Re: Sought False Positives

2010-11-09 Thread Justin Mason
guys, feel free to mail me samples (offlist) of sought FPs -- ideally, as mboxes. it's easy enough to add them to the training process. --j. On Mon, Nov 8, 2010 at 22:54, mouss mo...@ml.netoyen.net wrote: Le 20/08/2010 17:12, Jan P. Kessler a écrit :  Hi, we use spamassassin with the

Re: Sought False Positives

2010-11-09 Thread Benny Pedersen
On tir 09 nov 2010 10:39:55 CET, Justin Mason wrote guys, feel free to mail me samples (offlist) of sought FPs -- ideally, as mboxes. it's easy enough to add them to the training process. add Mail::SpamAssassin::MailingList check to sought not solving it ? -- xpoint

Re: Bad pattern in HELO_DYNAMIC_IPADDR check?

2010-11-09 Thread Angel L. Mateo
El 08/11/10 12:31, Matus UHLAR - fantomas escribió: On Thu, 28 Oct 2010, Angel L. Mateo wrote: Is there any reason for this pattern being so general? Or this is a bug? El 28/10/10 15:03, John Hardin escribió: IPv4 addresses are numbers (uint4 to be precise), dotted quad notation is just the

Re: pattern problem

2010-11-09 Thread Matus UHLAR - fantomas
On 05.11.10 12:28, RW wrote: It's not all that safe to deep-parse XBL because it's mostly dynamically assigned IP addresses. On Fri, 5 Nov 2010 14:38:45 +0100 Matus UHLAR - fantomas uh...@fantomas.sk wrote: the PBL from ZEN is mostly dynamically assigned. the XBL means exploits

Re: SA 3.3.1 and NetAddr::IP 4.034

2010-11-09 Thread Mark Martinec
On Tuesday November 9 2010 09:29:57 Marcin Mirosław wrote: Trying 66.232.79.143... Connected to mail.redfish-solutions.com. 554 mail.redfish-solutions.com ESMTP not accepting messages (the message is now sitting in our queue, retrying periodically) Just from curiosity, You mail

Re: Sought False Positives

2010-11-09 Thread Bowie Bailey
On 11/8/2010 6:04 PM, Lawrence @ Rogers wrote: On 08/11/2010 12:06 PM, Ned Slider wrote: Fair enough - fortunately I've not seen any of those here so assumed a genuine facebook mail had maybe slipped through into the corpus by mistake. Either way, it was fixed by the time I'd spotted it.

Re: Sought False Positives

2010-11-09 Thread Jared Hall
Bowie Bailey wrote: I haven't seen a lot of false positives, but you're right that they are not hitting much spam. I just checked my logs for the past two weeks and the Sought rules have hit on just over 1% of my spam. They used to be the top rules in my list. What happened? Concur.

sa-learn problems and comprehension question

2010-11-09 Thread Karl Meyer
Hi, I want to configure bayes learning and still having some problems and questions after reading several tutorials: I executed sa-learn for my inbox # su -c /usr/bin/sa-learn --dbpath /var/amavis/.spamassassin/bayes/ --ham --showdots /var/spool/imap/user/kmeyer/[0-9]*. amavis and got a

Re: Sought False Positives

2010-11-09 Thread Justin Mason
On Tue, Nov 9, 2010 at 14:24, Bowie Bailey bowie_bai...@buc.com wrote: On 11/8/2010 6:04 PM, Lawrence @ Rogers wrote: On 08/11/2010 12:06 PM, Ned Slider wrote: Fair enough - fortunately I've not seen any of those here so assumed a genuine facebook mail had maybe slipped through into the

Re: sa-learn problems and comprehension question

2010-11-09 Thread Marcin Mirosław
W dniu 09.11.2010 17:14, Karl Meyer pisze: Hi, I want to configure bayes learning and still having some problems and questions after reading several tutorials: I executed sa-learn for my inbox # su -c /usr/bin/sa-learn --dbpath /var/amavis/.spamassassin/bayes/ --ham --showdots

Re: Sought False Positives

2010-11-09 Thread Bowie Bailey
On 11/9/2010 11:14 AM, Justin Mason wrote: On Tue, Nov 9, 2010 at 14:24, Bowie Bailey bowie_bai...@buc.com wrote: I just checked my logs for the past two weeks and the Sought rules have hit on just over 1% of my spam. They used to be the top rules in my list. What happened? Sorry about

Re: sa-learn problems and comprehension question

2010-11-09 Thread Bowie Bailey
On 11/9/2010 11:16 AM, Marcin Mirosław wrote: W dniu 09.11.2010 17:14, Karl Meyer pisze: Hi, I want to configure bayes learning and still having some problems and questions after reading several tutorials: I executed sa-learn for my inbox # su -c /usr/bin/sa-learn --dbpath

Re: sa-learn problems and comprehension question

2010-11-09 Thread Karsten Bräckelmann
On Tue, 2010-11-09 at 08:14 -0800, Karl Meyer wrote: # su -c /usr/bin/sa-learn --dbpath /var/amavis/.spamassassin/bayes/ --ham The --dbpath option is bad. Despite its name, it is not a path, but a prefix. The sa-update man page states it is in bayes_path form, which is documented in the general

Re: sa-learn problems and comprehension question

2010-11-09 Thread Marcin Mirosław
W dniu 2010-11-09 17:24, Bowie Bailey pisze: If you learn a message as ham, it will not learn the same message as ham a second time (same with spam). However, you can change your mind and learn the message as spam. Bayes will forget what it learned the first time and re-learn the message.

Yahoo webmail spam from Africa

2010-11-09 Thread Philip Prindeville
Has anyone else noticed that if they get a message with: Received: from [41.184.9.153] by web80007.mail.sp1.yahoo.com via HTTP; Sat, 06 Nov 2010 09:52:53 PDT i.e. from the 41.0.0.0/8 CIDR block from Africa, and the transport was HTTP, to anything ending with yahoo.com that 100% of the time

Re: Yahoo webmail spam from Africa

2010-11-09 Thread Alexandre Chapellon
Yes I got some 2 weeks ago. It was more phishing than spam. It was really targeted to my customers, asking them to provide login/passwords of their mailbox in order to avoid de-activation of their mailbox (of course not true). Here is a snippet of logs: Received: from [41.189.54.185] by

Re: Yahoo webmail spam from Africa

2010-11-09 Thread Ned Slider
On 09/11/10 21:31, Philip Prindeville wrote: Has anyone else noticed that if they get a message with: Received: from [41.184.9.153] by web80007.mail.sp1.yahoo.com via HTTP; Sat, 06 Nov 2010 09:52:53 PDT i.e. from the 41.0.0.0/8 CIDR block from Africa, and the transport was HTTP, to anything

Re: sa-learn problems and comprehension question

2010-11-09 Thread Karl Meyer
Marcin Mirosław wrote: and got a message, that it learned from n messages. Also in the dbpath foder two files appeared. After I got 15 new mails in my inbox, I executed the same command again. But this time it didn't learned. Sa-learn remember msgid message which has been learned, it

Does anyone known the braindead anti-spam software MagicSpam ?

2010-11-09 Thread Per Jessen
I got the following reject this morning: book...@example.com: host mail.example.com[1.2.3.4] said: 550 Dynamic Style reverse DNS IP=[212.25.14.40].Rejected by MagicSpam 1.0.4-9.1 (http://www.magicspam.com/). Do a reverse look up of 212.25.14.40, and you'll see that it's perfectly

Re: sa-learn problems and comprehension question

2010-11-09 Thread Marcin Mirosław
W dniu 2010-11-10 07:37, Karl Meyer pisze: But the 15 new messages weren't learnd yet. I had 10 messages in my inbox and run sa-learn on that folder. Then I got 15 different new messages and re-run sa-learn again. But it said that it learned from 0 messages. Do you run SA from smtp server?