a lot of
us would like some authoritative answers.

Since I've been collecting statistics at 0800 on 28 November:

Percentage of messages received that are spam: 30%. A lot more than we
have been used to.

Percentage of spams that only have the greylist headers: 81%. Perhaps
I've misunderstood the situation, but that seems to me that the spam
filters aren't working for that amount of spam

Any comments?

With best wishes,

Peter.

[Paul Vigay]

In a dim and distant universe <***@pnyoung.ormail.co.uk>,
Dr Peter Young <***@ormail.co.uk> muttered:
[Snippety snip]

Post by Dr Peter Young
Again, this is written in sorrow, not anger, but now that Paul is back
from the show (and I hope it was successful), I'm sure that a lot of us
would like some authoritative answers.

Unfortunately, there is no authoritative answer, as I can't see where the
problem lies. Everything appears to be working normally this end, so I can
only assume that the spammers have become a bit more devious.

As explained in the past, it's a bit of a never-ending battle trying to
block spam (without blocking legitimate emails), so all I can say is that
I'm aware of the problem and am investigating it.

Paul

[Dr Peter Young]

Post by Paul Vigay
[Snippety snip]

Post by Dr Peter Young
Again, this is written in sorrow, not anger, but now that Paul is back
from the show (and I hope it was successful), I'm sure that a lot of us
would like some authoritative answers.

Unfortunately, there is no authoritative answer, as I can't see where the
problem lies. Everything appears to be working normally this end, so I can
only assume that the spammers have become a bit more devious.
As explained in the past, it's a bit of a never-ending battle trying to
block spam (without blocking legitimate emails), so all I can say is that
I'm aware of the problem and am investigating it.

All this is fully understood, but the point is not the amount of spam,
but the fact that much more seems to be getting through since the
greylist headers started appearing, and for 80% of the time appearing
without the usual spam filter headers. (FWIW 6 spams this morning, and
3 with only the greylist headers.)

When you say that "everything seems to be working normally at this
end" do you mean that you don't get these greylist only ones? If so,
then the spammers must be getting devious indeed. Is it possible for
them to bypass the servers? Or have they done something nasty to them?

Just wondering ...

With best wishes,

Peter

[Russell Hafter News]

Post by Dr Peter Young
When you say that "everything seems to be working
normally at this end" do you mean that you don't get
these greylist only ones? If so, then the spammers must
be getting devious indeed. Is it possible for them to
bypass the servers? Or have they done something nasty to
them?

Indeed, if I understand Peter correctly, what he is finding,
as am I, is that most e-mail now has no headers at all
indicating processing by Spam Assasin.

It may well be that you have changed to a different system
of spam checking which does not add its headers to the
e-mail.

In the past, "everything working normally" meant that
e-mails arrived with headers such as:

X-orpheus-MailScanner: Found to be clean
X-orpheus-MailScanner-SpamCheck: not spam, SpamAssassin (not
cached,
score=3.501, required 5, BAYES_99 3.50, HTML_MESSAGE 0.00)
X-orpheus-MailScanner-SpamScore: 3

We just, by an large, no longer see such headers. If you
have stopped using Spam Assassin, it would be interesting to
know why.

If you have not, then things are manifestly "not working
normally"

Interestingly, the sample I give above is a puzzle as to why
it got an SA score of three.

The only text in the e-mail is

Post by Dr Peter Young
Can you please send me information on this area and your
offered packages.
Thank You

plus the senders name.

It came from an ISP in Ireland (not, I would have thought, a
significant base for known spammers).

The originating ISP had already scanned the e-mail for spam,
using a different system, and it scored zero.

[Adrian Crafer]

Post by Russell Hafter News

Post by Dr Peter Young
When you say that "everything seems to be working
normally at this end" do you mean that you don't get
these greylist only ones? If so, then the spammers must
be getting devious indeed. Is it possible for them to
bypass the servers? Or have they done something nasty to
them?

Indeed, if I understand Peter correctly, what he is finding,
as am I, is that most e-mail now has no headers at all
indicating processing by Spam Assasin.
It may well be that you have changed to a different system
of spam checking which does not add its headers to the
e-mail.
In the past, "everything working normally" meant that
X-orpheus-MailScanner: Found to be clean
X-orpheus-MailScanner-SpamCheck: not spam, SpamAssassin (not
cached,
score=3.501, required 5, BAYES_99 3.50, HTML_MESSAGE 0.00)
X-orpheus-MailScanner-SpamScore: 3

[snip]

I had a long chat with Paul on Saturday at the show, and he advised me
that all the servers other than 'gan' had had their software updated.
gan had not as that allows a roll back position. Paul also said that
the servers have been rebooted so that everything was running lovely.

After leaving the show and travelling home it occurred to me that the
new improved software may have a default of no spam checking. So maybe
Paul you need to check the set up again and confirm its doing what you
think its doing, and what we as customers would like it to do.

Thanks

Adrian Crafer

[Dr Peter Young]

Post by Russell Hafter News

Post by Dr Peter Young
When you say that "everything seems to be working
normally at this end" do you mean that you don't get
these greylist only ones? If so, then the spammers must
be getting devious indeed. Is it possible for them to
bypass the servers? Or have they done something nasty to
them?

Indeed, if I understand Peter correctly, what he is finding,
as am I, is that most e-mail now has no headers at all
indicating processing by Spam Assasin.

Indeed that is so. If someone can explain to me what the greylist
headers mean, and why they apparently let spam through, then I will
shut up!

For the time being, anyway :-)

With best wishes,

Peter.

[Dr Peter Young]

Post by Dr Peter Young

Post by Russell Hafter News

Post by Dr Peter Young
When you say that "everything seems to be working
normally at this end" do you mean that you don't get
these greylist only ones? If so, then the spammers must
be getting devious indeed. Is it possible for them to
bypass the servers? Or have they done something nasty to
them?

Indeed, if I understand Peter correctly, what he is finding,
as am I, is that most e-mail now has no headers at all
indicating processing by Spam Assasin.

Indeed that is so. If someone can explain to me what the greylist
headers mean, and why they apparently let spam through, then I will
shut up!

Answer came there none :-(

80% of spam so far today with only greylist headers.

With best wishes,

Peter.

[Tennant Stuart]

Post by Paul Vigay
As explained in the past, it's a bit of a never-ending battle trying to
block spam (without blocking legitimate emails), so all I can say is that
I'm aware of the problem and am investigating it.

I do appreciate your efforts, but surely the never-ending battle involves:

a) Spammer creates spam version 1

b) Orpheus finds a way to block it

c) Spam version 1 stops arriving

d) Spammer creates spam version 2

e) Orpheus finds a way to block it

f) Spam version 2 stops arriving

g) Spammer creates... and so on

What shouldn't happen is spam version 1 etc starts arriving again.


Tennant

[Adrian Crafer]

Post by Tennant Stuart

Post by Paul Vigay
As explained in the past, it's a bit of a never-ending battle trying to
block spam (without blocking legitimate emails), so all I can say is that
I'm aware of the problem and am investigating it.

[snip]

Post by Tennant Stuart
What shouldn't happen is spam version 1 etc starts arriving again.
Tennant

I have not checked my spam over the last couple of days, I just
deleted it. The level seems to be much the same.

Today I checked my emails, none from 'gan'.

No emails have a spam assassin header. However it was noted that both
spam and legitimate emails were being reported as delayed by the grey
list, so that system now appear to be active. Can we please have spam
assasin back as well to deal with type 1 spam.

Paul is well aware of the problems white/grey lists can cause as he is
invetigating a problem with BTinternet really Yahoo where simultaneous
emails to 5 or more customers of Btinternet get blocked.

Adrian Crafer

[Dr Peter Young]

Post by Dr Peter Young

Post by Tennant Stuart

Post by Paul Vigay
As explained in the past, it's a bit of a never-ending battle trying to
block spam (without blocking legitimate emails), so all I can say is that
I'm aware of the problem and am investigating it.

[snip]

Post by Tennant Stuart
What shouldn't happen is spam version 1 etc starts arriving again.
Tennant

I have not checked my spam over the last couple of days, I just
deleted it. The level seems to be much the same.
Today I checked my emails, none from 'gan'.
No emails have a spam assassin header. However it was noted that both
spam and legitimate emails were being reported as delayed by the grey
list, so that system now appear to be active. Can we please have spam
assasin back as well to deal with type 1 spam.

Certainly a lot less here today, but 4 out of the 11 spams so far
today still don't have the SpamAssasin headers. But for this relief
much thanks.

Post by Dr Peter Young
Paul is well aware of the problems white/grey lists can cause

I am still aware that nobody has yet told me what the greylist means,
and why its advent coincided with the sudden upsurge in spam. I
promise that I'll go on wittering about it till someone does get round
to explaining :-)

Post by Dr Peter Young
as he is invetigating a problem with BTinternet really Yahoo where
simultaneous emails to 5 or more customers of Btinternet get blocked.

???

With best wishes,

Peter.

[Paul Vigay]

Post by Dr Peter Young
I am still aware that nobody has yet told me what the greylist means,
and why its advent coincided with the sudden upsurge in spam. I promise
that I'll go on wittering about it till someone does get round to
explaining :-)

According to my sysadmin, the arrival of the greylist headers was a total
coincidence to the sudden surge in spam and the two are completely
unrelated.

Paul

[Dr Peter Young]

Post by Paul Vigay

Post by Dr Peter Young
I am still aware that nobody has yet told me what the greylist means,
and why its advent coincided with the sudden upsurge in spam. I promise
that I'll go on wittering about it till someone does get round to
explaining :-)

According to my sysadmin, the arrival of the greylist headers was a total
coincidence to the sudden surge in spam and the two are completely
unrelated.

Thanks, and I'll now give over :-)

However, I still don't know what they /mean/!

With best wishes,

Peter.

[Dr Peter Young]

On 21 Nov 2007 Paul Vigay

Post by Paul Vigay
[Snippety snip]

Obviously gan bit relates to orpheus, is the Razor stuff something added
by the sender as a smoke screen to imply that it is ok? Does it affect
orpheus scanning if it is. I note a reference to white and grey list,
with an implication that emails are not being matched against the grey
list to speed them up is that correct? If this is the case how much
would the grey list check slow the emails down?

It doesn't. :-)
The grey listing was some experimental code my sysadmin was working on over
the past couple of days. It's currently disabled, so shouldn't be on the
main servers.

The problem continues, the greylist headers are still being added
without any proper filter headers, and much more spam than usual is
coming through. I have no idea of these comments are related. Can we
have a comment, please?

With best wishes,

Peter.

[Russell Hafter News]

In article

Post by Paul Vigay
1. We update all our spam detection systems.
2. Spammers devise new ways to bypass spam detection
methods.
3. GO TO 1."

Ought that not to read:

WHILE spam=true
1. We update all our spam detection systems.
2. Spammers devise new ways to bypass spam detection
methods.
END WHILE

:-)

[Tennant Stuart]

Post by Paul Vigay
As my sysadmin commented to me during the week when I asked him about
1. We update all our spam detection systems.
2. Spammers devise new ways to bypass spam detection methods.
3. GO TO 1."

Except spam is arriving *without* new ways to bypass detection.


Tennant Stuart