Re: Smut spam

2010-01-30 Thread Christian Brel
On Fri, 29 Jan 2010 14:34:46 -0500 Adam Katz antis...@khopis.com wrote: Robert Fitzpatrick wrote: http://mx1.webtent.net/test.msg http://mx1.webtent.net/test2.msg The first one now also hits razor ... can't say one way or another about how it hit earlier, but I'd suggest double-checking

Re: Smut spam

2010-01-30 Thread Ned Slider
Christian Brel wrote: header __HOTMAIL_SPX1 ALL =~ /Received\:.{1,30}hotmail\.com/i body __HOTMAIL_SPX2 /http\:\/\/groups\.yahoo\.com/ meta HOTMAIL_SPAM_GY (__HOTMAIL_SPX1 __HOTMAIL_SPX2) score HOTMAIL_SPAM_GY 0.0 If I may... To match only Received headers: header __HOTMAIL_SPX1

Re: [SPAM:9.6] Re: Smut spam

2010-01-30 Thread Christian Brel
On Sat, 30 Jan 2010 09:32:31 + Ned Slider n...@unixmail.co.uk wrote: Christian Brel wrote: header __HOTMAIL_SPX1 ALL =~ /Received\:.{1,30}hotmail\.com/i body __HOTMAIL_SPX2 /http\:\/\/groups\.yahoo\.com/ meta HOTMAIL_SPAM_GY (__HOTMAIL_SPX1 __HOTMAIL_SPX2) score HOTMAIL_SPAM_GY

Re: 3.3.0 wants to mkdir ~/.spamassassin for userprefs - can this be turned off

2010-01-30 Thread Mark Martinec
On Saturday January 30 2010 06:17:14 Juergen Heberling wrote: All my userprefs are stored in SQL so I dont want a ~/.spamassassin directory. (My earlier version (3.1.7) did not attempt to do this.) I'm running spamd from rc.conf with spamd_flags=-Q -x -d -m 10 The attempt to create this

Re: Anyone Notice Spam Drop 11 Hours Ago?

2010-01-30 Thread Robert Schetterer
Am 30.01.2010 04:27, schrieb Andy Dorman: Today (Friday) around 1600 GMT, Jan 29, we experienced a large drop (almost 50%) in spam connections. And since then we have seen anywhere from 25% to 40% less spam volume than is normal. Anyone else see something similar? From what we have seen,

Re: Anyone Notice Spam Drop 11 Hours Ago?

2010-01-30 Thread Jean-Yves Avenard
2010/1/30 Andy Dorman ador...@ironicdesign.com: Today (Friday) around 1600 GMT, Jan 29, we experienced a large drop (almost 50%) in spam connections.  And since then we have seen anywhere from 25% to 40% less spam volume than is normal. Anyone else see something similar?  From what we have

How should this tricky spam be filtered?

2010-01-30 Thread Kārlis Repsons
People, perhaps its simple to be done, but I personally would like to know the ways to get rid of something like this: -- Forwarded Message -- Subject: marty rizin g suppe r socio logy mason ing Date: Friday 29 January 2010 From: Cheap Tamiflu on www.ra97.com

Re: How should this tricky spam be filtered?

2010-01-30 Thread Mike Cardwell
On 30/01/2010 13:35, Kārlis Repsons wrote: People, perhaps its simple to be done, but I personally would like to know the ways to get rid of something like this: -- Forwarded Message -- Subject: marty rizin g suppe r socio logy mason ing Date: Friday 29 January

Re: How should this tricky spam be filtered?

2010-01-30 Thread Jeff Mincy
From: Kārlis Repsons karlis.reps...@gmail.com Date: Sat, 30 Jan 2010 13:35:26 + People, perhaps its simple to be done, but I personally would like to know the ways to get rid of something like this: Use pastebin and save the entire message including the headers instead

Re: How should this tricky spam be filtered?

2010-01-30 Thread Kārlis Repsons
On Saturday 30 January 2010 13:51:18 Mike Cardwell wrote: By forwarding the email the way you have, your email client has stripped out most of the useful header information. Try pasting the message including the full set of headers into http://spamalyser.com/ or http://pastebin.com/ or similar

Re: How should this tricky spam be filtered?

2010-01-30 Thread Kārlis Repsons
On Saturday 30 January 2010 13:54:14 Jeff Mincy wrote: Retrain the message correctly in Bayes. Bayes will catch on to this after a few times. The subject alone should be a strong enough clue for bayes (I get BAYES_80 on this partial sample), so it looks like you are doing only autolearn and

Re: How should this tricky spam be filtered?

2010-01-30 Thread Jeff Mincy
From: Kārlis Repsons karlis.reps...@gmail.com Date: Sat, 30 Jan 2010 14:07:16 + On Saturday 30 January 2010 13:54:14 Jeff Mincy wrote: Retrain the message correctly in Bayes. Bayes will catch on to this after a few times. The subject alone should be a strong enough clue

Re: How should this tricky spam be filtered?

2010-01-30 Thread Martin Gregorie
On Sat, 2010-01-30 at 13:35 +, Kārlis Repsons wrote: People, perhaps its simple to be done, but I personally would like to know the ways to get rid of something like this: Apparently putting the spam's payload in the personal name part of the From: header is as old a trick as putting

Re: How should this tricky spam be filtered?

2010-01-30 Thread Dale Carstensen
The Postfix program users@spamassassin.apache.org: host mx1.us.apache.org[140.211.11.136] said: 552 spam score (10.4) exceeded threshold (in reply to end of DATA command) Karlis, That's what the list said about my reply to you. I guess the (I was going to write that

Re: How should this tricky spam be filtered?

2010-01-30 Thread Ralph Bornefeld-Ettmann
Am 30.01.2010 16:48, schrieb Jeff Mincy: From: K�rlis Repsons karlis.reps...@gmail.com Date: Sat, 30 Jan 2010 14:07:16 + On Saturday 30 January 2010 13:54:14 Jeff Mincy wrote: Retrain the message correctly in Bayes. Bayes will catch on to this after a few times.

Re: How should this tricky spam be filtered?

2010-01-30 Thread Kārlis Repsons
On Saturday 30 January 2010 15:48:36 Jeff Mincy wrote: BAYES_99,DCC_CHECK,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_FIVETEN_SPAM,RCVD_IN_NIX SPAM,RCVD_IN_UCEPROTECT1,RCVD_IN_UCEPROTECT2,RCVD_IN_UCEPROTECT3,BOTNET,BOT NET_BADDNS Botnet/FIVETEN/NIXSPAM/UCEPROTECT are additional rules added. -jeff

Re: How should this tricky spam be filtered?

2010-01-30 Thread Mike Cardwell
On 30/01/2010 17:14, Ralph Bornefeld-Ettmann wrote: I couldn't figure out how to get an unadulterated version of the message from the spamalyser.com link you posted in a previous message. I tried this wget -O - -q http://spamalyser.com/v/5cbffujq/original.txt pastebin has a simple way to

Re: How should this tricky spam be filtered?

2010-01-30 Thread Jari Fredriksson
On 30.1.2010 19:14, Ralph Bornefeld-Ettmann wrote: in the Raw Message tab you can get the plain message (http://spamalyser.com/v/5cbffujq/raw) It's not raw message, it has a line number on each row. -- http://www.iki.fi/jarif/ You may be recognized soon. Hide. signature.asc

Configuration Files (once was: Re: how can i finetune to spamassassin to handle spams)

2010-01-30 Thread Karsten Bräckelmann
On Sat, 2010-01-30 at 01:08 -0500, Alex wrote: Is this order documented anywhere? man spamassassin http://wiki.apache.org/spamassassin/FrontPage Internal Server Error Err, yeah. Same for http://wiki.apache.org/spamassassin/NoSuchPage and any other non-existent page it seems. Not nice,

Re: How should this tricky spam be filtered?

2010-01-30 Thread Kārlis Repsons
On Saturday 30 January 2010 16:55:54 Dale Carstensen wrote: The Postfix program users@spamassassin.apache.org: host mx1.us.apache.org[140.211.11.136] said: 552 spam score (10.4) exceeded threshold (in reply to end of DATA command) Karlis, That's what the list said

Re: How should this tricky spam be filtered?

2010-01-30 Thread RW
On Sat, 30 Jan 2010 19:25:15 +0200 Jari Fredriksson ja...@iki.fi wrote: On 30.1.2010 19:14, Ralph Bornefeld-Ettmann wrote: in the Raw Message tab you can get the plain message (http://spamalyser.com/v/5cbffujq/raw) It's not raw message, it has a line number on each row. Click on

Re: [SPAM:9.5] Re: Smut spam

2010-01-30 Thread Christian Brel
On Sat, 30 Jan 2010 12:59:10 -0500 Jared Hall jh...@tbi.net wrote: 2) Here are some ruleset extractions that might help you get over the hump. Comment if you must but be advised that I usually ignore them, good or bad. {snip} Thank you for taking the time to post them here - appreciated.

Re: Smut spam

2010-01-30 Thread Karsten Bräckelmann
On Sat, 2010-01-30 at 12:59 -0500, Jared Hall wrote: 1) Probably a good idea to remove hotmail.com, livejournal.com and whatever else suits you from the 25_uribl.cf ruleset. The line probably says: uridnsbl_skip_domain hallmark.com hinet.net hotbar.com hotmail.com I haven't seen an

Re: Smut spam

2010-01-30 Thread Jared Hall
These rules may be useful for taking care of Hotmail offenders. I believe the RelayCountry plugin can address that also, in a broad brush fashion. # Ruleset: jared_head.cf # Description: Jared's rules for SpamAssassin # Applicability: Southeastern US; service-oriented companies # Version: 01.021

Re: How should this tricky spam be filtered?

2010-01-30 Thread Jeff Mincy
From: Ralph Bornefeld-Ettmann ilike...@bornefeld-ettmann.de Date: Sat, 30 Jan 2010 18:14:10 +0100 Am 30.01.2010 16:48, schrieb Jeff Mincy: From: Kārlis Repsons karlis.reps...@gmail.com Date: Sat, 30 Jan 2010 14:07:16 + On Saturday 30 January 2010

Re: How should this tricky spam be filtered?

2010-01-30 Thread Jeff Mincy
From: Kārlis Repsons karlis.reps...@gmail.com Date: Sat, 30 Jan 2010 17:20:23 + On Saturday 30 January 2010 15:48:36 Jeff Mincy wrote: BAYES_99,DCC_CHECK,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_FIVETEN_SPAM,RCVD_IN_NIX

Magical mystery colon

2010-01-30 Thread Philip A. Prindeville
I ran yum update on my FC11 machine a couple of days ago, and now I'm getting nightly cron errors: plugin: failed to parse plugin (from @INC): syntax error at (eval 84) line 1, near require Mail::SpamAssassin: plugin: failed to parse plugin (from @INC): syntax error at (eval 148) line 1, near

Re: Magical mystery colon

2010-01-30 Thread Karsten Bräckelmann
On Sat, 2010-01-30 at 12:16 -0800, Philip A. Prindeville wrote: I ran yum update on my FC11 machine a couple of days ago, and now I'm getting nightly cron errors: Would be nice and maybe even helpful to know, what command(s) that cron job executes, don't you think? :) plugin: failed to parse

Re: Magical mystery colon

2010-01-30 Thread Aaron Wolfe
wow, based on the subject alone, I thought my SA had missed a very strange spam :) On Sat, Jan 30, 2010 at 3:16 PM, Philip A. Prindeville philipp_s...@redfish-solutions.com wrote: I ran yum update on my FC11 machine a couple of days ago, and now I'm getting nightly cron errors: plugin:

The ninjas have left the building (was Re: [Sare-users] painting everybody in Taiwan with the same brush)

2010-01-30 Thread Marc Sherman
Matija Nalis wrote: Also note that SARE Ninjas are long gone - see main page http://www.rulesemporium.com/. So nobody could fix those rules even if they thought it was a good idea (and at least some people are not convinced it is a bad idea); and even if the rules could be fixed, still at

_TOKENSUMMARY_ not working in 3.3.0?

2010-01-30 Thread Michael Schaap
Hi, I just upgraded from 3.2.5 to 3.3.0. I have the following custom header in my local.cf: add_header all Tokens _TOKENSUMMARY_\nHammy: _HAMMYTOKENS(5)_\nSpammy: _SPAMMYTOKENS(5)_ This always worked in 3.2.x, and resulted in a header like: X-Spam-Tokens: Tokens: new, 67; hammy, 79; neutral,

does amavis invoke spamassassin?

2010-01-30 Thread angela vulpio
Hi, I installed my mail server using ISPConfig3 on Ubntu9.10 Server... I'm interested in using the two-level spam treatment configuring SPAM tag level,SPAM tag2 level and SPAM kill level... The server works perfectly but the mail that it receives don't show the effects of the spamassassin's

Re: does amavis invoke spamassassin?

2010-01-30 Thread Karsten Bräckelmann
On Sat, 2010-01-30 at 23:37 +0100, angela vulpio wrote: I'm interested in using the two-level spam treatment configuring SPAM tag level,SPAM tag2 level and SPAM kill level... Sounds like amavisd-new to me. Yes, amavis does invoke SA on its own using the API, and does not need spamd (the vanilla

Re: does amavis invoke spamassassin?

2010-01-30 Thread Mark Martinec
Angela, I installed my mail server using ISPConfig3 on Ubntu9.10 Server... I'm interested in using the two-level spam treatment configuring SPAM tag level,SPAM tag2 level and SPAM kill level... The server works perfectly but the mail that it receives don't show the effects of the