Interesting low scoring phish

2009-12-07 Thread rich...@buzzhost.co.uk
http://pastebin.com/m7c1c17d Interesting insofar as it appears to be whitelisted??? Is this some kind of well known US email or hosting service? Sane missed it, the dnsbl's have missed it and the content filtering has missed it. So it's a tasty morsel of spam :-)

Re: Interesting low scoring phish

2009-12-07 Thread rich...@buzzhost.co.uk
On Mon, 2009-12-07 at 16:00 +0100, Yet Another Ninja wrote: On 12/7/2009 3:42 PM, rich...@buzzhost.co.uk wrote: http://pastebin.com/m7c1c17d Interesting insofar as it appears to be whitelisted??? Is this some kind of well known US email or hosting service? Sane missed

RE: Suggestion for use by ANY whitelist service....

2009-12-06 Thread rich...@buzzhost.co.uk
On Sat, 2009-12-05 at 22:12 -0800, R-Elists wrote: frankly, nothing against them, yet if an organization really needs Return Path to get their email through to mailboxes without rejection, then doesn't the originator of the email have problems? Of course they do! That's why ESP's exist -

HABEAS 'date the UK' accreddited spam figures

2009-12-06 Thread rich...@buzzhost.co.uk
My figures for date the UK in the last 72 hours: 118 mails *all* HABEAS accredited. == CHECKING DNSBL WHITE LISTS == 80.75.69.201 NOT WHITELISTED: sa-other.bondedsender.org, resl.emailreg.org, plus.bondedsender.org, ips.whitelisted.org

Re: HABEAS 'date the UK' accreddited spam figures

2009-12-06 Thread rich...@buzzhost.co.uk
On Sun, 2009-12-06 at 18:07 +0100, Per Jessen wrote: FYI, abuse@ is specified in RFC2142, and need not be explicitly listed in the whois. Thanks. I knew it was somewhere :-)

Re: Suggestion for use by ANY whitelist service....

2009-12-06 Thread rich...@buzzhost.co.uk
On Sun, 2009-12-06 at 12:02 -0700, LuKreme wrote: On 6-Dec-2009, at 02:24, rich...@buzzhost.co.uk wrote: A truly clean company that always uses opt-in and never spams has nothing to fear from any anti-spam measure. Oh, that is CERTAINLY not true. It's not even true of just SpamAssassin

Re: Suggestion for use by ANY whitelist service....

2009-12-05 Thread rich...@buzzhost.co.uk
On Dec 4, 2009, at 12:19, Ted Mittelstaedt t...@ipinc.net wrote: That wouldn't ever happen because the whole point of the CAN-SPAM act is to allow the spammers to send out the first mail. The CAN-SPAM spiel is an American phenomena that holds questionable relevance to the rest of the

Re: Suggestion for use by ANY whitelist service....

2009-12-05 Thread rich...@buzzhost.co.uk
On Sat, 2009-12-05 at 15:57 +0100, Per Jessen wrote: rich...@buzzhost.co.uk wrote: In the UK I'm more interested in the offences sending UBE/UCE commits under the Protection from Harassment Act, Section 42 of the Telecommunications Act and possible offences under the Data Protection

Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 00:18 -0800, jdow wrote: From: LuKreme krem...@kreme.com Sent: Thursday, 2009/December/03 20:55 On Dec 3, 2009, at 13:43, rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: On Thu, 2009-12-03 at 11:23 -0700, J.D. Falk wrote: On Dec 2, 2009, at 12:59 AM, rich

Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 04:16 -0800, jdow wrote: From: Yet Another Ninja sa-l...@alexb.ch Sent: Friday, 2009/December/04 02:28 On 12/4/2009 10:57 AM, rich...@buzzhost.co.uk wrote: FINAL This is not a social club, it's a question and issues list for Spamassassin. My question and issue

Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 11:28 +0100, Yet Another Ninja wrote: The correct answer will be precisely why this state of affairs exists. - because developers think/have thought its a good idea. - because nobody other than you makes such a noise about it. And YOU who are so against, have you

Re: J.D. Falk spineless insults (Re: HABEAS_ACCREDITED SPAMMER)

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 06:55 -0700, LuKreme wrote: On 3-Dec-2009, at 23:06, R-Elists wrote: certainly we understand your point here, yet what about accountability for Return Path Inc (and other RPI companies) related rules in the default Spamassassin configs? My position on HABEAS is

Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 10:50 -0500, Charles Gregory wrote: On Fri, 4 Dec 2009, rich...@buzzhost.co.uk wrote: Qualifies what, that I get UBE that is Habeas Accredited? Should I start with the 40 from 'DateTheuk' in the last 8 days? Okay, let's be methodical. Let us indeed start with those

Re: Suggestion for use by ANY whitelist service....

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 11:08 -0500, Charles Gregory wrote: All this debate about 'legitimate' mail services like 'returnpath' being abused by 'sneaky' spammers. How is that possible? There should be easy ways to prevent it. Here's a few ideas: As soon as any whitelist service like

Re: Suggestion for use by ANY whitelist service....

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 12:01 -0500, Bowie Bailey wrote: rich...@buzzhost.co.uk wrote: That to one side, the default for a spam filter should not be to give any weight to a white list unless the user modifies the config themselves specifically. It can be seen to be suspicious and offering

Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-04 Thread rich...@buzzhost.co.uk
On Fri, 2009-12-04 at 18:11 +0100, Per Jessen wrote: rich...@buzzhost.co.uk wrote: This was raised as the IP appeared in HABEAS and for a few hours it 'vanished' from the list. It's back there now, but DateTheUk is now pumping out via an ip six decimal places up on the last octet

Re: [sa] Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-04 Thread rich...@buzzhost.co.uk
I've just had another one to a honeypot - care of myspace. My dog does not have a myspace account. Again, this is a harvested email address. 204.16.33.75WHITELISTED:sa-accredit.habeas.com Whilst I appreciate that nobody would turn their noses up at taking $$$ from someone like

Re: J.D. Falk spineless insults (Re: HABEAS_ACCREDITED SPAMMER)

2009-12-03 Thread rich...@buzzhost.co.uk
On Thu, 2009-12-03 at 11:23 -0700, J.D. Falk wrote: On Dec 2, 2009, at 12:59 AM, rich...@buzzhost.co.uk wrote: As for insulting you - grow up. You work in the business of sending unwanted junk email. You haven't done any research at all, have you? http://www.cauce.org/about/bod.html

Re: HABEAS_ACCREDITED SPAMMER

2009-12-02 Thread rich...@buzzhost.co.uk
On Tue, 2009-12-01 at 15:06 -0700, J.D. Falk wrote: On Nov 30, 2009, at 12:38 PM, rich...@buzzhost.co.uk wrote: So please, spare me the sob story about what a wonderful idea HABEAS is. Talk is cheap, action speaks louder than words. Who's sobbing? I'm merely explaining how it works

OT: Christmas Gift ideas

2009-12-02 Thread rich...@buzzhost.co.uk
This is top of my list.. http://www.amazon.co.uk/Constant-Contact-Guide-email-Marketing/dp/0470503416/ref=sr_1_1?ie=UTF8s=booksqid=1259777127sr=8-1

Re: which free RBL do you use?

2009-11-30 Thread rich...@buzzhost.co.uk
Matus forgot to include this one he sent to me personally: On Fri, 2009-11-27 at 14:03 +0100, Matus UHLAR - fantomas wrote: Why do you tell me? Tell the OP, I just have used the same terminology. On 27.11.09 15:47, rich...@buzzhost.co.uk wrote: Matus, why are you once more sending me off

Re: Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
Even after learning they still only score 3.6 Anything I can do? On 28.11.09 10:12, rich...@buzzhost.co.uk wrote: I got '5' for it, at a push... X-Spam-Level: * X-Spam-Status: Yes, score=5.1 required=5.0 tests=RDNS_NONE,RELAYCOUNTRY_FR X-Spam-RBL-Results: dns

Re: Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 13:57 +0100, Matus UHLAR - fantomas wrote: it's funny that you send me private copies for mail that DOES belong to the list, but you refuse private mail even if it's does NOT belong here. Well, I figured if you wanted to go on being an ignorant asshole and keep doing it,

Re: Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 13:57 +0100, Matus UHLAR - fantomas wrote: On 28.11.09 10:12, rich...@buzzhost.co.uk wrote: I got '5' for it, at a push... X-Spam-Report: * 5.0 RELAYCOUNTRY_FR Relayed through France On Mon, 2009-11-30 at 12:18 +0100, Matus UHLAR - fantomas wrote

Re: Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 14:14 +0100, Matus UHLAR - fantomas wrote: On 28.11.09 10:12, rich...@buzzhost.co.uk wrote: The last time I checked no two email systems, be they home, soho or enterprise, had to be the same. Unless, of course, you are now declaring that everyone should be set

Re: NOT really about Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 10:08 -0500, Charles Gregory wrote: PS. If I were a spammer I would be laughing my ass off at this waste of time. Every effort spent on fighting each other is less spent on them. Actually, it's reasonable to argue that you are worse - you've just contributed to an

Re: OT: Re: NOT really about Unhindered Pharma Spam

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 12:06 -0500, Matt Garretson wrote: Chris Owen wrote: Why anyone replies to this guy about anything is beyond me. Adding him to a kill file doesn't do much good when you still see the other half of the argument. +1 If you must feed the trolls, please at least

Re: HABEAS_ACCREDITED SPAMMER

2009-11-30 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-30 at 12:19 -0700, J.D. Falk wrote: On Nov 25, 2009, at 3:57 AM, Hajdú Zoltán wrote: Then whos job? :) Habeas doesnt monitor Your Inbox. If You have the time to write here just for 'flaming' against a ~good concept... ...Maybe it would be a better idea to spend that

Re: Unhindered Pharma Spam

2009-11-28 Thread rich...@buzzhost.co.uk
On Sat, 2009-11-28 at 09:48 +, Arthur Dent wrote: Hello all, I have had a couple of these sail into my my inbox untouched by SA with the exception of RDNS_NONE and Bayes. Score of -0.1! http://pastebin.com/m478c33ce Even after learning they still only score 3.6 Anything I can do?

Re: which free RBL do you use?

2009-11-27 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-27 at 12:27 +0100, Matus UHLAR - fantomas wrote: On 26.11.09 17:12, Allen Chen wrote: I didn't touch my spamassassin server for almost one year. It's still running and filtering spam without any problems. But I think things are changed a lot. I'm using 3.2.4. So I am

Re: which free RBL do you use?

2009-11-27 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-27 at 14:03 +0100, Matus UHLAR - fantomas wrote: Why do you tell me? Tell the OP, I just have used the same terminology. Matus, why are you once more sending me off list replies? Again, will you *please* keep your replies *ON LIST*. I pointed out that RBL is trademark just to

Re: which free RBL do you use?

2009-11-27 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-27 at 17:17 +0100, Benny Pedersen wrote: On fre 27 nov 2009 16:47:54 CET, rich...@buzzhost.co.uk wrote Matus, why are you once more sending me off list replies? Again, will you *please* keep your replies *ON LIST*. priceless reply-to Priceless indeed. Everybody else can

Re: well, isnt that special...

2009-11-26 Thread rich...@buzzhost.co.uk
On Thu, 2009-11-26 at 08:57 +0100, Per Jessen wrote: rich...@buzzhost.co.uk wrote: On Wed, 2009-11-25 at 14:04 -0500, Alex wrote: iptables -A FIREWALL -s 127.0.0.0/8 -j DROP Nah, use REJECT so you get that immediate satisfaction :-) Alex NO NO NO NO NO! Drop has the effect

Re: well, isnt that special...

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 17:34 +, Ned Slider wrote: Aaron Wolfe wrote: On Wed, Nov 25, 2009 at 12:04 PM, Ned Slider n...@unixmail.co.uk wrote: R-Elists wrote: on a much more important note, can those on the list that have a good handle on better filtering spam and/or UCE from

Re: UCEPROTECT questions

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 13:45 -0500, Alex wrote: Hi, I'm interested in people's opinion of UCEPROTECT. I'm aware of how it works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I wondered if I was doing something wrong. I've set the score to 0.01 for now, while I watch and see

Re: well, isnt that special...

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 19:20 +0100, Benny Pedersen wrote: On ons 25 nov 2009 18:55:11 CET, rich...@buzzhost.co.uk wrote Any more ranges most welcome :-) iptables -A FIREWALL -s 127.0.0.0/8 -j DROP Very good. That was nearly funny :-) Why don't you add: iptables -A FIREWALL -s 0.0.0.0/0 -j

Re: well, isnt that special...

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 14:04 -0500, Alex wrote: iptables -A FIREWALL -s 127.0.0.0/8 -j DROP Nah, use REJECT so you get that immediate satisfaction :-) Alex NO NO NO NO NO! Drop has the effect of tarpitting them :-) As the Supremes sang; Set me free why don't you baby? You just keep me

Re: HABEAS_ACCREDITED SPAMMER

2009-11-24 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-24 at 09:17 +0100, Hajdú Zoltán wrote: Habeas (nowdays ReturnPath) certifies their clients, forces them to provide unsubscription options in their advertising messages, etc. If there wasnt any unsubscribe option then contact their support/abuse team. They list many important

Re: HABEAS_ACCREDITED SPAMMER

2009-11-24 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 00:23 -0700, LuKreme wrote: On 24-Nov-2009, at 15:23, Jeff Mincy wrote: From: LuKreme krem...@kreme.com On Nov 23, 2009, at 7:39, Matus UHLAR - fantomas uh...@fantomas.sk Yes, why to differ between non-abusing and abusing marketers... We've been through

Re: HABEAS_ACCREDITED SPAMMER

2009-11-23 Thread rich...@buzzhost.co.uk
Thanks to Matus for the explanation, LuKreme for the suggestion on scoring and Hajdu for the contact details. I am obliged to you and thank you for your time.

Re: HABEAS_ACCREDITED SPAMMER

2009-11-23 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-23 at 17:08 -0700, LuKreme wrote: On Nov 23, 2009, at 7:39, Matus UHLAR - fantomas uh...@fantomas.sk wrote: Yes, why to differ between non-abusing and abusing marketers... We've been through this before. On my mail, habeas is a very strong indicator of spam. It does

Custom Rule Location

2009-11-22 Thread rich...@buzzhost.co.uk
I think this may have been answered before, but I can't find it in the archives. Custom rules can be kept in /etc/spamassassin/whateva.cf files no problem. I would like to keep some rules separate for maintenance, by keeping rules I write in /etc/spamassassin/custom/, and some that friends write

Re: Custom Rule Location

2009-11-22 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-22 at 17:10 +0100, Benny Pedersen wrote: man sa-update Thanks, but all that says is making use of: --updatedir Will allow rules to be downloaded to a different directory. What I'm looking to do is have SA look in these directories in addition to the default locations. I don't

Re: Custom Rule Location

2009-11-22 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-22 at 14:17 -0500, Alex wrote: Hi, What I'm looking to do is have SA look in these directories in addition to the default locations. I don't have a problem putting rules there Benny. I have a problem getting SA to look there for them :-) Are you talking about doing

Re: rbl checks not running

2009-11-20 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-20 at 12:29 -0800, Mark Hedges wrote: On Fri, 20 Nov 2009, Mark Hedges wrote: Hi. I've set up my own rbldnsd server. It's responding to queries correctly, for example, I am trying to block the server that this message comes from, 64.22.103.163. I forgot to say, I'm

Re: DNSBL Comparison 20091114

2009-11-16 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 17:21 +1000, Res wrote: On Mon, 16 Nov 2009, rich...@buzzhost.co.uk wrote: safe. BRBL has a high hit rate as well, with a moderate safety rating. Wondered why i wasn't getting anything from mysql.com for over a week, BRBL has them listed :) You neglected to trim

Re: DNSBL Comparison 20091114

2009-11-16 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 14:00 +, Justin Mason wrote: First -- my name is not Jim. Secondly -- I don't care what Spamhaus does, I'm asking what you suggest SpamAssassin do to measure FPs. Is that a core feature of spamassassin Just in? Is it necessary to have that data? Will 'Hey, I noticed

Re: balancechecker.zip balancechecker.exe

2009-11-16 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 14:08 +0100, Ralph Bornefeld-Ettmann wrote: rich...@buzzhost.co.uk schrieb: On Mon, 2009-11-16 at 00:07 +0100, Ralph Bornefeld-Ettmann wrote: rich...@buzzhost.co.uk schrieb: Is anyone else seeing an influx of spam with a zip attachment balancechecker.zip

Re: DNSBL Comparison 20091114

2009-11-15 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-15 at 03:14 -0500, Warren Togami wrote: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200910.mbox/%3c4ad11c44.9030...@redhat.com%3e Compare this report to a similar report last month. http://wiki.apache.org/spamassassin/NightlyMassCheck The results below are

balancechecker.zip balancechecker.exe

2009-11-15 Thread rich...@buzzhost.co.uk
Is anyone else seeing an influx of spam with a zip attachment balancechecker.zip? This contains a windows executable, balancechecker.exe, which appears to be testing clean with clam and others. I'm inclined to think it's *not* clean and is viral. EXAMPLE http://pastebin.com/m730f90e9

Re: DNSBL Comparison 20091114

2009-11-15 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-15 at 20:34 +, Justin Mason wrote: On Sun, Nov 15, 2009 at 08:53, rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: On Sun, 2009-11-15 at 03:14 -0500, Warren Togami wrote: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200910.mbox/%3c4ad11c44.9030

Re: balancechecker.zip balancechecker.exe

2009-11-15 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-16 at 00:07 +0100, Ralph Bornefeld-Ettmann wrote: rich...@buzzhost.co.uk schrieb: Is anyone else seeing an influx of spam with a zip attachment balancechecker.zip? This contains a windows executable, balancechecker.exe, which appears to be testing clean with clam

Re: [Fwd: Re: Getting off the Cloudmark formerly spamnet blacklist]

2009-11-13 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-13 at 09:12 +0100, Matus UHLAR - fantomas wrote: On 12.11.09 13:55, Chris Hoogendyk wrote: I don't know about Linux viruses; BUT, I do remember less than ten years ago when it was virtually impossible to build a Linux box with a hot online connection, because you would

Re: Getting off the Cloudmark formerly spamnet blacklist

2009-11-13 Thread rich...@buzzhost.co.uk
Linux system. On 13.11.09 08:38, rich...@buzzhost.co.uk wrote: I think you may have your Windows -v- Linux mixed up and this kind of urban myth belongs in the battles that go on in the COLA Flame Wars (that often surface around the release of a new Windo$e) Since I didn't clearly

Re: Getting off the Cloudmark formerly spamnet blacklist

2009-11-13 Thread rich...@buzzhost.co.uk
On Fri, 2009-11-13 at 11:40 +0100, Matus UHLAR - fantomas wrote: Am I the only one who thints that issues clearly off-topic should be sent off-list? Your response was to correct an onlist reply to an onlist remark. Is there some reason why you would feel it appropriate to off-list that?

Re: Regex Question

2009-11-10 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-10 at 14:32 +0100, Ralf Hildebrandt wrote: * rahlqu...@gmail.com rahlqu...@gmail.com: Ok regex is not my strong suit by any means. Trying to get a match for email addresses that start with a pipe character ( about 15% of my spam is this ). That's not needed. Why are you

Re: Regex Question

2009-11-10 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-10 at 16:50 +0100, Benny Pedersen wrote: On tir 10 nov 2009 15:26:43 CET, rich...@buzzhost.co.uk wrote Please keep this in your mind in future before trotting out that tired old gas. imho Ralf have never being banned in maillist here, if you dont like his answers just

Re: Regex Question

2009-11-10 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-10 at 11:45 -0500, Alex wrote: imho Ralf have never being banned in maillist here, if you dont like his answers just unsubscribe Trotting out useless, pointless, tardy, curt, terse replies benefit nobody at all and makes the poster look arrogant especially when the

Re: [SPAM:6.0] Spam coming from hotmail.

2009-11-09 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-09 at 07:56 -0500, Casartello, Thomas wrote: I’ve been getting a lot of non-scoring spam coming from hotmail over the last couple weeks. It’s one user that’s been complaining about it. Here’s a few samples: {serious ascii murder commited} I could not stop laughing at this

RE: [SPAM:6.0] Spam coming from hotmail.

2009-11-09 Thread rich...@buzzhost.co.uk
snip Running those through my SA gets the biggest hit for the second example with the Indian link in the body. But that's a custom rule kindly given to me by of one of the good people on this list. I'm more concerned with this: X-Originating-IP: [189.69.146.53] In Brazil yet my relay module

Re: Spam coming from hotmail.

2009-11-09 Thread rich...@buzzhost.co.uk
On Mon, 2009-11-09 at 17:12 +, RW wrote: On Mon, 09 Nov 2009 15:09:18 + rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: snip Running those through my SA gets the biggest hit for the second example with the Indian link in the body. But that's a custom rule kindly given

Re: facebook Spam Question

2009-11-08 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-08 at 10:39 +, Chip M. wrote: Ugh. I just checked Twitter, and no SPF record. :( No? What's this? ;; ANSWER SECTION: twitter.com.600 IN TXT v=spf1 ip4:128.121.145.168 ip4:128.121.146.128/27 mx ptr a:postmaster.twitter.com mx:one.textdrive.com

Re: Messagelabs sends phish, SA+ClamAV+sanesecurity sigs catches it

2009-11-06 Thread rich...@buzzhost.co.uk
On Thu, 2009-11-05 at 23:54 -0600, David B Funk wrote: I just now found a phish in one of my spamtraps, no surprise there. The surprising thing is that it was sent out via a messagelabs.com mailserver, complete with headers indicating that it passed their virus checks. At my end spamassassin

Re: [SPAM:6.0] Re: FN: RUSSIAN_LINKS BODY:

2009-11-03 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-03 at 10:55 +, Ned Slider wrote: rich...@buzzhost.co.uk wrote: RUSSIAN_LINKS BODY: link to .ru Appears to miss the example: http://pastebin.com/m7ae0f8ec Unless I'm missing something ? Well, lets see your RUSSIAN_LINKS rule as it hits fine on my narod

Re: Crashes running SA as milter in Postfix

2009-11-01 Thread rich...@buzzhost.co.uk
On Sun, 2009-11-01 at 22:31 +0100, Patrick Ben Koetter wrote: We regularly experience SA crashes on a Ubuntu Hardy machine. The setup is as follows: Postfix (2.5.1) - SpamAssassin Milter (0.3.1-6) - SpamAssassin (3.2.4-1ubuntu1.1) The milter is run like this:

HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
I don't see a great deal of spam from Hotmail, but often get it with headers looking like this: X-Originating-IP: [123.160.198.207] From: joannie nolin crevett...@msn.nullcom To: clo...@skipbarber.nullcom, kantan...@gmail.nullcom, preiswunderland...@web.dde, h...@interpoint24.dde,

Re: VL scoring 0.1 Phish Spam

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 07:29 -0500, Chris wrote: On Sat, 2009-10-31 at 07:46 +, rich...@buzzhost.co.uk wrote: http://pastebin.com/m53a550ce Somewhat unfortunately seen coming out of The Dana-Farber Cancer Institute. Looking at it objectively there is little for a filter to go

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 07:35 -0500, Chris wrote: On Sat, 2009-10-31 at 07:59 +, rich...@buzzhost.co.uk wrote: I don't see a great deal of spam from Hotmail, but often get it with headers looking like this: X-Originating-IP: [123.160.198.207] From: joannie nolin crevett

Re: VL scoring 0.1 Phish Spam

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 08:05 -0500, Chris wrote: On Sat, 2009-10-31 at 12:53 +, rich...@buzzhost.co.uk wrote: On Sat, 2009-10-31 at 07:29 -0500, Chris wrote: On Sat, 2009-10-31 at 07:46 +, rich...@buzzhost.co.uk wrote: http://pastebin.com/m53a550ce Somewhat unfortunately

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 13:58 +, RW wrote: On Sat, 31 Oct 2009 07:59:24 + rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: A couple of observations; 123.160.198.207 - is on the PBL {deep in the heart of China} so is possible to extend the network tests to look for fairly constant

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 16:30 +0200, Henrik K wrote: On Sat, Oct 31, 2009 at 02:13:45PM +, rich...@buzzhost.co.uk wrote: On Sat, 2009-10-31 at 13:58 +, RW wrote: On Sat, 31 Oct 2009 07:59:24 + rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: A couple of observations

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-31 at 18:49 +0200, Henrik K wrote: On Sat, Oct 31, 2009 at 03:33:59PM +, rich...@buzzhost.co.uk wrote: Uh, SpamAssassin parses X-Originating-IP and friends just fine. Of course PBL isn't going to hit it, since it's an lastexternal rule. That has totally escaped

Barracuda List Broken

2009-10-30 Thread rich...@buzzhost.co.uk
Anyone else noticing lots of DNS timeouts on the Barracuda List today? Looks like it's really struggling. Perhaps they are hosting it on their own hardware now LOL.

Re: there goes the uri scripts..

2009-10-30 Thread rich...@buzzhost.co.uk
On Fri, 2009-10-30 at 15:10 -0400, Charles Gregory wrote: On Fri, 30 Oct 2009, Terry Carmen wrote: approval to a plan to permit Web addresses in characters other than the Latin alphabet, including Arabic, Chinese, Hindi and Korean. I'd be *really* surprised if these became popular. The

Re: Geocities closed

2009-10-27 Thread rich...@buzzhost.co.uk
On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote: On 27-Oct-2009, at 04:53, Mike Cardwell wrote: Why have any geocities specific rules any more if geocities doesn't exist? It's not as if spammers can host their websites on geocities anymore so there's no reason why a spammer would

Re: Geocities closed

2009-10-27 Thread rich...@buzzhost.co.uk
On Tue, 2009-10-27 at 05:50 -0700, John Rudd wrote: On Tue, Oct 27, 2009 at 05:42, rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: On Tue, 2009-10-27 at 05:08 -0600, LuKreme wrote: On 27-Oct-2009, at 04:53, Mike Cardwell wrote: Why have any geocities specific rules any more

Re: Geocities closed

2009-10-27 Thread rich...@buzzhost.co.uk
I just found this one working: http://uk.geocities.com/midsomerland/midsomerland_indexone.htm so providence would suggest leaving things alone.

Low Score - {Brazillian Host} Lottery Spam

2009-10-27 Thread rich...@buzzhost.co.uk
Anyone else seeing these today? Or seen them recently? http://pastebin.com/m4e25954f score=0.1 Subject was real neat: Subject: =?ISO-8859-1?B?WW91IFdvbiCjMQ==?=,750,000.00 GBP You Won £750,000.00 GBP {surprised this did not bite} End of the message is missing on the five of them that I've

Re: Is spamming legal in the UK ?

2009-10-23 Thread rich...@buzzhost.co.uk
On Fri, 2009-10-23 at 10:38 +0200, Per Jessen wrote: I was just spammed by T-mobile (UK). Seems incredible that an otherwise reputable company would sink so low - does anyone know if spamming (given the right conditions) is legal in the UK ? /Per Jessen, Zürich Recently I've caught lots

Re: Is spamming legal in the UK ?

2009-10-23 Thread rich...@buzzhost.co.uk
I need to add this is in ADDITION to guidelines mostly aimed at junk faxes published here and already quoted: http://www.ico.gov.uk/what_we_cover/privacy_and_electronic_communications.aspx

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Fri, 2009-10-16 at 13:29 -0700, John Hardin wrote: On Fri, 16 Oct 2009, John Rudd wrote: Me. I work for one of their clients (a University). One or two of our divisions use them for large mailings to our internal users. How is Constant Contact better than (say) GNU mailman for that

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-17 at 07:26 -0400, Aaron Wolfe wrote: On Sat, Oct 17, 2009 at 5:47 AM, rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: On Fri, 2009-10-16 at 13:29 -0700, John Hardin wrote: On Fri, 16 Oct 2009, John Rudd wrote: Me. I work for one of their clients (a University

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-17 at 09:30 -0400, Gene Heskett wrote: On Saturday 17 October 2009, rich...@buzzhost.co.uk wrote: On Sat, 2009-10-17 at 07:26 -0400, Aaron Wolfe wrote: On Sat, Oct 17, 2009 at 5:47 AM, rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: On Fri, 2009-10-16 at 13:29 -0700

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-17 at 18:53 +0200, Karsten Bräckelmann wrote: On Sat, 2009-10-17 at 14:24 +0100, rich...@buzzhost.co.uk wrote: On Sat, 2009-10-17 at 07:26 -0400, Aaron Wolfe wrote: [...] Why are we covering for their mistakes and supporting a company that profits from sending spam

Re: Constant Contact

2009-10-17 Thread rich...@buzzhost.co.uk
On Sat, 2009-10-17 at 19:58 +0200, Karsten Bräckelmann wrote: In other words, how comes you're only venting about the companies you despise, and don't even mention the whitelist with a single word? guenther You need to deal with your personality issues - this is *not* about *you*

Re: MagicSpam

2009-09-24 Thread rich...@buzzhost.co.uk
On Thu, 2009-09-24 at 12:51 +0100, RW wrote: On Thu, 24 Sep 2009 06:46:42 +0100 rich...@buzzhost.co.uk rich...@buzzhost.co.uk wrote: On Wed, 2009-09-23 at 23:36 +0100, RW wrote: On Wed, 23 Sep 2009 10:40:11 -0700 (PDT) linuxmagic sa...@linuxmagic.com wrote: Incidently

Re: MagicSpam

2009-09-23 Thread rich...@buzzhost.co.uk
On Wed, 2009-09-23 at 23:36 +0100, RW wrote: On Wed, 23 Sep 2009 10:40:11 -0700 (PDT) linuxmagic sa...@linuxmagic.com wrote: Incidently the point about backscatter is wrong. The traditional approach of classifying, and then discarding or filing to a spam folder, produces zero backscatter

Re: MagicSpam

2009-09-23 Thread rich...@buzzhost.co.uk
On Wed, 2009-09-23 at 19:45 -0400, Aaron Wolfe wrote: On Wed, Sep 23, 2009 at 1:40 PM, linuxmagic sa...@linuxmagic.com wrote: I really like this quote from their sales web site: Now you can have MagicSpam spam protection for your Postfix (Linux) Mail Servers. Complete with one click

Re: Using a blacklist - configuration-file not working

2009-09-11 Thread rich...@buzzhost.co.uk
On Fri, 2009-09-11 at 00:51 -0700, franc wrote: Hello, i just installed spamassassin 3.2.4 (running on Perl 5.8.8) with postfix 2.5.1 on a Ubuntu 8.04. Now i want to use a personal blacklist an i put into /etc/spamassassin/myblacklist.cf an put into it: blacklist_from

Re: Using a blacklist - configuration-file not working

2009-09-11 Thread rich...@buzzhost.co.uk
On Fri, 2009-09-11 at 01:07 -0700, franc wrote: rich...@buzzhost.co.uk wrote: To do this, somewhere near the end of your main.cf: header_checks = regexp:/etc/postfix/header_checks File /etc/postfix/header_checks looks like this: /^From:.*whoe...@aol.com/ REJECT sender blacklisted

Re: Using a blacklist - configuration-file not working

2009-09-11 Thread rich...@buzzhost.co.uk
On Fri, 2009-09-11 at 01:07 -0700, franc wrote: rich...@buzzhost.co.uk wrote: To do this, somewhere near the end of your main.cf: header_checks = regexp:/etc/postfix/header_checks File /etc/postfix/header_checks looks like this: /^From:.*whoe...@aol.com/ REJECT sender blacklisted

Re: Using a blacklist - configuration-file not working

2009-09-11 Thread rich...@buzzhost.co.uk
On Fri, 2009-09-11 at 03:53 -0700, franc wrote: rich...@buzzhost.co.uk wrote: Create the blacklist file: # vim /etc/spamassassin/blacklist.cf blacklist_from *...@aol.com blacklist_from drop.t...@aol.com Test it for errors: # spamassassin --lint Restart Spamassassin

Re: antispam comparison by virus bulletin

2009-09-07 Thread rich...@buzzhost.co.uk
On Mon, 2009-09-07 at 10:00 +0100, Justin Mason wrote: On Sun, Sep 6, 2009 at 22:59, moussmo...@ml.netoyen.net wrote: Justin Mason a écrit : In fairness, they got in touch to ask for help in setting up a more recent SA, but none of us (ie the PMC) had the spare cycles to help out.

Re: spams to abuse@ id

2009-08-25 Thread rich...@buzzhost.co.uk
On Tue, 2009-08-25 at 08:06 +0200, Benny Pedersen wrote: else fight sender forgies in mta, and only accept spf pass, if sender domain is not with spf record count how many ham mails is comming from this domain, if none, then domain blacklist this sender, open again if there is spf later

Re: Barracuda RBL in first place

2009-08-18 Thread rich...@buzzhost.co.uk
On Tue, 2009-08-18 at 20:02 +0100, Ned Slider wrote: LuKreme wrote: On 17-Aug-2009, at 04:24, Ned Slider wrote: Question - in Postfix do user unknown rejections still incur a dns RBL lookup, or does the rejection occur before reject_rbl_client? HELO/EHLO rejections do not reach

Re: Barracuda RBL in first place

2009-08-18 Thread rich...@buzzhost.co.uk
On Wed, 2009-08-19 at 01:06 +0200, mouss wrote: ... in short, whatever jeff says, spamhaus is the one. the fundamental concept is not how many spam it blocks, but how much do I trust it. Exactly!

Re: Barracuda RBL in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 00:51 -0600, LuKreme wrote: On 16-Aug-2009, at 16:55, MySQL Student wrote: So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Can you explain a bit more here? What are you checking for, that the host

Re: Barracuda RBL not in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 06:39 -0700, Marc Perkel wrote: rich...@buzzhost.co.uk wrote: I have to agree with LuKreme, my overnight had 446 blocked prior to RBL, and only 387 by RBL. Again, noted that 'Barracuda' missed 43, 35 of these Spamhaus caught - so for me Spamhaus is still better

RE: Barracuda RBL not in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 08:36 -0700, R-Elists wrote: But this is all *OT* and has no relevance to SA. Why this list was spammed with an unscientific spin of a claim in the first instance just shows the dark hand of Barracuda at work. Richard, i imagine you are far more

RE: Barracuda RBL not in first place

2009-08-17 Thread rich...@buzzhost.co.uk
On Mon, 2009-08-17 at 09:21 -0700, R-Elists wrote: Richard Wrote: No. Here is why. When someone posts a Barracuda send-up that is questionable, it will still end up in the archives. It is, therefore, relevant that any counter argument and supporting material be archived with it for

  1   2   3   >