Re: automated reporting plugin (was Re: HABEAS_ACCREDITED_COI)

2009-03-25 Thread Jari Fredriksson
On Tue, Mar 17, 2009 at 5:18 PM, J.D. Falk jdfalk-li...@cybernothing.org wrote: RobertH wrote: Maia Mailguard is a neat project that uses SA/amavisd to provide users with a web based quarantine. When a user indicates that a message is spam, the system can automatically submit the

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread Aaron Wolfe
On Tue, Mar 17, 2009 at 1:42 AM, LuKreme krem...@kreme.com wrote: On 16-Mar-2009, at 16:40, Chris wrote: -8.0 HABEAS_ACCREDITED_COI  RBL: Habeas Accredited Confirmed Opt-In or                           Better                           [208.82.16.109 listed in I changed my HABEAS scores

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread Matus UHLAR - fantomas
On 16-Mar-2009, at 16:40, Chris wrote: -8.0 HABEAS_ACCREDITED_COI  RBL: Habeas Accredited Confirmed Opt-In or                           Better                           [208.82.16.109 listed in On Tue, Mar 17, 2009 at 1:42 AM, LuKreme krem...@kreme.com wrote: I changed my HABEAS scores

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread Aaron Wolfe
2009/3/17 Matus UHLAR - fantomas uh...@fantomas.sk: On 16-Mar-2009, at 16:40, Chris wrote: -8.0 HABEAS_ACCREDITED_COI  RBL: Habeas Accredited Confirmed Opt-In or                           Better                           [208.82.16.109 listed in On Tue, Mar 17, 2009 at 1:42 AM, LuKreme

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread LuKreme
On 17-Mar-2009, at 03:08, Matus UHLAR - fantomas wrote: I still think it's much better to report them to habeas for spamming... Why? My time is valuable, and I don't have any interest in being an unpaid volunteer for a commercial service. It's very simple, I don't see Habeas headers in

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread Neil Schwartzman
On 17/03/09 5:08 AM, Matus UHLAR - fantomas uh...@fantomas.sk wrote: I still think it's much better to report them to habeas for spamming... COI means confirmed opt-in. If you did subscribe, it is NOT spam whether you want it or not. Isn't it good to have someone who will sue spammers? Matus,

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread Neil Schwartzman
On 17/03/09 6:41 AM, LuKreme krem...@kreme.com wrote: On 17-Mar-2009, at 03:08, Matus UHLAR - fantomas wrote: I still think it's much better to report them to habeas for spamming... Why? My time is valuable, and I don't have any interest in being an unpaid volunteer for a commercial

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread John Hardin
On Tue, 17 Mar 2009, Neil Schwartzman wrote: Since February 17, we have received less than 20 complaints. A question if I may, Neil: does returnpath run any spamtraps to see whether your clients are indeed violating your terms? Having few complaints is not necessarily a good metric given

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread Neil Schwartzman
On 17/03/09 6:59 AM, John Hardin jhar...@impsec.org wrote: A question if I may, Neil: does returnpath run any spamtraps to see whether your clients are indeed violating your terms? Having few complaints is not necessarily a good metric given the number of people who will simply curse you and

RE: HABEAS_ACCREDITED_COI

2009-03-17 Thread RobertH
HABEAS_ACCREDITED_COI 0 tflags HABEAS_ACCREDITED_COI net # score HABEAS_UNCONFIRMED 8.0 tflags HABEAS_UNCONFIRMED net header HABEAS_UNCONFIRMED eval:check_rbl('habeas-firsttrusted','sa-accredit.habeas.com.', '127\.\d+\.\d+\.[6789]\d') - rh

RE: HABEAS_ACCREDITED_COI

2009-03-17 Thread RobertH
I still think it's much better to report them to habeas for spamming... COI means confirmed opt-in. If you did subscribe, it is NOT spam whether you want it or not. Isn't it good to have someone who will sue spammers? -- Matus UHLAR - Matus even though it is COI, what i see

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread Michael Scheidell
RobertH wrote: I still think it's much better to report them to habeas for spamming... COI means confirmed opt-in. If you did subscribe, it is NOT spam whether you want it or not. Isn't it good to have someone who will sue spammers? -- Matus UHLAR - and the reason we use that

RE: HABEAS_ACCREDITED_COI

2009-03-17 Thread RobertH
From: Neil Schwartzman snip Well, to each his own. I have spent a lot of time reporting spam in my life, (probably too much), in actual fact. My thinking in reporting spam to DNSBLs (I am or was in the top 10 reporters at Phishtank URIBL, high on the board at Netcraft, and have an

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread Kelson
LuKreme wrote: It's very simple, I don't see Habeas headers in legitimate email, and haven't for years. I see it in spam. I score it up. The score of -8.0 is ridiculous for something that is so easily forged. They haven't *used* the headers in years, either. Habeas is an IP-based

automated reporting plugin (was Re: HABEAS_ACCREDITED_COI)

2009-03-17 Thread J.D. Falk
RobertH wrote: there is bound to be some way that those (of us or the SA Team) that want to participate, can help you and help us at the same time. some type of automated plugin that needs to be created that reports to us and returnpath info relevant to stopping the bad eggs yet allowing the

Re: automated reporting plugin (was Re: HABEAS_ACCREDITED_COI)

2009-03-17 Thread Aaron Wolfe
On Tue, Mar 17, 2009 at 5:18 PM, J.D. Falk jdfalk-li...@cybernothing.org wrote: RobertH wrote: there is bound to be some way that those (of us or the SA Team) that want to participate, can help you and help us at the same time. some type of automated plugin that needs to be created that

HABEAS_ACCREDITED_COI

2009-03-16 Thread Chris
,DCC_CHECK_NEGATIVE=-0.0001,HABEAS_ACCREDITED_COI=-8, SARE_FRAUD_X3=1.667,SARE_FRAUD_X4=1.667,SARE_FRAUD_X5=1.667,US_DOLLARS_3=0.63 Content analysis details: (7.0 points, 5.0 required) pts rule name description -- -- -8.0

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread Greg Troxel
The wiki now has an email address to report Habeas-accredited spam: http://wiki.apache.org/spamassassin/Rules/HABEAS_ACCREDITED_COI pgp8bfg8GvsBB.pgp Description: PGP signature

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread Chris
On Mon, 2009-03-16 at 19:46 -0400, Greg Troxel wrote: The wiki now has an email address to report Habeas-accredited spam: http://wiki.apache.org/spamassassin/Rules/HABEAS_ACCREDITED_COI Thanks Greg, I've reported it to them -- KeyID 0xE372A7DA98E6705C signature.asc Description

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread LuKreme
On 16-Mar-2009, at 16:40, Chris wrote: -8.0 HABEAS_ACCREDITED_COI RBL: Habeas Accredited Confirmed Opt-In or Better [208.82.16.109 listed in I changed my HABEAS scores ages ago: score HABEAS_ACCREDITED_COI -1.0 score

Re: How to report FN on HABEAS_ACCREDITED_COI

2008-06-02 Thread Eloise Carlton
We are working with the sender and providing recommendations to secure and monitor account users (such as using captcha to prevent bots from registering and setting rate limits on the user level). Currently there is no historical data on abuse from this particular user, they have flagged this

Re: How to report FN on HABEAS_ACCREDITED_COI

2008-06-02 Thread SM
Hi Eloise, At 02:07 02-06-2008, Eloise Carlton wrote: We are working with the sender and providing recommendations to secure and monitor account users (such as using captcha to prevent bots from registering and setting rate limits on the user level). Currently there is no historical data on

Re: How to report FN on HABEAS_ACCREDITED_COI

2008-05-20 Thread Eloise Carlton
are coming with HABEAS_ACCREDITED_COI Where do I report these try searching the habeas website... -- Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek

Re: How to report FN on HABEAS_ACCREDITED_COI

2008-05-20 Thread ram
PROTECTED] On Fri, May 2, 2008 at 7:29 AM, Matus UHLAR - fantomas [EMAIL PROTECTED] wrote: On 02.05.08 19:11, ram wrote: I am getting spams on my spamtraps which are coming with HABEAS_ACCREDITED_COI Where do I report these try searching the habeas website... -- Matus UHLAR

Re: How to report FN on HABEAS_ACCREDITED_COI

2008-05-20 Thread mouss
ram wrote: Yes but the invite option may be abused. Like yahoo calendar invites are abused to send spam Mailing-Lists also can be abused (try to subscribe with a forged address). the question is - can the abuser put his text or url inside the message? If so, the site should run the text

How to report FN on HABEAS_ACCREDITED_COI

2008-05-02 Thread ram
I am getting spams on my spamtraps which are coming with HABEAS_ACCREDITED_COI Where do I report these --- X-Envelope-From: [EMAIL PROTECTED] Received: from omxp01.mx.ning.com (omxp01.mx.ning.com [208.82.16.109]) by mx1.netcore.co.in (Postfix) with ESMTP id C1B901DE4AF

Re: How to report FN on HABEAS_ACCREDITED_COI

2008-05-02 Thread Matus UHLAR - fantomas
On 02.05.08 19:11, ram wrote: I am getting spams on my spamtraps which are coming with HABEAS_ACCREDITED_COI Where do I report these try searching the habeas website... -- Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising

Re: HABEAS_ACCREDITED_COI

2008-02-27 Thread Anthony Peacock
Hi, ram wrote: On Tue, 2008-02-26 at 08:49 +, Anthony Peacock wrote: Hi, I have just received a number of spam emails which got through the filtering system because they hit the HABEAS_ACCREDITED_COI rule, which give them -8. They all came to role based addresses that are never used

Re: HABEAS_ACCREDITED_COI

2008-02-27 Thread Derek Harding
On Wed, 2008-02-27 at 08:21 +, Anthony Peacock wrote: For anyone interested here is the full email (well one of them)... http://www.chime.ucl.ac.uk/~rmhiajp/habeas-misfire.eml Looks to me as though someone has found a way to abuse ning.com's platform/systems. I suspect they'd be very

Re: HABEAS_ACCREDITED_COI

2008-02-27 Thread Matus UHLAR - fantomas
On 26.02.08 11:18, Igor Chudov wrote: If I recall correctly... This Habeas is some sort of a braindead business idea to insert an unauthenticated header in bodies of legitimate emails coming from their customers, to assure spam filters that the email is legitimate. afaiuc, Habeas is sort

Re: HABEAS_ACCREDITED_COI

2008-02-27 Thread Yet Another Ninja
On 2/27/2008 10:16 AM, Derek Harding wrote: On Wed, 2008-02-27 at 08:21 +, Anthony Peacock wrote: For anyone interested here is the full email (well one of them)... http://www.chime.ucl.ac.uk/~rmhiajp/habeas-misfire.eml Looks to me as though someone has found a way to abuse ning.com's

Re: HABEAS_ACCREDITED_COI

2008-02-27 Thread Justin Mason
Derek Harding writes: On Wed, 2008-02-27 at 08:21 +, Anthony Peacock wrote: For anyone interested here is the full email (well one of them)... http://www.chime.ucl.ac.uk/~rmhiajp/habeas-misfire.eml Looks to me as though someone has found a way to abuse ning.com's

Re: HABEAS_ACCREDITED_COI

2008-02-27 Thread Benny Pedersen
http://www.chime.ucl.ac.uk/~rmhiajp/habeas-misfire.eml disable DomainKey plugin and add DKIM plugin will help on that msg and search on DKIM mta scores for not being sent from a DKIM signer

Re: HABEAS_ACCREDITED_COI

2008-02-27 Thread Anthony Peacock
Hi Benny, Benny Pedersen wrote: http://www.chime.ucl.ac.uk/~rmhiajp/habeas-misfire.eml disable DomainKey plugin and add DKIM plugin will help on that msg and search on DKIM mta scores for not being sent from a DKIM signer I will have a look at this. But I have already made sufficient

HABEAS_ACCREDITED_COI

2008-02-26 Thread Anthony Peacock
Hi, I have just received a number of spam emails which got through the filtering system because they hit the HABEAS_ACCREDITED_COI rule, which give them -8. They all came to role based addresses that are never used to outgoing emails and would certainly never be subscribed to opt in email

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Benny Pedersen
On Tue, February 26, 2008 09:49, Anthony Peacock wrote: Does anyone know anything about this. At this stage I am planning on changing the score for all HABEAS_ACCREDITED_??? rules to 0, to make them neutral to the score. score 0 disables the test

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Jason Haar
Anthony Peacock wrote: I have had a look around the http://www.habeas.com/ website and can't really see how to check the company in question, or make a complaint. There is a form for asking them to ask the company to remove these addresses from their mailing list, but I don't want to have to

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Justin Mason
/at/ habeas.com. 'HABEAS_ACCREDITED_COI' is supposed to require confirmed opt-in. They should LART these senders with a big stick. --j.

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Yet Another Ninja
forward it to complaints /at/ habeas.com. 'HABEAS_ACCREDITED_COI' is supposed to require confirmed opt-in. They should LART these senders with a big stick. I would personally welcome all these certifier rules being disabled by default. There's performance and filtering reasons to request

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Anthony Peacock
that this was just another mechanism to implement unsubscribing, and not a proper complaint procedure. I will actually report the emails that I have got. But I think I am going to disable all the HABEAS rules anyway. 'HABEAS_ACCREDITED_COI' is supposed to require confirmed opt-in. They should LART

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Michael Scheidell
From: Anthony Peacock [EMAIL PROTECTED] Date: Tue, 26 Feb 2008 08:49:11 + To: SpamAssassin Users users@spamassassin.apache.org Subject: HABEAS_ACCREDITED_COI Hi, I have just received a number of spam emails which got through the filtering system because they hit

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Per Jessen
Jason Haar wrote: Anthony Peacock wrote: I have had a look around the http://www.habeas.com/ website and can't really see how to check the company in question, or make a complaint. There is a form for asking them to ask the company to remove these addresses from their mailing list, but I

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Anthony Peacock
Hi, Following up to myself... Anthony Peacock wrote: Hi Justin, Justin Mason wrote: Jason Haar writes: Anthony Peacock wrote: I have had a look around the http://www.habeas.com/ website and can't really see how to check the company in question, or make a complaint. There is a form for

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Igor Chudov
If I recall correctly... This Habeas is some sort of a braindead business idea to insert an unauthenticated header in bodies of legitimate emails coming from their customers, to assure spam filters that the email is legitimate. Kind of like SPF, but implemented by third graders with multiple

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Igor Chudov
I strongly recommend to block Habeas entirely. They are a yet another garbage email company. i On Tue, Feb 26, 2008 at 03:10:54PM +, Anthony Peacock wrote: Hi, Following up to myself... Anthony Peacock wrote: Hi Justin, Justin Mason wrote: Jason Haar writes: Anthony Peacock wrote:

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread John Hardin
On Tue, 26 Feb 2008, Igor Chudov wrote: If I recall correctly... This Habeas is some sort of a braindead business idea to insert an unauthenticated header in bodies of legitimate emails coming from their customers, to assure spam filters that the email is legitimate. Kind of like SPF, but

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Theo Van Dinter
On Tue, Feb 26, 2008 at 11:18:32AM -0600, Igor Chudov wrote: This Habeas is some sort of a braindead business idea to insert an unauthenticated header in bodies of legitimate emails coming from their customers, to assure spam filters that the email is legitimate. The original Habeas SWE was a

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Kelson
Igor Chudov wrote: If I recall correctly... This Habeas is some sort of a braindead business idea to insert an unauthenticated header in bodies of legitimate emails coming from their customers, to assure spam filters that the email is legitimate. Not anymore. They've long since switched to

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread ram
On Tue, 2008-02-26 at 08:49 +, Anthony Peacock wrote: Hi, I have just received a number of spam emails which got through the filtering system because they hit the HABEAS_ACCREDITED_COI rule, which give them -8. They all came to role based addresses that are never used to outgoing