Re: BOTNET timeouts?

2009-06-10 Thread Bill Landry
Jake Maul wrote: Interesting that I'm just now running into this... I've been using Botnet on this server for several months without issue. Thanks for the link, shorter timeouts should cure it. :) Even though Mark Martinec had provided John Rudd with a nice, neat patch for botnet.pm well

Re: BOTNET timeouts?

2009-06-10 Thread Bill Landry
John Rudd wrote: On Wed, Jun 10, 2009 at 21:11, Bill Landryb...@inetmsg.com wrote: Jake Maul wrote: Interesting that I'm just now running into this... I've been using Botnet on this server for several months without issue. Thanks for the link, shorter timeouts should cure it. :) Even though

Re: BOTNET timeouts?

2009-06-11 Thread Bill Landry
McDonald, Dan wrote: On Wed, 2009-06-10 at 21:40 -0700, John Rudd wrote: On Wed, Jun 10, 2009 at 21:11, Bill Landryb...@inetmsg.com wrote: Jake Maul wrote: Interesting that I'm just now running into this... I've been using Botnet on this server for several months without issue. Thanks for

Re: BOTNET timeouts?

2009-06-11 Thread Bill Landry
I've had no trouble with Botnet timeouts, but just now patched anyway, to avoid any potential trouble. I, and many others appreciate how responsive you've been with your sanesecurity work, but not everyone has the same resources. Whenever I install GNU free software, I have to remember this.

Re: BOTNET timeouts?

2009-06-11 Thread Bill Landry
Well I suppose you could always take the product that you dislike so badly back to the store and ask for a refund of your purchase price. Sometimes it really amazes me how much, and how severely, some people will gripe about free products that exist only because other people volunteer their

Re: BOTNET timeouts?

2009-06-11 Thread Bill Landry
This issue has been unresolved for way too long. All of this, in my mind, this makes the plugin orphaned and unusable if not patched with Mark's patch. Actually it's a patch by Daniel J McDonald from 2007-06-15. I just refreshed it for 0.8 and reposted it two months later. Credits where

Re: BOTNET timeouts?

2009-06-13 Thread Bill Landry
I just love these kinds of responses (talk about 5yo tantrums), as they only server to prove my point about your credibility and the value of your opinions. Thank you! :-) Bill Res wrote: On Thu, 11 Jun 2009, Bill Landry wrote: I'm sure John might be happier to stay awake later and work

Re: BOTNET timeouts?

2009-06-13 Thread Bill Landry
Res wrote: No because I seem to have reliable DNS and have never exhibited the issue. Oh, and if in fact you really had a clue, you would know that DNS reliability has absolutely nothing to do with this issue... ;-) Bill

Re: BOTNET timeouts?

2009-06-13 Thread Bill Landry
John Rudd wrote: Further, Bill, I don't answer to you for my time constraints. Now quit your whining and put your money where your mouth is. If it's so important, then provide a fix that replaces Net::DNS with SA's internal DNS routines, and I'll use it. If it's not important enough to

Re: BOTNET timeouts?

2009-06-13 Thread Bill Landry
Benny Pedersen wrote: On Sat, June 13, 2009 14:31, Bill Landry wrote: However, if you are willing to release something to the open source community, you should also be willing to take on the responsibility of providing ongoing support for it. who says that ?, i have maybe missunderstod gpl

Re: BOTNET timeouts?

2009-06-13 Thread Bill Landry
Res wrote: On Sat, 13 Jun 2009, Bill Landry wrote: I just love these kinds of responses (talk about 5yo tantrums), as they only server to prove my point about your credibility and the value of your opinions. Thank you! :-) truth hurts dont it landry, just like i tell those who demand

Re: [sa] Re: BOTNET timeouts?

2009-06-14 Thread Bill Landry
Res wrote: On Sat, 13 Jun 2009, Charles Gregory wrote: On Sun, 14 Jun 2009, Res wrote: Though now its Sunday, I have socialising to do, and none of that includes sitting on mailing lists listening to cry babies who expect people involved in OSSP's to drop everything and be their servants.

Re: List headers and footers [Re: Unsubscribe]

2009-06-14 Thread Bill Landry
David Gibbs wrote: mouss wrote: - mail admin at example.com configures his mail system to sign all outbound mail with DKIM - he rejects any mail with a From: in his domain if it doesn't have a valid DKIM signature - j...@example.com posts to a list that appends a footer (or munges the

Re: List headers and footers [Re: Unsubscribe]

2009-06-14 Thread Bill Landry
David Gibbs wrote: Bill Landry wrote: This may be true if the sender were adding the footer before signing and sending the message to the list. However, not true if it's the mailing list that is adding the footer after the original sender has already signed the message. As I understand

Re: List headers and footers [Re: Unsubscribe]

2009-06-14 Thread Bill Landry
Chris Owen wrote: On Jun 14, 2009, at 8:10 PM, Bill Landry wrote: Mailman has specific functionality to remove signature headers so that the message can be resigned as it's sent out. If that happens then the message is no longer signed by the original sender, but rather by the mailing

Re: some URIBL accidentally listed .org?

2009-06-15 Thread Bill Landry
ram wrote: On Mon, 2009-06-15 at 15:35 +1000, Con Tassios wrote: On Mon, 15 Jun 2009, Chip M. wrote: DOB (Day Old Bread) had the same problem last year: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200810.mbox/%3cva.33f1.14690...@news.conactive.com%3e With software bugs,

Re: [sa] Re: BOTNET timeouts?

2009-06-15 Thread Bill Landry
Bill Landry a écrit : Res wrote: On Sat, 13 Jun 2009, Charles Gregory wrote: On Sun, 14 Jun 2009, Res wrote: Though now its Sunday, I have socialising to do, and none of that includes sitting on mailing lists listening to cry babies who expect people involved in OSSP's to drop everything

Re: List headers and footers [Re: Unsubscribe]

2009-06-16 Thread Bill Landry
mouss wrote: Mailman has specific functionality to remove signature headers so that the message can be resigned as it's sent out. which doesn't help, because if I get mail claiming to come From: mo...@netoyen.net, yet it doesn't have a sig of mine, I don't really care if some fancy mailman

Re: Image spam is back

2009-08-23 Thread Bill Landry
Giampaolo Tomassoni wrote: Are you experiencing the same? Some of them are even sleeping through FuzzyOcr. Any tuning to suggest? Yes, shake them as they are passing through FuzzyOcr, that should wake them up so that FuzzyOcr can detect them as they pass through... ;-) Bill

Re: Non scoring 'Bank Deposit' spam

2009-09-14 Thread Bill Landry
Clunk Werclick wrote: On Mon, 2009-09-14 at 08:05 -0600, LuKreme wrote: On 14-Sep-2009, at 05:24, --[ UxBoD ]-- wrote: If the OP cannot refrain from that sort of foul language when presented with counter arguments then please ban. The list would be far happier IMHO. Based on his reply

Re: .cn domain age query?

2009-09-14 Thread Bill Landry
On Mon, 14 Sep 2009, Warren Togami wrote: One thing they all have in common is their registration dates are very young according to whois lookups. It seems in general if we had a reliable way to lookup domain age we might be able to differentiate spam. What's the current status of the Day

Re: Non scoring 'Bank Deposit' spam

2009-09-14 Thread Bill Landry
--[ UxBoD ]-- wrote: - Clunk Werclick mailbacku...@googlemail.com wrote: | On Mon, 2009-09-14 at 19:52 +0100, --[ UxBoD ]-- wrote: | - Benny Pedersen m...@junc.org wrote: | | | On man 14 sep 2009 16:54:39 CEST, Bill Landry wrote | | So how far does someone have to go before

Re: Non scoring 'Bank Deposit' spam

2009-09-14 Thread Bill Landry
Clunk Werclick wrote: On Mon, 2009-09-14 at 20:38 +0100, --[ UxBoD ]-- wrote: - Clunk Werclick mailbacku...@googlemail.com wrote: | On Mon, 2009-09-14 at 19:52 +0100, --[ UxBoD ]-- wrote: | - Benny Pedersen m...@junc.org wrote: | | | On man 14 sep 2009 16:54:39 CEST, Bill Landry

Re: Moderation? (was: Drivel)

2009-09-15 Thread Bill Landry
On Tue, 2009-09-15 at 18:34 -0400, Charles Gregory wrote: I had considered this, but another poster made the worthy point that the (ab)user in question was likely the sort to get another fake address just so they could keep posting their crud. Sometimes 'ignore them' is the simplest and best

Re: Moderation? (was: Drivel)

2009-09-15 Thread Bill Landry
On Tue, 2009-09-15 at 18:34 -0400, Charles Gregory wrote: I had considered this, but another poster made the worthy point that the (ab)user in question was likely the sort to get another fake address just so they could keep posting their crud. Sometimes 'ignore them' is the simplest and

Re: Moderation?

2009-09-15 Thread Bill Landry
Karsten Bräckelmann wrote: On Tue, 2009-09-15 at 16:36 -0700, Bill Landry wrote: Yes, the buzzard has also displayed the same abusive nature under his other email address many times in the past. He uses the same email client (X-Mailer: Evolution 2.24.3), the same reference in his Message-Id

Re: Problems with whitelist_from_rcvd

2009-10-02 Thread Bill Landry
John Hardin wrote: On Fri, 2 Oct 2009, Igor Bogomazov wrote: whitelist_from_rcvd s...@domain.mail prefix.domain.mail doesn't work. I've checked rDNS of the prefix.domain.mail with 'host' utility - it's all right. You don't check rDNS using host, you check it using dig -x

[Fwd: ** IMPORTANT: Karmasphere Reputation Service End of Life ***]

2009-11-04 Thread Bill Landry
Just FYI, in case you might be using the Karmasphere plug-in with Spamassassin. Bill Original Message Subject: ** IMPORTANT: Karmasphere Reputation Service End of Life *** Date: Mon, 2 Nov 2009 19:31:55 + (GMT) From: D J Stewart d...@karmasphere.com To:

Re: Regex Question

2009-11-10 Thread Bill Landry
Ralf Hildebrandt wrote: * Benny Pedersen m...@junc.org: On tir 10 nov 2009 15:26:43 CET, rich...@buzzhost.co.uk wrote Please keep this in your mind in future before trotting out that tired old gas. imho Ralf have never being banned in maillist here, if you dont like his answers just

Re: emailreg.org - tainted white list

2009-12-14 Thread Bill Landry
Christian Brel, AKA rich...@buzzhost.co.uk (among other aliases), is back... Bill

Re: About upgrading

2010-01-10 Thread Bill Landry
LuKreme wrote: On 9-Jan-2010, at 21:23, Rosenbaum, Larry M. wrote: It's the number of seconds since the epoch (Jan 1, 1970). One easy way to convert it to a readable time is # perl -e 'print scalar localtime 1263044805, \n' Sat Jan 9 08:46:45 2010 Or even simpler: perl -le 'print

Re: About upgrading

2010-01-10 Thread Bill Landry
Rosenbaum, Larry M. wrote: -Original Message- From: Bill Landry [mailto:b...@inetmsg.com] Sent: Sunday, January 10, 2010 12:42 PM To: users@spamassassin.apache.org Subject: Re: About upgrading LuKreme wrote: On 9-Jan-2010, at 21:23, Rosenbaum, Larry M. wrote: It's the number

Re: SpamAssassin 3.3.0, Botnet FP with IPv6

2010-01-29 Thread Bill Landry
Mark Martinec wrote: On Thursday 28 January 2010 14:40:56 Graham Murray wrote: Since upgrading to SA 3.3.0, botnet (version 0.8) is showing a false positive on every email I receive via IPv6. Has anyone contacted the author? As most here on the list know: Good luck with that. From what

Botnet KING arrested...

2007-10-03 Thread Bill Landry
Saw this posted on another list: http://sunbeltblog.blogspot.com/2007/10/botmaster-busted.html United States Attorney McGregor W. Scott announced today the arrest of GREG KING, 21, of Fairfield, California, and...

Re: [sa-list] Re: Auto-RBL was: Why did this not hit more? (SPF, DKIM, Ironport,

2007-10-08 Thread Bill Landry
Dan Mahoney, System Admin wrote: On Mon, 8 Oct 2007, Rob McEwen wrote: Therefore, I recommend that you re-think your choices here! Don't let your quest for guaranteed long-term perfection keep you from making **substantial** progress today! Rob, Then help rally the SA team to include

Re: LashBack URL / BL?

2007-10-11 Thread Bill Landry
Kris Deugau wrote: Mikael Syska wrote: I'm not sure about all the diff black list options ... but I guess it would be rather easy to test it . header RCVD_IN_LASHBACK eval:check_rbl('LASHBACK','ubl.unsubscore.com') describe RCVD_IN_LASHBACK lashback tflags RCVD_IN_LASHBACK net score

Re: Check $HOME for an ever growing razor-agent.log

2007-10-19 Thread Bill Landry
[EMAIL PROTECTED] wrote the following on 10/18/2007 11:01 PM -0800: Check your $HOME for an ever growing ~/razor-agent.log apparently brought in by sa-update two days ago, which will one day fill your disk, according to a web search. How to tell it that just like the other 99% of

Re: Top spam hosters, how to decline email mentioning them

2007-10-20 Thread Bill Landry
Igor Chudov wrote the following on 10/20/2007 9:27 PM -0800: I was looking at this article http://en.wikipedia.org/wiki/E-mail_spam It claims that only five countries are hosting 99.68% of the global spammer websites, of which the foremost is China, hosting 73.58% of all web sites

Re: Top spam hosters, how to decline email mentioning them

2007-10-21 Thread Bill Landry
JP Kelly wrote the following on 10/21/2007 11:41 AM -0800: this looks interesting to me as well i am a little confused about how to use/install it on the page you provided a link to it says under USAGE to add the following to your local.cf file loadplugin

Re: Top spam hosters, how to decline email mentioning them

2007-10-22 Thread Bill Landry
Nigel Frankcom wrote the following on 10/21/2007 11:22 PM -0800: On Sat, 20 Oct 2007 23:27:41 -0500, Igor Chudov [EMAIL PROTECTED] wrote: I was looking at this article http://en.wikipedia.org/wiki/E-mail_spam It claims that only five countries are hosting 99.68% of the global spammer

Re: Perl problem (Scalar::Util)

2008-02-29 Thread Bill Landry
Steven Stern wrote: I'm getting the following error from various perl programs: $sa-update Use of uninitialized value in concatenation (.) or string at /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi/Scalar/Util.pm line 30. OK... maybe we need an update: [EMAIL PROTECTED] ~]# perl -MCPAN

Re: Can SA be used to implement greylisting?

2006-06-19 Thread Bill Landry
- Original Message - From: Steven W. Orr [EMAIL PROTECTED] On Monday, Jun 19th 2006 at 11:40 -0400, quoth Chris Santerre: = = = -Original Message- = From: Steven W. Orr [mailto:[EMAIL PROTECTED] = Sent: Monday, June 19, 2006 9:08 AM = To: spamassassin-users = Subject: Can SA

Re: iXhash plugin docs updated, version for 3.0.x added.

2006-06-21 Thread Bill Landry
- Original Message - From: Dirk Bonengel [EMAIL PROTECTED] Hi list, just as the subject says: I added some stuff to http://wiki.apache.org/spamassassin/iXhash and - made it clear (I hope) what it actually does - added installation instructions - added a version that runs under

Re: SPF breaks email forwarding

2006-07-25 Thread Bill Landry
- Original Message - From: Thomas Lindell [EMAIL PROTECTED] I only recently got spamassassin up and running and am hardly an expert but can anyone explain to me exactly what spf is? See http://www.openspf.org/ for detailed information on SPF. Bill

Re: Image spams getting thru

2006-08-01 Thread Bill Landry
- Original Message - From: Jim Maul [EMAIL PROTECTED] John D. Hardin wrote: On Tue, 1 Aug 2006, Ramprasad wrote: How about sending 450 Please Try later to ever mail with an inline image and then somehow verify if it really comes back. (Obviously not my original idea :-) ) The

Re: Improved OCR Plugin with approximate matching

2006-08-09 Thread Bill Landry
- Original Message - From: Spamassassin List [EMAIL PROTECTED] To: users@spamassassin.apache.org Sent: Wednesday, August 09, 2006 2:26 PM Subject: Re: Improved OCR Plugin with approximate matching Spamassassin List wrote: decoder wrote: See

Re: breaking out: thinking abt the 'sa-update *VS* rdj' thread .. .

2006-08-16 Thread Bill Landry
- Original Message - From: Andy Jezierski There's a bunch of people in SARE (I don't know the actual number) focused on developing rules. Agreed. That's all they do is rules. Who knows how many ninja's are out there. Well, from what I recall, from when my kids were much

Re: Host Karma Database - white/yellow/black lists - looking for data

2006-08-17 Thread Bill Landry
- Original Message - From: [EMAIL PROTECTED] | Here's how you might use the lists if you have Exim: | | # Mark it White | warn dnslists = hostkarma.junkemailfilter.com=127.0.0.1 | set acl_c1 = white - dnswl - $sender_fullhost | # Mark it Yellow | warn dnslists =

Re: Host Karma Database - white/yellow/black lists - looking for data

2006-08-17 Thread Bill Landry
- Original Message - From: Marc Perkel [EMAIL PROTECTED] Mark, Since I don't use Exim, do you know how I can implement this to call from SA? Something like this would work: header __RCVD_IN_JMFILTER eval:check_rbl('JMFILTER', 'hostkarma.junkemailfilter.com.') describe

Re: Host Karma Database - white/yellow/black lists - looking for data

2006-08-18 Thread Bill Landry
- Original Message - From: Marc Perkel [EMAIL PROTECTED] wrote: | Here's how you might use the lists if you have Exim: | | # Mark it White | warn dnslists = hostkarma.junkemailfilter.com=127.0.0.1 | set acl_c1 = white - dnswl - $sender_fullhost | # Mark it Yellow | warn

Re: Spamassassin munging headers

2006-08-28 Thread Bill Landry
Title: Scalix message content Why would you hijack someone else's thread? If you are not going to at least response to the original question, then at least have the courtesy to start your own new message thread. Bill - Original Message - From: Nathan Brink To: users

Inetesting new URI ploy

2006-09-11 Thread Bill Landry
Just came across one of these in a spam message: bang Locals @ www.nowdatenow. com oopsy no space before com Oh what will they try next...? Bill

Re: Infuriating gif spam...

2006-09-26 Thread Bill Landry
- Original Message - From: Steve [Spamassasin] [EMAIL PROTECTED] Jorge Valdes wrote: There are multiple images in these gifs, and because the first image is 'junk', sending this image through gocr will yield no results. The problem is that you have to scan all images to find the text.

Re: DNSBL mirrors

2010-02-27 Thread Bill Landry
On 2/27/2010 5:35 PM, João Gouveia wrote: Hi all, we are aiming to provide free usage of our DNSBL to the general anti spam community as soon as possible. However, in order to do this we would need to deploy more DNS mirrors or we risk providing a poor service due to the amount of DNS traffic

Re: DNSBL mirrors

2010-02-27 Thread Bill Landry
On 2/27/2010 6:42 PM, João Gouveia wrote: Hi Bill, - Bill Landryb...@inetmsg.com wrote: On 2/27/2010 5:35 PM, João Gouveia wrote: Hi all, we are aiming to provide free usage of our DNSBL to the general anti spam community as soon as possible. However, in order

Re: Block Spammers Spoofing My Domain

2010-02-28 Thread Bill Landry
On 2/28/2010 11:35 AM, Carlos Williams wrote: On Fri, Feb 26, 2010 at 4:38 PM, Benny Pedersenm...@junc.org wrote: I do the following but from my MTA. I don't know if you're using Postfix or Sendmail but I have the following 'helo_checks.pcre' in my Postfix directory: /^localhost$/

Re: is this right? uribl_dbl seems to have a very odd number

2010-03-03 Thread Bill Landry
On 3/3/2010 1:40 PM, Mike Cardwell wrote: On 03/03/2010 21:32, Michael Scheidell wrote: tracking down some FP's on Sa 3.3.0, they all hit URIBL_DBL. (every email hits that rule) # DBL, http://www.spamhaus.org/dbl/ . Note that hits return 127.0.1.x # A records, so we use a 32-bit mask to

Re: UPS Delivery problem

2010-03-03 Thread Bill Landry
On Wed, March 3, 2010 5:38 am, Jari Fredriksson wrote: On 3.3.2010 15:34, Jari Fredriksson wrote: On 3.3.2010 15:22, twofers wrote: I have 52 of these sitting in my inbox this morning when I came in to work. this is just the beginning. I get literally hundreds of these a day and Spamassassin

Re: UPS Delivery problem

2010-03-03 Thread Bill Landry
On Wed, March 3, 2010 5:20 pm, Karsten Bräckelmann wrote: On Wed, 2010-03-03 at 16:06 -0800, Bill Landry wrote: On Wed, March 3, 2010 5:38 am, Jari Fredriksson wrote: We're not going to re-hash one of the many discussions, err, heated flame-fests from the clamav and sanesecurity lists, are we

Re: spamassassin-3.3.1 RPM packages for Fedora and RHEL5

2010-03-22 Thread Bill Landry
On Mon, March 22, 2010 9:01 am, Bill Landry wrote: On 3/22/2010 4:31 AM, Kai Schaetzl wrote: Warren Togami wrote on Sun, 21 Mar 2010 22:13:10 -0400: I highly recommend NOT building the RPM package from the spec file contained within the spamassassin tarball. It has never been tested to work

Re: spamassassin-3.3.1 RPM packages for Fedora and RHEL5

2010-03-22 Thread Bill Landry
On Mon, March 22, 2010 10:31 am, Kai Schaetzl wrote: Bill Landry wrote on Mon, 22 Mar 2010 09:01:26 -0700: I tried it with Fedora 12 I didn't say anything about Fedora. But Warren certainly did in his original post. And BTW, he didn't say anything about CentOS is his original post

Re: Rules updates

2010-05-20 Thread Bill Landry
On Thu, May 20, 2010 4:26 pm, Benny Pedersen wrote: On fre 21 maj 2010 00:05:26 CEST, Michael Scheidell wrote On 5/20/10 6:00 PM, Robert Palmer wrote: I am running spamassassin version 3.2.4 and notice my rules have not updated (sa-update) for many months and I have started getting a lot of

Re: Spamhaus Whitelist

2010-11-06 Thread Bill Landry
On 11/5/2010 11:40 PM, Dan Mahoney, System Admin wrote: All, Has anyone come up with a ruleset yet to score against the new spamhaus whitelists, and deduct points appropriately? You could try something like: header SPAMHAUS_SWL eval:check_rbl('SPAMHAUS_SWL', 'swl.spamhaus.org.') describe

Re: Spamhaus Whitelist

2010-11-06 Thread Bill Landry
On 11/6/2010 12:19 AM, Bill Landry wrote: On 11/5/2010 11:40 PM, Dan Mahoney, System Admin wrote: All, Has anyone come up with a ruleset yet to score against the new spamhaus whitelists, and deduct points appropriately? You could try something like: header SPAMHAUS_SWL eval:check_rbl

Re: Spamhaus Whitelist

2010-11-06 Thread Bill Landry
On 11/6/2010 12:50 AM, David F. Skoll wrote: On Sat, 06 Nov 2010 00:41:53 -0700 Bill Landryb...@inetmsg.com wrote: You could also test the envelope sender: header SPAMHAUS_ENV eval:check_rbl_envfrom('SPAMHAUS_ENV', '_vouch.dwl.spamhaus.org.') But that's an abuse... you should not

Re: BOTNET rules question

2011-01-05 Thread Bill Landry
On 1/5/2011 5:11 PM, Mark Martinec wrote: Combining p0f with BOTNET is indended to *reduce* the high number of false positives that BOTNET alone produces, *at least* for the non-windows machines. The windows hosts are left alone and are not protected by p0f from BOTNET FP. If someone is scoring

The one year anniversary of the Spamhaus DBL brings a new zone

2011-03-08 Thread Bill Landry
FYI: Spamhaus created a new URL shortener/redirector zone in the DBL. See: http://www.spamhaus.org/news.lasso?article=667 Will Spamassassin be adding support for this new DBL shortener/redirector response code?: 127.0.1.3 spammed redirector domain For details, see:

Microsoft brings down major fake drug spam network

2011-03-18 Thread Bill Landry
No wonder I have seen such a huge drop in spam the past few days: http://timesofindia.indiatimes.com/tech/enterprise-it/security/Microsoft-brings-down-major-fake-drug-spam-network/articleshow/7734903.cms Anyone else been noticing the decrease in spam? Bill

Re: Microsoft brings down major fake drug spam network

2011-03-18 Thread Bill Landry
On 3/18/2011 5:08 PM, Michelle Konzack wrote: Hello Bill Landry, Am 2011-03-18 15:11:47, hacktest Du folgendes herunter: No wonder I have seen such a huge drop in spam the past few days: ??? I get 18-26 mio spams (36 servers with 96.000 users) per day and nothing has changed. Please

Re: SOLVED Re: malware.blocklist.cf : www.malware.com.br unavailable

2011-08-09 Thread Bill Landry
On 8/9/2011 8:28 AM, Dave Wreski wrote: Hi, I noticed that the site that provided the malware.blocklist.cf has been unavailable since at least the 8th of August. URL for the file was on http://www.malware.com.br/cgi/submit?action=list_sa The FQDN no longer resolves to an address. I have

Re: FuzzyOCR words file

2006-11-18 Thread Bill Landry
Marc Perkel wrote the following on 11/18/2006 8:24 AM -0800: decoder wrote: Marc Perkel wrote: The words file needs a little documentation. Is it limited to single words or phrases too? What's with the colon and the numbers after the word? Phrases are possible too, spaces and numbers are

Re: new Botnet plugin version soon

2006-11-30 Thread Bill Landry
John Rudd wrote the following on 11/30/2006 9:26 AM -0800: Jonas Eckerman wrote: John Rudd wrote: Question 2: someone asked why my module is Botnet instead of Mail::SpamAssassin::Plugin::Botnet. The answer is: when I first started this (and this is/was my first SA Plugin authoring attempt),

Re: Spamassassin doesn't ding sender for saying HELO i-am-you

2006-12-06 Thread Bill Landry
Kelly Jones wrote the following on 12/6/2006 8:13 PM -0800: Spamassassin has lots of tests for fake HELOs. If someone says HELO hotmail.com, but aren't connecting from a Hotmail IP address, they get dinged (spam score is increased). Recently, someone connected our server, call it mx.xyz.com,

Re: AWL scoring on lots of spam

2007-02-15 Thread Bill Landry
LuKreme wrote the following on 2/15/2007 4:18 PM -0800: I have a LOT of spam that is hitting with score in the teens despite getting very low AWL scores. In fact, of the 400 messages in my current SPAM folder, 77 have negative AWL, some as high as -7.9 (38 have positive AWL scores) for

Re: sa-learn from maildir

2007-03-24 Thread Bill Landry
Marc Perkel wrote the following on 3/24/2007 1:25 PM -0800: What's the easiest way to do an sa-learn on a bunch of messages stored in maildir format. Should I pipe them into salearn or use spamc? sa-learn --progress --spam /path/to/maildir/.Spam/cur/* Will do what you want. Bill

Re: spamhaus / whitelist

2007-03-27 Thread Bill Landry
Jean-Paul Natola wrote the following on 3/27/2007 7:36 AM -0800: Hi everyone, I have a contact from Africa whom I put on the whitelist because everytime he would send mail the scores went through the roof- Recently he started getting this: 554 5.7.1 Service unavailable; Client host

Re: Alternative to red.uribl.com?

2007-04-03 Thread Bill Landry
Dave Pooser wrote the following on 4/3/2007 11:19 AM -0800: I'm seeing a bunch of spam using URLs from domains created on the same day or in the past day or two. I don't know how red.uribl.com works, but I imagine it missed the same-day stuff because its automated process needs time to work. Is

Re: Alternative to red.uribl.com?

2007-04-04 Thread Bill Landry
ram wrote the following on 4/4/2007 12:56 AM -0800: On Tue, 2007-04-03 at 13:15 -0700, Bill Landry wrote: Dave Pooser wrote the following on 4/3/2007 11:19 AM -0800: I'm seeing a bunch of spam using URLs from domains created on the same day or in the past day or two. I don't know how

Re: Alternative to red.uribl.com?

2007-04-06 Thread Bill Landry
ram wrote the following on 4/5/2007 10:23 PM -0800: On Wed, 2007-04-04 at 08:11 -0700, Bill Landry wrote: ram wrote the following on 4/4/2007 12:56 AM -0800: On Tue, 2007-04-03 at 13:15 -0700, Bill Landry wrote: Dave Pooser wrote the following on 4/3/2007 11:19 AM -0800

Re: Spam bounceback attack

2007-04-08 Thread Bill Landry
J. wrote the following on 4/8/2007 11:14 AM -0800: Not sure if this is connected to my agressive smtp connection rejection campaign over the past week, but we've been hit for the first time in many months with a backscatter spam attack. Spammer(s) use random addresses with our domain for their

Re: Spam bounceback attack

2007-04-08 Thread Bill Landry
J. wrote the following on 4/8/2007 4:11 PM -0800: --- Bill Landry [EMAIL PROTECTED] wrote: Also, have you taken a look at the SA vbounce ruleset? See: http://wiki.apache.org/spamassassin/VBounceRuleset One issue is that I have fast_spamassassin turned on so I don't get

Re: spam test

2007-04-09 Thread Bill Landry
Peter Russell wrote the following on 4/9/2007 3:41 PM -0800: We dont use Botnet anymore, it fires on anything/everything and drives me nuts. You must not have Botnet and/or your trusted_networks setup correctly then. Bill

Re: spam test

2007-04-09 Thread Bill Landry
Robert Fitzpatrick wrote the following on 4/9/2007 4:37 PM -0800: Bill Landry wrote: Peter Russell wrote the following on 4/9/2007 3:41 PM -0800: We dont use Botnet anymore, it fires on anything/everything and drives me nuts. You must not have Botnet and/or your trusted_networks setup

SA 3.2.0 URIBL header reporting

2007-05-03 Thread Bill Landry
Since upgrading to SA 3.2.0 yesterday, I am noticing that the header reporting for URIBLs has changed (I had to rename the original domain names with 1.example.com 2.example.com names as my first message to the list was rejected). With SA 3.1.8: * 2.5 URIBL_OB_SURBL Contains an URL listed

Re: False Positive

2007-05-06 Thread Bill Landry
Marc Perkel wrote the following on 5/6/2007 9:17 AM -0800: Been getting a few strange false positives lately. Here's something unusual. X-Spam-Report: * 0.0 HTML_MESSAGE BODY: HTML included in message * -2.0 BAYES_05 BODY: Bayesian spam probability is 1 to 5% * [score: 0.0206] * 1.4

Re: SA and Amavisd-new 2.5.0

2007-05-14 Thread Bill Landry
Jerry Durand wrote the following on 5/14/2007 10:00 PM -0800: Sorry for the posting on this list, someone mentioned that even though the man for amavisd is essentially empty, this feature is mentioned elsewhere. I only recently got on the amavisd-new announce list so didn't see anything about

Re: RelayCountry Issues

2007-05-15 Thread Bill Landry
Big Wave Dave wrote the following on 5/15/2007 12:54 PM -0800: On 5/15/07, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: Big Wave Dave wrote: Do you want to see the full debug with --lint or a real message? Should I send it to the list as well? Thanks for your assistance. Either would

Re: qmail auth not recognized

2007-05-24 Thread Bill Landry
[EMAIL PROTECTED] wrote the following on 5/24/2007 10:23 PM -0800: Hi Daryl, you are speaking in riddles??? Wolfgang Daryl C. W. O'Shea wrote: Never mind, looking into this further there's no problem with the change made in r447014. The issue is qmail should be adding with ESMTPA

Re: Buggy Spamassassin configuration

2007-05-28 Thread Bill Landry
Karamanga wrote the following on 5/28/2007 1:01 PM -0800: Dear Daryl, ty for your reply, I got rid of the anti-drug.cf error buh just renaming this cf file. The error on DCC i dont understand. The plugin is installed and uncommentent in the v310.pre file in the sa directory and i cheked the

Re: These are getting through SA...

2007-06-08 Thread Bill Landry
Daryl C. W. O'Shea wrote the following on 6/8/2007 2:41 PM -0800: If you've got the current update from updates.spamassassin.org you've got a working set of rules for URIBL_BLACK and URIBL_GREY. It turns out that they didn't hit for Raymond either, so you won't see them in this case. Daryl

Re: These are getting through SA...

2007-06-12 Thread Bill Landry
Mark Martinec wrote the following on 6/12/2007 3:53 AM -0800: Luis, I don't have any URIBL rules firing up (SA 3.2.0 from source here, most of the other relevant info is in the header of the mail I sent before to test). Where did you get them? [...] But the main difference between the live

Re: These are getting through SA...

2007-06-12 Thread Bill Landry
Mark Martinec wrote the following on 6/12/2007 3:05 PM -0800: Bill, Mark, just curious if you are running Botnet? I found that some messages cause the Botnet RDNS test to timeout after hanging for about 30 seconds, and then network test randomly fail (primarily URIBL tests). I found that

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Mark Martinec wrote the following on 6/15/2007 3:36 AM -0800: Phil, Bill, Mark, I patched Dns.pm but this didn't resolve the issue for me. You can test with the sample messages I posted to bugzilla: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5506 I was getting this

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Mark Martinec wrote the following on 6/15/2007 10:41 AM -0800: Bill, There is now an additional patch at: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5511 which should fix this. Mark, thanks for the patches. However, even with both Dns.pm patches applied, unless I

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Randal, Phil wrote the following on 6/15/2007 2:08 PM -0800: Bill, The problem is that Botnet uses Net::DNS::Resolver's default retry and timeout values, which are way too high. Spamassassin's DnsResolver.pm uses these values: udp_timeout:3 tcp_timeout:3 retrans:0 retry:1 try

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Mark Martinec wrote the following on 6/15/2007 2:34 PM -0800: So far so good with Mark's patches - although I am awaiting his follow-up regarding a possible bug... Not sure I understand this. My fixes make SA more robust when plugins misbehave. The Botnet problem still causes the mail

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
John Rudd wrote the following on 6/15/2007 3:00 PM -0800: Bill Landry wrote: Also, I'm not sure if John Rudd is still supporting Botnet or not, since I have sent him 3 e-mails to the address listed in Botnet.pm off-list over the past week about this, and asked him if he would consider

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Daniel J McDonald wrote the following on 6/15/2007 2:54 PM -0800: On Fri, 2007-06-15 at 22:08 +0100, Randal, Phil wrote: Bill, The problem is that Botnet uses Net::DNS::Resolver's default retry and timeout values, which are way too high. Spamassassin's DnsResolver.pm uses these values:

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Daniel J McDonald wrote the following on 6/15/2007 3:37 PM -0800: On Fri, 2007-06-15 at 15:27 -0700, Bill Landry wrote: Daniel J McDonald wrote the following on 6/15/2007 2:54 PM -0800: On Fri, 2007-06-15 at 22:08 +0100, Randal, Phil wrote: And a few others... Might as well

Re: SaneSecurity

2007-06-27 Thread Bill Landry
John Rudd wrote the following on 6/27/2007 10:27 AM -0800: Bret Miller wrote: Perhaps more a clamav question, but does anyone use the additional definitions for clam from SaneSecurity and are they helpful in the Spam Wars? You're in luck! I just installed them yesterday. Had been meaning to

  1   2   3   >