Re: Abused accounts

On 3/15/2016 6:26 PM, John Hardin wrote: On Tue, 15 Mar 2016, Ted Mittelstaedt wrote: we have scripts checking any samples against current bayes classification and ignore them if they already have BAYES_99, Is this even necessary? I thought the learner automatically rejected everything

Re: Abused accounts

On Tue, 15 Mar 2016, Ted Mittelstaedt wrote: we have scripts checking any samples against current bayes classification and ignore them if they already have BAYES_99, Is this even necessary? I thought the learner automatically rejected everything already tagged. Already *learned*. There's

Re: Abused accounts

On 3/15/2016 2:48 PM, Reindl Harald wrote: Am 15.03.2016 um 22:24 schrieb Ted Mittelstaedt: Baloney - spamoney!!! I do not use autolearning, and ALL my spam is either hand-selected or it comes from honeypot addresses that have NEVER been on my domains - I get these honeypot addresses by

Bayes expiry vs. sync, again

I am sorry to return to this horse which has perhaps been beaten enough. But I still don't know and don't understand (_after_ reading the docs) if I can, at the same time: 1. completely disable expiry 2. force a sync of the journal I just saw with my own eyes that passing --sync to sa-learn

Re: Abused accounts

On 3/15/2016 5:14 PM, Reindl Harald wrote: a lot of nosense * nobody is talking about throw away *any* other rules Uh, why yes, they are: "Some other systems such as isnotspam.com caught some SA rule which DOESENT EXIST ANYMORE in latest SA." sure seems like SOMEONE IS talking about

Re: Abused accounts

Am 15.03.2016 um 22:15 schrieb Ted Mittelstaedt: It's foolish to throw away working rulesets and put all your eggs in the Bayes basket. Bayes is not a panacea. I kind of feel there is a NIH mentality among the spamassassin maintainers when it comes to rulesets a lot of nosense * nobody is

Re: Abused accounts

On Tue, 15 Mar 2016 14:15:53 -0700 Ted Mittelstaedt wrote: > It's foolish to throw away working rulesets and put all your eggs in > the Bayes basket. Bayes is not a panacea. I kind of feel there is a > NIH mentality among the spamassassin maintainers when it comes to > rulesets - it's like "we

Re: Abused accounts

Am 15.03.2016 um 22:24 schrieb Ted Mittelstaedt: Baloney - spamoney!!! I do not use autolearning, and ALL my spam is either hand-selected or it comes from honeypot addresses that have NEVER been on my domains - I get these honeypot addresses by scanning the mail log and looking for guesses by

Fwd: Re: Abused accounts

Baloney - spamoney!!! I do not use autolearning, and ALL my spam is either hand-selected or it comes from honeypot addresses that have NEVER been on my domains - I get these honeypot addresses by scanning the mail log and looking for guesses by spammers - when I see a popular address in the

Re: Abused accounts

On 3/15/2016 2:01 PM, David B Funk wrote: IE, out of the 130KB of that message, only a few dozen bytes is actually the spam 'payload' and thus Bayes wise gets swamped by the O365 noise. I'm considering tagging most of the O365 headers with bayes_ignore_header. Anybody else wrestling with

Re: Abused accounts

Am 15.03.2016 um 22:01 schrieb David B Funk: Actually this is one case where Bayes may not be a help. Our campus recently outsourced almost all users to O365. As a consequence our Bayes gets a -lot- of ham from O365 and therefore has most of its fingerprints tagged as ham. Thus it takes a very

Re: Abused accounts

On Tue, 15 Mar 2016, Kris Deugau wrote: Robert Boyl wrote: Hi, everyone Please check http://pastebin.com/GUBqpyZ8 Interesting how some spams that abuse some legit account such as this one are hard to detect, how Spamassassin scores almost nothing although there are spammy works, etc. System

Re: Help understanding TxRep errors.

On Wed, 16 Mar 2016 08:55:46 +1300 Philip wrote: > After turning on TxRep I get these lines in my /var/log/spamd.log > file. > > Wed Mar 16 08:21:55 2016 [16629] warn: Use of uninitialized value > $msgscore in addition (+) at /etc/spamassassin/TxRep.pm line 1414. > Wed Mar 16 08:21:55 2016

Help understanding TxRep errors.

After turning on TxRep I get these lines in my /var/log/spamd.log file. Wed Mar 16 08:21:55 2016 [16629] warn: Use of uninitialized value $msgscore in addition (+) at /etc/spamassassin/TxRep.pm line 1414. Wed Mar 16 08:21:55 2016 [16629] warn: Use of uninitialized value $msgscore in

Re: Abused accounts

-- Charles Sprickman NetEng/SysAdmin Bway.net - New York's Best Internet www.bway.net sp...@bway.net - 212.982.9800 > On Mar 15, 2016, at 12:28 PM, Reindl Harald wrote: > > > > Am 15.03.2016 um 17:07 schrieb Robert Boyl: >> Hi, everyone >> >> Please check

Re: Missed spam, suggestions?

On Fri, 11 Mar 2016, Robert Chalmers wrote: Found a copy here … http://www.impsec.org/~jhardin/antispam/sa-stats.pl Note that I also host a version that works with gzipped log files, if you have compression enabled in your log rotator. But that's not the latest. I don't know where the

Re: Abused accounts

Am 15.03.2016 um 17:07 schrieb Robert Boyl: Hi, everyone Please check http://pastebin.com/GUBqpyZ8 Interesting how some spams that abuse some legit account such as this one are hard to detect, how Spamassassin scores almost nothing although there are spammy works, etc. System caught

Re: Abused accounts

Robert Boyl wrote: > Hi, everyone > > Please check http://pastebin.com/GUBqpyZ8 > > Interesting how some spams that abuse some legit account such as this > one are hard to detect, how Spamassassin scores almost nothing although > there are spammy works, etc. System caught DCC_CHECK 1.10. > >

Abused accounts

Hi, everyone Please check http://pastebin.com/GUBqpyZ8 Interesting how some spams that abuse some legit account such as this one are hard to detect, how Spamassassin scores almost nothing although there are spammy works, etc. System caught DCC_CHECK 1.10. Some other systems such as