Re: URIBL_BLOCKED while using local BIND

Hi Axb, yes, I did c the config block from the wiki 1:1 into my BIND setup. I have added that zone - exemption you suggested into my config. I'll wait for a few spams to arrive to see the results. Thank you for sharing your thoughts. Best regards, Marc Am 16.09.2015 um 11:41 schrieb Axb

Re: URIBL_BLOCKED while using local BIND

sec is high ;; Query time: 121 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Di Sep 15 13:27:59 CEST 2015 ;; MSG SIZE rcvd: 57 That's correct and one of the reasons I'd like to rely on my ISPs data, since changing this is out of my hands. Best regards, Marc

Re: URIBL_BLOCKED while using local BIND

://wiki.apache.org/spamassassin/CachingNameserver#Non-forwarding and they were copied 1:1 into my setup. I'll try to find out what's wrong in the Bind-community, too. Best regards, Marc

Re: URIBL_BLOCKED while using local BIND

ed this as suggested and send myself some spams. The DNSBL Checks are working now, Thank you :) Best regards, Marc

Re: URIBL_BLOCKED while using local BIND

much stumbling blocks. Marc Am 16.09.2015 um 13:43 schrieb Reindl Harald: Am 16.09.2015 um 13:38 schrieb Marc Richter: Am 16.09.2015 um 11:41 schrieb Axb: Although, the intended setup with exemptions by defining empty forwarders for DNSBL zones was not my idea - this scenario is described

URIBL_BLOCKED while using local BIND

ISP's DNS, but resolve them using DNS Root servers. But even the IP of my server was sending just 2 requests for incomming spam since I have integrated BIND, these messages contain this ADMINISTRATOR NOTICE also. How can I hit the free usage limit by just 2 requests? Best regards, Marc

Re: URIBL_BLOCKED while using local BIND

Yes Am 15.09.2015 um 13:30 schrieb Axb: On 09/15/2015 01:23 PM, Marc Richter wrote: Also, you shouldn't make assumptions without measuring something: 1. without forwarding: ;; Query time: 543 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) 2. with forwarding to my ISP's servers: ;; Query time: 2

Re: URIBL_BLOCKED while using local BIND

SERVER: 127.0.0.1#53(127.0.0.1) 2. with forwarding to my ISP's servers: ;; Query time: 2 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) That's 271 times faster than root-servers's lookup. Marc Am 15.09.2015 um 12:55 schrieb Reindl Harald: Am 15.09.2015 um 12:51 schrieb Marc Richter: I recently read th

Re: SA doesn't respect my user_prefs

Guess this means that I have to run "spamassassin" instead of spamc, don't I? I do not understand the reason for spamc to exist then - but based upon the conversation result, it seems like the way to go ... hope my host can handle the load. Am 10.09.2015 um 12:50 schrieb Marc Ri

Re: SA doesn't respect my user_prefs

Hi KAM, why not - spamassassin seems to respect the user_prefs file. Of course I'd like to stick ti spamc, but if there is no solution for the user_prefs - issue, it fits only half of my needs. Best regard, Marc Am 11.09.2015 um 11:47 schrieb Kevin A. McGrail: Spamc exists to save startup

Re: SA doesn't respect my user_prefs

tried to run spamd as root and this is what it results in: spamd: cannot run as nonexistent user or root with -u option Best regards, Marc Am 11.09.2015 um 12:05 schrieb Olivier Nicole: Marc Richter <m...@marc-richter.info> writes: Hi KAM, why not - spamassassin seems to r

Re: SA doesn't respect my user_prefs

spamd -g spamd" to "/usr/bin/vendor_perl/spamd -u spamd -g spamd" 3. systemctl daemon-reload 4. systemctl restart spamassassin Now it works again like a charm, running spamd as spamd:spamd, and using spamc. Thanks @ all for trying to help in this case! :) Best regards, Marc

Re: SA doesn't respect my user_prefs

know what user the file "belongs" to, in test-mode. you can use -p or alternately set HOME "spamc -h" brings ... ... -p, --port port Specify port for connection to spamd. [default: 783] ... What does this help in search of a debug mode? Best regards, Marc

Re: SA doesn't respect my user_prefs

Hi @ all, maybe I'm doing it wrong here - I do not insist on being unfailable. But what's the correct way to do it then? Best regards, Marc Am 10.09.2015 um 01:48 schrieb RW: On Wed, 9 Sep 2015 14:48:14 -0700 jdow wrote: On 2015-09-09 13:51, RW wrote: On Wed, 9 Sep 2015 17:27:54 +0200 Marc

SA doesn't respect my user_prefs

*@neuronation.* Today, I got another mail with the following (relevant) headers: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on tango012.marc-richter.info X-Spam-Level: *** X-Spam-Status: No, score=3.6 required=4.0 tests=BAYES_99,BAYES_999,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU

Re: SA doesn't respect my user_prefs

e option in the normal mail-flow in a way it gets logged by journald? Can I simply add "-D" to the filter.sh script and it get's caught in journald's database? How else can I test this? Sorry if I'm slow in understanding atm ... Best regards, Marc

Re: SA doesn't respect my user_prefs

sin when the developers intend spamc to be used for this purpose? - How do I get spamc to respect user_prefs file? Best regards, Marc Am 09.09.2015 um 13:47 schrieb Marc Richter: Hi jdow, hi Matus, thanks for your replies. Regardless if it's necessary or not, I have done so. It also happens regul

Re: SA doesn't respect my user_prefs

Hi Matus, Am 09.09.2015 um 15:01 schrieb Matus UHLAR - fantomas: On 09.09.15 13:47, Marc Richter wrote: Regardless if it's necessary or not, I have done so. It also happens regularly by cron (all 3 hours), along with other jobs like sa-learn, sa-update and sa-compile. reload should be enough

Re: SA doesn't respect my user_prefs

. And it worked before, yes. When I issue spamc without the -u trigger as user ww, I get the same (wrong) results. Best regards, Marc

Delivering email to mail.protection.outlook.com [ot]

of email is delayed 1/2 hour and people are not happy. I'm hoping to get lucky and someone here knows the secret trick to delivering to mail.protection.outlook.com Thanks in advance. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot

Some free spam filtering

/Spam_DNS_Lists -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: RBL format to blacklist email addresses?

part case-sensitive * you sell ha...@example.com is a different person than ha...@example.com? * well, how do you handle half of your users just for fun using caps in their mail client and the other half don't -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http

RBL format to blacklist email addresses?

Just wondering. I'm thinking about creating an RBL to block email addresses. But you can't use an @ in a hostname for lookups. So - is there a standard RBL format for email addresses or do I need to just make something up? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http

Re: RBL format to blacklist email addresses?

On 07/29/15 12:00, David B Funk wrote: On Wed, 29 Jul 2015, Marc Perkel wrote: Just wondering. I'm thinking about creating an RBL to block email addresses. But you can't use an @ in a hostname for lookups. So - is there a standard RBL format for email addresses or do I need to just make

Detecting macros in word files

Is there any way to detect macros inside of word doc files as attachments? Or linux command line utils to do so? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: .science the new leper of TLD's?

On Tue, Jun 23, 2015 at 09:11:27AM +0200, Axb wrote: serious sites won't stick to that NS anyway. And private sites should not be sending e-mail anyway? Please don't throw out the baby with the bathwater.

Re: Help me waste spammers resources

We accept all authenticated email to tarbaby as spam. Normal email to tarbaby.junkemailfilter.com gets a 4xx error. But if it's spam or virus bots it can also make our black lists. But good email from greylisting won't be affected. On 06/19/15 14:06, David Jones wrote: From: Marc Perkel

Re: TextCat - Language help

with textcat_acceptable_score. Increasing it slightly (e.g. back to the old default of 1.05) seems to reduce those wild guesses. Regards, Marc

Help me waste spammers resources

. tarbaby.junkemailfilter.com or you can CNAME to it if you want. And I'll absorb the spam for you as they hack mt servers and that's spam you don't have to process. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: Better Post Processing

On Sat, Jun 06, 2015 at 12:48:42PM -0400, Michael B Allen wrote: Right now I'm using procmail to put spam in user's .Spam Maildir folder and then periodically just manually running sa-learn on .LearnAsSpam and then deleting everything from both folders. This is obviously not ideal since it's

Re: definition update frequency?

to expect an update at the weekend. To answer Harald's question: Even if there are no new rules, updates will still be published with current scores in order to better cope with the kind of spam that is being sent right now. After all, spammers keep adapting their tactics. Regards, Marc

Re: check_rbl_txt and multiple elements

On Fri, May 08, 2015 at 01:55:47PM +0100, RW wrote: [Plugin::ASN] The plugin generates psuedo-headers you can run tests against. X-ASN and X-ASN-Route contain _ASN_ and _ASNCIDR_ respectively. Thank you very much! This is indeed easy to test. It would be great if this piece of

check_rbl_txt and multiple elements

, but IIUC it can only be used for tagging, not for assigning direct scores?) Full patch appended (there are two more similar cases, one of which is merely cosmetic). Regards Marc --- Dns.pm.orig 2015-01-31 19:08:37.0 + +++ Dns.pm 2015-05-08 09:00:12.082711483 + @@ -174,7 +174,7

New Domain Names sending Spam

it works for you. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

testing

just checking. My email doesn't seem to be posting. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: SA 3.4.0 Upgrade

Thanks - I'll try to install it. On 10/15/14 12:38, Timo Schöler wrote: Am 15. Oktober 2014 19:10:28 MESZ, schrieb Marc Perkel supp...@junkemailfilter.com: I'm thinking about trying out SA 3.4.0 on Centos 6 or 7 if I have to. Just wondering - is it worth it? And is Redis available and how

SA 3.4.0 Upgrade

I'm thinking about trying out SA 3.4.0 on Centos 6 or 7 if I have to. Just wondering - is it worth it? And is Redis available and how hard is it to actually make it work? Thanks in advance -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email

Re: regex help

On 2/18/2014 9:32 AM, John Hardin wrote: On Tue, 18 Feb 2014, Marc Perkel wrote: Trying to do something complex and not sure how it's done. What I'm looking for is to combine 2 conditions in a single regular expression so that both have to be true for a match. Yes - I know I can make 2 SA

Re: Who wants to trade data?

On 2/7/2014 3:01 AM, Benny Pedersen wrote: On 2014-02-06 23:41, Marc Perkel wrote: I have 700,000 IP addresses of hackers trying to send email using stolen authentication. Anyone interested? http://ipadmin.junkemailfilter.com/auth-hack.txt q: how many is listed in spamhaus pbl ? q: is dnswl

Who wants to trade data?

I have 700,000 IP addresses of hackers trying to send email using stolen authentication. Anyone interested? http://ipadmin.junkemailfilter.com/auth-hack.txt -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Do you want to buy this domain name spam

I'm seeing a lot of Do you want to buy this domain name spam lately. Is it just me or is anyone else seeing this? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

[OT] Wrote a cool script to give cron seconds resolution

Short bash script to run a program 30 20 15 12 10 6 5 4 3 2 executions per minute. http://wiki.junkemailfilter.com/index.php/How_to_run_a_Linux_script_every_few_seconds_under_cron -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter

Re: Who wants my spam?

thought of. Besides - I use other lists for free so it's my way of giving back. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Who wants my spam?

, all kinds of good juicy spam needing to be blocked. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: Who wants my spam?

On 12/12/2013 10:57 AM, David F. Skoll wrote: On Thu, 12 Dec 2013 10:01:30 -0800 Marc Perkel supp...@junkemailfilter.com wrote: [some stuff] Amusingly, the original message was trapped by our system as spam. Was that a correct decision? Do we need to purchase the OP's spam feeds? Should I

Re: Feedback on blacklist rule I plan to write

?) ...or is the REALLY a very bad idea? Thanks so much for your assistance in advance. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

How to get removed from spamcop?

there? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: How to get removed from spamcop?

On 10/28/2013 8:23 PM, Joe Sniderman wrote: On 10/28/2013 05:06 PM, Marc Perkel wrote: Just wondering if any real people are there or if it's totally automated. They have real people there. They have several of our IP addresses listed Hmmm and delisting doesn't seem to work. Strange

Re: Spam harvesting using Fake Authentication

. But I do take in their whole message. And I don't let them know they are blocked so I'm just wasting their bandwidth. But it's added about 1/4 of a million IPs to my blacklist. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com

Spam harvesting using Fake Authentication

passwords. All user password combinations are accepted. And it's working. All authenticated email is harvested as spam and the IP is blacklisted and spam is analyzed. And it helps waste hackers resources. I have a list of about 250,000 IP addresses of hackers. -- Marc Perkel - Sales/Support supp

Re: Spam harvesting using Fake Authentication

probed by spammers as well? No - not sure what I'd do with it. Thanks, Alex -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Interesting Spam Trap Idea - Fake Authentication

hack. I'm wondering if enough of us put up fake authentication not only can we detect spam that way but we could waste a lot of spammer's resources. Thoughts? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: Interesting Spam Trap Idea - Fake Authentication

, I'd assume it was a honeypot and avoid it. Creating a realistic honeypot that's hard to detect as such is quite difficult. Regards, David. I'm not sure. I'm wondering if they use automation and maybe it's not so smart. I don't think there is a guy typing passwords. -- Marc Perkel - Sales

Re: Interesting Spam Trap Idea - Fake Authentication

On 6/10/2013 8:38 AM, David F. Skoll wrote: On Mon, 10 Jun 2013 08:32:35 -0700 Marc Perkel supp...@junkemailfilter.com wrote: I decided to implement and advertise that the server had SMTP athentication even though there was nothing to authenticate. I created an authenticator that would accept

Need rules to catch this kind of spam

=Geneva, sans-serif size=2 color=#f4f4f8other/FONT/p pFONT face=Lucida Sans Unicode, Arial size=-1 color=#f2f2f6/FONT /p /body /html -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

MariaDB replacing MySQL for Bayes

So - after a couple of weeks it just works. I recommend getting rid of MySQL in favor of MariaDB. Besides bayes I'm using it on my web server and it just works and it's a lot more solid. My 2 centz -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk

Reducing SPAMD memory size?

My spamd tasks are using 100M to 300M each. Seems excessive. What can I do to reduce this? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: MariaDB instead of MySQL

So - after a few days all is good. The verdict seems to be that MariaDB works much better than MySQL. The conversion was trivial and everything just works now. I'm filtering for about 80k users. MySQL never worked for me longer than a few hours. Token count is abut 2,000,000. I'm recommending

Re: MariaDB instead of MySQL

On 5/17/2013 6:45 AM, Benny Pedersen wrote: Marc Perkel skrev den 2013-05-17 06:12: Yeah - I'm running global too. Not per user. why do you have 7 servers and only one mysql server ? :) well to get more performance out of mysql one need to use clustered backends aswell, so to get most

MariaDB instead of MySQL

good. Just wondering if anyone else has any thoughts or suggestions about this. Maria is telling me it's processing 400 connections per second in my configuration. Thoughts? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415

Re: MariaDB instead of MySQL

. I'm hoping it will continue to work. We'll see if it makes it to tomorrow. So far the conversion to MariaDB was painless. I'm somewhat impressed so far. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: MariaDB instead of MySQL

tried. It would avoid having to rsync the FNs to learn them for each system. Thanks, Alex -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

What does this haxker code do?

('/Windows/', $ua) preg_match('/MSIE|Opera/', $ua) ){ error_reporting(0); if(!isset($_COOKIE['__utmfr']) $nfc=frm_getfrm() ) { @setcookie('__utmfr',rand(1,1000),time()+86400*7,'/'); print($nfc); } } } -- Marc Perkel

Testing Valid Recipients for outbound spam filtering

recipient callouts. DNS indicators that would suggest the recipient is bad. Or - open to any suggestions on blocking outbound spam. (I'm filtering outbound for customers so I don't control the original servers) -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http

Re: Testing Valid Recipients for outbound spam filtering

On 5/1/2013 12:12 AM, Robert Schetterer wrote: Am 01.05.2013 08:17, schrieb Marc Perkel: Looking for tricks. I'm working on improving outbound spam filtering and I'm using Exim and testing for valid recipients doing forward recipient callouts, which I would like to reduce. I'm wondering

Need rule to catch lots of font changes

=#e8fdfaher/p pFONT face=Comic Sans MS, Arial size=1 color=#e4f9f6/FONT /p /FONT -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Yahoo single link spam

style=font-size: 16px;nbsp;/span/spana href=http://www.eisingen.de/kb/m6ods3ohyayq.r34xx5y7k8rn1ycnemh;http://www.eisingen.de/kb/m6ods3ohyayq.r34xx5y7k8rn1ycnemh/abrbrLisa Tostado, NDbrdivbr/div/div/body/html ---262101065-1882747875-1361559395=:62570-- -- Marc Perkel - Sales/Support supp

Masscheck question

Hi, I've been running mass checking for about a week getting the process fine tuned. I notice however that I never get a negative score. Lowest score is 0. Am I missing something? Thanks in advance -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com

Re: mass check tips and tricks - need advice

. Looking for advice at this point about anything I should be doing that I'm not, or any useful feedback. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

mass check tips and tricks - need advice

maildir format. I am going to be running on SSD drives. should I use mbox? I'm just looking for general advice about how to do it right. Any good advice appreciated. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992

Re: Who wants a lot of spam (to analyse)

On 2/11/2013 2:58 AM, Benny Pedersen wrote: Marc Perkel skrev den 2013-02-08 17:36: I have some spam streams - about 200 spams per minute - that I'm willing to share for free or sell to anyone who wants to use it to fight spam. We would forward the spam to an email address you would provide

Re: Who wants a lot of spam (to analyse)

On 2/11/2013 7:23 AM, Kevin A. McGrail wrote: On 2/11/2013 10:18 AM, Marc Perkel wrote: I actually have 2 companies who are paying me for spam. Just shows some people will buy anything. :) But also looking to give it away. I have about 7 more people who I give it away or trade

Who wants a lot of spam (to analyse)

information or lists to the public for free. No charge black lists. Anyone who has a list or something of value that we need to trade. We will also sell the spam to anyone else. Contact me privately if you're interested. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http

Re: Who wants a lot of spam (to analyse)

On 2/8/2013 8:43 AM, John Hardin wrote: On Fri, 8 Feb 2013, Marc Perkel wrote: I have some spam streams - about 200 spams per minute - that I'm willing to share for free or sell to anyone who wants to use it to fight spam. We would forward the spam to an email address you would provide

Re: Telling BAYES not to learn?

On 2/7/2013 6:58 AM, RW wrote: On Tue, 05 Feb 2013 07:20:24 -0800 Marc Perkel wrote: is there a way I can put something in a rule that would cause bayes not to learn - such as a rule that detects bayes poisoning? Why do you think this is a good idea? Because when a message uses invisible

Re: Rules based on number of lines?

On 2/7/2013 10:11 AM, Kevin A. McGrail wrote: On 2/7/2013 11:15 AM, Marc Perkel wrote: How would you write a rule to detect a message with less than 5 lines and has a link in it? Are you by chance working on crap from compromised Yahoo! accounts? Have you looked at the 3.4 rule

White Text Rule

Is there some sort of rule to catch white text on white background to hide text? Seems like there should be. FONT COLOR=#FF -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Telling BAYES not to learn?

is there a way I can put something in a rule that would cause bayes not to learn - such as a rule that detects bayes poisoning? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: White Text Rule

On 2/5/2013 8:08 AM, John Hardin wrote: On Tue, 5 Feb 2013, Marc Perkel wrote: Is there some sort of rule to catch white text on white background to hide text? Seems like there should be. FONT COLOR=#FF Yes. HTML_FONT_LOW_CONTRAST. On Tue, 5 Feb 2013, David F. Skoll wrote: etc

Re: sudden increase in spam

the spammers worked out a new way around the current SA machinery? -- View this message in context: http://spamassassin.1065346.n5.nabble.com/sudden-increase-in-spam-tp103247.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com. -- Marc Perkel - Sales/Support supp

Re: Regex Help

On 11/10/2012 11:13 AM, John Hardin wrote: On Sat, 10 Nov 2012, Marc Perkel wrote: Just a thought, I changed this: uri URI_PROTO_MC /^(?!(?-i:https?:))https?:/i into this: uri URI_PROTO_MC /^(?!(?-i:ttps?:))ttps?:/i Some people capitalize the H - but the rest of it being mixed case

Regex Help

Need a rule to catch this: HtTp://goOGleplAcESSEOopTimiZaTIonx.cOm Mixed case links -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: Regex Help

I meant a rule to catch mixed case URIs in general. That was just one example. On 11/10/2012 7:44 AM, dar...@chaosreigns.com wrote: On 11/10, Marc Perkel wrote: Need a rule to catch this: HtTp://goOGleplAcESSEOopTimiZaTIonx.cOm body GOOGLEMIXED /HtTp:\/\/goOGleplAcESSEOopTimiZaTIonx.cOm

Re: Regex Help

On 11/10/2012 8:57 AM, John Hardin wrote: On Sat, 10 Nov 2012, Marc Perkel wrote: Need a rule to catch this: HtTp://goOGleplAcESSEOopTimiZaTIonx.cOm Mixed case links Mixed-case protocol: uri URI_PROTO_MC /^(?!(?-i:https?:))https?:/i Note: this _will_trigger on HTTP and HTTPS but I

Re: Regex Help

Actually - I think that will do as is. I'm going to test it. Thanks for your help. On 11/10/2012 8:57 AM, John Hardin wrote: uri URI_PROTO_MC /^(?!(?-i:https?:))https?:/i -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415

Re: Regex Help

On 11/10/2012 10:51 AM, John Hardin wrote: On Sat, 10 Nov 2012, Marc Perkel wrote: What would you have to do to show the URI in the description? ...it would have to be a plugin. There's no general-purpose model for putting a capturing expression into a rule and having the captured match

Re: Regex Help

That should have been: uri URI_PROTO_MC /^[Hh](?!(?-i:ttps?:))ttps?:/i -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: Rules Needed to verify bank fraud

exceptions including if the SFP lists it, or a list of known 3rd parties that pass the bank's email. Here's why this is important. It hits the fraud community hard. Takes the money out. Makes spam less profitable. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http

Rules Needed to verify bank fraud

wikipedia.org windowslive.com yahoo.com.cn yahoo.com.hk yahoo.com.in yahoo.com.uk -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: Rules Needed to verify bank fraud

so that we can be 100% accurate on blocking and passing those specific domains. Most of these domains should be easy to detect once we know where they send legitimate email from. This would be a devastating blow to spammers. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http

Sweet spamassassin server hardware

Just bought this at NewEgg and it's making a great SA server. Using a desktop Asus motherboard, 8 core AMD processor @ 3.6 ghz per core - and 32 gigs of ram. And you can get all that for $600. Pretty amazing! -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http

Re: Bayes and MySQL - does it actually work?

On 12/21/2011 10:58 AM, Robert Schetterer wrote: Am 21.12.2011 19:10, schrieb Kris Deugau: Marc Perkel wrote: I've been trying for a long time to get bayes/mysql to actually work. Running a dedicated server with MySQL. Several servers running SA configured to talk to it. I'm running big

Bayes and MySQL - does it actually work?

if it is ever going to work and if someone is going to fix it? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: Bayes and MySQL - does it actually work?

: Am 21.12.2011 15:39, schrieb Marc Perkel: I've been trying for a long time to get bayes/mysql to actually work. Running a dedicated server with MySQL. Several servers running SA configured to talk to it. I'm running big servers with lots of ram and raid 0 flash drives for speed. Also using InnoDB

Detecting serious domains

and provide some sort of DNS based lookup of whois information to be able to determine the registrar of a domain, the domain age, or other info that would be useful in determining that the domain is serious or not. Who thinks I'm onto something? -- Marc Perkel - Sales/Support supp

Regex to detect gibberisk

htnotdw btbd e. UL eofotg esng tthsnl iaehpcn HWte eaorirtn HOIEes sss trlRRe hpkgbagt hao ewRet dvi, hi . RGAtp tees ocrbwfs sEki frn lgDiiho, dETHTp itbrifra IShism a'ef ihojnfNL ayeecsaca idhcAOEHuie erefe ishttcUL ituhi dsiaiel ahenh -- Marc Perkel - Sales/Support supp...@junkemailfilter.com

Re: Why doesn't anything at all get these botnet spammers?

://hnungarid.fileave.com/index.html czqrrgdmud ymlfkdv wh jhuaemf dus iv wztppda nqq vwoq nppfb. -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: Good bye RCVD_IN_HOSTKARMA_BL

On 10/13/2011 9:43 PM, Rob McEwen wrote: On 10/14/2011 12:05 AM, Marc Perkel wrote: OK - I didn't deliberately blacklist them. I found a bug in my yellow listing code No system or person or group of people is perfect and we ALL make mistakes... even big mistakes from time to time... and even

Re: Good bye RCVD_IN_HOSTKARMA_BL

On 10/12/2011 12:49 PM, jdow wrote: The idiots who run that one have put the Earthlink smtp servers into their list. So I am opting out of it. I don't want ALL my received mail marked as spam. Damn fools. {+_+} Excuse me! Earthlink servers are NOT blacklisted. -- Marc Perkel - Sales

Re: Good bye RCVD_IN_HOSTKARMA_BL

be ) possible ever, at your site and on other sites Except the premise is not true. We do not list earthlink.net in our blacklist. Eathlinks servers are yellow listed indicating that they are a mixed source of email and the IP address means nothing. -- Marc Perkel - Sales/Support supp

<    1   2   3   4   5   6   7   8   9   10   >