SPF_HELO_PASS on a spam message?

2010-05-28 Thread theTree
Hi, I received a spam email that scored zero on the SpamAssassin score. I think it may be to do with the SPF_HELO_PASS that it scored - would someone be able to give me some pointers? Many thanks! I've swapped out my domain for @mydomain.com, and our mail server for my.mail.server. Below is the

Re: SPF_HELO_PASS on a spam message?

2010-05-28 Thread Matus UHLAR - fantomas
On 28.05.10 01:25, theTree wrote: I received a spam email that scored zero on the SpamAssassin score. I think it may be to do with the SPF_HELO_PASS that it scored no. - would someone be able to give me some pointers? you may be an early recipient, that received spam before it got to

Re: SPF_HELO_PASS on a spam message?

2010-05-28 Thread theTree
Matus, Thanks for the swift reply, I'll take your advice. I do find it peculiar though that a message with a subject of 'Shiny Posh Slut' and body text of 'Hardcore Blonde MILF Video' has to reply on blacklists etc. I thought systems such as the Bayesian filter would take notice of such a

Re: SPF_HELO_PASS on a spam message?

2010-05-28 Thread Matus UHLAR - fantomas
On 28.05.10 02:18, theTree wrote: Thanks for the swift reply, I'll take your advice. I do find it peculiar though that a message with a subject of 'Shiny Posh Slut' and body text of 'Hardcore Blonde MILF Video' has to reply on blacklists etc. I thought systems such as the Bayesian filter would

Re: SPF_HELO_PASS on a spam message?

2010-05-28 Thread RW
On Fri, 28 May 2010 01:25:44 -0700 (PDT) theTree tomb8...@gmail.com wrote: Hi, I received a spam email that scored zero on the SpamAssassin score. I think it may be to do with the SPF_HELO_PASS That only has a nominal score. that it scored - would someone be able to give me some

Re: bayes_learn_to_journal 1 (should we eliminate journaling) - subject oops

2010-05-28 Thread Matt Kettler
On 5/27/2010 11:50 PM, Matt Kettler wrote: On 5/27/2010 11:53 AM, Matt wrote: Does 'bayes_learn_to_journal 1' in local.cf do anything yet? I thought in past it helped save on disk I/O Matt FYI, please ignore the should we ignore journaling. My original version of the email

Re: SPF_HELO_PASS on a spam message?

2010-05-28 Thread Charles Gregory
On Fri, 28 May 2010, theTree wrote: I received a spam email that scored zero on the SpamAssassin score. I think it may be to do with the SPF_HELO_PASS that it scored - would someone be able to give me some pointers? I can't be certain with the munged headers, but it looks like you are

Attached Spam Messages

2010-05-28 Thread Kaleb Hosie
Hey Everyone, We've been having a problem with emails that are completely blank except for an attached .rtf file which is where the spam message is. Is there a way of decoding that file and feeding it to bayes? Thanks for your help. Kaleb smime.p7s Description: S/MIME cryptographic signature

RE: Attached Spam Messages

2010-05-28 Thread Thomas Mullins
I am having the same issue, In fact, I was going to post the same exact question. Thanks Shane -Original Message- From: Kaleb Hosie [mailto:kho...@spectraaluminum.com] Sent: Friday, May 28, 2010 1:05 PM To: users@spamassassin.apache.org Subject: Attached Spam Messages Hey Everyone,

RE: Attached Spam Messages

2010-05-28 Thread John Hardin
On Fri, 28 May 2010, Thomas Mullins wrote: I am having the same issue, In fact, I was going to post the same exact question. -Original Message- From: Kaleb Hosie [mailto:kho...@spectraaluminum.com] We've been having a problem with emails that are completely blank except for an

RE: Attached Spam Messages

2010-05-28 Thread Karsten Bräckelmann
On Fri, 2010-05-28 at 12:54 -0700, John Hardin wrote: It's becoming much more prevalent. I'm seeing lots of 419 and phishing spams as .txt and .html attachments, more rarely .doc or .rtf. Writing an extractor for .txt attachments is trivial, and it shouldn't be too hard to do HTML. RTF and

Re: How to remove a domain from a stock or third-party 2tld ruleset?

2010-05-28 Thread Karsten Bräckelmann
On Wed, 2010-05-26 at 11:35 -0400, Kris Deugau wrote: Is there any way to take a domain listed with util_rb_2tld, and un-2tld it (similar to how you can unwhitelist stock whitelist entries if they don't work well with your mail)? IIRC this is not possible. Well, possible, but there's just no

RE: Attached Spam Messages

2010-05-28 Thread Kaleb Hosie
On Fri, 2010-05-28 at 12:54 -0700, John Hardin wrote: It's becoming much more prevalent. I'm seeing lots of 419 and phishing spams as .txt and .html attachments, more rarely .doc or .rtf. Writing an extractor for .txt attachments is trivial, and it shouldn't be too hard to do

Re: Attached Spam Messages

2010-05-28 Thread Karsten Bräckelmann
On Fri, 2010-05-28 at 13:05 -0400, Kaleb Hosie wrote: We've been having a problem with emails that are completely blank except for an attached .rtf file which is where the spam message is. Err, do you *really* mean attached? If so, provide a sample. Otherwise I guess you are actually talking

RE: Attached Spam Messages

2010-05-28 Thread John Hardin
On Fri, 28 May 2010, Karsten Br?ckelmann wrote: On Fri, 2010-05-28 at 12:54 -0700, John Hardin wrote: It's becoming much more prevalent. I'm seeing lots of 419 and phishing spams as .txt and .html attachments, more rarely .doc or .rtf. Writing an extractor for .txt attachments is trivial,

Re: How to remove a domain from a stock or third-party 2tld ruleset?

2010-05-28 Thread Kris Deugau
Karsten Bräckelmann wrote: On Wed, 2010-05-26 at 11:35 -0400, Kris Deugau wrote: Is there any way to take a domain listed with util_rb_2tld, and un-2tld it (similar to how you can unwhitelist stock whitelist entries if they don't work well with your mail)? IIRC this is not possible. Well,

Re: How to remove a domain from a stock or third-party 2tld ruleset?

2010-05-28 Thread Yet Another Ninja
On 2010-05-28 23:57, Kris Deugau wrote: Karsten Bräckelmann wrote: On Wed, 2010-05-26 at 11:35 -0400, Kris Deugau wrote: Is there any way to take a domain listed with util_rb_2tld, and un-2tld it (similar to how you can unwhitelist stock whitelist entries if they don't work well with your

RE: Attached Spam Messages

2010-05-28 Thread Karsten Bräckelmann
On Fri, 2010-05-28 at 14:55 -0700, John Hardin wrote: On Fri, 28 May 2010, Karsten Bräckelmann wrote: Err, unless I am terribly mistaken and didn't interpret the docs correctly (too lazy to test) -- SA always uses any textual part. That includes plain text and HTML attached to the