I am seeing a clear downtrend in the number for spams hitting our
servers, I am not sure why ? Since Last week spams are at 50% of what
they used to be last month. Is this what you all are seeing
But the irritant 419's are still coming in ( and some get past SA ),
in many new variants. I have
Yet Another Ninja a écrit :
If these are hit rates with a very minimal daily corpus, don't know if
the present ruleset is ready for production unless you have 0 tolerance
for any bulk, period
I'm afraid I must agree. I don't have a confirmed and sorted corpus per
se, but after a single
On Dienstag, 24. Juni 2008 Benny Pedersen wrote:
14400 is 4 hours (4*3660) which is a bit low for an MX 86400
(24 hours) is probably better.
nice calc for 4 hours :-)
mouss is french, you must know ;-)
mfg zmi
--
// Michael Monnerie, Ing.BSc- http://it-management.at
//
On Dienstag, 24. Juni 2008 John Wilcock wrote:
with just a bit of fine tuning
I guess John Gallet needs a bigger corpus, maybe you could share some
ham/spam with him. He does the work to create the rules, and with
better corpus the rules will become better. I know this, I maintain the
GERMAN
Am/On Tue, 24 Jun 2008 12:10:53 +0530 schrieb/wrote ram:
I am seeing a clear downtrend in the number for spams hitting our
servers, I am not sure why ? Since Last week spams are at 50% of what
they used to be last month. Is this what you all are seeing
not really.
I varies between 60 to 89 %,
On Tuesday 24 June 2008 02:33, Benny Pedersen wrote:
On Tue, June 24, 2008 01:10, Stefan Jakobs wrote:
I'm guess this doesn't work:
amavis[31206]: (31206-01) SPAM-TAG, [EMAIL PROTECTED] - [EMAIL
PROTECTED], Yes,
score=7.88 tagged_above=-999 required=5 tests=[ALL_TRUSTED=-1.8,
Michael Monnerie wrote:
On Dienstag, 24. Juni 2008 Benny Pedersen wrote:
14400 is 4 hours (4*3660) which is a bit low for an MX 86400
(24 hours) is probably better.
nice calc for 4 hours :-)
mouss is french, you must know ;-)
yep. I have problems with anything but the
Hello,
we use latest versions of postfix and spamassasin on slackware machines.
Our postfix acts as smtp gateway - no local users. We want to set up
white/blacklists per username. Spammassasin keeps white/black lists in sql.
$GLOBAL definitions are working OK.
Testing scenario:
[EMAIL PROTECTED]
John GALLET a écrit :
I think I have a newbye simple problem of philosophy/strategy: my
approach, for what it's worth, was that I flag anything that contains
some unsubscribe links and French law reminders because anyway all the
ones I receive are spam, and I add the opt-in mailing/newsletter
John GALLET writes:
Hi,
You run seek-phrases-in-corpus over the 2 corpora, and it'll spit out
the patterns; you can then write rules based on these.
I did so, the results are interesting, though I do not really know where
to go from there. If I take the first 50 best patterns and
Hi folks --
this string has been cropping up a lot in the SOUGHT rules recently;
it appears a spammer is using it:
--
Using Opera's revolutionary [MUNGED] e-mail client: http://www.opera.com/mail/
(I added [MUNGED] in case you're using the ruleset in question ;)
Grepping my ham corpora,
Re,
Anyway, these are the patterns I tried to code in FR_SPAMISLEGAL and
FR_HOWTOUNSUBSCRIBE, plus one I considered too generic (if you can't
read this mail in html, click here).
It might be worth collecting more ham that includes any such common
text -- or even _generating_ mails along those
On Tue, 2008-06-24 at 09:54 +0100, Justin Mason wrote:
this string has been cropping up a lot in the SOUGHT rules recently;
it appears a spammer is using it:
FWIW, my devel OPERA_MID_* rules are designed to trigger on these recent
forgery. :)
guenther
--
char *t=[EMAIL PROTECTED];
John GALLET writes:
Re,
Anyway, these are the patterns I tried to code in FR_SPAMISLEGAL and
FR_HOWTOUNSUBSCRIBE, plus one I considered too generic (if you can't
read this mail in html, click here).
It might be worth collecting more ham that includes any such common
text -- or even
Karsten =?ISO-8859-1?Q?Br=E4ckelmann?= writes:
On Tue, 2008-06-24 at 09:54 +0100, Justin Mason wrote:
this string has been cropping up a lot in the SOUGHT rules recently;
it appears a spammer is using it:
FWIW, my devel OPERA_MID_* rules are designed to trigger on these recent
Sh..., you are right. Thanks.
I never thought of that! Stupid!
Chris
I suspect Net::DNS cannot parse nameserver localhost. Try
nameserver 127.0.0.1
instead,
--j.
Vinogratzky writes:
I thought so, too. But
---8---
; DiG 9.3.4 3.2.3.updates.spamassassin.org ANY
;;
Guys,
We are running a postfix mail server. We recently installed spamassasin.
Since then, any email send in or out of the server send a copy of the email
to the sender. For example, if i send an email from my gmail id to my work
id, my gmail id gets a copy of it.
We have done all we can in the
Hi,
I setup my mail server with two instance of postfix to listen on port 25 for
incomming mail, and port 11234 for outgoing mail. Only mail coming through
port 25 are filtered by SA. But now I have too many spam from my server,
they have bot to auto connect to our server and sending mail to me.
People ;
I have a spamassassin installation in my box , detail as follows
[star]$ spamassassin -V
SpamAssassin version 3.1.8
running on Perl version 5.8.8
I want to deny the spam mails to the mailing lists running in
this box , how to do that
my MTA is postfix , mailman is the
John GALLET a écrit :
What happens with the agrave htmlentity ? I mean if the received spam is
htmlentity encoded, or mixes utf-8 accents and ascii-htmlentity ?
SA deals with that for you. Body rules are applied to text that has
already been decoded, so you don't need to take account of html
Justin Mason a écrit :
John GALLET writes:
Well, thanks for writing it. I think its main weak point for French and
other accented languages is handling the different encodings for a same
char with an accent, some kind of synonyms list. The same letter, say a
with an accent, can be misspelled
On 24.06.08 03:41, manojp77 wrote:
We are running a postfix mail server. We recently installed spamassasin.
Since then, any email send in or out of the server send a copy of the email
to the sender. For example, if i send an email from my gmail id to my work
id, my gmail id gets a copy of it.
John Wilcock writes:
Justin Mason a écrit :
John GALLET writes:
Well, thanks for writing it. I think its main weak point for French and
other accented languages is handling the different encodings for a same
char with an accent, some kind of synonyms list. The same letter, say a
Lê Ngọc Hiếu wrote:
Hi,
I setup my mail server with two instance of postfix to listen on port
25 for incomming mail, and port 11234 for outgoing mail. Only mail
coming through port 25 are filtered by SA. But now I have too many
spam from my server, they have bot to auto connect to our server
I'm not sure if this is a SpamAssassin or a MIMEDefang problem. I set up MD and
SA on a new machine running CentOS, MD 2.64, SA 3.2.4. I backed up the Bayes
database on my old server, running FreeBSD, MD 2.51, SA 3.0.3, and restored it
to the new
machine. I can train it and sync it and so-on,
ram wrote:
I am seeing a clear downtrend in the number for spams hitting our
servers, I am not sure why ? Since Last week spams are at 50% of what
they used to be last month. Is this what you all are seeing
But the irritant 419's are still coming in ( and some get past SA ),
in many new
Our spam levels are 1/2 to 1/3 of what they were two weeks ago.
Also, virus e-mails are also very very low. Low enough for me to
start reviewing the e-mail logs for anomalies.
The summer doldrums are upon us...
On Tue, 2008-06-24 at 10:19 -0400, Randy Ramsdell wrote:
ram wrote:
I am seeing a clear downtrend in the number for spams hitting our
servers, I am not sure why ? Since Last week spams are at 50% of what
they used to be last month. Is this what you all are seeing
Our spam levels are
Daniel J McDonald wrote:
On Tue, 2008-06-24 at 10:19 -0400, Randy Ramsdell wrote:
ram wrote:
I am seeing a clear downtrend in the number for spams hitting our
servers, I am not sure why ? Since Last week spams are at 50% of what
they used to be last month. Is this what you all are
Matt Kettler wrote:
Lê Ngọc Hiếu wrote:
Hi,
I setup my mail server with two instance of postfix to listen on port
25 for incomming mail, and port 11234 for outgoing mail. Only mail
coming through port 25 are filtered by SA. But now I have too many
spam from my server, they have bot to auto
Thank you all, I'll try amavisd-new :-)
On Tue, Jun 24, 2008 at 10:27 PM, mouss [EMAIL PROTECTED] wrote:
Matt Kettler wrote:
Lê Ngọc Hiếu wrote:
Hi,
I setup my mail server with two instance of postfix to listen on port 25
for incomming mail, and port 11234 for outgoing mail. Only mail
Running SA version 3.2.4
amavisd-new version 2.2.1
Postfix version 2.5.2
Upgraded postfix from version 2.1.x to 2.5.2 just a few hours ago.
Now Spamassassin is giving everything a score of 0, even the obvious spam.
Worked properly just minutes before I ran the upgrade.
Looked at all the logs for
Daniel J McDonald wrote:
On Tue, 2008-06-24 at 10:19 -0400, Randy Ramsdell wrote:
ram wrote:
I am seeing a clear downtrend in the number for spams hitting our
servers, I am not sure why ? Since Last week spams are at 50% of what
they used to be last month. Is this what you
Randy Ramsdell wrote:
Our spam levels are 1/2 to 1/3 of what they were two weeks ago. Also,
virus e-mails are also very very low. Low enough for me to start
reviewing the e-mail logs for anomalies.
The volume hitting my traps is significantly down, although a few days
ago, I quit trapping
Example headers?
Output of spamassassin --lint ?
mmedlin99 wrote:
Running SA version 3.2.4
amavisd-new version 2.2.1
Postfix version 2.5.2
Upgraded postfix from version 2.1.x to 2.5.2 just a few hours ago.
Now Spamassassin is giving everything a score of 0, even the obvious spam.
Worked
On Tue, June 24, 2008 10:14, Daniel Chojecki wrote:
Any idea ?
problem is in mta not in spamassassin, mta sends to more then one to
spamassassin, and scores with one in mind
change this in mta so it just sends always to one recipient at a time, no
matter how many you send to, that fixes the
manojp77 wrote:
Guys,
We are running a postfix mail server. We recently installed spamassasin.
Since then, any email send in or out of the server send a copy of the email
to the sender. For example, if i send an email from my gmail id to my work
id, my gmail id gets a copy of it.
this is a
Daniel Chojecki wrote:
Hello,
we use latest versions of postfix and spamassasin on slackware machines.
Our postfix acts as smtp gateway - no local users. We want to set up
white/blacklists per username. Spammassasin keeps white/black lists in sql.
$GLOBAL definitions are working OK.
Testing
On Tue, 2008-06-24 at 10:41 -0700, Evan Platt wrote:
Example headers?
Output of spamassassin --lint ?
Since he's running amavisd-new, running `amavisd -c blah.conf debug-sa`
would probably provide the most information...
mmedlin99 wrote:
Running SA version 3.2.4
amavisd-new version
Justin Mason wrote:
Grepping my ham corpora, I find some hits from 2005 and 2006, but nothing
in the past 2 years for this. Does anyone use recent builds of the real
Opera mail? does it use this footer, or is it safe to list it in the
rule?
I don't normally use Opera for email, but I use it
To follow up, here's a message actually sent from Opera 9.5 on Windows, in
case someone wants the info for header analysis.
And yes, I've changed the signature, partly so that it won't trip the rule
in question.
--
Kelson Vibber
SpeedGate Communications www.speed.net
Thanks for responding,
Output of spamassassin --lint is ..nothing. It just does it's thing and
returns to the prompt. From what I've read no messages should be a good
thing.
You;ll have to forgive me I'm sometimes not so bright, I assumed that
blah.conf meant amavisd.conf.
Ran what you
John Hardin wrote:
On Mon, 23 Jun 2008, Stefan Jakobs wrote:
But now I get a lint warning:
# spamassassin --lint
[12533] warn: config: warning: score set for non-existent rule
JM_SOUGHT_3
Would be worth considering extending the conditional section of the
parser to cope with this?
if
On Tue, Jun 24, 2008 at 09:44:40PM +0100, Matt Hampton wrote:
if defined JM_SOUGHT_3
score JM_SOUGHT_3 1.5
endif
Has anyone thought to ask JM to make sure that 3 rules are always generated,
even if the third one is empty ala:
meta JM_SOUGHT_3 0
thereby skipping all of the kluging
On Tue, 24 Jun 2008, Theo Van Dinter wrote:
Has anyone thought to ask JM to make sure that 3 rules are always generated,
even if the third one is empty ala:
meta JM_SOUGHT_3 0
thereby skipping all of the kluging suggestions to work around it?
No. Kludging is fun.
--
John Hardin KA7OHZ
45 matches
Mail list logo
