Re: Phishing rules?

2008-10-31 Thread Jeff Chan
On Thursday, October 30, 2008, 12:56:53 PM, Micah Anderson wrote: I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: [...] I've got spamassassin 3.2.5 with URIBL plugin loaded (which I understand pulls in the 25_uribl.cf

Re: Phishing rules?

2008-10-31 Thread Brent Clark
Hiya See SA examples http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists Also add hostkarma.junkemailfilter.com to you DNSBL. Works really well. Another thing I do find is useful is adding additional higher valued MX records. http://www.junkemailfilter.com/spam/support.html HTH

Re: Problems with the email adress of our company

2008-10-31 Thread Kai Schaetzl
Greg Troxel wrote on Thu, 30 Oct 2008 08:53:17 -0400: So I wonder if domains with no vowels are normal in Germany no. (they are not normal in the US). Easy: Remote Sensing Solutions GmbH - Remote Sensing Solutions Ltd - rssltd.com Kai -- Kai Schätzl, Berlin, Germany Get your web at

Re: Problems with the email adress of our company

2008-10-31 Thread Matt Kettler
Kai Schaetzl wrote: Greg Troxel wrote on Thu, 30 Oct 2008 08:53:17 -0400: So I wonder if domains with no vowels are normal in Germany no. Regardless, they're common enough that the S/O for the rule was sucking really bad on recent ruleQA's. (FROM_DOMAIN_NOVOWEL was posting

sa-update directory

2008-10-31 Thread Shelley Waltz
I am running spamassassin with amavisd on RHEL5. I have the perl script sa-update run daily. There are updates .cf files written into /var/lib/spamassassin/3.002004/updates_spamassassin_org/ and there is a /var/lib/spamassassin/3.002004/updates_spamassassin_org.cf I have

RE: sa-update directory

2008-10-31 Thread Bowie Bailey
Shelley Waltz wrote: I am running spamassassin with amavisd on RHEL5. I have the perl script sa-update run daily. There are updates .cf files written into /var/lib/spamassassin/3.002004/updates_spamassassin_org/ and there is a /var/lib/spamassassin/3.002004/updates_spamassassin_org.cf

Rule for encoded/bugged URLs?

2008-10-31 Thread Kevin Windham
Is there a ruleset for encoded URLs or addresses? I have some examples I can send, but so far I tried to send this email twice with the example URLs, and it never makes it to the list, so I'm guessing someone has some rules in place that I would like to be running on my server. TIA,

Re: Rule for encoded/bugged URLs?

2008-10-31 Thread ram
On Fri, 2008-10-31 at 08:53 -0500, Kevin Windham wrote: Is there a ruleset for encoded URLs or addresses? I have some examples I can send, but so far I tried to send this email twice with the example URLs, and it never makes it to the list, so I'm guessing someone has some rules in place

Re: Rule for encoded/bugged URLs?

2008-10-31 Thread Kevin Windham
On Oct 31, 2008, at 9:25 AM, ram wrote: Use a pastebin to paste the entire mail and send us the the URL. Here is the email. http://pastebin.com/m4d55a610 Thanks, Kevin

Re: Rule for encoded/bugged URLs?

2008-10-31 Thread Ned Slider
Kevin Windham wrote: On Oct 31, 2008, at 9:25 AM, ram wrote: Use a pastebin to paste the entire mail and send us the the URL. Here is the email. http://pastebin.com/m4d55a610 Thanks, Kevin Not sure what you mean by encoded - the fact it's part of an html formatted message? Anyway,

OT need anti-spam domain registrar

2008-10-31 Thread Michael Scheidell
I need a domain registry who won't spam me every two weeks with crap and argue that since I am a client of theirs, its not a violation of can-spam laws to spam me and refuse to stop. And, no, I can't change the email address because then we won't get REALLY important announcements, like

Re: OT need anti-spam domain registrar

2008-10-31 Thread Sahil Tandon
On Oct 31, 2008, at 11:23 AM, Michael Scheidell [EMAIL PROTECTED] wrote: I need a domain registry who won't spam me every two weeks with crap and argue that since I am a client of theirs, its not a violation of can-spam laws to spam me and refuse to stop. And, no, I can't change the

Re: OT need anti-spam domain registrar

2008-10-31 Thread Timothy Lyons
Try dyndns.org and/or gandi.net - never had a problem with either. --Tim On 10/31/08, Michael Scheidell [EMAIL PROTECTED] wrote: I need a domain registry who won't spam me every two weeks with crap and argue that since I am a client of theirs, its not a violation of can-spam laws to spam me

Re: Rule for encoded/bugged URLs?

2008-10-31 Thread Kevin Windham
On Oct 31, 2008, at 9:58 AM, Ned Slider wrote: Kevin Windham wrote: On Oct 31, 2008, at 9:25 AM, ram wrote: Use a pastebin to paste the entire mail and send us the the URL. Here is the email. http://pastebin.com/m4d55a610 Thanks, Kevin Not sure what you mean by encoded - the fact it's

Re: Rule for encoded/bugged URLs?

2008-10-31 Thread John Hardin
On Fri, 31 Oct 2008, Kevin Windham wrote: On Oct 31, 2008, at 9:58 AM, Ned Slider wrote: Not sure what you mean by encoded I just mean that the URLs look like they are encoded to capture identity. I would suggest tagged might be a better way to express that than encoded. -- John

Re: Rule for encoded/bugged URLs?

2008-10-31 Thread Kelson
Kevin Windham wrote: The other sign is the encoded img tags. I can't recall seeing a regular site use img tags that are encoded with no meaningful name. I take it you've never looked at the HTML code for, say, Flickr or Amazon? A *lot* of dynamic websites will use a catalog number (or

Re: Rule for encoded/bugged URLs?

2008-10-31 Thread Kevin Windham
On Oct 31, 2008, at 11:59 AM, Kelson wrote: Kevin Windham wrote: The other sign is the encoded img tags. I can't recall seeing a regular site use img tags that are encoded with no meaningful name. I take it you've never looked at the HTML code for, say, Flickr or Amazon? A *lot* of

Rules with non-ASCII characters and normalize_charset 1

2008-10-31 Thread Ben Winslow
Hello, I've been trying to figure out how to write rules matching international spam with non-ASCII characters -- especially languages with a completely different script (e.g. Cyrillic) -- for SA 3.2.5 on perl 5.10.0. Rather than write rules to match words in 3+ character sets per language

Re: Phishing rules?

2008-10-31 Thread Micah Anderson
* Jeff Chan [EMAIL PROTECTED] [2008-10-31 02:36-0400]: On Thursday, October 30, 2008, 12:56:53 PM, Micah Anderson wrote: I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: [...] I've got spamassassin 3.2.5 with URIBL

Re: OT need anti-spam domain registrar

2008-10-31 Thread Per Jessen
Michael Scheidell wrote: So, who do you use? I don't want to have to whitelist them because they are in DNS blacklists already, and I don't want them sending me 'important offers from our partners that you just can't live without'. I've used networksolutions.com for about 10 years I think.