Re: Collecting IP reputation data from many people

again. If you have legitimate criticisms of the RFC, please make them on the list (http://lists.roaringpenguin.com/cgi-bin/mailman/listinfo/reputation-reporting) or direct to d...@roaringpenguin.com (the main author). Cheers, Dave -- Dave O'Neill d...@roaringpenguin.comRoaring Penguin Software

Re: user_prefs questions/problem

then there's an issue with your per-user prefs, if not then there's an issue with the white-listing itself. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

service (EG DCC), database access, etc. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527

Re: IPv6 problem with sa-update

no IPv6 address). For some reason when you set that options inet6 your system is not willing to fall back to IPv4 mode (or a bug is preventing it). That's what you need to look into (until such time as spamassassin.apache.org gets v6 connected ;). -- Dave Funk

Re: Writing an MTA

and borrow good ideas. ;) FWIW, I'm prejudiced as I've only ever worked with sendmail postfix. Other people can chime in about other MTAs. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege of Engineering 319/335-5751 FAX: 319/384-0549

Re: I need MORE SPAM - You get less spam

for the protocol, but given sufficient interest and support, that could happen. Cheers, Dave -- Dave O'Neill d...@roaringpenguin.comRoaring Penguin Software Inc. +1 (613) 231-6599http://www.roaringpenguin.com/ For CanIt technical support, please mail: supp

Re: I need MORE SPAM - You get less spam

things first. The protocol is extensible to other event types, but the only ones specified thus far are for IP address events. Other types will come later. Cheers, Dave -- Dave O'Neill d...@roaringpenguin.comRoaring Penguin Software Inc. +1 (613) 231-6599http

Re: How to stop weird From: crap?

according to your mail environment. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527

Re: How not to implement SPF (nationwide.co.uk)

, not the ultimate hat-checker. Just a way that I can make sure legitimate mails from $sender get through while forged messages pretending to be from $sender don't. This ain't rocket surgery. -- Dave Pooser Cat-Herder-in-Chief Pooserville.com

Re: Set for Whitelist Only?

AJ_NOT_TO_ABUSED80.0 Messages from whitelisted users will start with a score of -20; messages from other users will start with a score of 80. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved

Re: Spamassasin as a gateway filter for Exchange

addresses. That's a very bad idea-- legitimate senders will sometimes mistype addresses, and having their messages disappear into a black hole with no notice to the sender is... suboptimal. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention

IP reputation data collection protocol

. If you're interested in discussing it, or collaborating, we'd like if it you would join the mailing list (see above URL) so that we can try and keep the discussion all in one place. Cheers, Dave -- Dave O'Neill d...@roaringpenguin.comRoaring Penguin Software Inc. +1 (613) 231-6599

Re: What happened to SOUGHT rules' server?

elsewhere? Regards, Giampaolo I've been having the same problem from several locations/ISPs, since mid-Saturday. 500 Can't connect to yerp.org:80 (connect: timeout) Dave

Re: Bogus mails from hijacked accounts

, in the past few years-- and used a number of phrases that a native speaker of American so-called-English wouldn't. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved piece, but to slide

Re: Spam Assassin Rejecting Comcast Validation Emails

. Do the emails always come from the same from envelope? You could whitelist the from address as an easy way around this specific problem. Certainly spammers could abuse this, but hopefully it would be a temporary solution anyways. Dave

Re: Off Topic - SPF - What a Disaster

is worth its weight in platinum -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved piece, but to slide across the finish line broadside, thoroughly used up, worn out, leaking oil, and shouting

Re: SA on outgoing SMTP

their suggestions. You may loose a client or two, but you will improve your network and get better clients in return for your efforts. DAve -- Posterity, you will know how much it cost the present generation to preserve your freedom. I hope you will make good use of it. If you do not, I shall repent in heaven

Re: blog article on 3.3.0

did that... When I get to a page I can't read, I reach for ctrl-a. Highlights the whole page, wa la, readable. DAve -- Posterity, you will know how much it cost the present generation to preserve your freedom. I hope you will make good use of it. If you do not, I shall repent in heaven

Re: painting everybody in Taiwan with the same brush

, but I'm not gonna get close enough for it to bite me. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved piece, but to slide across the finish line broadside, thoroughly used up, worn out

Spamhaus and paid subscription

in subscriber_key.zen.dq.spamhaus.net] I can't be printing our key in the emails, what is a sysadmin to do? DAve -- Posterity, you will know how much it cost the present generation to preserve your freedom. I hope you will make good use of it. If you do not, I shall repent in heaven that ever I took half the pains

Re: Spamhaus and paid subscription

a subscribe line is. DAve -- Posterity, you will know how much it cost the present generation to preserve your freedom. I hope you will make good use of it. If you do not, I shall repent in heaven that ever I took half the pains to preserve it. John Adams http://appleseedinfo.org

Re: Spamhaus and paid subscription

Michael Scheidell wrote: On 1/7/10 11:25 AM, DAve wrote: Good morning all, I can't be printing our key in the emails, what is a sysadmin to do? you could (maybe) use meta rules? zero out (disable) originals, use meta rules, keep meta names to match original rule names in case of other

Re: Spamhaus and paid subscription

d.h...@yournetplus.com wrote: Quoting DAve dave.l...@pixelhammer.com: Good morning all, I recently got my employer to pay for spamhaus queries, finally. I need to use a key to access spamhaus now. Not an issue for for me MTA but SA is another problem. When I change the rules to use our key

Re: Adding remote-ip/ESMTPID/X-Envelope to logging output?

sendmail spamd) and you can log what ever you desire. By the time you get to procmail the message is already in the 'delivery' phase and some of your desired info is no longer available. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege

Re: Dear Santa

to share the code so that some of us could auto-generate rules based on our own ham/spam mailstreams, and then share those rules with you for possible SOUGHT inclusion? -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention of arriving safely in one

Re: Dear Santa

with a diagnosis of terminal cancer (they gave him six months-- he held on four years); through chemo and all the other sufferings he'd stayed energetically involved in fighting spam and helping others learn to do so. Talk about sliding across the finish line broadside -- Dave Pooser Cat-Herder

Re: OT: Museum piece...

faster and 100x more friendly for the tech directors to use than the $20k GVG package was. Heh. And today at $DAYJOB we're using $2200 worth of Playback Pro software + iMac because it's 4x faster and 100x more friendly than the $10k GV Turbo. The more things change :-) -- Dave Pooser Cat

Re: emailreg.org - pretty good white list

mail server ya gots here-- be a shame if something wuz to HAPPEN to it -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved piece, but to slide across the finish line broadside

Re: Geocities closed

a year now without a complaint. I believe I will leave the geocities rules in place until they no longer hit mail. DAve -- Posterity, you will know how much it cost the present generation to preserve your freedom. I hope you will make good use of it. If you do not, I shall repent in heaven

Re: Constant Contact

. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com And the beer I had for breakfast Wasn't bad, so I had one more for dessert.

Checking external mail

it put the message through it's various checks? Thanks. Dave. Delivered-To: dave.meh...@gmail.com Received: by 10.100.6.16 with SMTP id 16cs108866anf; Sat, 5 Sep 2009 07:42:46 -0700 (PDT) Received: by 10.224.42.83 with SMTP id r19mr8187638qae.35.1252161766037; Sat, 05 Sep 2009 07:42

forwarding emails will sa learn?

for the future? So far i've just increased the value of the three sa tests that got it. Thanks. Dave.

RE: sare channels

Hi, Thanks. If the sare rules work great, is it standard practice to use them and they catch what they catch or look elsewhere? Thanks. Dave. -Original Message- From: Ted Mittelstaedt [mailto:t...@ipinc.net] Sent: Thursday, August 20, 2009 2:29 PM To: Gary Smith Cc: 'Matt

RE: SA and mail from backup mx?

, if the primary goes down for maintence or whatever the backup holds messages then relays when the primary is back. Thanks. Dave.

SA and mail from backup mx?

Hello, Mail from my backup mx is not being scanned for spam as it's coming in. Is this something i'd have to turn on at the MTA level, content filter, or SA? A majority of stuff my backup mx sends me is spam and i'd like to get it tagged as such. Thanks. Dave.

RE: SA and mail from backup mx?

Hi, Postfix on my server, the backup mx is using qmail. Dave. -Original Message- From: Gary Smith [mailto:gary.sm...@holdstead.com] Sent: Wednesday, August 19, 2009 6:03 PM To: 'dave.meh...@gmail.com'; 'users@spamassassin.apache.org' Subject: RE: SA and mail from backup mx

sare channels

Hello, I'm trying to add additional sa rules and wanted to use the sare channels referenced by the wiki. I'm using sa 3.2.5 and when i atempted to get updates from saupdates.openprotect.com the channel didn't exist. Has it moved? Thanks. Dave.

local mail headers

=~ /.*\(\S+\.example\.com\s+\[.*\]\)/ describe LOCAL_RCVD Received from mail.example.com Thanks. Dave.

Re: Any one interested in using a proper forum?

in having to go a shop for information when I can have it sent to me. List mail also has the advantage of being fully compatible with plain text viewing, at my leisure. Feel free though to start a forum if you wish. DAve -- Posterity, you will know how much it cost the present generation to preserve

Re: Any one interested in using a proper forum?

:-) Perhaps: http://www.mailbucket.org The only criticism i have with the SA list is that the Reply-To header isn't set, meaning most mail clients will reply directly to the person - rather than the list. Perhaps I should add some procmail foo, but ho hum. Kind Regards, Dave Walker

Re: unsubscribe

HERE to post a message. | It has had mail-list support for over 10 years. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_admin

Re: constantcontact.com

whitelisted in any app/device. I care about whether it can be turned off easily or not. If the majority of SA users find CC gives little or no spam, let SA add CC to a whitelist by default. Better to let some spam in by default then to keep ham out. Just don't take away my switch. DAve

Re: Independence Day - Barracuda SA Rules White List

assume you gave the holiday a different name to clarify for those of us on the wrong side of the pond?) -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved piece, but to slide across

Re: SORBS bites the dust

lists they wouldn't allow us to use half the software we do. DAve Quoting Res r...@ausics.net: On Thu, 25 Jun 2009, rich...@buzzhost.co.uk wrote: 1. It's 'You're' a joke - not 'your' a joke Ah the classic sign of someone in defeat, has to nit pick someones grammer 2. You could always

Re: BOTNET timeouts?

John Hardin wrote ... (6/11/2009 4:21 PM): On Thu, 11 Jun 2009, John Rudd wrote: As I've said, I don't really have a plan to incorporate the patch into the main dist. You probably should. It doesn't prevent you from pursuing your design changes, and it would fix the problem for those who

Re: EmailBl Stats

, for now the last five days stats are as follows. Total mail through SA = 208,498 Total spam messages tagged with EMAILBL = 1471 Total non spam messages tagged with EMAILBL = 128 FP seen = 0 (fully %80 of our traffic never gets to SA) DAve -- Posterity, you will know how much it cost the present

Re: I want MORE SPAM - MORE SPAM

600k when things get bad. We have a wide variety of clients from dialup/DSL users to corporate users. Our clients receive mail from Europe and the Pacific Rim regularly. I'm just sayin... DAve -- Posterity, you will know how much it cost the present generation to preserve your freedom. I hope

Re: EmailBl Stats

Karsten Bräckelmann wrote: On Mon, 2009-05-18 at 10:50 -0400, DAve wrote: I will see about the update, for now the last five days stats are as follows. Total mail through SA = 208,498 Total spam messages tagged with EMAILBL = 1471 Total non spam messages tagged with EMAILBL = 128 What

Re: EmailBL hit count

by EMAILBL. EMAILBL hit 15 that were not already tagged as spam. Seems like this plugin hit almost in lock step with the JM_SOUGHT rules here. I will continue to run it on both servers for a week and see what happens. DAve -- Posterity, you will know how much it cost the present generation

Re: Boxtrapper and Spamassassin Cpanel 11 strange behaviour.

to make sure the backscatterer gets the spam. I figure if he wants me to filter his spam for free, he'll get every bit of his money's worth. ;-) -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com If you think bringing a wet noodle to an Amish rake fight makes you 'better armed' for it, then you have

Re: Best way to invoke SA?

. The benefit of using procmail is that you can have additional rules for placing mail. However some people swear by a MDA called Sieve. However you do it, it doesn't really matter IMO - however, I quite like that way. Kind Regards, Dave Walker

Re: bayes training doesn't seem to have any affect

have autolearn enabled. To see what is really going on run $ spamassassin -D /path/to/the/email /dev/null, and see if you can learn anything as to why it's not working as expected. Also, to see how experienced your Bayes knowledge is - use $ sa-leanrn --dump magic HTH. Kind Regards, Dave

Re: Virtual Postfix Users move SPAM to .Junk

. I am really hoping someone can point me in the right direction. SNIP Hi Jason, I use procmail to achieve just this, can you provide some log extracts on where you are seeing Security Reasons? Kind Regards, Dave Walker

Re: Bombed by PNG spam and spamassassin say its HAM argh

into their Outlook hit 'send'. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527 #include

Re: sa with spamass-milter UNPARSEABLE_RELAY problem - fixed

that are not offered. So when in doubt give it more than it needs. EG for your instance, set that confMILTER_MACROS_ENVRCPT to be: define(`confMILTER_MACROS_ENVRCPT',`r, v, Z, b, _, {greylist}')dnl -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.edu

Re: emailBL

. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527 #include std_disclaimer.h Better is not better

Re: Phishing

Hi Thomas! Casartello, Thomas wrote ... (4/24/2009 8:05 PM): One major issue we’ve been having lately is with phishing emails being targeted at us. They’re being sent to us from hacked accounts at other educational institutes. The message usually is about “Your EDU webmail account is

Re: Phishing

John Hardin wrote ... (4/25/2009 12:06 PM): A phisher would send emails to a large number of people saying, literally, I am your email administrator, your account is to be suspended, please send me your username and password. DKIM will not work, BAYES should work quite well. Actually it

Re: 20_dnsbl_tests.cf

Michael Hutchinson wrote ... (4/7/2009 7:09 PM): I have made some changes to my SA 3.1.7 20_dnsbl_tests.cf when I compared it to the 3.2.5 release. I basically just removed 2 DNSBL lookups that are redundant. This is done in attempt to solve an issue random scan times of 30 seconds plus. When

Re: [OT] Re: SpamAssassin is EXTREMLY slow

cache is reaching out to a common DNS cache inside the same network which is doing all the outside DNS lookups for mail services. The common cache is cycling around once an hour. SA routinely takes less than a second per message with several URLs in the message. Does that help? DAve

Suggestions on Rules and SA config location in Plesk?

- but leaves no clues as to where that file is to attempt to edit it! Unless it's then compiled, which may run faster but is annoying, so how do I get it in a plain form - edit - then recompile? Also not in docs I could find after an exhaustive search. Thanks! Dave PSCGi

Re: Suggestions on Rules and SA config location in Plesk?

- Original Message - From: Kris Deugau kdeu...@vianet.ca To: SpamAssassin Users List users@spamassassin.apache.org Sent: Thursday, March 26, 2009 4:04 PM Subject: Re: Suggestions on Rules and SA config location in Plesk? Dave Duffner wrote: OK, apparently when I had an Ensim box

Re: Spam Assassin White List

Is there a blacklist_noauth? Because it seems that would be far more useful for paypal. blacklist_auth *paypal* You whitelist_auth paypal.com and then a rule that scores +50 for From contains *...@paypal.com -- quick and easy. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com

Re: Suddenly bouncing emails

practice is to run a DNS instance on your mail server for its exclusive use to avoid that sort of problem. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com You know a nice little side benefit of watching women's sports? Sitting in front of the TV for a while without hearing about erectile dysfunction

Re: Spam Assassin White List

in a world where spammers forge From: addresses constantly. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com You're useless when you're high on catnip, you know that?

Re: accept only gpg/pgp mail

dmdm wrote ... (3/7/2009 2:07 PM): What lines lines would need to be added and in which file to accept only gpg/pgp encrypted and non-ecrypted signed emails to my admin account? (debian lenny mail server amavisd-new) dmdm Wrong list. SA does not accept nor reject emails, it only scans

Re: Bye Bye Bayes

I used to have a couple of users who treated their Trash folder as long-term read-message storage. I have a user like that at $DAYJOB. I used to ask him if he kept his car title and other important documents in the wastebasket under his desk at home. -- Dave Pooser Cat-Herder-in-Chief

Re: DNS MX Question [OT]

On Sat, 14 Feb 2009, Marc Perkel wrote: Dave Funk wrote: On Sat, 14 Feb 2009, Marc Perkel wrote: Marc Perkel wrote: Hi, I have a quick bind question. I want to set the MX records on a domain to something normal but I want to set the MX for all subdomains to something else

Re: DNS MX Question [OT]

On Sat, 14 Feb 2009, Marc Perkel wrote: Lindsay Haisley wrote: On Sat, 2009-02-14 at 22:06 -0800, Marc Perkel wrote: Dave Funk wrote: Yes, it -is- that simple. ;) Not recommended for normal use but if you understand the risks involved, it does work that way. Thanks Dave, but I

Re: DNS MX Question [OT]

10 blackhole.example.com. Yes, it -is- that simple. ;) Not recommended for normal use but if you understand the risks involved, it does work that way. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege of Engineering 319/335-5751

Re: Spam hitting Bayes_99?

accurately-flagged spam-- into that folder for learning. You can do the same thing with ham, too. I have my server regularly learn as ham a couple of users' inboxes to make sure Bayes has a good ham corpus to work with. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey

Re: Temporary 'Replacements' for SaneSecurity

None of my friends are on services that are that poorly configured No friends on Verizon? Their @#$% mail servers are 70% of my FPs. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved

Re: Spamassassin RBL

to spamassassin in test mode: spamassassin -t testmessage.txt Look at the output. Now open the testmessage in your favorite text editor, change the final '.1' in that URL to '.2' and retest. You should see a bunch of URI rule hits and the total score should jump by 20 points or more. -- Dave

Preemptive URI blocklisting

joins their blacklist a couple of weeks later) -- but I think the real win would come in creating a URI specifically for preemptively listing these snowshoe domains. Anybody else think this could be useful? -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com I don't think there's a problem you

Re: sought rules updates

yet. I'm sure it will be fixed by tomorrow. He's pretty good about getting those things fixed quickly. Dave

Re: night of pleasure spam

would get it after a few hits I think. DAve -- The whole internet thing is sucking the life out of me, there ain't no pony in there.

Re: SURBL Usage Policy change

Jeff Chan wrote ... (11/11/2008 7:33 PM): Hi Micah, Thanks very much for the feedback. Does anyone know how many non-profits have more than 1,000 users (i.e., users with mailboxes)? The non-profit pricing is below ISPs and half that of regular end users. There are many non-profits out

Re: Re[2]: filter for russian porno message?

Thanks. Sorry,but I'm new in spamassassin users.Can you say where I must write this rules? Thanks again. Be very careful with that rule-- it would hit on all Russian-language email, which considering your geographic location might be unwise. -- Dave Pooser Cat-Herder-in-Chief

Re: New free blacklist: BRBL - Barracuda Reputation Block List

Joseph Brennan wrote ... (9/23/2008 2:37 PM): No, they don't, really. They 'may' do that (see below). Try it. Effective immediately: AOL 220- may no longer accept connections from IP addresses which 220 have no reverse-DNS (PTR record) assigned. According to AOL's Policy

Re: New free blacklist: BRBL - Barracuda Reputation Block List

:23 -0700 From: BCOrgInfo_Team Hi Dave, Thank you for contacting BarracudaCentral.org. We have resolved the rDNS/PTR record issue. Since you did not receive the initial confirmation email, you can request a second email to be sent here: http://www.barracudacentral.org/account/resend-vcode

Re: New free blacklist: BRBL - Barracuda Reputation Block List

. *From:* Dave Koontz *Sent:* Monday, September 22, 2008 11:56 AM *To:* [EMAIL PROTECTED] *Subject:* RE: Thank you for contacting BarracudaCentral.org I just signed up over the weekend for your new BRBL service. I never got a confirmation email (primary

Re: New free blacklist: BRBL - Barracuda Reputation Block List

that submitted the original message somewhere in the bowels of an RFC1918 network. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com ...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved piece, but to slide across the finish line broadside, thoroughly

Re: New free blacklist: BRBL - Barracuda Reputation Block List

it not much to count on. DAve -- Don't tell me I'm driving the cart!

Re: New free blacklist: BRBL - Barracuda Reputation Block List

Justin Piszcz wrote ... (9/22/2008 10:14 AM): Hmm I signed up for this 1-2 days ago but never got a confirmation e-mail from them? What is the RBL name? Justin. Same here. For those currently running this, how long did it take to get confirmation email and setup? ~ Sparky ~

Re: New free blacklist: BRBL - Barracuda Reputation Block List

Rose, Bobby wrote ... (9/22/2008 10:24 AM): I had the same issue and found that the system that's relaying (216.129.105.40) those confirmation emails doesn't have a PTR record. You'd think someone selling a antispam/email appliance would be familiar with the RFCs. That would explain why I

Re: More spam after disabling local BIND ?

a great reduction in traffic for the RBL provider. DAve Perhaps there is a timeout associated with the RBL filters that can be increased? I understand that if such a timout option existed and was increased, performance would suffer. I'm just fishing here ... Turning off BIND was needed

Re: Rule to block link to *.zip *.exe *.scr ...

Rejaine Monteiro wrote ... (8/1/2008 1:40 PM): Hi all How can I create a generic rule to block any e-mail with links to dangerous files ? Like http://.zip or http://***.exe or ***.doc.exe etc... This is one I wrote to deal with a large influx of Storm Worm's that got through once.

Re: Solution for Disaster spam?

too. Bottom line, network tests seem to be the best defense. -- Dave Funk University of Iowa dbfunk (at) engineering.uiowa.eduCollege of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_adminIowa

Re: [OT] Odd spammer tactic?

for the hope a poorly configured server running multiple services (DNS, Web, Mail, etc) will let something slip through. DAve -- Don't tell me I'm driving the cart!

Re: collecting mail for sa-learn, how to?

John Hardin wrote: On Mon, 2008-07-14 at 14:11 -0400, DAve wrote: John Hardin wrote: On Mon, 2008-07-14 at 12:16 -0400, DAve wrote: andys wrote: for a mail server running email for multiple domains what is the typical/recommended way to collect emails which arent detected as spam

Re: collecting mail for sa-learn, how to?

Diego Pomatta wrote: DAve escribió: We have had good luck by setting the email clients of *trusted* users to leave their mail on the server for 1 day. The users can then login to their webmail and move the spam to a SPAM folder and a selection of ham to a HAM folder. I train bayes on those

Re: collecting mail for sa-learn, how to?

their selections. DAve -- Don't tell me I'm driving the cart!

Re: collecting mail for sa-learn, how to?

night. By retaining the messages I train with for seven days, I can go back and relearn any improperly classified messages if needed. The key part is *trusted* users. DAve -- Don't tell me I'm driving the cart!

Re: collecting mail for sa-learn, how to?

John Hardin wrote: On Mon, 2008-07-14 at 12:16 -0400, DAve wrote: andys wrote: Hi, for a mail server running email for multiple domains what is the typical/recommended way to collect emails which arent detected as spam to be processed by sa-learn? Users are downloading mail via POP3, so once

Re: mysql AWL issue....

the SpamAssassin perl modules directly. Have you modified your MIMEDefang filter to use spamd instead? Cheers, Dave -- Dave O'Neill [EMAIL PROTECTED]Roaring Penguin Software Inc. +1 (613) 231-6599http://www.roaringpenguin.com/ For CanIt technical support, please mail

Re: how to stop SPF checks from going past trusted host?

someone have to do with bouncing back incorrect SPF failure messages? I'm sorry, but you're a constant source of backscatter, Benny. -- *Dave Koontz* (MCSE/GCIH) Associate Director Computer Information Services *Mary Baldwin College* Email: [EMAIL PROTECTED] Phone: (540) 887-7399 http

Re: [Rule Set proposal] French Rules

you mentioned, but not all of the files below it. I received: Forbidden You don't have permission to access /spam/FR_PAYLESSTAXES.txt on this server. Dave

MailChannles SPAMMING List Members?

know what I think of them now. Well, I will share my response to them as well. :-) -Original Message- From: Dave Koontz Sent: Wednesday, June 11, 2008 7:02 PM To: 'Desmond Liao' Subject: RE: Request for Interview Boy, you are border line on SPAM by sending me this message to begin

Testing DNSRBLs using SA

the server running SA with an IP known to be in the list, I do get the proper response. Anyone see a flaw in this concept? Thanks, DAve -- In 50 years, our descendants will look back on the early years of the internet, and much like we now look back on men with rockets on their back

Re: Testing DNSRBLs using SA

Rob McEwen wrote: DAve wrote: I am trying to use SA to test a DNSBL SNIP PLEASE--note that direct queries to the invaluement.com DNSBLs will *always* fail. These are *only* available via RSYNC. So please don't try to add SIP to your RBL list... it won't work!!! (Dave knows this... I'm

<    1   2   3   4   5   6   7   8   9   >