Hard money conference spam

2008-11-11 Thread Micah Anderson
I'm getting probably 4-5 of these a day, the messages vary, so they aren't the same, but they aren't firing on any specific rules related to their 'hard money conference/webinar/seminar' etc. Does anyone have any customized rules for these? I've been training my bayes on them, and its starting to

Re: Hard money conference spam

2008-11-11 Thread Rob McEwen
Micah, In addition to the barracuda RBL, this IP is also listed on ivmSIP (since 10/21/08) and ivmSIP/24 Additionally, the domain hardmoney-event DOT com is blacklisted on both ivmURI and URIBL.COM At the very least, you should add uribl.com to your filtering since that list is free. Scoring

Re: Hard money conference spam

2008-11-11 Thread Rob McEwen
Micah, In addition to the barracuda RBL, this IP is also listed on ivmSIP (since 10/21/08) and ivmSIP/24 Additionally, the domain hardmoney-event DOT com is blacklisted on both ivmURI and URIBL.COM At the very least, you should add uribl.com to your filtering since that list is free. Scoring

Re: Barracuda RBL

2008-11-11 Thread Henrik K
On Tue, Nov 11, 2008 at 08:30:26AM -0700, Chris wrote: On Tuesday 11 November 2008 8:15:26 am Sujit Acharyya-Choudhury wrote: I would like to use the free barracuda RBL with SpamAssassin. Is there any rule for that yet? Easy enough to create one. I created /etc/mail/spamassassin/brbl.cf

Re: filter for russian porno message?

2008-11-11 Thread Ned Slider
sergioser wrote: Hello all! During last month I receive a lot of messages with russian language subjects with hard sexual words. Spamassassin just let through all of them. Maybe somebody have special filters for messages like these, do you know? Or maybe you can help to configure spamd for

Re: Barracuda RBL

2008-11-11 Thread Henrik K
On Tue, Nov 11, 2008 at 05:34:28PM +0200, Henrik K wrote: On Tue, Nov 11, 2008 at 08:30:26AM -0700, Chris wrote: On Tuesday 11 November 2008 8:15:26 am Sujit Acharyya-Choudhury wrote: I would like to use the free barracuda RBL with SpamAssassin. Is there any rule for that yet? Easy

Re[2]: filter for russian porno message?

2008-11-11 Thread sergio
Hello Ned, Tuesday, November 11, 2008, 5:43:22 PM, you wrote: sergioser wrote: Hello all! During last month I receive a lot of messages with russian language subjects with hard sexual words. Spamassassin just let through all of them. Maybe somebody have special filters for messages like

RE: Barracuda RBL

2008-11-11 Thread Sujit Acharyya-Choudhury
Thanks Henrik. However, I am not using SVN 3.3 so the rule on its own will be useful. Regards Sujit -Original Message- From: Henrik K [mailto:[EMAIL PROTECTED] Sent: 11 November 2008 15:38 To: users@spamassassin.apache.org Subject: Re: Barracuda RBL On Tue, Nov 11, 2008 at

Re: Re[2]: filter for russian porno message?

2008-11-11 Thread Dave Pooser
Thanks. Sorry,but I'm new in spamassassin users.Can you say where I must write this rules? Thanks again. Be very careful with that rule-- it would hit on all Russian-language email, which considering your geographic location might be unwise. -- Dave Pooser Cat-Herder-in-Chief,

Re: SURBL Usage Policy change

2008-11-11 Thread Micah Anderson
Jeff Chan [EMAIL PROTECTED] writes: I think that SURBL is a valuable service, and I understand how it is difficult to maintain such a service without resources. The funding is, by design, very moderate and will provide much needed support to sustain this initiative. However, I believe that

Re: Hard money conference spam

2008-11-11 Thread Micah Anderson
Rob McEwen [EMAIL PROTECTED] writes: Micah, In addition to the barracuda RBL, this IP is also listed on ivmSIP (since 10/21/08) and ivmSIP/24 Can you provide me with the local.cf details to be able to add the ivm RBLs? Additionally, the domain hardmoney-event DOT com is blacklisted on

RE: Re: Barracuda RBL

2008-11-11 Thread Sujit Acharyya-Choudhury
Hi Micah, Is lastexternal in brbl required? i.e. as you said: eval:check_rbl('brbl-lastexternal', 'b.barracudacentral.org.','127.0.0.2') Sujit Choudhury ISLS University of Westminster This e-mail and its attachments are intended for the above named only and may be confidential. If they have

Re: filter for russian porno message?

2008-11-11 Thread Ned Slider
Dave Pooser wrote: Thanks. Sorry,but I'm new in spamassassin users.Can you say where I must write this rules? Thanks again. Be very careful with that rule-- it would hit on all Russian-language email, which considering your geographic location might be unwise. Very true - sorry, I didn't

TextCat

2008-11-11 Thread Matt
I appear to have TextCat on my server: locate TextCat /usr/lib/perl5/vendor_perl/5.8.5/Mail/SpamAssassin/Plugin/TextCat.pm /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Plugin/TextCat.pm /usr/share/man/man3/Mail::SpamAssassin::Plugin::TextCat.3pm.gz

whitelist not working...?

2008-11-11 Thread Johnson, S
I've been using the whitelist with success up until this point. I've got a particular person that is trying to send in to us with the last name of vollum. Vollum is getting caught by the fuzzy valium filter and tossed as spam. I tried adding his email address as well as the domain into the

Barracuda RBL

2008-11-11 Thread Sujit Acharyya-Choudhury
I would like to use the free barracuda RBL with SpamAssassin. Is there any rule for that yet? Regards Sujit Choudhury -- The University of Westminster is a charity and a company limited by guarantee. Registration number: 977818 England. Registered Office: 309 Regent Street, London W1B

Freemail config: dup unknown type freemail_re, Regexp

2008-11-11 Thread Micah Anderson
I recently added the FreeMail plugin, and although it appears to be working, when I start SpamAssassin, I receive this message in my log: Nov 11 06:45:48 spamd2 spamd[29934]: config: dup unknown type freemail_re, Regexp I've put the FreeMail.pm in /etc/spamassassin, and created FreeMail.cf as

Re: TextCat

2008-11-11 Thread Karsten Bräckelmann
On Tue, 2008-11-11 at 09:59 -0600, Matt wrote: I appear to have TextCat on my server: locate TextCat /usr/lib/perl5/vendor_perl/5.8.5/Mail/SpamAssassin/Plugin/TextCat.pm /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Plugin/TextCat.pm

Question training the Bayse filter

2008-11-11 Thread Thomas Zastrow
Hello, I'm still not happy with my Spamassassin ... it don't recognizes a lot of Spam mails, even my Thunderbird with default properties recognizes more than SA. Every day, I train the Bayes filter with all the spam which were not already recognized as spam. My question is now: makes it sense to

Re: Barracuda RBL

2008-11-11 Thread Benny Pedersen
On Tue, November 11, 2008 16:38, Henrik K wrote: header RCVD_IN_BRBL_LASTEXT eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org') bb ? -- Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Checking for SPF DKIM Checks

2008-11-11 Thread Micah Anderson
mouss [EMAIL PROTECTED] writes: Francis Russell wrote: Even with the default DKIM scores, I finding I am getting spam that are DKIM_VERIFIED causing the score to dip below zero and let the message through, for example: http://micah.riseup.net/1 that's spam relayed by a

Re: Checking for SPF DKIM Checks

2008-11-11 Thread Matus UHLAR - fantomas
mouss [EMAIL PROTECTED] writes: That's what I meant. Maybe I use the term relay too liberally? anyway, such spam is harder to stop unless you add the list relays to your trusted_networks. On 11.11.08 12:05, Micah Anderson wrote: This is something in SA that I have the hardest time

Re: Checking for SPF DKIM Checks

2008-11-11 Thread Greg Troxel
Micah Anderson [EMAIL PROTECTED] writes: mouss [EMAIL PROTECTED] writes: That's what I meant. Maybe I use the term relay too liberally? anyway, such spam is harder to stop unless you add the list relays to your trusted_networks. This is something in SA that I have the hardest time

Re: Barracuda RBL

2008-11-11 Thread Micah Anderson
Sujit Acharyya-Choudhury [EMAIL PROTECTED] writes: Thanks Henrik. However, I am not using SVN 3.3 so the rule on its own will be useful. I'm using: # Add a rule to give barracude RBL a +1 score, this is a really good # RBL, but we were having false-positives when using it to block at # the

Re: Barracuda RBL

2008-11-11 Thread Ralf Hildebrandt
* Benny Pedersen [EMAIL PROTECTED]: On Tue, November 11, 2008 16:38, Henrik K wrote: header RCVD_IN_BRBL_LASTEXT eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org') bb ? Yes, I was wondering about this as well. Typo? -- Ralf Hildebrandt (i.A. des GB IT)

Re: Barracuda RBL

2008-11-11 Thread Ralf Hildebrandt
* Ralf Hildebrandt [EMAIL PROTECTED]: * Benny Pedersen [EMAIL PROTECTED]: On Tue, November 11, 2008 16:38, Henrik K wrote: header RCVD_IN_BRBL_LASTEXT eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org') bb ? Yes, I was wondering about this as well. Typo? No typo,

Re: Barracuda RBL

2008-11-11 Thread Noel Jones
2008/11/11 Ralf Hildebrandt [EMAIL PROTECTED] * Benny Pedersen [EMAIL PROTECTED]: On Tue, November 11, 2008 16:38, Henrik K wrote: header RCVD_IN_BRBL_LASTEXT eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org') bb ? Yes, I was wondering about this as well. Typo? --

Re: Barracuda RBL

2008-11-11 Thread Chris
On Tuesday 11 November 2008 8:15:26 am Sujit Acharyya-Choudhury wrote: I would like to use the free barracuda RBL with SpamAssassin. Is there any rule for that yet? Easy enough to create one. I created /etc/mail/spamassassin/brbl.cf with the content: # BarracudaCental.org RBL header

filter for russian porno message?

2008-11-11 Thread sergioser
Hello all! During last month I receive a lot of messages with russian language subjects with hard sexual words. Spamassassin just let through all of them. Maybe somebody have special filters for messages like these, do you know? Or maybe you can help to configure spamd for effective fight with

Single URI spam not checked against URIBLs

2008-11-11 Thread Bill Landry
I've posted a short pharma spam message to: http://www.inetmsg.com/spam.txt and debug output to: http://www.inetmsg.com/sa-debug.txt It displays a single URI linked line in an e-mail client that only displays: Please visit our shop. There seems to be something about the URI in the message

Re: sa-learn journal location for teaching spamassassin on multiple hosts

2008-11-11 Thread Jake Maul
On Fri, Nov 7, 2008 at 4:45 AM, Samy Ascha, Xel Media B.V. [EMAIL PROTECTED] wrote: I have recently setup a mailbox and a sa-learn script to start teaching SpamAssassin. This was all no problem, but: We have an MX group of usually about 3 MTAs, which all run their own content filter (amavis)

Re: Single URI spam not checked against URIBLs

2008-11-11 Thread mouss
Bill Landry wrote: I've posted a short pharma spam message to: http://www.inetmsg.com/spam.txt and debug output to: http://www.inetmsg.com/sa-debug.txt It displays a single URI linked line in an e-mail client that only displays: Please visit our shop. There seems to be something about the

Re: Barracuda RBL

2008-11-11 Thread mouss
Ralf Hildebrandt wrote: * Benny Pedersen [EMAIL PROTECTED]: On Tue, November 11, 2008 16:38, Henrik K wrote: header RCVD_IN_BRBL_LASTEXT eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org') bb ? Yes, I was wondering about this as well. Typo? no, it's the zone set for SA, so

Re: Checking for SPF DKIM Checks

2008-11-11 Thread mouss
Micah Anderson wrote: mouss [EMAIL PROTECTED] writes: Francis Russell wrote: Even with the default DKIM scores, I finding I am getting spam that are DKIM_VERIFIED causing the score to dip below zero and let the message through, for example: http://micah.riseup.net/1 that's spam

Re: html tricks style tags used to block background noise.

2008-11-11 Thread Jake Maul
On Mon, Nov 10, 2008 at 6:29 AM, Michael Scheidell [EMAIL PROTECTED] wrote: looks like spammers are using style (some random text from books) /style to try to poison baysian seems text inside of style/ doesn't show up on the page, and if they wrap their spam in style tags, they can hide the

Re: Single URI spam not checked against URIBLs

2008-11-11 Thread Bill Landry
mouss wrote: Bill Landry wrote: I've posted a short pharma spam message to: http://www.inetmsg.com/spam.txt and debug output to: http://www.inetmsg.com/sa-debug.txt It displays a single URI linked line in an e-mail client that only displays: Please visit our shop. There seems to be

sa-update fails suddenly

2008-11-11 Thread Michael Monnerie
Without changing anything my sa-update suddenly fails badly. Can someone give me a hint? Subroutine check_for_from_dns redefined at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/EvalTests.pm line 1429. plugin: failed to parse plugin (from @INC): Bareword

Re: Question training the Bayse filter

2008-11-11 Thread Karsten Bräckelmann
On Tue, 2008-11-11 at 21:55 +0100, Thomas Zastrow wrote: I'm still not happy with my Spamassassin ... it don't recognizes a lot of Spam mails, even my Thunderbird with default properties recognizes more than SA. Every day, I train the Bayes filter with all the spam which were not already

Re: SURBL Usage Policy change

2008-11-11 Thread Jeff Chan
On Tuesday, November 11, 2008, 8:49:44 AM, Micah Anderson wrote: Jeff Chan [EMAIL PROTECTED] writes: I think that SURBL is a valuable service, and I understand how it is difficult to maintain such a service without resources. The funding is, by design, very moderate and will provide much

Overriding user prefs in local.cf

2008-11-11 Thread Micah Anderson
I set some 'add_header' options in my global local.cf and could not figure out why they were not being applied. It turns out that because I am using SQL user_prefs, any add_header lines I put in local.cf are just ignored (even though I have no global or individual add_header lines configured in

Re: Overriding user prefs in local.cf

2008-11-11 Thread Matt Kettler
Micah Anderson wrote: I set some 'add_header' options in my global local.cf and could not figure out why they were not being applied. It turns out that because I am using SQL user_prefs, any add_header lines I put in local.cf are just ignored (even though I have no global or individual