jdow skrev:
From: Anders Norrbring [EMAIL PROTECTED]
Stuart Johnston skrev:
Anders Norrbring wrote:
Hiya all!
I'm getting really sick on recieving 10-100 of the attached mails
every day. Any suggestions on how to get rid of them? Apparently my
Amavis-new and SpamAssassin only tags them
At 10:26 PM 8/21/2006 -0700, John Rudd wrote:
I also heard that interlaced gif spam is appearing now.
Yes, I saw that post, however there wasn't a publicly available sample.
Any such would be much appreciated.
It'd be interesting to see how to counter them.
Should be easy. One approach is
SysAdmin wrote:
I wrote the following rule in an attempt to catch these but I've
obviously made some error. Can someone give me a little guidance as
to where I went awry?
rawbody SWF_r_AMPGFX1 /\.(com|net)/\w+/\?90\amp/i
The forward slashes need to be escaped as well.
Regards,
Andreas
John D. Hardin wrote:
Coders (if any):
Can anybody point me at a code sample showing how to get details into
the report SUMMARY tag from within a plugin?
Like the [IP address etc.] in this:
* 1.0 RBL_PSBL_01 RBL: Mail client listed by psbl.surriel.com
* [64.8.111.2 listed in
Andreas Pettersson wrote:
SysAdmin wrote:
I wrote the following rule in an attempt to catch these but I've
obviously made some error. Can someone give me a little guidance as
to where I went awry?
rawbody SWF_r_AMPGFX1 /\.(com|net)/\w+/\?90\amp/i
The forward slashes need to be
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
John Rudd wrote:
On Aug 21, 2006, at 10:13 PM, Chip M. wrote:
While skimming thru my daily rejected spam pile, did a double take
when a
GIF spam seemed to blink at me. Thought it was a sw glitch at
first...
then realized the sneaky Borg had
Hi Gary,
On Sun, 20 Aug 2006, Gary V wrote:
installs an initscript, so there are advantages. Mixing both methods is often
a bad thing however.
Ok, I'll definite refrain myself from doing that.
Are you using DCC/Razor2/Pyzor? Are they (along
with other network based tests) working?
Hi all,
Not pertaining to Debian (I think)... I was wondering in what
order are SA's settings read in. Is this correct:
1) /etc/spamassassin/init.pre
2) /etc/spamassassin/local.cf
3) /usr/share/spamassassin/*.cf
4) ~/.spamassassin/user_prefs
I also have a v310.pre and a v312.pre in
Hi
I've been struggling with gocr segfaulting or floating point
exceptioning on some pictures lately in FuzzyOcr
Then I remembered a patch suggested long time ago for the Ocr Plugin.
Installed it and all the pictures in question that previously crashed
one or the other gocr Version I had
Is anyone else seeing this sort of spam? It consists of a short message
and always has a URL in it that ends with the string '/sk/'. The URL
points to a web site advertising human growth hormone and testosterone
treatment.
These spams aren't firing on enough rules to be tagged by
In article [EMAIL PROTECTED], DAve
[EMAIL PROTECTED] writes
I really don't want to install X on my mailgateways. It would have to be
as good as URIBL and SURBL before I would consider that.
Is there a way around the dependencies? The FreeBSD port shows the
following, xorg-libraries-6.9.0,
On Tue, 22 Aug 2006, Kevin Golding wrote:
In article [EMAIL PROTECTED], DAve
[EMAIL PROTECTED] writes
I really don't want to install X on my mailgateways. It would have to be
as good as URIBL and SURBL before I would consider that.
Is there a way around the dependencies? The FreeBSD port
DAve writes:
jdow wrote:
From: DAve [EMAIL PROTECTED]
Loren Wilton wrote:
It was mentioned that several people are getting hammered by
world-wide robot attacks. I see from the little spam I get that
there is a new spam sending tool for robots that is running a stock
spam. I
Hi,We have over 100 domains on a server, all of which are getting junk mail. SA 3.1.4 installed, but I don't think it's properly trained yet (even though I did upgrade from an earlier version).If I set up a
[EMAIL PROTECTED] address and tell all my customers to forward the junk mail they get to
Christopher Mills wrote:
Hi,
We have over 100 domains on a server, all of which are getting junk mail. SA
3.1.4 installed, but I don't think it's properly trained yet (even though I did
upgrade from an earlier version).
If I set up a [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] address and
Raymond Wan wrote:
Not pertaining to Debian (I think)... I was wondering in what
order are SA's settings read in. Is this correct:
1) /etc/spamassassin/init.pre
2) /etc/spamassassin/local.cf
3) /usr/share/spamassassin/*.cf
4) ~/.spamassassin/user_prefs
Not quite. I believe
Christopher Mills wrote:
Hi,
We have over 100 domains on a server, all of which are getting junk
mail. SA 3.1.4 installed, but I don't think it's properly trained yet
(even though I did upgrade from an earlier version).
If I set up a [EMAIL PROTECTED] address and tell all my customers
to
Jim Maul wrote:
Christopher Mills wrote:
Hi,
We have over 100 domains on a server, all of which are getting junk
mail. SA 3.1.4 installed, but I don't think it's properly trained yet
(even though I did upgrade from an earlier version).
If I set up a [EMAIL PROTECTED] mailto:[EMAIL
Well, that was part of my reason for doing it. My bayes is seriously
skewed for the spam side, something like 4 to 1. The problem is I'm
getting about 90% spam coming in, so it's difficult enough finding
legitimate mail to feed it. I wasn't talking about feeding strictly
outbounds, but using
Well, I have the following issue. When I report abuse to [EMAIL PROTECTED],
they send me back an auto-generated email ticket with a broken Date: on
it (honestly, people, how hard is it to correctly format the date???).
They do this as for the sending address.
How does one go about writing a
On Tue, Aug 22, 2006 at 08:53:16AM -0500, Chris Mills (Chrysalis) wrote:
[19782] warn: config: SpamAssassin failed to parse line, MY_DSL .85 is not
valid for score, skipping: score MY_DSL .85
[19782] warn: config: SpamAssassin failed to parse line, AOL_DSL .25 is
not valid for score, skipping:
On Tue, Aug 22, 2006 at 07:11:25PM +0900, Raymond Wan wrote:
Not pertaining to Debian (I think)... I was wondering in what
order are SA's settings read in. Is this correct:
1) /etc/spamassassin/init.pre
2) /etc/spamassassin/local.cf
3) /usr/share/spamassassin/*.cf
4)
On Mon, 21 Aug 2006, Loren Wilton wrote:
From: Loren Wilton [EMAIL PROTECTED]
Resent-From: [EMAIL PROTECTED]
To: SpamAssassin Users List users@spamassassin.apache.org
Resent-To: [EMAIL PROTECTED]
Date: Mon, 21 Aug 2006 01:09:37 -0700
Resent-Date: Mon, 21 Aug 2006 09:11:20 +0100 (BST)
Wouldnt forwarding strip away
header info that is used to train spam?
From: Christopher
Mills [mailto:[EMAIL PROTECTED]
Sent: Tuesday, August 22, 2006
9:22 AM
To: users@spamassassin.apache.org
Subject: SA-LEARN Question
Hi,
We have over 100 domains on a server, all of
http://rulesemporium.com/rules/99_FVGT_meta.cf
http://www.rulesemporium.com/rules/88_FVGT_body.cf
Fred writes good rules. ;-)
Loren
Indeed! Score on the stoopid spam example in my earlier post jumped
up nicely. Thanks, Fred.
This post inspired me to try Fred's rules (as
When I start spamassassin, I'm getting these types of errors in my mail log:
Aug 22 09:36:55 eisenhower spamd[96202]: rules: meta test
SARE_HEAD_8BIT_NOSPM has undefined dependency '__SARE_HEAD_8BIT_DATE'
Aug 22 09:36:55 eisenhower spamd[96202]: rules: meta test
SARE_HEAD_8BIT_NOSPM has
On Tue, 22 Aug 2006, Matt Kettler wrote:
John D. Hardin wrote:
Coders (if any):
Can anybody point me at a code sample showing how to get details into
the report SUMMARY tag from within a plugin?
Like the [IP address etc.] in this:
* 1.0 RBL_PSBL_01 RBL: Mail client listed by
On Tue, Aug 22, 2006 at 09:55:05AM -0500, Mike Loiterman wrote:
Spamassassin -D to see what is going on, it just stops at this point:
[...]
Try spamassassin -D --lint. Otherwise, SA sits there looking for a message
on STDIN.
--
Randomly Generated Tagline:
Auribus teneo lupum.
[I hold
Hi Theo,
On Tue, 22 Aug 2006, Theo Van Dinter wrote:
1) /etc/spamassassin/init.pre
2) /etc/spamassassin/local.cf
3) /usr/share/spamassassin/*.cf
4) ~/.spamassassin/user_prefs
You could just read the spamassassin documentation which talks about all of
this. :)
But to answer your
On Wed, Aug 23, 2006 at 12:27:44AM +0900, Raymond Wan wrote:
No, they aren't backups of init.pre, they're pre files that got added in
3.1.0
and 3.1.2.
Oh? You mean they're cummulative? When you upgrade to a new
version, the new init.pre doesn't include the old ones?
Yes and no.
Bowie Bailey wrote:
Christopher Mills wrote:
Hi,
We have over 100 domains on a server, all of which are getting junk
mail. SA 3.1.4 installed, but I don't think it's properly trained yet
(even though I did upgrade from an earlier version).
If I set up a [EMAIL PROTECTED] address and tell
On Mon, 21 Aug 2006, jdow wrote:
From: Joe Zitnik [EMAIL PROTECTED]
Our scanning program has the ability to archive all e-mail, both inbound
and outbound, which we have been doing for months now. Given that your
outbound mail is almost certainly ham, the majority of it's content is
going to
All my headers say autolearn=no, yet, i have in my local.cf both of these settings:bayes_auto_learn 1auto_learn 1neither one works with or without the other it seems. Am I doing something wrong?
On Tue, Aug 22, 2006 at 10:44:36AM -0500, Christopher Mills wrote:
All my headers say autolearn=no, yet, i have in my local.cf both of these
settings:
bayes_auto_learn 1
auto_learn 1
neither one works with or without the other it seems. Am I doing something
wrong?
We experienced an intentional GCI flood over several days. These IPs
are infected (or participated voluntarily in a DDoS).
If this of of use to anyone, it includes the IP and host name.
http://tqmcube.com/files/ddos-data.bz2
This is an incomplete list of unique IPs that were participants.
Some
On Mon, 21 Aug 2006, John Rudd wrote:
On Aug 21, 2006, at 10:13 PM, Chip M. wrote:
While skimming thru my daily rejected spam pile, did a double take when a
GIF spam seemed to blink at me. Thought it was a sw glitch at first...
then realized the sneaky Borg had adapted again.
Took a look at
On Tuesday 22 August 2006 16:31, Jean-Paul Natola took the opportunity to say:
Wouldn't forwarding strip away header info that is used to train spam?
It depends on the MUA. Some MUAs, like MS Outlook (who would've guessed?) (at
least Outlook 2000), mangle the mail even when forwarding as an
-Original Message-
From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
Sent: Monday, August 21, 2006 12:50 PM
To: users@spamassassin.apache.org
Subject: Re: How can I (we) get rid of this?
On Mon, Aug 21, 2006 at 11:52:04AM -0400, Jean-Paul Natola wrote:
I'm getting an error when
On Monday 21 August 2006 22:21, Stefan Bauer took the opportunity to say:
iam using Debian with Spamassasin 3.1.1-1 and exim 4.62.
Iam looking forward to use sa-stats[1] with the stats from spamassasin
from /var/log/exim4/mainlog.log like:
Aug 21 17:58:51 main spamd[4064]: spamd: result: .
On Tue, Aug 22, 2006 at 02:01:38PM -0400, Jean-Paul Natola wrote:
Ok I have installed the indicated modules , now I get a
sa-update: importing default keyring to
'/usr/local/etc/mail/spamassassin//sa-update-keys'...
fatal: couldn't find GPG in $PATH
If you don't have GPG (GnuPG)
-Original Message-
From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
Sent: Tuesday, August 22, 2006 2:07 PM
To: users@spamassassin.apache.org
Subject: Re: How can I (we) get rid of this?
On Tue, Aug 22, 2006 at 02:01:38PM -0400, Jean-Paul Natola wrote:
Ok I have installed the indicated
On 22-Aug-06, at 1:57 PM, Magnus Holmgren wrote:
On Tuesday 22 August 2006 16:31, Jean-Paul Natola took the
opportunity to say:
Wouldn't forwarding strip away header info that is used to train
spam?
It depends on the MUA. Some MUAs, like MS Outlook (who would've
guessed?) (at
least
On Aug 21, 2006, at 11:04 AM, Stuart Johnston wrote:
Anders Norrbring wrote:
Hiya all!
I'm getting really sick on recieving 10-100 of the attached mails
every day. Any suggestions on how to get rid of them? Apparently
my Amavis-new and SpamAssassin only tags them from 0 to 1.6 points.
On Aug 21, 2006, at 9:55 PM, DAve wrote:
Is there a way around the dependencies? The FreeBSD port shows the
following, xorg-libraries-6.9.0, ghostscript-gnu-7.07_15,
teTeX-3.0_1, tcl-8.4.13_1 (TCL?), and all their dependancies. Plus
a lot more.
which port? i can't find fuzzyocr port
Vivek Khera wrote:
On Aug 21, 2006, at 11:04 AM, Stuart Johnston wrote:
Anders Norrbring wrote:
Hiya all!
I'm getting really sick on recieving 10-100 of the attached mails
every day. Any suggestions on how to get rid of them? Apparently my
Amavis-new and SpamAssassin only tags them from 0
Thank you very much for the suggestion, but I should have mentioned earlier
that I had already tried that. I actually now have it without the question
mark and the messages from The Bat! keep flowing right through.
Here is what I now have, which to me, should match:
header SPAM_BAT
--On Tuesday, August 22, 2006 1:07 AM -0500 Chip M.
[EMAIL PROTECTED] wrote:
For interlaced ... I have no idea. Depends a lot on how the interlaced
images are stored, I guess.
Yes, exactly. Until there's samples, I'm not going to worry about it.
There's also progressive JPEG.
On Tue, Aug 22, 2006 at 03:16:07PM -0500, Kyle Harris wrote:
header SPAM_BAT X-Mailer =~ /The Bat/I
a capital I isn't valid.
I'm really beginning to think there is something wrong with the code. I
even have a utility where I can change the X-Mailer header of a test message
to
Raymond Wan wrote:
Hi Theo,
On Tue, 22 Aug 2006, Theo Van Dinter wrote:
score UPPERCASE_25_50 0
score UPPERCASE_50_75 0
score UPPERCASE_75_100 0
score OBSCURED_EMAIL 0
which I honestly don't know what it means... :)
Those rules are being
Michel Vaillancourt wrote:
Bowie Bailey wrote:
Christopher Mills wrote:
Hi,
We have over 100 domains on a server, all of which are getting
junk mail. SA 3.1.4 installed, but I don't think it's properly
trained yet (even though I did upgrade from an earlier version).
If I set
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Kenneth Porter wrote:
--On Tuesday, August 22, 2006 1:07 AM -0500 Chip M.
[EMAIL PROTECTED] wrote:
For interlaced ... I have no idea. Depends a lot on how the
interlaced images are stored, I guess.
Yes, exactly. Until there's samples, I'm not
Hi, I am new to this list and certainly not a SA expert, however I have
moderate experience in general linux issues and mailer issues.
I am getting a series of messages allowed through on the basis of
USER_IN_WHITELIST. I have searched the mailing list archive and pored
over my setup files and
Nick Rout wrote:
Hi, I am new to this list and certainly not a SA expert, however I have
moderate experience in general linux issues and mailer issues.
I am getting a series of messages allowed through on the basis of
USER_IN_WHITELIST. I have searched the mailing list archive and pored
over my
Nick Rout wrote:
Hi, I am new to this list and certainly not a SA expert, however I have
moderate experience in general linux issues and mailer issues.
I am getting a series of messages allowed through on the basis of
USER_IN_WHITELIST. I have searched the mailing list archive and pored
over my
Did you do something utterly reckless and give it a score? And you
want lower case i, I believe. Also be sure to restart any daemonized
SpamAssassin when you make changes.
And for that matter WHERE do you have the rule? If it's not in the
same place as local.cf then it probably won't get run
John D. Hardin wrote:
On Tue, 22 Aug 2006, Matt Kettler wrote:
John D. Hardin wrote:
Coders (if any):
Can anybody point me at a code sample showing how to get details into
the report SUMMARY tag from within a plugin?
Like the [IP address etc.] in this:
* 1.0 RBL_PSBL_01 RBL: Mail
From: Mike Loiterman [EMAIL PROTECTED]
Aug 22 09:36:55 eisenhower spamd[96202]: rules: meta test
SARE_HEAD_8BIT_NOSPM has undefined dependency '__SARE_HEAD_8BIT_DATE'
grep SARE_HEAD_8BIT_NOSPM /etc/mail/spamassassin/*.cf
Modify the location to match your reality if needed.
{^_^}
On Tue, 22 Aug 2006 19:58:59 -0400
Rick Macdougall wrote:
Return-Path: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 3.1.3-gr0 (2006-06-01) on
www.rout.co.nz
X-Spam-Level:
X-Spam-Status: No, score=-88.6 required=5.5 tests=AWL,BAYES_99,
On Aug 22, 2006, at 17:06, jdow wrote:
Did you do something utterly reckless and give it a score?
Give it a score!? You sure do live dangerously!
Nick Rout wrote:
On Tue, 22 Aug 2006 19:58:59 -0400
Thanks, quick reply! (Thanks too Daryl, also quick)
So I take it USER_IN_WHITELIST also checks Return-Path? I wonder where
Return-Path is being set? Is it likely to be set by the spammer? Or is
my system adding it in somewhere (probably in
From: Nick Rout [EMAIL PROTECTED]
On Tue, 22 Aug 2006 19:58:59 -0400
Rick Macdougall wrote:
Return-Path: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 3.1.3-gr0 (2006-06-01) on www.rout.co.nz
X-Spam-Level:
X-Spam-Status: No, score=-88.6 required=5.5 tests=AWL,BAYES_99,
From: John Rudd [EMAIL PROTECTED]
On Aug 22, 2006, at 17:06, jdow wrote:
Did you do something utterly reckless and give it a score?
Give it a score!? You sure do live dangerously!
If you did give it a score and made the score zero for safe testing
the rule will never run. A score of
decoder wrote:
Which OCR plugin are you using there? If it is the original OcrPlugin,
then you might try FuzzyOcr instead. The original OcrPlugin was more
proof-of-concept, and will cause you lots of headaches with the
current image spam...
I did upgrade to FuzzyOCR after I read your message.
Hi Bowie,
On Tue, 22 Aug 2006, Bowie Bailey wrote:
Raymond Wan wrote:
1) /etc/spamassassin/*.pre
2a) /var/lib/spamassassin/3.001003/updates_spamassassin_org/*.cf
(if the directory exists)
2b) /usr/share/spamassassin/*.cf
(if the previous directory doesn't exist)
3)
On Tue, 22 Aug 2006, Daryl C. W. O'Shea wrote:
I took a casual glance at the code, it seems to be related to the
test_log subroutine, which populates test_log_msgs, that later
gets added to the REPORT and SUMMARY.
I got the same impression, but $self-test_log($msg); in the
plugin
From: Raymond Wan [EMAIL PROTECTED]
Hi Bowie,
On Tue, 22 Aug 2006, Bowie Bailey wrote:
Raymond Wan wrote:
1) /etc/spamassassin/*.pre
2a) /var/lib/spamassassin/3.001003/updates_spamassassin_org/*.cf
(if the directory exists)
2b) /usr/share/spamassassin/*.cf
(if the previous directory
Hi jdow,
On Tue, 22 Aug 2006, jdow wrote:
Never change /etc/share/spamassassin or the /var/lib/spamassassin
directories. Always change /etc/spamassassin/ or
/etc/mail/spamassassin
as appropriate for your install. You can override values set
earlier
with new ones. That change should probably
67 matches
Mail list logo
