Additional URIBL phish/fraud list

2004-09-18 Thread Bill Landry
This is a list that MailPolice hosts and I have been running it for a few hours and it has already flagged some phish and fraud e-mails. Here is some info about the list: http://rhs.mailpolice.com/#rhsfraud This is my configuration for SA 2.64 with the SpamCopURI plug-in: uri MP_URI_RBL

Re: Additional URIBL phish/fraud list

2004-09-18 Thread Jeff Chan
On Friday, September 17, 2004, 4:24:37 PM, Bill Landry wrote: This is a list that MailPolice hosts and I have been running it for a few hours and it has already flagged some phish and fraud e-mails. Here is some info about the list: http://rhs.mailpolice.com/#rhsfraud This is my

Re[2]: Memory usage question

2004-09-18 Thread Robert Menschel
Hello Chr., Friday, September 17, 2004, 7:58:11 AM, Stucki (Christoph von Stuckrad) wrote: CvS On Fri, Sep 17, 2004 at 10:42:20AM -0400, Matt Kettler wrote: Since your box has 256mb of physical ram, I'd limit it to maximum of 256mb/15mb = 17 spamd's at the highest. I'd really suggest using

Re: New spammer trick?

2004-09-18 Thread Robert Menschel
Hello Andy, Friday, September 17, 2004, 3:23:15 AM, you wrote: AS Hi, I just got a nigerian spam with a huge Reply-To: line! Never seen AS that trick before, but I suppose it works with quite a few of the AS recipients. Should we create a new rule for that? I can't think of AS a legitimate

very basic IP address question

2004-09-18 Thread lee
hello everyone, With IP addresses, do the blocks of numbers have any specific meaning or location-specific detail? For eg, lots of spam I'm getting sent to one of my domain's addresses with netsky attachments always shows 203.221 as the first two IP blocks when I look at the received

Re: very basic IP address question

2004-09-18 Thread lee
Thanks, I've now sent their abuse department the details, although I understand that spammers can appear to be on a certain ISP even if they're not. lee jdow wrote: A simple "whois" query indicates this is a set of addresses "owned" by Comindico in Oz. If you don't have "whois" handy

Re: spam w/ special characters

2004-09-18 Thread Matt Kettler
At 06:21 PM 9/18/2004 +0300, Marie Fischer wrote: Hello, in the last week or two, we have been getting some spam that spamassassin doesn't seem to recognize. A common feature of all these messages seems to be that they contain lots of special characters (~, ^, `, and others) mixed into the text. I

Re: spam w/ special characters

2004-09-18 Thread Loren Wilton
Would a rule to calculate some kind of special chars vs total chars ratio be useful? Does anybody have that kind of rule already? Doing that as a ratio would require an eval, I suspect. However, detecting obfuscated things is pretty easy. You need some new rules! :-) Hie thee off to exit0

stripping SA headers for reporting? (spamcop, etc.)

2004-09-18 Thread John Owens
I report spam to SpamCop among other places. I get mail from several upstream places (where I don't have control of the SA parameters), so when I get spam, it's often wrapped in a variety of different ways (sometimes as a MIME attachment, sometimes with SA results in the headers, etc.). I'd

Re: stripping SA headers for reporting? (spamcop, etc.)

2004-09-18 Thread Matt Kettler
At 03:32 PM 9/18/2004 +, John Owens wrote: I'd like to send as original a message as I can to SpamCop and other places since they don't like munged reports. Currently I'm doing this manually, which is annoying. I note that sa-learn knows how to remove all SA-specific annotations from a message

Re: spam w/ special characters

2004-09-18 Thread Raymond Dijkxhoorn
Hi! in the last week or two, we have been getting some spam that spamassassin doesn't seem to recognize. A common feature of all these messages seems to be that they contain lots of special characters (~, ^, `, and others) mixed into the text. I put some examples up at http://marie.vtl.ee/spam.txt

Re: stripping SA headers for reporting? (spamcop, etc.)

2004-09-18 Thread Ryan Thompson
Andre Nicholson wrote to users@spamassassin.apache.org: John Owens wrote: I'd like to send as original a message as I can to SpamCop and other places since they don't like munged reports. Currently I'm doing this manually, which is annoying. I note that sa-learn knows how to remove all

Two logs for each daemon?

2004-09-18 Thread Ed Kasky
I just upgraded to 3.0.7-1 and noticed an slight oddity in the logs now beig created. In my smb.conf I have: log level = 2 log file = /var/log/samba/%m.log Since upgrading I now get two logs for smbd and two for nmbd... 114676 Sep 18 07:19 /var/log/samba/log.nmbd 100728 Sep 18 15:35