RE: new PDF "Launch" malware exploit (with sample)

Quoting "Rosenbaum, Larry M." : Please don't send live malware samples to the list. Um... The OP did not send malware to the list. A link was supplied to the original message. You must have a scanner set up to follow links. That isn't a good idea, in my opinion. -Original Message---

Re: Match returned message headers on any NDR

Quoting Michael Scheidell : On 4/14/10 12:21 PM, Kris Deugau wrote: Is there a consistent way to match whatever headers might be available in a returned message? use the vbounce rules. google for sa and vbounce. its already done if you are using a newer version of SA. you need to specifi

Re: How do I filter out phishing email?

Quoting Jari Fredriksson : On 14.4.2010 19:57, d.h...@yournetplus.com wrote: Quoting Jari Fredriksson : Please do not post spammy mail to the list (it "poisons" our Bayes with spammy tokens with hammy score). Why are you scanning messages to the SA list? I do not for your reasoning. Beca

Re: How do I filter out phishing email?

Quoting Jari Fredriksson : Please do not post spammy mail to the list (it "poisons" our Bayes with spammy tokens with hammy score). Why are you scanning messages to the SA list? I do not for your reasoning.

Re: RBLs not run when dns_available=yes?

Quoting Jeff_47 : d.hill wrote: Quoting Jeff_47: I have an odd situation - it seems like I must be missing something but I don't know what. In my local.cf, I had the following lines: dns_available yes skip_rbl_checks 0 I noticed that no RBL checks were being run. If I change dns_availa

Re: RBLs not run when dns_available=yes?

Quoting Jeff_47 : I have an odd situation - it seems like I must be missing something but I don't know what. In my local.cf, I had the following lines: dns_available yes skip_rbl_checks 0 I noticed that no RBL checks were being run. If I change dns_available to "test" or comment out the line

Re: A possibly suspect idea

Quoting Bowie Bailey : Martin Gregorie wrote: On Fri, 2010-03-12 at 08:15 +0200, Henrik K wrote: Why don't you simply maintain your wordlists in some files and use a script to generate portmanteau.cf? You could use Regexp::Assemble module to optimize also. Who cares what the actual rules loo

Re: SA 3.3.0 depends on Perl 5.10 (FreeBSD Ports)???

Quoting LuKreme : On 04-Mar-10 21:41, James Smallacombe wrote: I tried to upgrade from SA 3.2.5 to 3.3.0 by installing the newer one from FreeBSD Ports. Really? I just did a update of the port tree and yet $ portversion p5-Mail-SpamAssassin p5-Mail-SpamAssassin= $ where SpamAssassi

Re: Putting your dead domains to use

Quoting Lucio Chiappetti : On Mon, 1 Mar 2010, Marc Perkel wrote: For what it's worth - if any of you have domains you don't use you can point them to my virus harvesting server for spam harvesting. Hmm ... how dead is dead ? :-) We had for some time three domains (our institute was moved f

Re: SpamAssassin, One Baye for a lot of SpamAssassin server

Quoting LuKreme : On 22-Jan-2010, at 02:07, Ralph Bornefeld-Ettmann wrote: bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsn DBI:mysql:mailscanner::3306 bayes_sql_username bayes_sql_password bayes_sql_override_username Where do you specify the name of the database to us

Re: newbie: configure SA to reject spam

Quoting Kai Schaetzl : LuKreme wrote on Thu, 14 Jan 2010 06:31:48 -0700: I've always been hesitant to try running SA during the transaction because I was afraid it would take too long. Indeed, that's why I would not consider it. And I assume if you do it this way that also means you have to

Re: Spamhaus and paid subscription

Quoting Raymond Dijkxhoorn : Hi! Can't you do zone transfers? Then you can do away with the subscriber_key thing and have DNS resolve locally for spamhaus.org and not have to query their DNS servers. They sell datafeed and they sell queries, we bought queries. I do not believe they would th

Re: Spamhaus and paid subscription

Quoting DAve : Good morning all, I recently got my employer to pay for spamhaus queries, finally. I need to use a key to access spamhaus now. Not an issue for for me MTA but SA is another problem. When I change the rules to use our key, the key is displayed in the spam report. When I add this

Re: FP on blacklist hostkarma

Quoting Benny Pedersen : On tir 01 dec 2009 00:51:38 CET, Raymond Dijkxhoorn wrote So if you have a crappy connection towards your mailserver Marc you can get listed, thats rather funny, and annoying. Connections do break also when not running a botnet... pfff maybe i am dump, but what

Re: How was your holiday weekend spam traffic?

Quoting d.h...@yournetplus.com: Quoting Chris Santerre : I'm just curious this morning. I see a dip in spam trapped, but a pretty big rise in blocking. I expected a lot worse over the long holiday weekend. Did someone get arrested or something? I'm not fully awake yet but it looks like my blo

Re: Is there a way of forcing spamd not to process malformed messages? (NO_RELAYS, NO_RECEIVED etc).

Quoting Per Jessen : d.h...@yournetplus.com wrote: Quoting Per Jessen : I seem to be having more emails with NO_RELAYS than I normally see, and I'd like to havee spamd just refuse to process them. That way they'd get left in the queue, and I'd have something to debug. NO_RELAYS indicates

Re: How was your holiday weekend spam traffic?

Quoting Chris Santerre : I'm just curious this morning. I see a dip in spam trapped, but a pretty big rise in blocking. I expected a lot worse over the long holiday weekend. Did someone get arrested or something? I'm not fully awake yet but it looks like my blocking numbers from RBLs tripled ov

Re: Is there a way of forcing spamd not to process malformed messages? (NO_RELAYS, NO_RECEIVED etc).

Quoting Per Jessen : I seem to be having more emails with NO_RELAYS than I normally see, and I'd like to havee spamd just refuse to process them. That way they'd get left in the queue, and I'd have something to debug. NO_RELAYS indicates there are no Received headers: http://wiki.apache.

Re: Crashes running SA as milter in Postfix

Quoting Patrick Ben Koetter : * d.h...@yournetplus.com : The home directory for the username spamassassin is probably set to /nonexistant in the passwd file (or whatever it is in Ubuntu). Thanks for the reply. I wish, it was that easy, but it is not. The $HOME is /home/spamassassin. That's

Re: Crashes running SA as milter in Postfix

Quoting Patrick Ben Koetter : We regularly experience SA crashes on a Ubuntu Hardy machine. The setup is as follows: Postfix (2.5.1) -> SpamAssassin Milter (0.3.1-6) -> SpamAssassin (3.2.4-1ubuntu1.1) The milter is run like this: /usr/sbin/spamass-milter -P /var/run/spamass/spamass.pid -

Re: Spamassassin not tagging some emails

Quoting Angus Dunn : Thanks everyone for your help! I have changed procmailrc to the following: DROPPRIVS=yes :0fw * < 512000 | /usr/bin/spamc :0 * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\* /dev/null It is now working fine. Someone mentioned that i can actually invoke spamassassin directly from se

Re: Spamassassin not tagging some emails

Quoting Karsten Bräckelmann : But this does not help. The spam emails still did not get tag. 2. I am using procmailrc to invoke spamassassin. Here is the /etc/procmailrc: DROPPRIVS=yes :0fw * < 25600 | /usr/bin/spamc That's 25 kByte! Yes, that is your problem. Any mail larger than that will N

Re: Spamassassin not tagging some emails

Quoting Angus Dunn : 2. I am using procmailrc to invoke spamassassin. Here is the /etc/procmailrc: DROPPRIVS=yes :0fw * < 25600 | /usr/bin/spamc :0 * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\* /dev/null ~ As someone suggested, this may be due to size of the email. It looks like spamassassion will not

Re: sneaky pharma spam shooting past standard rules

Quoting LuKreme : On 15-Oct-2009, at 17:31, MySQL Student wrote: Hi, With this: Received: from public30108.xdsl.centertel.pl (HELO marcin-8963fd6f) (79.163.117.156) my postfix setup would have simply dropped it on the floor at the HELO/EHLO. If it doens't HELO with an FQDN and a proper

Re: Spamc issues with remote userprefs

Quoting Jari Fredriksson : Hi, We're rebuilding a mail server and are having some issues with SQL-based SA preference lookups. We're running Postfix 2.5.5 and SA 3.2.5 (Debian Lenny version) - here's our Postfix config from master.cf: spamassassin unix - n n - - pipe user

Re: some domains in my local.cf file not being tagged

Quoting Matt Kettler : Mark Mahabir wrote: 2009/9/3 Matt Kettler : Does the From: header of these messages match *...@domain.com, or are they *...@something.somedomain.com (which wouldn't match)? They're definitely *...@domain.com in the From: header. Does the X-Spam-Status header show

Re: Barracuda RBL in first place

Quoting Matus UHLAR - fantomas : Quoting Matus UHLAR - fantomas : On 17.08.09 12:07, d.h...@yournetplus.com wrote: That all depends upon how you have Postfix configured. I have a gateway set up here and do the RBL lookups late in the smtpd_recipient_restrictions just before the greylist polic

Re: Barracuda RBL in first place

Quoting Matus UHLAR - fantomas : On 17.08.09 12:07, d.h...@yournetplus.com wrote: That all depends upon how you have Postfix configured. I have a gateway set up here and do the RBL lookups late in the smtpd_recipient_restrictions just before the greylist policy. I.e.: smtpd_recipient_restricti

Re: Barracuda RBL in first place

Quoting Ned Slider : LuKreme wrote: On 16-Aug-2009, at 16:55, MySQL Student wrote: So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Can you explain a bit more here? What are you checking for, that the host is valid?

RE: Barracuda RBL in first place

Quoting Michael Hutchinson : Hello All, Considering all of the interesting information that's being going around regarding Barracuda, and it's RBL's, I probably wouldn't use it. Not any time soon. But that's based purely on reputation, and has nothing to do with hit ratio. Our Spam gateway seem

Re: Backscatter.org used as RBL??

Quoting LuKreme : On 5-Aug-2009, at 10:53, d.h...@yournetplus.com wrote: Quoting LuKreme : On Aug 4, 2009, at 6:35, d.h...@yournetplus.com wrote: Quoting LuKreme : On 3-Aug-2009, at 18:36, Dennis G German wrote: Is Backscatter.org used by any ru

Re: Backscatter.org used as RBL??

Quoting "McDonald, Dan" : On Wed, 2009-08-05 at 10:34 -0600, LuKreme wrote: On Aug 4, 2009, at 6:35, d.h...@yournetplus.com wrote: > Quoting LuKreme : > >> On 3-Aug-2009, at 18:36, Dennis G German wrote: > > If you use the lists as an RBL to reject at SMTP, you will end up > rejecting legitima

Re: Backscatter.org used as RBL??

Quoting LuKreme : On Aug 4, 2009, at 6:35, d.h...@yournetplus.com wrote: Quoting LuKreme : On 3-Aug-2009, at 18:36, Dennis G German wrote: Is Backscatter.org used by any rules? Pretty sure not. The way to use that RBL is as an RBL. Don't accept

Re: Backscatter.org used as RBL??

Quoting LuKreme : On 3-Aug-2009, at 18:36, Dennis G German wrote: Is Backscatter.org used by any rules? Pretty sure not. The way to use that RBL is as an RBL. Don't accept the backscatter in the first place. If you use the lists as an RBL to rejec

Re: two databases

Quoting Micah Anderson : any case I might have had some issues because my MySQL database needed to be optimized, but I was not able to determine how and now I just run one of the spamd's without bayes, which is not too bad because my bayes database seems to be totally worthless at the moment. :P

Re: FW: SpamAssassin error Interrupted system call

Quoting Luis campo : The service is still active spamd just does not process the emails, all giving a score of zero and then get the error message ServerA spamc [7277]: connect to spamd on 172.16.0.14 > Failed, retrying (# 1 of 3): Interrupted system call When this problem occurs restar

Re: FW: SpamAssassin error Interrupted system call

Quoting Luis campo : The service is still active spamd just does not process the emails, all giving a score of zero and then get the error message ServerA spamc [7277]: connect to spamd on 172.16.0.14 > Failed, retrying (# 1 of 3): Interrupted system call When this problem occurs restarte

Re: Hrm, this spam is annoying

Quoting LuKreme : Scores 1.0 for me X-Spam-Report: * 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server * [93.86.56.82 listed in dnsbl.sorbs.net] * -0.0 SPF_PASS SPF: sender matches SPF record * -3.3

Re: make SA remove X-Spam-Flag

On Thu, 12 Jun 2008 at 10:54 +0200, [EMAIL PROTECTED] confabulated: Hi, just 10 minutes ago i received a false positive. First i was confused then i figured that my SA setup didn't actually flag it, but the senders SA. So, how could i tell SA to remove any X-Spam flags in case the mail has been

Re: heads up: .13.3 of re2c might be broken

On Tue, 10 Jun 2008 at 15:20 -0400, [EMAIL PROTECTED] confabulated: Heads up: don't upgrade to re2c 13.3!!! I upgraded from re2c 12.1 to 13.3 and now, things that used to compile, don't. re2c -i -b -o scanner17.c scanner17.re re2c: error: line 99, column 2: Token exceeds limit command failed

Re: how to keep updated against german spam?

On Tue, 10 Jun 2008 at 14:35 +0200, [EMAIL PROTECTED] confabulated: Yet Another Ninja wrote: Is there a place where you posted these spams so potential rule writers know which you're talking about? I just uploaded three different examples of recent spamwave to my webpage: http://www.g

Re: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC (@INC

On Thu, 5 Jun 2008 at 06:24 -0500, [EMAIL PROTECTED] confabulated: After this mornings sa-update run I noticed this in my syslog: Jun 5 06:14:24 localhost spamd[26853]: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC (@INC contains: /var/lib/spamassassin/compiled/3.002004 /va

Re: google netblocks records etc

On Tue, 3 Jun 2008 at 15:30 +0200, [EMAIL PROTECTED] confabulated: D Hill wrote: [snip] In Postfix: reject_unknown_reverse_client_hostname Reject the request when the client IP address has no address->name mapping. reject_unknown_client_hostname Reject the request when 1)

Re: google netblocks records etc

On Tue, 3 Jun 2008 at 16:15 +0300, [EMAIL PROTECTED] confabulated: On Tue, Jun 03, 2008 at 01:08:07PM +, D Hill wrote: On Tue, 3 Jun 2008 at 15:42 +0300, [EMAIL PROTECTED] confabulated: On Tue, Jun 03, 2008 at 02:02:29PM +0200, Benny Pedersen wrote: http://en.wikipedia.org/wiki

Re: google netblocks records etc

On Tue, 3 Jun 2008 at 15:42 +0300, [EMAIL PROTECTED] confabulated: On Tue, Jun 03, 2008 at 02:02:29PM +0200, Benny Pedersen wrote: http://en.wikipedia.org/wiki/Forward_Confirmed_reverse_DNS i know this fact, but OP question only based on reverse :/ One should always assume "reverse" means

Re: Testing DNSRBLs using SA

On Fri, 23 May 2008 at 10:32 -0400, [EMAIL PROTECTED] confabulated: Good morning all, I am trying to use SA to test a DNSBL and I am not having any luck getting the rule to hit. I've looked through 20_dnsbl_tests.cf, and read the appropriate section in the docs. http://spamassassin.apache.o

Re: dsbl.org dying?

On Wed, 21 May 2008 at 14:26 -0400, [EMAIL PROTECTED] confabulated: On May 21, 2008, at 10:01 AM, mouss wrote: dsbl.org are having problems. it would be nice if people who use it disable it, at least temporarily. I asked about this on the spamtools list on the 12th to deafening silence.

Re: msrbl.com disappeared

On Sun, 11 May 2008 at 22:45 +0200, [EMAIL PROTECTED] confabulated: Frank Bures wrote: Hi, I could not update SANE Security signatures in the last couple of days. It looks like domain msrbl.com disappeared. Could please anyone shed some light on this? $ host msrbl.com msrbl.com has address

Re: False positive on forged_mua_outlook

On Sat, 10 May 2008 at 10:13 +0200, [EMAIL PROTECTED] confabulated: Randy Ramsdell wrote: [snip] Scratch that and reverse it. If it does match, then it will score the message header as fake. oops :) sorry. Let me check some more things. Did outlook really generate this message-id: Message

Re: fractional scores and syntax

On Fri, 9 May 2008 at 09:42 -0700, [EMAIL PROTECTED] confabulated: I am not sure how to ask this We have a test URIBL # # # ### # urirhssub URIBL_TEST uri.test.local.A 2 body URIBL_TEST eval:check_uridnsbl('URIB

Re: can we make AWL ignore mail from self to self?

On Tue, 29 Apr 2008 at 17:58 -0700, [EMAIL PROTECTED] confabulated: I'm not repeating for the 5th time that there are no trusted mailservers. Only this host. Correct. On our filter server(s) which are strictly inbound only (nothing trusted but itself): # Begin SA Network Settings clear

Re: can we make AWL ignore mail from self to self?

On Tue, 29 Apr 2008 at 17:53 -0700, [EMAIL PROTECTED] confabulated: Now please stop arguing that AWL is useless. It works for me. If it doesn't work for you, then you have no reason to reply on this thread. (not trying to be rude, but this conversation is pointless) Works for me too. I was

Re: gpg failure on sa-update due to non-cross-certified key

On Fri, 18 Apr 2008 at 10:30 -0500, [EMAIL PROTECTED] confabulated: On Fri, 2008-04-18 at 13:51 +, D Hill wrote: Re-download a GPG key and import: wget http://spamassassin.apache.org/updates/GPG.KEY sa-update --import GPG.KEY This is in the wiki: http://wiki.apache.org

Re: gpg failure on sa-update due to non-cross-certified key

Re-download a GPG key and import: wget http://spamassassin.apache.org/updates/GPG.KEY sa-update --import GPG.KEY This is in the wiki: http://wiki.apache.org/spamassassin/SaUpdateKeyNotCrossCertified?highlight=%28update%29 I had the same thing happen and all is well now. -d On Fri, 18 Apr

Re: sa-learn incapable of handling large amounts of messages?

On Tue, 15 Apr 2008 at 21:53 -0400, [EMAIL PROTECTED] confabulated: I'm trying to run sa-learn --spam /spamdir/* on a directory with 2449 spam messages. But it doesn't seem to work. I'm not sure why. What format are the messages in? mdir? mbox? sa-learn --spam [EMAIL PROTECTED] spam/ works

Re: FW: Why is this spam passing my SA (counterfeit goods)

On Fri, 11 Apr 2008 at 14:10 -0400, [EMAIL PROTECTED] confabulated: Josie Walls wrote: Hello, Would this group agree that requiring 5 hits in order to classify an email as spam is too conservative a number? I suspect ISPs have their filter settings at 3 or less. Any insight would be apprecia

Re: foreign spam slipping through

On Thu, 3 Apr 2008 at 17:00 -0400, [EMAIL PROTECTED] confabulated: On Thursday 03 April 2008 04:32:40 pm you wrote: Most of those are getting caught here. Here is what your message scored: any way to increase the score that language receives? I have the same: ok_languages en I also have

Re: foreign spam slipping through

On Thu, 3 Apr 2008 at 16:51 -0400, [EMAIL PROTECTED] confabulated: How do I unsubscribe from here? There are no unsubscribe links at the bottom of these messages. As found in the headers of ALL list messages: list-unsubscribe:

Re: foreign spam slipping through

On Thu, 3 Apr 2008 at 16:12 -0400, [EMAIL PROTECTED] confabulated: the attached email is one of the mails that keeps slipping through. I have no idea what it says, or why it continues to slip through my filter (well why it has a lower score than what's required). kmail runs spamassassin -L wit

Re: SORBS_DUL

Now your confusing the subject. The previous response you made was from: From: James Gray <[EMAIL PROTECTED]> Now you are using: From: James Gray <[EMAIL PROTECTED]> BOTH of those domains point to an MX that has a CNAME to: smtp.mas.viperplatform.net.au On Wed, 26 Mar 2008 at 00:51 -00

Re: SORBS_DUL

On Wed, 26 Mar 2008 at 00:47 -, [EMAIL PROTECTED] confabulated: On Wed, 26 Mar 2008 at 11:39 +1100, [EMAIL PROTECTED] confabulated: On Wed, 26 Mar 2008 03:31:34 am mouss wrote: James Gray wrote: Why are rules that look up against this list still in the base of SpamAssassin?? The SORBS dy

Re: SORBS_DUL

On Wed, 26 Mar 2008 at 11:39 +1100, [EMAIL PROTECTED] confabulated: On Wed, 26 Mar 2008 03:31:34 am mouss wrote: James Gray wrote: Why are rules that look up against this list still in the base of SpamAssassin?? The SORBS dynamic list is so poorly maintained that it's practically useless and i

RE: Why two spam assassins rank the same message so differently?

On Mon, 24 Mar 2008 at 18:14 -0400, [EMAIL PROTECTED] confabulated: by dgw218.neoplus.adsl.tpnet.pl with smtp (Exim 4.62 We've been blocking adsl.tpnet.pl for over a year yet they still barrage our servers daily with bot-infested clients. Some sites block the whole .PL tld, but that's

Re: Spamassassin not checking a particular Email.

On Mon, 10 Mar 2008 at 18:00 -0400, [EMAIL PROTECTED] confabulated: Michael Hutchinson wrote: Hi all, Another query.. another busy SA day. I have a piece of Spam that is getting through to one of our biggest clients. I have written rules to tag this Spam, but it is as if it isn't even being c

Re: SpamAssassin 3.2.4 and syslog

On Wed, 5 Mar 2008 at 11:41 -0700, [EMAIL PROTECTED] confabulated: Just an observation hereI did my 3.2.3 to 3.2.4 and suddenly sysloging of spamd stopped. I had to manually add ?s mail to my startup to get it to play fair again. Was this change documented anywhere...that syslog was now tu

Re: Headers not being updated

On Mon, 15 Oct 2007 at 15:26 -0700, [EMAIL PROTECTED] confabulated: I have recently moved to a new VPS, everything has been setup for me and is working well except Spamassassin. (I've never had problems with it on my previous host and I'm a newbie to working with it, so please excuse my ignoran

Re: Advice on MTA blacklist

On Tue, 9 Oct 2007 at 10:00 -0700, [EMAIL PROTECTED] confabulated: Spamhaus: yes. Use zen.spamhaus.org (you might end up needing to pay for it, and use a local cache, if you're a heavy traffic site, but, frankly, it's worth paying for). We use Spamhaus here with their datefeed service. Our