Re: Up tick in missed SPAM from co domain

esterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed >> SPAM from .co domain. Though obvious SPAM >> weight loss, phish, "personals", they are scoring rather low. > > spammer use spamassassin self to make there spam pass spamassassin > >&

Re: Up tick in missed SPAM from co domain

On 2022-02-03 16:50, joea- lists wrote: SA version 3.4.5 old version, stable is 3.4.6 now Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed SPAM from .co domain. Though obvious SPAM weight loss, phish, "personals", they are scoring rather low. spammer use sp

Re: Up tick in missed SPAM from co domain

>> On Thu, 2022‑02‑03 at 10:50 ‑0500, joea‑ lists wrote: SA version 3.4.5 >>> >>> Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed >>> SPAM from .co domain. Though obvious SPAM >>> weight loss, phish, "personals", the

Re: Up tick in missed SPAM from co domain

> On Thu, 2022-02-03 at 10:50 -0500, joea- lists wrote: >> SA version 3.4.5 >> >> Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed >> SPAM from .co domain. Though obvious SPAM >> weight loss, phish, "personals", they are scorin

Re: Up tick in missed SPAM from co domain

On Thu, 2022-02-03 at 10:50 -0500, joea- lists wrote: > SA version 3.4.5 > > Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed > SPAM from .co domain.  Though obvious SPAM > weight loss, phish, "personals", they are scoring rather low.  

Up tick in missed SPAM from co domain

SA version 3.4.5 Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed SPAM from .co domain. Though obvious SPAM weight loss, phish, "personals", they are scoring rather low. Added a custom rule for that domain, which should deal with it, but wondering if I m

Re: lots of missed spam/false negatives from .info TLD being marked with URIBL_RHS_DOB

On Tue, 30 May 2017, Robert Kudyba wrote: I note that message hit BAYES_00. If content like that is getting a "strong ham" Bayes score, you should review your training processes and Bayes corpora - you *do* keep copies of messages you train Bayes with, right? :) Yes just re-synced. Did you

Re: lots of missed spam/false negatives from .info TLD being marked with URIBL_RHS_DOB

> For the past few days lots of missed spam has been getting through, running >>> SA 3.4.1 on Fedora 25 with sendmail. I see that they are being tagged with >>> URIBL_RHS_DOB, i.e., domains registered in the last five days. Since we >>> are not running our own DN

Re: lots of missed spam/false negatives from .info TLD being marked with URIBL_RHS_DOB

>From: John Hardin <jhar...@impsec.org>   >On Mon, 29 May 2017, Robert Kudyba wrote: >> For the past few days lots of missed spam has been getting through, running >> SA 3.4.1 on Fedora 25 with sendmail. I see that they are being tagged with >> URIBL_RHS_

Re: lots of missed spam/false negatives from .info TLD being marked with URIBL_RHS_DOB

On Mon, 29 May 2017, Robert Kudyba wrote: For the past few days lots of missed spam has been getting through, running SA 3.4.1 on Fedora 25 with sendmail. I see that they are being tagged with URIBL_RHS_DOB, i.e., domains registered in the last five days. Since we are not running our own DNS

lots of missed spam/false negatives from .info TLD being marked with URIBL_RHS_DOB

For the past few days lots of missed spam has been getting through, running SA 3.4.1 on Fedora 25 with sendmail. I see that they are being tagged with URIBL_RHS_DOB, i.e., domains registered in the last five days. Since we are not running our own DNS server (yet--need permission from our CISO

Re: Missed spam, suggestions?

On Fri, 11 Mar 2016, Robert Chalmers wrote: Found a copy here … http://www.impsec.org/~jhardin/antispam/sa-stats.pl Note that I also host a version that works with gzipped log files, if you have compression enabled in your log rotator. But that's not the latest. I don't know where the

Re: sa-stats log analyzer (RE: Missed spam, suggestions?)

t; >> I would like to know how to get these stats too. >> >> From: Robert Chalmers [mailto:rob...@chalmers.com.au] >> Sent: Tuesday, March 08, 2016 5:25 AM >> To: users@spamassassin.apache.org >> Subject: Re: Missed spam, suggestions? >> >&

Re: Missed spam, suggestions?

0%) >>> 2016-03-11 16 0 ( 0%) 0 ( 0%) >>> 2016-03-11 17 0 ( 0%) 0 ( 0%) >>> 2016-03-11 18 0 ( 0%) 0 ( 0%) >>> 2016-03-11 19 0 ( 0%) 0 ( 0%) >>> 2016-03-11 20 0 (

Re: Missed spam, suggestions?

0 ( 0%) 0 ( 0%) >> 2016-03-11 20 0 ( 0%) 0 ( 0%) >> 2016-03-11 21 0 ( 0%) 0 ( 0%) >> 2016-03-11 22 0 ( 0%) 0 ( 0%) >> 2016-03-11 23 0 ( 0%) 0 ( 0%) >> Done. Report g

Re: Missed spam, suggestions?

0 ( 0%) 0 ( 0%) >> 2016-03-11 20 0 ( 0%) 0 ( 0%) >> 2016-03-11 21 0 ( 0%) 0 ( 0%) >> 2016-03-11 22 0 ( 0%) 0 ( 0%) >> 2016-03-11 23 0 ( 0%) 0 ( 0%) >> Done. R

Re: Missed spam, suggestions?

get these stats too. From: Robert Chalmers [mailto:rob...@chalmers.com.au] Sent: Tuesday, March 08, 2016 5:25 AM To: users@spamassassin.apache.org Subject: Re: Missed spam, suggestions? Can I ask, how are you getting these stats please? Thanks On 8 Mar 2016, at 05:11, David B Funk <

Re: Missed spam, suggestions?

ilto:rob...@chalmers.com.au] > Sent: Tuesday, March 08, 2016 5:25 AM > To: users@spamassassin.apache.org > Subject: Re: Missed spam, suggestions? > > Can I ask, how are you getting these stats please? > > Thanks > On 8 Mar 2016, at 05:11, David B Funk <dbf...@enginee

Re: Missed spam, suggestions?

am.com> wrote: > > I would like to know how to get these stats too. > > From: Robert Chalmers [mailto:rob...@chalmers.com.au] > Sent: Tuesday, March 08, 2016 5:25 AM > To: users@spamassassin.apache.org > Subject: Re: Missed spam, suggestions? > > Can I ask, ho

Re: Missed spam, suggestions?

From: Robert Chalmers [mailto:rob...@chalmers.com.au] > Sent: Tuesday, March 08, 2016 5:25 AM > To: users@spamassassin.apache.org > Subject: Re: Missed spam, suggestions? > > Can I ask, how are you getting these stats please? > > Thanks > On 8 Mar 2016, at 05:1

sa-stats log analyzer (RE: Missed spam, suggestions?)

hese stats too.   From: Robert Chalmers [mailto:rob...@chalmers.com.au] Sent: Tuesday, March 08, 2016 5:25 AM To: users@spamassassin.apache.org Subject: Re: Missed spam, suggestions?   Can I ask, how are you getting these stats please?   Thanks On 8 Mar 2016, at 05:11, David B

RE: Missed spam, suggestions?

I would like to know how to get these stats too. From: Robert Chalmers [mailto:rob...@chalmers.com.au] Sent: Tuesday, March 08, 2016 5:25 AM To: users@spamassassin.apache.org Subject: Re: Missed spam, suggestions? Can I ask, how are you getting these stats please? Thanks On 8 Mar 2016, at 05:11

Re: Missed spam, suggestions?

On Tue, 8 Mar 2016, Matus UHLAR - fantomas wrote: On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: how can these two stats be different? On 08.03.16 10:19, @lbutlr wrote: Because one is for SPAM and one is for HAM. On Mar 8, 2016, at 10:41 AM, Matus UHLAR -

Re: Missed spam, suggestions?

On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: how can these two stats be different? On 08.03.16 10:19, @lbutlr wrote: Because one is for SPAM and one is for HAM. On Mar 8, 2016, at 10:41 AM, Matus UHLAR - fantomas wrote: Why did you

Re: Missed spam, suggestions?

On Tue, 8 Mar 2016, Matus UHLAR - fantomas wrote: On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: > how can these two stats be different? On 08.03.16 10:19, @lbutlr wrote: Because one is for SPAM and one is for HAM. TOP SPAM RULES FIRED RANK RULE NAME

Re: Missed spam, suggestions?

> On Mar 8, 2016, at 10:41 AM, Matus UHLAR - fantomas wrote: > >> On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: >>> how can these two stats be different? > > On 08.03.16 10:19, @lbutlr wrote: >> Because one is for SPAM and one is for HAM. > >

Re: Missed spam, suggestions?

On 8. mar. 2016 18.42.03 Matus UHLAR - fantomas wrote: Why did the same rule hit 38.98% of all mail and 50.51% of all mail? grep foo ./hamfolder grep bar ./spamfolder Why should both folders need same counts of mails ?

Re: Missed spam, suggestions?

On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: how can these two stats be different? On 08.03.16 10:19, @lbutlr wrote: Because one is for SPAM and one is for HAM. Why did you remove the important part? TOP SPAM RULES FIRED RANKRULE NAME

Re: Missed spam, suggestions?

On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: > how can these two stats be different? Because one is for SPAM and one is for HAM. -- No man is free who is not master of himself

Re: Missed spam, suggestions?

On 07.03.16 23:39, Charles Sprickman wrote: TOP SPAM RULES FIRED RANKRULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM 2 HTML_MESSAGE12714 8.18 38.98 87.85 90.80 TOP HAM RULES FIRED RANKRULE NAME COUNT

Re: Missed spam, suggestions?

Can I ask, how are you getting these stats please? Thanks > On 8 Mar 2016, at 05:11, David B Funk wrote: > > On Mon, 7 Mar 2016, Charles Sprickman wrote: > >> I’ve been running with some daily training for a little over a week and I’m >> seeing less spam in my

Re: Missed spam, suggestions?

On Mon, 7 Mar 2016, Charles Sprickman wrote: I’ve been running with some daily training for a little over a week and I’m seeing less spam in my inbox. I’ve seen a few things slip through because bayes tipped them below the default score, these were two phishing emails. Here’s some rule

Re: Missed spam, suggestions?

> On Feb 29, 2016, at 3:18 PM, Reindl Harald wrote: > > Am 29.02.2016 um 21:05 schrieb Charles Sprickman: >>> On Feb 29, 2016, at 4:23 AM, Reindl Harald wrote: >>> >>> Am 29.02.2016 um 06:24 schrieb Charles Sprickman: I’ve not had much luck

Re: Missed spam, suggestions?

On Mon, 29 Feb 2016, Charles Sprickman wrote: My concern with disabling autolearn is that then I’m the only one training. My spam probably looks like everyone else’s, but my ham is very different, lots list traffic and such. You can still have your users provide misses for training, you'd

Re: Missed spam, suggestions?

Am 29.02.2016 um 21:05 schrieb Charles Sprickman: On Feb 29, 2016, at 4:23 AM, Reindl Harald wrote: Am 29.02.2016 um 06:24 schrieb Charles Sprickman: I’ve not had much luck with Bayes - when I had it enabled recently on a per-user basis it was just hitting the

Re: Missed spam, suggestions?

> On Feb 29, 2016, at 4:23 AM, Reindl Harald wrote: > > > > Am 29.02.2016 um 06:24 schrieb Charles Sprickman: >> I’ve not had much luck with Bayes - when I had it enabled recently on a >> per-user basis it was just hitting the master DB server too hard with udpates >

Re: Missed spam, suggestions?

Am 29.02.2016 um 06:24 schrieb Charles Sprickman: I’ve not had much luck with Bayes - when I had it enabled recently on a per-user basis it was just hitting the master DB server too hard with udpates just make a sitewide bayes (https://wiki.apache.org/spamassassin/SiteWideBayesSetup)

Re: Missed spam, suggestions?

Changes, SUV sales and Lawyer Finders. > > What I just did was go through a collection of missed spam and re-ran > it through spamassassin. All of it jumped from originally scoring > around 2-3 to a minimum of 6.5 with most hitting around 12. The > biggest difference I see is that DNS

Missed spam, suggestions?

a collection of missed spam and re-ran it through spamassassin. All of it jumped from originally scoring around 2-3 to a minimum of 6.5 with most hitting around 12. The biggest difference I see is that DNSBL and URIBL services had started hitting. When originally received, these emails all originated

Re: Missed SPAM

Is this the format being referred to? These are consistently getting through SA for us too http://pastebin.com/VHkfnTtm Jason On 01/04/12 10:05, John Hardin wrote: On Sat, 31 Mar 2012, joea wrote: On 3/31/2012 at 8:22 AM, Michael Scheidell michael.scheid...@secnap.com wrote: if you need

Re: Missed SPAM

On 04-04-2012 11:26, Jason Haar wrote: Is this the format being referred to? These are consistently getting through SA for us too http://pastebin.com/VHkfnTtm Jason On 01/04/12 10:05, John Hardin wrote: On Sat, 31 Mar 2012, joea wrote: On 3/31/2012 at 8:22 AM, Michael Scheidell

Re: Missed SPAM

On Thu, 5 Apr 2012, Jason Haar wrote: Is this the format being referred to? These are consistently getting through SA for us too http://pastebin.com/VHkfnTtm No, it's not. On 01/04/12 10:05, John Hardin wrote: On Sat, 31 Mar 2012, joea wrote: On 3/31/2012 at 8:22 AM, Michael Scheidell

Re: Missed SPAM

. . . That's very little information to go on. Sorry. We learn as we go. Posting samples (with _all_ headers intact) on a pastebin or on a personal website so we can see them might yield some advice or new rules. Please don't send samples to the list, just the URLs where the samples are

Re: Missed SPAM

On 3/31/12 8:04 AM, joea wrote: starting below my local and MP details? Hopefully, the latter, as the former leaves me feeling a bit exposed. we already know everything you think you want to hide. if you need help, you need enough full information. Or, you make the pastebin 'private', and

Re: Missed SPAM

On 3/31/2012 at 8:22 AM, Michael Scheidell michael.scheid...@secnap.com wrote: On 3/31/12 8:04 AM, joea wrote: starting below my local and MP details? Hopefully, the latter, as the former leaves me feeling a bit exposed. we already know everything you think you want to hide. Well, let's

Re: Missed SPAM

Post what you feel. The ML will help if they can. You can replace IPs and domains etc. -- Jeremy McSpadden On Mar 31, 2012, at 11:19 AM, joea j...@j4computers.com wrote: On 3/31/2012 at 8:22 AM, Michael Scheidell michael.scheid...@secnap.com wrote: On 3/31/12 8:04 AM, joea wrote:

Re: Missed SPAM

31.3.2012 19:17, joea kirjoitti: Beyond that, where can I find the difference, in a SPAM learning sense, between sa-learn --spam filename and spamassassin -r filename? If I do the sa-learn on the same file, after doing spamassassin, it tells me 0 tokens. If I then do sa-learn --forget

Re: Missed SPAM

On Sat, 31 Mar 2012, joea wrote: On 3/31/2012 at 8:22 AM, Michael Scheidell michael.scheid...@secnap.com wrote: if you need help, you need enough full information. Or, you make the pastebin 'private', and send the link offlist to someone who has volunteered to help. . . . . If there are

Re: Missed SPAM

On Sat, 31 Mar 2012 12:17:52 -0400 joea wrote: Beyond that, where can I find the difference, in a SPAM learning sense, between sa-learn --spam filename and spamassassin -r filename? If I do the sa-learn on the same file, after doing spamassassin, it tells me 0 tokens. If I then do

Re: Missed SPAM

On 3/31/2012 at 6:27 PM, RW rwmailli...@googlemail.com wrote: On Sat, 31 Mar 2012 12:17:52 -0400 joea wrote: Beyond that, where can I find the difference, in a SPAM learning sense, between sa-learn --spam filename and spamassassin -r filename? If I do the sa-learn on the same file,

Missed SPAM

Having some difficulty grasping why some SPAM is getting thru yet some similar is marked. They have different source email address and subject, yet identical layout 3 http links, 3 graphics items and like that. When I save the message source (Mime.822 file) and do sa-learn --spam file it

Re: Missed SPAM

On Fri, 30 Mar 2012, joea wrote: Having some difficulty grasping why some SPAM is getting thru yet some similar is marked. They have different source email address and subject, yet identical layout 3 http links, 3 graphics items and like that. Layout generally isn't relevant. The links

Re: Lots of missed spam

* Leigh Sharpe wrote (29/06/06 03:03): This was my first suspicion. I turned off Bayes tests temporarily and it had little effect. I'm seriously considering resetting the bayes and starting again I can recommend that. I had a situation a while ago where the bayes database got mysteriously

Re: Lots of missed spam

From: Loren Wilton [EMAIL PROTECTED] I turned off Bayes tests temporarily and it had little effect. This seems a bit odd. That bayes_00 should have been good for about -3 points. Backing out Bayes should have raised the scores on this stuff by around 3 points, which with only a little bit

Lots of missed spam

Hi All, After 6 months or more of perfect operation, I have had heaps of spam has been missed over the last few weeks. Running SA with -D option shows nothing obvious in the logs. A small selection of misses is posted here: http://www.pacificwireless.com.au/spam/ Anybodygot any ideas why

Re: Lots of missed spam

Leigh Sharpe wrote: Hi All, After 6 months or more of perfect operation, I have had heaps of spam has been missed over the last few weeks. Running SA with -D option shows nothing obvious in the logs. A small selection of misses is posted here: http://www.pacificwireless.com.au/spam/

Re: Lots of missed spam

From: Matt Kettler [EMAIL PROTECTED] Leigh Sharpe wrote: Hi All, After 6 months or more of perfect operation, I have had heaps of spam has been missed over the last few weeks. Running SA with -D option shows nothing obvious in the logs. A small selection of misses is posted here:

Re: Lots of missed spam

Leigh you have a large boatload of spam trained as ham. Make sure your users realize that GOOD messages train as ham and BAD messages train as spam. It appears at least one person has been feeding them both to the ham training. {^_^} - Original Message - From: Leigh Sharpe [EMAIL

RE: Lots of missed spam

] Sent: Thursday, June 29, 2006 11:57 AM To: users@spamassassin.apache.org Subject: Re: Lots of missed spam Leigh you have a large boatload of spam trained as ham. Make sure your users realize that GOOD messages train as ham and BAD messages train as spam. It appears at least one person has been

RE: Lots of missed spam

On Thu, 29 Jun 2006, Leigh Sharpe wrote: I'm seriously considering resetting the bayes and starting again, but this time I'll be making sure that it only gets fed by people who are actually competent enough to put their spam in the spam folder and ham in the ham folder, not the other way

Re: Lots of missed spam

On Wed, Jun 28, 2006 at 06:55:07PM -0700, jdow wrote: 1) all of this spam is hitting BAYES_00.. you really should check your bayes training and correct it. THAT is a bad thing. Getting down to BAYES_00 for spam takes some doing. At the very least a whole lot of spam got trained as ham.

Another missed spam question

Since upgrading v2.64 to 3.0.2, I have a much higher false negative rate. I posted one a couple of days ago that involved a trusted issue. I just got a medication-spam this morning that ONLY triggered bayes_99, although it mentioned sexual health, anxiety and others I would've thought would've

Re: Another missed spam question

Is a lot of reconfiguration usually necessary when upgrading 2.64 to 3.0? I thought I understood that 3.0 incorporated several of the rulesets that were previously separate, and besides, I haven't removed any old rulesets yet anyway. Some is necessary. Shouldn't be a huge amount. You need

Re: Another missed spam question

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Am Freitag, 21. Januar 2005 14:30 schrieb John Fleming: Since upgrading v2.64 to 3.0.2, I have a much higher false negative rate. I posted one a couple of days ago that involved a trusted issue. I just got a medication-spam this morning that ONLY

Re: Missed spam

On Friday 26 November 2004 10:28 am, Jerry Bell wrote: This spam went through with a score of 0. I'm using 3.01 with most of the sare rulesets. Any ideas on how to catch these? Just as a me too. I've been battling these for the last month or so with SA 3.0.1 with varied results. I run with

Missed spam

This spam went through with a score of 0. I'm using 3.01 with most of the sare rulesets. Any ideas on how to catch these? Thanks, Jerry http://www.syslog.org Return-path: [EMAIL PROTECTED] Envelope-to: [EMAIL PROTECTED], [EMAIL PROTECTED] Delivery-date: Thu, 25 Nov 2004 14:53:39 -0500

Re: Missed spam

Jerry Bell wrote: This spam went through with a score of 0. I'm using 3.01 with most of the sare rulesets. Any ideas on how to catch these? Thanks, Jerry http://www.syslog.org Return-path: [EMAIL PROTECTED] Envelope-to: [EMAIL PROTECTED], [EMAIL PROTECTED] Delivery-date: Thu, 25 Nov 2004

Re: Missed spam

I'm using SA through exim/exiscan, and I've got it set up to only report if it is spam. Guess I should change that. The SA logs showing it getting a score of 0. SA is working really well for me the other 99% of the time. Jerry Jerry Bell wrote: This spam went through with a score of 0. I'm

Re: Missed spam

Jerry Bell wrote: I'm using SA through exim/exiscan, and I've got it set up to only report if it is spam. Guess I should change that. The SA logs showing it getting a score of 0. SA is working really well for me the other 99% of the time. Jerry Jerry Bell wrote: This spam went through with a

Re: Missed spam

I wonder if my bayes db has been poisoned to the point of thinking this is ham? In the logs, it autolearned this one as ham, so I suspect that may be the case. Jerry Bell wrote: I'm using SA through exim/exiscan, and I've got it set up to only report if it is spam. Guess I should change that.

Re: Missed spam

Jerry Bell wrote: I wonder if my bayes db has been poisoned to the point of thinking this is ham? In the logs, it autolearned this one as ham, so I suspect that may be the case. You say it scored 0 points..does this mean it triggered no rules or the + - rules totaled up to 0? Regardless of

Re: Missed spam

When I run it manually, this is what I get: X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on db.stelesys.com X-Spam-Status: No, score=0.1 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 X-Spam-Level: What's this best way to get it out of the AWL and bayes? Thanks

Re: Missed spam

Jerry Bell wrote: When I run it manually, this is what I get: X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on db.stelesys.com X-Spam-Status: No, score=0.1 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 X-Spam-Level: What's this best way to get it out of the AWL and