Stopping HTML Spam mail using your own address

2008-12-26 Thread The Doctor
Does anyone know how to stop this menace? -- Member - Liberal International This is doc...@nl2k.ab.ca Ici doc...@nl2k.ab.ca God, Queen and country! Beware Anti-Christ rising! Merry Christmas 2008 NOT 2o8 and Happy New Year 2009 NOT 2o9 -- This message has been scanned for viruses

Re: Stopping HTML Spam mail using your own address

2008-12-26 Thread Benny Pedersen
On Fri, December 26, 2008 13:48, The Doctor wrote: Does anyone know how to stop this menace? http://www.arschkrebs.de/postfix/postfix_restriction_classes3_en.shtml -- Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Bayes-SQL improvements

2008-12-26 Thread Justin Mason
so you're basically sharding the bayes_token tables... could you open a bug on the SpamAssassin bugzilla with this patch? thanks! --j. Thorsten Meinl writes: --nextPart9059977.pG6Pp7397c Content-Type: multipart/mixed; boundary=Boundary-01=_oj8UJ9IS8rBJw6M Content-Transfer-Encoding: 7bit

Re: Stopping HTML Spam mail using your own address

2008-12-26 Thread mouss
The Doctor a écrit : Does anyone know how to stop this menace? Post a sample to pastebin so that we see which one(s) make it to your inbox. if your server does not need to allow unauthenticated access to your users, then you can configure your MTA to block such mail except from authenticated

A lot of spams go through, see example

2008-12-26 Thread Igor Chudov
http://igor.chudov.com/tmp/spam005.txt I get a lot of these, all seemingly sent by the same software and the same person, any way of filtering them out? i

Re: A lot of spams go through, see example

2008-12-26 Thread Benny Pedersen
On Fri, December 26, 2008 20:06, Igor Chudov wrote: http://igor.chudov.com/tmp/spam005.txt I get a lot of these, all seemingly sent by the same software and the same person, any way of filtering them out? add the domain to http://uribl.com/ (you need a login there) currently

Re: A lot of spams go through, see example

2008-12-26 Thread Rob McEwen
Igor Chudov wrote: http://igor.chudov.com/tmp/spam005.txt I get a lot of these, all seemingly sent by the same software and the same person, any way of filtering them out? The sending IP is currently blacklisted on FiveTenSig and ivmSIP/24. Both of these are best used as scoring lists and

Re: A lot of spams go through, see example

2008-12-26 Thread SM
At 11:06 26-12-2008, Igor Chudov wrote: http://igor.chudov.com/tmp/spam005.txt I get a lot of these, all seemingly sent by the same software and the same person, any way of filtering them out? Autolearning is categorizing that email as ham because of the zero score. Turn off autolearning or

Re: sa-update damages existing SA installation

2008-12-26 Thread jidanni
DNS seems to have been reporting 709395 as current for about eight weeks HK If you want more up-to-date protection, use latest SVN (3.3). That's where HK the development happens. It's been working fine here for a long time. All I know is I have $ crontab -l 33 3 * * * PATH=$HOME/bin:$PATH

Re: sa-update damages existing SA installation

2008-12-26 Thread Henrik K
On Sat, Dec 27, 2008 at 04:31:48AM +0800, jida...@jidanni.org wrote: DNS seems to have been reporting 709395 as current for about eight weeks HK If you want more up-to-date protection, use latest SVN (3.3). That's where HK the development happens. It's been working fine here for a long time.

Re: sought rules updates

2008-12-26 Thread jidanni
m http://www.netoyen.net/sa/sa-update.sh.txt m http://www.netoyen.net/sa/channel.conf They give 403 Forbidden.

Re: I have a new email address! spam

2008-12-26 Thread jidanni
m those I looked at triggered JM_SOUGHT_FRAUD_1. so make sure you use the m sought channel in your sa-update. OK, I did all the research to find what it might be that you were talking about. I completed the steps (some of them exposing how sa-update fails to catch a bumbling user): $ wget

Re: sought rules updates

2008-12-26 Thread mouss
jida...@jidanni.org a écrit : m http://www.netoyen.net/sa/sa-update.sh.txt m http://www.netoyen.net/sa/channel.conf They give 403 Forbidden. should be fixed now. sorry for the annoyance.

Re: I have a new email address! spam

2008-12-26 Thread mouss
jida...@jidanni.org a écrit : m those I looked at triggered JM_SOUGHT_FRAUD_1. so make sure you use the m sought channel in your sa-update. OK, I did all the research to find what it might be that you were talking about. I completed the steps (some of them exposing how sa-update fails to

Re: A lot of spams go through, see example

2008-12-26 Thread sebastian
Igor Chudov schrieb: http://igor.chudov.com/tmp/spam005.txt I get a lot of these, all seemingly sent by the same software and the same person, any way of filtering them out? i perhaps you can check it whith http://www.openrbl.org and then you can modificate your config on your mail server

Re: I have a new email address! spam

2008-12-26 Thread Ned Slider
jida...@jidanni.org wrote: m those I looked at triggered JM_SOUGHT_FRAUD_1. so make sure you use the m sought channel in your sa-update. OK, I did all the research to find what it might be that you were talking about. I completed the steps (some of them exposing how sa-update fails to catch a

what's the big risk with sa-update --nogpg?

2008-12-26 Thread jidanni
So what's the worst thing that could happen to me with sa-update --nogpg? Just a little more spam getting through? Ha! If you would just follow instructions, you wouldn't need --nogpg Yes, well, let's just say things didn't work out, and we want to use --nogpg just for that risky feel. Like

Re: A lot of spams go through, see example

2008-12-26 Thread Ned Slider
SM wrote: At 11:06 26-12-2008, Igor Chudov wrote: http://igor.chudov.com/tmp/spam005.txt I get a lot of these, all seemingly sent by the same software and the same person, any way of filtering them out? Autolearning is categorizing that email as ham because of the zero score. Turn off

Re: sa-update damages existing SA installation

2008-12-26 Thread jidanni
HK If SVN does not ring a bell, Oh, you mean like the example on http://svn.savannah.gnu.org/viewvc/trunk/grub2/docs/grub.texi?root=grubview=log $ svn co svn://svn.sv.gnu.org/grub/trunk/grub2/docs/grub.texi svn: URL 'svn://svn.sv.gnu.org/grub/trunk/grub2/docs/grub.texi' refers to a file, not a

Re: what's the big risk with sa-update --nogpg?

2008-12-26 Thread mouss
jida...@jidanni.org a écrit : So what's the worst thing that could happen to me with sa-update --nogpg? Just a little more spam getting through? Ha! If you would just follow instructions, you wouldn't need --nogpg Yes, well, let's just say things didn't work out, and we want to use

'sought' rules take three times longer to run

2008-12-26 Thread jidanni
OK, I have just finished $ sa-update -D --no-gpg --channel sought.rules.yerp.org And would just like to warn other users that 'sought' rules take three times longer: $ time spamassassin --local -t a_typical_spam_message /dev/null real0m14.081s user0m13.489s sys 0m0.588s Up from real

Re: what's the big risk with sa-update --nogpg?

2008-12-26 Thread Benny Pedersen
On Fri, December 26, 2008 22:44, jida...@jidanni.org wrote: So what's the worst thing that could happen, our mailbox getting cancer? cheers -- Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: what's the big risk with sa-update --nogpg?

2008-12-26 Thread Jake Maul
The point of the GPG sig check is to verify the authenticity of the source of the rules you're downloading. To get in the frame of mind as to what it means to skip this, consider what it would mean to have an unknown (obviously malicious) person masquerade as your wife/husband for a while. What

Re: 'sought' rules take three times longer to run

2008-12-26 Thread jidanni
I took a look at Mail::SpamAssassin::Plugin::Shortcircuit, but what I really want to do is if it is ham, run it through the expensive 'sought' extra tests, to see if it really is ham. I.e., if the end result is below required_score, continue on into the sought tests. Probably the only way to do