>
>True, you might list associated domains. However, URIBLs still
>aren't psychic,
>they're just smart enough to do research :)
>
>However, the important point still remains: Time of check IS a
>major factor when
>talking about URIBLs. You cannot assume that two URIBL checks
>are comparable if
fore
they are used. It also helps we have people throughout the timezones. So at
any time of the day...someone is awake :)
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
>-Original Message-
>From: David B Funk [mailto:[EMAIL PROTECTED]
>Sent: Thursday, June 09, 2005 2:16 PM
>To: Chris Santerre
>Cc: users@spamassassin.apache.org
>Subject: RE: Gif-Only spams
>
>
>On Thu, 9 Jun 2005, Chris Santerre wrote:
>
>> >My onl
>-Original Message-
>From: Geoff Manning [mailto:[EMAIL PROTECTED]
>Sent: Thursday, June 09, 2005 11:45 AM
>To: users@spamassassin.apache.org
>Subject: RE: Gif-Only spams
>
>
>> Check out the interesting idea at www.rulesemporium.com/forums/
>>
>> entitled: Image attachment MD5 footprint
>-Original Message-
>From: Sven Riedel [mailto:[EMAIL PROTECTED]
>Sent: Thursday, June 09, 2005 10:19 AM
>To: users@spamassassin.apache.org
>Subject: Gif-Only spams
>
>
>Hi,
>has anyone developed a good strategy against spams
>that contain a random text and the actual spam in
>an image w
his torrent
>of mortgage
>spam?
>
>Thanks,
>Geoff
Well...you didn't hear this from me...but you could use black.uribl.com.
Sh...don't tell anyone. Its not public yet ;)
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
sages)
>100.000 88.0685 11.93150.881 0.000.00 (all messages as %)
> 65.949 74.8754 0.06400.999 1.003.00 URIBL_BLACK
*cough*
And I've sinced removed the FP that was hit ;)
(Thank you again, little birdy who gave me that data!)
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
also void out a lot of pre-exhisting rules that look for some of
these filter bypassing codes.
I always try to turn their attempts to bypass, into spam flags.
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
>Randomly Generated Tagline:
>"I'd rather see my sister in a whorehouse than my brother
>using windows."
> - Sam Creasey
Ahahahahahahahahahahahah! Theo, you rock!
--Chris
the extra processing up front, our research just
pays more attention to those 'pure evil' hosts. Which is one of the reasons
the domains fall into balck.uribl.com so fast.
I won't release the list of IPs I have now. Not yet anyway. Don't want them
to move :)
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
against other submitters! (Privacy is kept, you
don't know who the others are, just where you fall in the stats.) Fun game,
play against your friends ;)
We are always looking for more mirrors. So if anyone has some spare
bandwidth.
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
>-Original Message-
>From: Michele Neylon :: Blacknight Solutions
>[mailto:[EMAIL PROTECTED]
>Sent: Tuesday, May 31, 2005 5:05 AM
>To: 'Jeff Chan'; 'SURBL Discussion list'; 'SpamAssassin Users'
>Subject: RE: [SURBL-Discuss] Blogger attacks SURBL
>
>
>[EMAIL PROTECTED] wrote:
>> Pardon the
>-Original Message-
>From: Jeff Chan [mailto:[EMAIL PROTECTED]
>Sent: Sunday, May 29, 2005 5:40 AM
>To: Chris
>Cc: users@spamassassin.apache.org
>Subject: Re: NANAS
>
>
>On Saturday, May 28, 2005, 2:52:52 PM, Chris Chris wrote:
>> I know what NANAS is, in fact I report to it nightly,
>ho
ilar, and he seems to be targetting only my
>Boss and not any of our clients.
>
>I guess 'the squeakiest wheel gets the grease' is defintely holding
>true at the minute :)
>
>R
It does happen often. And those IPs get noted. We gather info on them often.
One IP hd something like 6k of spam domains on it.
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
>-Original Message-
>From: Jeff Chan [mailto:[EMAIL PROTECTED]
>Sent: Monday, May 30, 2005 8:57 PM
>To: SURBL Discuss; SpamAssassin Users
>Subject: Blogger attacks SURBL
>
>
>Pardon the dramatic title, but hopefully it got your attention.
>
>This guy's domain got listed by Outblaze, we re
>-Original Message-
>From: Steven Dickenson [mailto:[EMAIL PROTECTED]
>
>Additionally, if you ever need to send directly from your Exchange
>server, not having an MX associated with that machine *can* cause your
>mail to look spammy to certain hard-line sites.
>
>- S
I haven't ever had
Lik Evan has stated, it just queues locally. Same for Sendmail installs. If
we a retalking VERY high traffic, with 1000s of users, then you better have
more then one server. Or a big HD for the queue ;)
--Chris
>-Original Message-
>From: E. Falk [mailto:[EMAIL PROTECTED]
>Sent: Friday,
>-Original Message-
>From: Robert Menschel [mailto:[EMAIL PROTECTED]
>Sent: Thursday, May 26, 2005 8:38 PM
>To: List Mail User
>Cc: users@spamassassin.apache.org
>Subject: Re[2]: Is Bayes Really Necessary?
>
>
>Hello List,
>
>Thursday, May 26, 2005, 10:05:26 AM, you wrote:
>
>LMU> Thoug
>-Original Message-
>From: Jake Colman [mailto:[EMAIL PROTECTED]
>Sent: Friday, May 27, 2005 9:47 AM
>To: users@spamassassin.apache.org
>Subject: Re: Is Bayes Really Necessary?
>
>
>
>OK. I misunderstood. The URIBLS are working fine.
>Interestingly, although
>I use the SARE rules and
>-Original Message-
>From: Jon Gray [mailto:[EMAIL PROTECTED]
>Sent: Friday, May 27, 2005 9:25 AM
>To: SpamAssassin Users
>Subject: Logfile analyzer
>
>
>Can anyone recommend a good logfile analyzer for Spamassassin?
>
Depends on what you want to analyze. One of the ninjas wrote a great
>-Original Message-
>From: David Brodbeck [mailto:[EMAIL PROTECTED]
>Sent: Thursday, May 26, 2005 4:05 PM
>To: users@spamassassin.apache.org
>Subject: Re: Adjusting the AWL value
>
>
>Dimitri Yioulos wrote:
>> Isn't the landscape bar required in every sysadmin's tool kit?
>
>A 3.5 foot le
>-Original Message-
>From: guenther [mailto:[EMAIL PROTECTED]
>Sent: Thursday, May 26, 2005 2:52 PM
>To: Craig Jackson
>Cc: users@spamassassin.apache.org
>Subject: Re: Adjusting the AWL value
>
>
>On Thu, 2005-05-26 at 12:55 -0500, Craig Jackson wrote:
>> Hi,
>> I'd like to change/reset-t
>-Original Message-
>From: Jake Colman [mailto:[EMAIL PROTECTED]
>Sent: Thursday, May 26, 2005 2:54 PM
>To: users@spamassassin.apache.org
>Subject: Re: Is Bayes Really Necessary?
>
>
>>>>>> "CS" == Chris Santerre <[EMAIL PROTECTED]>
strive for, so SA can be more widley
excepted.
I have a 99% filter rate without bayes. And I'm proud of that.
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
>-Original Message-
>From: aecioneto [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, May 25, 2005 8:36 PM
>To: users
>Subject: Re: Comparison of SA and commercial solutions
>
>
>Loren and Chris,
>thanks for your replies.
>I am aware of SA, I have been using it from a very long time
>ago - ha
Which, IMHO is complete BS. You just don't have a phone
number to call. But there is plenty of support.
So again, I have seen no single fair comparison between any comercial
product and SA.
HTH,
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
corpa (old records) as well.
Net tests would be polling outside agencies like Interpol, ect.
Maybe they already have something like this? Maybe not. Just something that
jumped into my ape brain while getting ready for work.
Chris Santerre
System Admin and SARE/URIBL Ninja
http
gt;uridnsbl_skip_domain*.spiegel.de
>uridnsbl_skip_domainspiegel.de
>uridnsbl_skip_domain*.taz.de
>uridnsbl_skip_domaintaz.de
>uridnsbl_skip_domain*.zdf.de
>uridnsbl_skip_domainzdf.de
Have also whitelisted these. URIBL still doesn't have public submissi
> -Original Message-
> From: martin smith [mailto:[EMAIL PROTECTED]
> Sent: Saturday, May 14, 2005 12:43 PM
> To: Spamassassin
> Subject: RE: {SPAM} Drug SPAM problem..any fixes?
>
>
> M>-Original Message-
> M>From: Matt Kettler [mailto:[EMAIL PROTECTED]
> M>Sent: 14 May 2005 1
> -Original Message-
> From: Loren Wilton [mailto:[EMAIL PROTECTED]
> Sent: Saturday, May 14, 2005 9:26 PM
> To: users@spamassassin.apache.org
> Subject: Re: Evading URI checks
>
>
> > > Go Here to Order Online: RxRealness.com
> >
> > > How would one go about adding checks for the omiss
>-Original Message-
>From: Matt Kettler [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, May 11, 2005 12:39 PM
>To: Chris Santerre
>Cc: 'Stuart Gall'; users@spamassassin.apache.org
>Subject: Re: Custom Rule question
>
>
>Chris Santerre wrote:
>
>&g
ach match in the body. and not just an on or off rule.
>
>Is there anyway to do this?
Short answer...no.
Long answer: Multiple meta rules. Take to much computational effort. The
regex isn't slick for these type of rules either.
Eval solution: Count hits, yes. Change score based on
>-Original Message-
>From: Kevin Peuhkurinen [mailto:[EMAIL PROTECTED]
>Sent: Monday, May 09, 2005 11:02 AM
>To: [EMAIL PROTECTED]
>Subject: Re: Stupid rule question
>
>
>Michael W Cocke wrote:
>> This is really getting on my nerves... Using Spamassassin
>3.03, could
>> someone please t
> -Original Message-
> From: Chris [mailto:[EMAIL PROTECTED]
> Sent: Sunday, May 08, 2005 8:59 AM
> To: users@spamassassin.apache.org
> Subject: Bogus Virus Warnings and RDJ
>
>
> I seem to be having another problem with getting the above
> ruleset again.
> Anyone else:
>
> Date: Sa
>-Original Message-
>From: Jason Frisvold [mailto:[EMAIL PROTECTED]
>Sent: Friday, May 06, 2005 3:22 PM
>To: Chris Santerre
>Cc: users@spamassassin.apache.org
>Subject: Re: Anybody order Alistairs book from Pakt?
>
>
>On 5/6/05, Chris Santerre <[EMAIL PROTE
ink it only took a few days to arrive.. I don't remember waiting
>very long for it...
Side note: He recently asked for feedback of things you would like to see
added to a second addition. So if you got any, fire him a quick email.
Looking to take it to a more advanced level.
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
>-Original Message-
>From: Stewart, John [mailto:[EMAIL PROTECTED]
>Sent: Friday, May 06, 2005 11:30 AM
>To: 'Chris Santerre'; 'users@spamassassin.apache.org'
>Subject: RE: Confession and rage
>
>
>
>> >- Simply ban their domai
e is about to get all her emails
blocked from 3/4 of the earth.
Do NOT place false appointments. Do not hack site. DO Educate.
Note: Make sure you do all this AFTER they cut your hair :)
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
>-Original Message-
>From: jdow [mailto:[EMAIL PROTECTED]
>Sent: Friday, May 06, 2005 7:22 AM
>To: spamassassin-users
>Subject: Brandy spanky new drug spam trick
>
>
>From: "Cialis $89, Soma $59, Viagra $69" <[EMAIL PROTECTED]>
>
>Guess what? It passes right through all the tests because
list like, "Wow thats
a big ass!" OR "Geesh your ass is small." THis usually refers to their ASS
DB being corrupt.
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
>-Original Message-
>From: Matt Kettler [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, May 04, 2005 4:16 PM
>To: Andy Jezierski
>Cc: users@spamassassin.apache.org
>Subject: Re: AWL whaaat
>
>
>Andy Jezierski wrote:
>
>>
>> I like it! And since the scores can shift over time, you'd probably
>-Original Message-
>From: Matt Kettler [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, May 04, 2005 1:11 PM
>To: users@spamassassin.apache.org
>Subject: Re: AWL whaaat
>
>
>Kelson wrote:
>
>> Matt Kettler wrote:
>>
>>> Or were you under the misconception based on the name AWL that it is
>>>
7;t get through. Any info is welcome. :D
We also add them to black.uribl.com list. We differentiate internally that
they are phish domains and IPs. But we just add them to the black list
because the outcome is the same :)
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
http://www.uribl.com
>-Original Message-
>From: Chris Lear [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, May 04, 2005 4:47 AM
>To: users@spamassassin.apache.org
>Subject: Re: OT: The highest score?
>
>
>* Chris wrote (05/04/05 01:27):
>> On Sunday 01 May 2005 04:49 pm, John Andersen wrote:
>>> On Sunday 01 May
>-Original Message-
>From: Martin Hepworth [mailto:[EMAIL PROTECTED]
>Sent: Tuesday, May 03, 2005 5:27 AM
>To: SpamAssassin Users
>Subject: rulesemporium.com outage again?
>
>
>All
>
>is it just me or is rulesemporium.com play silly whatsits again? Ie I
>can't connect have haven't be
>-Original Message-
>From: wolfgang [mailto:[EMAIL PROTECTED]
>Sent: Sunday, May 01, 2005 2:03 PM
>To: users@spamassassin.apache.org
>Subject: Re: regexp: exclude a string
>
>
>In an older episode (Sunday 01 May 2005 12:49), Loren Wilton wrote:
>> > /p(?:0|o)rtf(?:0|o)(?:\||l)i(?:0|o)/
>>
>-Original Message-
>From: jdow [mailto:[EMAIL PROTECTED]
>Sent: Monday, May 02, 2005 1:41 AM
>To: users@spamassassin.apache.org
>Subject: Re: The highest score?
>
>
>I cheat. I have a couple personal rules guaranteed to hit spam and no
>ham whatsoever. They hit 100. "MOM Agent" is guaran
>-Original Message-
>From: Kevin Peuhkurinen [mailto:[EMAIL PROTECTED]
>Sent: Monday, May 02, 2005 7:59 AM
>To: users@spamassassin.apache.org
>Subject: Web based helpdesk tool for SA?
>
>
>Lately I've been thinking that something that would really be
>useful for
>SA is a web based helpd
>-Original Message-
>From: Martin Hepworth [mailto:[EMAIL PROTECTED]
>Sent: Friday, April 29, 2005 9:48 AM
>To: Chris Santerre
>Cc: 'List Mail User'; users@spamassassin.apache.org
>Subject: Re: Vendare Media Corporation / VENDAREGROUP. COM
>
>
>
&g
>-Original Message-
>From: List Mail User [mailto:[EMAIL PROTECTED]
>Sent: Friday, April 29, 2005 9:25 AM
>To: users@spamassassin.apache.org
>Cc: [EMAIL PROTECTED]
>Subject: Vendare Media Corporation / VENDAREGROUP. COM
>
>
> Does anyone know of any emails from the VENDARE folks, or
>-Original Message-
>From: Randal, Phil [mailto:[EMAIL PROTECTED]
>Sent: Thursday, April 28, 2005 11:27 AM
>To: users@spamassassin.apache.org
>Subject: RE: If you need proof that spammers use the same resources as
>us ...
>
>
>Jim Maul wrote:
>
>&g
>-Original Message-
>From: Craig McLean [mailto:[EMAIL PROTECTED]
>Sent: Thursday, April 28, 2005 10:33 AM
>To: users@spamassassin.apache.org
>Subject: OT?: If you need proof that spammers use the same resources as
>us...
>
>
>-BEGIN PGP SIGNED MESSAGE-
>Hash: SHA1
>
>Call me para
>I did write a rule to catch these since a lot of spammers are
>still using
>this trick :-
>
>uri __SpoofPort_URL /(?:\:|\...:)/
>
>uri __OkPort_URL /(?:\:[0-9]|\...:[0-9])/
>
>meta MS_Spoof_Port_URL ((__SpoofPort_URL - __OkPort_URL) > 0)
>
>score MS_Spoof_Port_URL 9
>
>describe MS_Spoof_
around chap 5. Chap 8 gets a little weird. Chap 11... well my fav
chapter. ;)
Great original music score!
Anywho, to keep your jobs, watch this at home with the kids out of the room.
And yes, I imagined the little ninja to be SA, and the bad guys spammers ;)
Chris Santerre
System Admin
work Analyst, Network and Security Team
>Information Systems & Technology Management Dept.
>Ceridian Canada Ltd
>600 - 125 Garry St
>Winnipeg, MB
>R3C 3P2
>204-975-5909
>
>
>
>
>Chris Santerre <[EMAIL PROTECTED]>
>Sent by: [EMAIL PROTECTED]
>04/22/2005
>-Original Message-
>From: Jeff Chan [mailto:[EMAIL PROTECTED]
>Sent: Thursday, April 21, 2005 7:46 PM
>To: SURBL Discuss; SpamAssassin Users
>Subject: Research wanted: age of spam gang URI domains
>
>
>Does anyone have research or references for the age profiles of
>domains appearing in
soon.
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
Disclaimer:
The statements and opinions or URIBL.com are those of URIBL.com only. Any
statements and opinions included in this post are not those of SURBL.com or
its members. We are not responsible if URIBL.com gets
>-Original Message-
>From: Francis Stevens [mailto:[EMAIL PROTECTED]
>Sent: Thursday, April 21, 2005 11:20 AM
>Cc: users@spamassassin.apache.org
>Subject: Re: rulesemporium.com availability
>
>
>Todd Adamson wrote:
>> There is apperantly a server problem. The 209.218.125.112
>> server is
and
final style.
Most of this stuff is more advanced. Off hand I can think of any specific
major changes to SA that would need to be covered. Unless I've missed
something in the dev list.
HTH,
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
on't seem to have been able to collect rules for a week
>or more.
>
>FAS
Agreed. I tried from NY office yesterday and it was S.L.O.W.!
I'll see what I can find out.
Chris Santerre
System Admin and SARE/URIBL Ninja
http://www.rulesemporium.com
>-Original Message-
>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
>Sent: Friday, April 15, 2005 2:41 PM
>To: Chris Santerre
>Cc: 'ROY,RHETT G'; users@spamassassin.apache.org
>Subject: Re: Results of adding SARE rules
>
>
>-BEGIN PGP SIGNE
>Total SMTP Connections
>6008
>Total Rejected By RBL
>4803
>Total Flagged By SA
>431
>Total Delivered
>774
>Percentage Delivered
>12
Wow! 12%! Damn!
Thank goodness for those SARE and SURBL guys! ;)
--Chris (Still working on a new SARE ruleset...8 months and counting)
>-Original Message-
>From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
>Sent: Tuesday, April 12, 2005 3:14 PM
>To: SA Users List
>Subject: Re: Arithmetic score for replaced O's and I's?
>
>
>On Tue, Apr 12, 2005 at 03:10:19PM -0400, Jim Maul wrote:
>> Sort of. You wanted to count them, wh
Well thanks for ruining another childhood fantasy of mine! I suppose next
you will tell me that wonderwoman if Swedish for "House maid"? Well I still
don't care, she can lasso me up!
--Chris
>-Original Message-
>From: Kurt Buff [mailto:[EMAIL PROTECTED]
>Sent: Monday, April 11, 2005 8:12
>-Original Message-
>From: Richard.Hall [mailto:[EMAIL PROTECTED]
>Sent: Saturday, April 09, 2005 11:37 AM
>To: users@spamassassin.apache.org
>Subject: RE: OT: Do spammers have a sense of humor?
>
>
>On Sat, 9 Apr 2005, Pierre Thomson wrote:
>
>> 419 spammers definitely produce humorous s
>-Original Message-
>From: Gray, Richard [mailto:[EMAIL PROTECTED]
>Sent: Friday, April 08, 2005 9:43 AM
>To: users@spamassassin.apache.org
>Subject: RE: Extra Sare Rules for meds?
>
>
>>
>> One of the things the SARE group has realized, is that using
>> '*' in any regex is a bad idea.
>-Original Message-
>From: Keith Ivey [mailto:[EMAIL PROTECTED]
>Sent: Thursday, April 07, 2005 10:32 PM
>To: users@spamassassin.apache.org
>Cc: Jesse Houwing
>Subject: Re: Extra Sare Rules for meds?
>
>
>Jesse Houwing wrote:
>
>> BODY TABLEOBFU
>>
>m{]+|"[^"]+)>(<([^>]+|"[^"]+)>)*[a-z]
esponds.
>
>Nick
Nick, ask him if he would like us to mirror it at SARE. We rate limit all of
the GETs. We even blacklist the fools that try to update every minute.
Chris Santerre
System Admin and SARE Ninja
http://www.rulesemporium.com
>
>I hold down a 50-60 hour work week, family, volunteer time for NPOs,
>plus personal interests, and still find time to fight spam via SARE,
>because it's that important to me. Personal preference.
>
>If you don't want to spend the time required to tweak SA to a high
>enough performance (you proba
>-Original Message-
>From: Bowie Bailey [mailto:[EMAIL PROTECTED]
>Sent: Thursday, April 07, 2005 10:44 AM
>Cc: users@spamassassin.apache.org
>Subject: RE: Rule-sets
>
>
>From: Ron McKeating [mailto:[EMAIL PROTECTED]
>>
>> On Thu, 2005-04-07 at 12:27 +0100, Gray, Richard wrote:
>> > > >
ks.htm
I need to add more.
Chris Santerre
System Admin and SARE Ninja
http://www.rulesemporium.com
Greetings Everyone,
As of today, I am leaving SURBL for private reasons. SURBL continues
to be one of the best antispam measures. I will be forming my own public URI
lists. One black and one gray. But they will not be affiliated with SURBL.
(So I'll most likely be begging for mirrors later!
One method would be to write some negative scoring rules based on where the
hams come from. They could override the SARE rules.
--Chris
>-Original Message-
>From: Gray, Richard [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, April 06, 2005 12:32 PM
>To: Jim Maul; SA Users List
>Subject: RE: E
his type of situation.
Hi Jim,
Do you get hams with the kinds of drug names often found in spam? Or are we
talking about other kinds of drugs?
You could always change the scores in the SARE ruleset to something very low
for testing purposes.
Chris Santerre
System Admin and SARE Ninja
http://www.rulesemporium.com
> -Original Message-
> From: Gustafson, Tim [mailto:[EMAIL PROTECTED]
> Sent: Monday, April 04, 2005 12:29 PM
> To: users@spamassassin.apache.org
> Subject: SpamAssassin Without Bayes
>
>
> Hi Everyone!
>
> I know that Bayes is "the" defacto best way to fight SPAM
> right now, but
> I
> -Original Message-
> From: Matt Kettler [mailto:[EMAIL PROTECTED]
> Sent: Monday, April 04, 2005 9:40 AM
> To: Jim Knuth; Pete Geenhuizen
> Cc: users@spamassassin.apache.org
> Subject: Re: RulesDuJour error updating bigevil.cf
>
>
> At 02:13 PM 4/3/2005, Jim Knuth wrote:
> > > Hi Jim,
>-Original Message-
>From: Chris [mailto:[EMAIL PROTECTED]
>Sent: Thursday, March 31, 2005 11:28 PM
>To: users@spamassassin.apache.org
>Subject: Re: EFF Newsletter as SPAM
>
>
>On Thursday 31 March 2005 08:56 pm, Jeff Chan wrote:
>> On Thursday, March 31, 2005, 6:50:17 PM, Chris Chris wro
lint will load the new cf files, provided they are in the proper
location. Restarting spamd will make the changes live.
HTH,
Chris Santerre
System Admin and SARE/SURBL Ninja
http://www.rulesemporium.com
http://www.surbl.org
'Owning a domain means you register who you are, in a public recor
http://www.plus613.com/image/12046
Chris Santerre
System Admin and SARE/SURBL Ninja
http://www.rulesemporium.com
http://www.surbl.org
'Owning a domain means you register who you are, in a public record. You
want privacy, don't buy a domain, live in the woods and eat acorns.' -
J.Kennedy
Too much traffic used for a file no longer updated. BigEvil has been
removed. I shall replace it with our newest ruleset soon. Its a real corker
;)
Chris Santerre
System Admin and SARE/SURBL Ninja
http://www.rulesemporium.com
http://www.surbl.org
'It is not the strongest of the species
>-Original Message-
>From: jdow [mailto:[EMAIL PROTECTED]
>Sent: Friday, March 25, 2005 6:29 AM
>To: users@spamassassin.apache.org
>Subject: SARE suggestion
>
>
>It seems there are a lot of anti-spam headers which if they are seen
>on incoming email is a fairly good indication that the me
>-Original Message-
>From: Jeff Chan [mailto:[EMAIL PROTECTED]
>Sent: Tuesday, March 22, 2005 7:23 AM
>To: users@spamassassin.apache.org; SURBL Discuss
>Subject: Re: ZDNET redirecting to spammer websites?
>
>
>On Tuesday, March 22, 2005, 4:13:33 AM, Bobby Rose wrote:
>> Even though zdnet.
>-Original Message-
>From: Jeff Chan [mailto:[EMAIL PROTECTED]
>Sent: Friday, March 18, 2005 2:21 AM
>To: users@spamassassin.apache.org
>Subject: Re: OT: SURBL usage for content-filters like SquidGuard?
>
>
>On Thursday, March 17, 2005, 7:13:32 PM, Jason Haar wrote:
>> I was wondering if
What on earth are you talking about?! It is an open redirect! I'd love for
them to have a few choice words for me. Here try this:
http://chkpt.zdnet.com/chkpt/blahblahwhateveryouwant/www.slashdot.org
How is that link NOT ZDnet's fault for being abused?
--Chris
>-Original Message-
>From
It makes more sense to email him direct. Too bad I can't find he email
anywhere! I guess its time to start telling the media about this open
redirect. Oh well, we gave them fair amount of time.
--Chris
>-Original Message-
>From: Rob McEwen [mailto:[EMAIL PROTECTED]
>Sent: Monday, March
>-Original Message-
>From: Daryl C. W. O'Shea [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, March 09, 2005 11:04 AM
>To: Chris Santerre
>Cc: 'Robert Menschel'; users@spamassassin.apache.org
>Subject: Re: Whitelist collection project
>
>
>Chris
>
>> The SpamAssassin report lists it as :
>> 0.6 URIBL_SBL Contains an URL listed in the SBL blocklist
>> [URIs: gov.ru]
>
>> But no matter what I try, I can´t find the blacklist that Is used.
>
>What this means is that the nameserver for gov.ru is listed
>in SBL.
>
> http://www
>-Original Message-
>From: Robert Menschel [mailto:[EMAIL PROTECTED]
>Sent: Tuesday, March 08, 2005 11:13 PM
>To: users@spamassassin.apache.org
>Subject: Whitelist collection project
>
>
>OK, based on what little discussion there's been so far, here's a
>draft proposal for people to think
I was not
specifically listed as an addressee, so I can't help you. Otherwise I open
myself up to 'criminal offense'. Perhaps if you remove this language from
your post, you might get more replies? :-)
--Chris
This
e-mail and the information that it contains may be privileged and/
>(copy/paste url in your browser)
How silly are spammers? Like we are not going to tag off of this phrase now?
Lazy bastards didn't even take the time to obfuscate it! :)
--Chris
>David B Funk wrote:
>> This particular one has been killfiled all over Usenet for over
>> a decade and so has turned to mailing lists.
>>
>> A quick Google or Usenet search will reveal it for what it is. ;)
>
>Wow. I have been living a sheltered life of late and have blissfully
>missed him. Go
>Hi all,
>
>I'm sure someone here can have a look at the SURBL+-Checker at
>www.rulesemporium.com.
>Seems to me somethings wrong with the WS-SURBL data used. I fed it two
>domains that, according to my SA setup, where included in the WS
>SURBL-list (MUNGEDhealtfrombirth.info and MUNGEDtukam.org )
>Good interview with Daniel Quinlan about SA:
>
> http://www.osdir.com/Article4419.phtml
>
>Especially:
>
>> OSDir.com: What's the most effective anti-spam technology that
>> SpamAssassin uses right now?
>>
>> Quinlan: I think network rules are the most effective single
>> technology, in partic
> I know you don't like bayes, but it is the best single
>tool for stock
>scams. The trouble with counting '|' is the frequency of
>transcribed spead-
>sheets would give too many FPs (typical is to use '|' to
>separate the columns).
>Most scock scams use non-obfucated words to look legiti
>
>Jon McGreevy wrote:
>> I am running SA 2.64 and trying to create a rule so that
>peoples email
>> inside the organization will not be marked as spam
>>
>> I am trying to use the header option and it is not working
>>
>> Here is what I have so far
>>
>> From =~ /[EMAIL PROTECTED]/I
>>
>> My
How about an eval that counts the number of '|' in a message. Over 4 and you
got yourself a spam :)
--Chris
>-Original Message-
>From: David Velásquez [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, March 02, 2005 1:46 PM
>To: [EMAIL PROTECTED]
>Subject: Typical spam not detected at all.. t
There has
been a lot of talk about dynamic scoring. Most people argue that Bayes is a good
substitute for it already. But not if you don't use Bayes ;)
I think its a
worthy idea for testing. Although the logic could be fairly simple. Like using
the top hitting rules script in a cron job.
>I just upgraded my DNS and URI, URIDNSBL appears to be working
>correctly
>now. I'm getting all of the benefits of 3.0.2!
>
>The URIDNSBL is pure genius, thanks to all who help create and
>support the
>SA product.
Glad you got it fixed. Believe me, the conference call that started URIDNSBL
was
>> Since about 18.00 yesterday, there seems to be a problem
>with retrieving
>> rules from http://www.rulesemporium.com/rules/.cf. When I
>> retrieve any rule, I get the following HTML on the front,
>which causes
>> SA lint to fail. I have tried several rulesets and several different
>> hosts
3:31
PMTo: MattCc: Chris Santerre;
[EMAIL PROTECTED]Subject: Re: Porn
E-MailWe are getting a ridiculous amount of spam related
to cheap stocks lately. Spam has definitely increased recently. Some customers
are calling us asking if we have spam filters, even though our Spamassassin is
301 - 400 of 642 matches
Mail list logo
