Re: command-line script to check URIBLs

2013-05-31 Thread Martin Gregorie
On Thu, 2013-05-30 at 23:11 -0400, Alex wrote: It would be great if there was an automated script that included checking surbl.org and others right from a shell script, given a domain name. What exactly are you trying to do? By that I mean, do you want to: 1) test an individual domain name

Re: command-line script to check URIBLs

2013-05-31 Thread Axb
On 05/31/2013 05:11 AM, Alex wrote: Hi all, I'd like to be able to take a domain such as fellass.us and check it against the same blacklists used by sites like mxtools, except do it on the command-line. We have our own URIBL for domains that haven't yet been added to zen or surriel, etc. I'd

increase in spams getting though

2013-05-31 Thread tony
I've been running spamassassin for about 4 years on a centos 5 server, currently running spamassassin-3.3.1-2.el5. I've always been impressed and very pleased with the way SA works and I regularly run sa-update and I update the bayes databases. I use plugins too - raor, pyzor, dkim etc but over

Re: increase in spams getting though

2013-05-31 Thread Martin Hepworth
I'd check what rules are firing for the spam that gets through Could be youve got a whitelist entry being abused or even something internally generating the crud Martin On Friday, 31 May 2013, tony wrote: I've been running spamassassin for about 4 years on a centos 5 server, currently

Re: increase in spams getting though

2013-05-31 Thread Matus UHLAR - fantomas
On 31.05.13 03:52, tony wrote: I've been running spamassassin for about 4 years on a centos 5 server, currently running spamassassin-3.3.1-2.el5. I've always been impressed and very pleased with the way SA works and I regularly run sa-update and I update the bayes databases. I use plugins too -

Re: increase in spams getting though

2013-05-31 Thread Martin Gregorie
On Fri, 2013-05-31 at 03:52 -0700, tony wrote: I've been running spamassassin for about 4 years on a centos 5 server, currently running spamassassin-3.3.1-2.el5. I've always been impressed and very pleased with the way SA works and I regularly run sa-update and I update the bayes databases. I

Question about T_KHOP_FOREIGN_CLICK

2013-05-31 Thread Matteo Vannucchi - TeamEnterprise
Title: FirmaMatteo Hello, my name is Matteo. I do not manage a spamassassin installation, but I would like to ask this simple question, because I saw it is a rule which is used to evaluate spam score. I tried searching Google, the users forum, the Wiki and the Docs

Re: Question about T_KHOP_FOREIGN_CLICK

2013-05-31 Thread Bowie Bailey
On 5/31/2013 8:30 AM, Matteo Vannucchi - TeamEnterprise wrote: Hello, my name is Matteo. I do not manage a spamassassin installation, but I would like to ask this simple question, because I saw it is a rule which is used to evaluate spam score. I tried searching Google, the users forum, the

Re: command-line script to check URIBLs

2013-05-31 Thread Kris Deugau
Alex wrote: Hi all, I'd like to be able to take a domain such as fellass.us and check it against the same blacklists used by sites like mxtools, except do it on the command-line. We have our own URIBL for domains that haven't yet been added to zen or surriel, etc. I'd like to periodically

Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
Hey all - I'm trying to set up a custom rule that scores HTML attachments. The problem I'm running across is that using a rule like this one: mimeheader HTML_ATTACH Content-Type =~ /^text\/html/i Will flag all messages that come in as HTML (vs. plain text). I found this : header

Re: Rule to scan for .html attachments?

2013-05-31 Thread Axb
On 05/31/2013 05:51 PM, Andrew Talbot wrote: Hey all - I'm trying to set up a custom rule that scores HTML attachments. The problem I'm running across is that using a rule like this one: mimeheader HTML_ATTACH Content-Type =~ /^text\/html/i Will flag all messages that come in as HTML (vs.

Re: Rule to scan for .html attachments?

2013-05-31 Thread Martin Gregorie
On Fri, 2013-05-31 at 11:51 -0400, Andrew Talbot wrote: I'm trying to set up a custom rule that scores HTML attachments. ..snippage.. I found this : header HTML_ATTACH_RULE_2 Content-Disposition =~ /^filename\=\[a-z]{2}\.html\/i Don't anchor it to the start of the line, i.e. try this:

Re: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
That didn't work :( On Fri, May 31, 2013 at 12:40 PM, Martin Gregorie mar...@gregorie.orgwrote: On Fri, 2013-05-31 at 11:51 -0400, Andrew Talbot wrote: I'm trying to set up a custom rule that scores HTML attachments. ..snippage.. I found this : header HTML_ATTACH_RULE_2

Re: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
Didn't work with mime_header (or mimeheader) with either rule. On Fri, May 31, 2013 at 12:23 PM, Axb axb.li...@gmail.com wrote: On 05/31/2013 05:51 PM, Andrew Talbot wrote: Hey all - I'm trying to set up a custom rule that scores HTML attachments. The problem I'm running across is that

Re: Rule to scan for .html attachments?

2013-05-31 Thread David F. Skoll
On Fri, 31 May 2013 14:10:36 -0400 Andrew Talbot andrew.talbot.ownweb...@gmail.com wrote: That didn't work :( What didn't work? Oh... you top-posted. Anyway... you might need a full rule, which can be expensive. Something like: full HTML_RULE

Re: Rule to scan for .html attachments?

2013-05-31 Thread Martin Gregorie
On Fri, 2013-05-31 at 14:10 -0400, Andrew Talbot wrote: That didn't work :( Can you post one or two examples of actual MIME attachment headers that you're trying to get the rule to fire on? Obvious question, but have you enabled the MIME header module? I'm using MimeMagic and enabling it

RE: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
That's what I was afraid of. We generally avoid those kinds of rules since we are scanning millions of messages a day. -Original Message- From: David F. Skoll [mailto:d...@roaringpenguin.com] Sent: Friday, May 31, 2013 2:22 PM To: users@spamassassin.apache.org Subject: Re: Rule to

RE: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
I need it to fire on any HTML attachment. The modules are enabled. I can get it to pick up text/html, remember, but the problem is that it detects messages sent as HTML when it's set up like that. It doesn't detect plain-text messages, but it will flag plain-text messages with HTML files

Re: Rule to scan for .html attachments?

2013-05-31 Thread David F. Skoll
On Fri, 31 May 2013 14:43:27 -0400 Andrew Talbot andrew.talbot.ownweb...@gmail.com wrote: That's what I was afraid of. We generally avoid those kinds of rules since we are scanning millions of messages a day. Well, a few rules won't hurt. We peak at around 6 million messages/day, though we

Re: increase in spams getting though

2013-05-31 Thread tony
now I've given it some more thought it's a certain type of spam that gets through. I never get scams or marital aid spam, never. The spam mails that get through are consistently to do with hospitality, increased sales and business courses. Are there rules I should be using to combat this type of

Re: Rule to scan for .html attachments?

2013-05-31 Thread Martin Gregorie
On Fri, 2013-05-31 at 14:45 -0400, Andrew Talbot wrote: I need it to fire on any HTML attachment. The modules are enabled. I can get it to pick up text/html, remember, but the problem is that it detects messages sent as HTML when it's set up like that. It doesn't detect plain-text messages,

Re: command-line script to check URIBLs

2013-05-31 Thread David B Funk
On Thu, 30 May 2013, Alex wrote: Hi all, I'd like to be able to take a domain such as fellass.us and check it against the same blacklists used by sites like mxtools, except do it on the command-line. We have our own URIBL for domains that haven't yet been added to zen or surriel, etc. I'd like

RE: Rule to scan for .html attachments?

2013-05-31 Thread John Hardin
On Fri, 31 May 2013, Andrew Talbot wrote: I need it to fire on any HTML attachment. The modules are enabled. I can get it to pick up text/html, remember, but the problem is that it detects messages sent as HTML when it's set up like that. Meta it with a negated subrule that hits on regular

Re: increase in spams getting though

2013-05-31 Thread Martin Gregorie
On Fri, 2013-05-31 at 12:15 -0700, tony wrote: now I've given it some more thought it's a certain type of spam that gets through. I never get scams or marital aid spam, never. The spam mails that get through are consistently to do with hospitality, increased sales and business courses. Are

Re: command-line script to check URIBLs

2013-05-31 Thread Alex
Hi, It would be great if there was an automated script that included checking surbl.org and others right from a shell script, given a domain name. I've attached a perl script that I hacked together 15 years ago to query both host-based and IPv4 based DNSBL lists. It's kind'a mutated over

Re: Rule to scan for .html attachments?

2013-05-31 Thread Karsten Bräckelmann
On Fri, 2013-05-31 at 11:51 -0400, Andrew Talbot wrote: header HTML_ATTACH_RULE_2 You will need a mimeheader [1] rule. A header rule matches the mail headers only. Content-Disposition =~ /^filename\=\[a-z]{2}\.html\/i That is not matching an

RE: Rule to scan for .html attachments?

2013-05-31 Thread Andrew Talbot
Hi, Martin - Thank you for your response. The original test was using a file arbitrarily named aa.html .. It still doesn't work with the rewrite you provided :/ -Original Message- From: Martin Gregorie [mailto:mar...@gregorie.org] Sent: Friday, May 31, 2013 3:38 PM To:

Re: Rule to scan for .html attachments?

2013-05-31 Thread Martin Gregorie
On Fri, 2013-05-31 at 17:48 -0400, Andrew Talbot wrote: Thank you for your response. The original test was using a file arbitrarily named aa.html .. It still doesn't work with the rewrite you provided :/ I did wonder. Its absolutely essential to have at least one genuine message to test your