On Sun, Feb 01, 2009 at 01:45:50PM +0100, mouss wrote:
> Henrik K a écrit :
> > On Sat, Jan 31, 2009 at 12:40:24PM +0100, mouss wrote:
> >> if you use the RelayCountry plugin, you can add rules for a few countries:
> >
> > If you are lazy, here is about all of africa..
> >
> > header RELAYED_419
RobertH wrote:
> matt
>
> i hear ya.
>
> ill be using it and scoring low (or whatever i desire) and using meta's it
> appears.
>
> i wasnt asking for it to be some major contention in SA core scoring...
>
> i just honestly cannot belive that there are still people out there sending
> these emails p
RobertH wrote:
looking hard?
of course i did.
You did say you didn't see Nigeria anywhere. I took this to mean
that you dodn't see it anywhere in the SA default rules, which
you would have done using a quick grep.
Now I don't know what you meant when you said you didn't see it
anywhere
RobertH wrote on Fri, 30 Jan 2009 08:53:47 -0800:
> i hear you, yet lets get real...
>
> and, we do use jm_sought stuff.
>
> the word nigeria alone is worth a point is all i was saying.
Wrong. It is worth a point for *you* and maybe for others. Not for
everyone. So, please add a custom rule a
Henrik K a écrit :
> On Sat, Jan 31, 2009 at 12:40:24PM +0100, mouss wrote:
>> if you use the RelayCountry plugin, you can add rules for a few countries:
>
> If you are lazy, here is about all of africa..
>
> header RELAYED_419 X-Relay-Countries =~
> /\b(?:AO|B[IJW]|C[DFGIMV]|DJ|E[RT]|G[AHMNQW]|
RobertH a écrit :
> thanks mouss
>
> u the reason i made the subject, "country in africa" was that i didnt
> want to use the exact word
>
you can if you try :)
> i can see my mistake it that now.
>
> as always, i sincerely appreciate the vast programming and SA application
> wisdom & knowl
matt
i hear ya.
ill be using it and scoring low (or whatever i desire) and using meta's it
appears.
i wasnt asking for it to be some major contention in SA core scoring...
i just honestly cannot belive that there are still people out there sending
these emails pretending to be someone from that
RobertH wrote:
>
>
> how many legitimate emails a day do you people get with the work Nigeria in
> it?
>
Daily, not really.
But often enough in email news feeds.
i.e. I got one within the last 24 hours.. Remember the rebels
threatening oil supplies in Nigeria 4 months ago? Yeah, they called
RobertH wrote:
it should get a hit.
how many legitimate emails a day do you people get with the work Nigeria in
it?
several now that we are sending the 'n word' back and forth on this list
now!
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
> *| *SECNAP Network Security Corporat
is this good enough for a basic rule to flag that word
or should it be different or raw or what?
something better?
body LOCAL_NIGERIA /\bnigeria\b/i
score LOCAL_NIGERIA 0.1
describe LOCAL_NIGERIA This is a simple test rule for nigeria
i know that single word rules in general are a bad
On Sat, 31 Jan 2009, SM wrote:
We then have to obfuscate the words so that we can mention them on this
mailing list.
If you're running SA mailing list messages through SA you get what you
deserve.
--
John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
jhar...@impsec.org
At 08:18 31-01-2009, RobertH wrote:
and if i understand correctly, you can tell the SA config not to
bayes_ignore_from *...@spamassassin.apache.org
bayes_ignore_to users@spamassassin.apache.org
Right. There are still some subscribers who don't realize that some
of the messages from this mai
thanks mouss
u the reason i made the subject, "country in africa" was that i didnt
want to use the exact word
i can see my mistake it that now.
as always, i sincerely appreciate the vast programming and SA application
wisdom & knowledge on this list.
thank you all for you help.
and again,
>
> You could score the content if it mentions a country in
> Africa. We then have to obfuscate the words so that we can
> mention them on this mailing list. It's better to use Bayes
> to deal with that type of email.
>
> Regards,
> -sm
>
>
actually, one does not have to obfuscate a w
At 22:39 30-01-2009, RobertH wrote:
when an email comes in with the word nigeria in it, it should get scored
something.
You could score the content if it mentions a country in Africa. We
then have to obfuscate the words so that we can mention them on this
mailing list. It's better to use Ba
On Sat, Jan 31, 2009 at 12:40:24PM +0100, mouss wrote:
>
> if you use the RelayCountry plugin, you can add rules for a few countries:
If you are lazy, here is about all of africa..
header RELAYED_419 X-Relay-Countries =~
/\b(?:AO|B[IJW]|C[DFGIMV]|DJ|E[RT]|G[AHMNQW]|K[EM]|L[RS]|M[WZ]|N[AEG]|RW|S
Benny Pedersen a écrit :
> On Sat, January 31, 2009 12:40, mouss wrote:
>> The above assumes you don't get (much) mail from these countries.
>> adjust the score as you see fit. and of course, use at your own rix.
>
> i see more spam from outside this countrys, eg 419 spams not sent
> from there an
On Sat, January 31, 2009 12:40, mouss wrote:
> The above assumes you don't get (much) mail from these countries.
> adjust the score as you see fit. and of course, use at your own rix.
i see more spam from outside this countrys, eg 419 spams not sent
from there anyway, botnet sooks :)
--
http://
funny story: we just got an inquiry from a large ISP in 'that country'
to implement a hosted anti-spam solution for them.
Seems we were the only company that they looked at that didn't block
email to/from or mentioning 'that country'.
(other providers they emailed blocked their email!)
They
RobertH a écrit :
>
>
>> No. Scoring based on single-words is pretty much the
>> opposite of the SA approach. That's all I was saying.
>>
>
> karsten,
>
> i get the SA approach
>
> and to the no answer, baloney
>
> this word should get a *HIT* no mattter how small it is scored.
>
if you
>
> No. Scoring based on single-words is pretty much the
> opposite of the SA approach. That's all I was saying.
>
karsten,
i get the SA approach
and to the no answer, baloney
this word should get a *HIT* no mattter how small it is scored.
- rh
>
> You must not be looking very hard. It's there, both in the
> default ruleset and in the updated ruleset, but not as a
> single-word rule:
>
> grep -i nigeria
> /var/db/spamassassin/3.002005/updates_spamassassin_org/*
> jo...@chip:~$ grep -i nigeria
> /var/db/spamassassin/3.002005/updates_
RobertH wrote:
how is it that the country in africa so often mentioned in email scams is
not worth a point in SA default config
You mean the rules?
nor do i see it anywhere
You must not be looking very hard. It's there, both in the
default ruleset and in the updated ruleset, but not as a
On 30.01.09 08:53, RobertH wrote:
> the word nigeria alone is worth a point is all i was saying.
It was already explained by Karsten...
> guess that should be in local rules eh?
if you want... yes.
But note that scoring on a single word is really a bad idea...
--
Matus UHLAR - fantomas, uh...
On Fri, 2009-01-30 at 08:53 -0800, RobertH wrote:
> Karsten and Matus
>
> i hear you, yet lets get real...
>
> and, we do use jm_sought stuff.
>
> the word nigeria alone is worth a point is all i was saying.
No. Scoring based on single-words is pretty much the opposite of the SA
approach. That
Karsten and Matus
i hear you, yet lets get real...
and, we do use jm_sought stuff.
the word nigeria alone is worth a point is all i was saying.
guess that should be in local rules eh?
;-)
- rh
On 30.01.09 08:42, RobertH wrote:
> what i mean is how could an email with nigeria make it through SA without a
> score based on the word nigeria?
because if they could not, I could not see this e-mail nor answer it.
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning:
matus,
what i mean is how could an email with nigeria make it through SA without a
score based on the word nigeria?
- rh
On Fri, 2009-01-30 at 08:22 -0800, RobertH wrote:
> how is it that the country in africa so often mentioned in email scams is
> not worth a point in SA default config
Because single-word rules are a bad idea.
Use JM_SOUGHT_FRAUD (part of the general Sought rule-set). Some of us
are *manually* goi
On 30.01.09 08:22, RobertH wrote:
> how is it that the country in africa so often mentioned in email scams is
> not worth a point in SA default config
What do you mean? How and why should it be mentioned in the defalt config?
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
30 matches
Mail list logo
