Re: tons of forged bills in german

2014-01-21 Thread Michael Monnerie
, Michael Monnerie, Ing. BSc, Tel: +43 660 415 6531 Protéger.at Internet Services Austria Web: http://protéger.at und http://proteger.at Facebook https://facebook.com/protegerat Mitglied im it-management Netzwerk http://it-management.at

Re: tons of forged bills in german

2014-01-21 Thread Michael Monnerie
Am 20.01.2014 09:54, schrieb Michael Monnerie: That should not matter. I want to say if there is a bill claiming to be from vodafone, then there MUST NOT be any link to anything else than https?://vodafone.de. Any idea how I could check for this? Is this possible? So I want to catch a real

Re: tons of forged bills in german

2014-01-20 Thread Michael Monnerie
Am 18.01.2014 15:27, schrieb Axb: pastebin samples ? Here are two, from Deutsche Telekom and Vodafone: http://pastebin.com/M3aTrdDx http://pastebin.com/i0kfjG8s

Re: tons of forged bills in german

2014-01-20 Thread Michael Monnerie
Am 18.01.2014 19:02, schrieb Benny Pedersen: They look like the original, and just the link in the middle, where it says download your bill here, goes to a site containing trojans. +1 i have seen some that contain a html attachment, this is now blocked in my own clamav rule Problem is,

tons of forged bills in german

2014-01-18 Thread Michael Monnerie
Dear list, since this week there are tons of very good forged bills that look like real, from big companies like telekom, vodafone, etc. They look like the original, and just the link in the middle, where it says download your bill here, goes to a site containing trojans. I'd like to write

reporting Spambot IPs

2013-11-24 Thread Michael Monnerie
One of our customers has been virus infected, his e-mail password stolen and used within a small botnet. Those 107 different IP addresses sent spam during 3 hours, the problem has been fixed already. I just wanted to report those 107 IPs here, I don't know any better method to report it. Has

How to report a spam botnet

2012-11-18 Thread Michael Monnerie
223.199.129.073 223.199.129.202 223.199.130.046 223.199.131.114 223.199.139.229 -- // Michael Monnerie, Ing.BSc --- it-management Michael Monnerie // http://it-management.atTel: +43 660 / 415 65 31 // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5

Re: How to report a spam botnet

2012-11-18 Thread Michael Monnerie
[crosspost postfix-users and spamassassin-users] Am Sonntag, 18. November 2012, 14:08:08 schrieb Michael Monnerie: How should we report those IPs, is there a anti botnet unit somewhere? Lets concentrate back on the subject, I got this answer: normally it makes no sense to report botnets

Re: Idea for AWL: increase totscore for know bad IP blocks

2012-10-08 Thread Michael Monnerie
, it's a sign that the whole spam filtering works poorly, as AWL averages points per sender. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel: +43 660 / 415 6531 signature.asc Description

Re: Idea for AWL: increase totscore for know bad IP blocks

2012-10-08 Thread Michael Monnerie
freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel: +43 660 / 415 6531 signature.asc Description: This is a digitally signed message part.

Re: Idea for AWL: increase totscore for know bad IP blocks

2012-10-03 Thread Michael Monnerie
Am Montag, 1. Oktober 2012, 18:28:30 schrieb Michael Monnerie: This increases the AWL totscore value for know bad senders to 1000, leaving a low chance that their mail passes the filters without being marked as spam. Did no one have time, or is this not interesting? Running this script helped

Idea for AWL: increase totscore for know bad IP blocks

2012-10-01 Thread Michael Monnerie
marked as spam. Maybe your setup needs to tweak the values a bit, but for us it seems to be good. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel: +43 660 / 415 6531 signature.asc Description

PDF scanning via sa

2012-03-19 Thread Michael Monnerie
Does someone do PDF scanning with SpamAssassin? I found PDFassassin on https://wiki.apache.org/spamassassin/UnmaintainedCustomPlugins but it's unmaintained. Someone got a working version? -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http

Re: ANNOUNCE: ZMI_GERMAN available via a new channel

2012-03-08 Thread Michael Monnerie
Latest info: - 2 Mirrors up and running. Please report if you find issues. - actual release is 312 - short explanation page on http://sa.zmi.at/ -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel

Re: ANNOUNCE: ZMI_GERMAN available via a new channel

2012-02-23 Thread Michael Monnerie
Am Mittwoch, 15. Februar 2012, 14:25:46 schrieb Michael Monnerie: Starting now, the ZMI_GERMAN ruleset is available via a new channel: # sa-update --channel sa.zmi.at --nogpg Latest info: - Key is now also available from https://sa.zmi.at/sa-update-german/GPG.KEY to be more conform to what

Re: ANNOUNCE: ZMI_GERMAN available via a new channel

2012-02-20 Thread Michael Monnerie
Am Mittwoch, 15. Februar 2012, 14:25:46 schrieb Michael Monnerie: Starting now, the ZMI_GERMAN ruleset is available via a new channel: # sa-update --channel sa.zmi.at --nogpg You need --nogpg for now as I have no info how to do a gpg setup with it's own key infrastructure to be useful

Re: Help for Channels needed

2012-02-17 Thread Michael Monnerie
in a specific place with --homedir, and then in the SVN post-commit hook that creates the rules tarball and signs it I use --homedir again with the same path. Sounds like the way to go. Thx! -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http

Re: Help for Channels needed

2012-02-15 Thread Michael Monnerie
do I tell gpg to use a different key to sign that file? -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel: +43 660 / 415 6531 signature.asc Description: This is a digitally signed message part.

ANNOUNCE: ZMI_GERMAN available via a new channel

2012-02-15 Thread Michael Monnerie
and is available via # http://sa.zmi.at/rulesets/70_zmi_german.cf from now on. I'll keep the old location for a while, but please change your scripts NOW. Feedback as always appreciated at spam-ger...@zmi.at -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger

Re: ANNOUNCE: ZMI_GERMAN available via a new channel

2012-02-15 Thread Michael Monnerie
Am Mittwoch, 15. Februar 2012, 14:30:23 schrieb Axb: sa.zmi.at has no A record Fixed now - thanks. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel: +43 660 / 415 6531 signature.asc Description

Re: Help for Channels needed

2012-02-15 Thread Michael Monnerie
Am Mittwoch, 15. Februar 2012, 11:02:40 schrieb Kevin A. McGrail: I believe you've got something working only locally. Try it from another network. Perhaps a bind view? Uh, thanks for your test. The glue record got lost on the zmi.at zone. Now it's there. -- mit freundlichen Grüssen, Michael

Re: ANNOUNCE: ZMI_GERMAN available via a new channel

2012-02-15 Thread Michael Monnerie
Am Mittwoch, 15. Februar 2012, 14:30:23 schrieb Axb: sa.zmi.at has no A record Fixed now - thanks. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel: +43 660 / 415 6531 signature.asc Description

Help for Channels needed

2012-02-14 Thread Michael Monnerie
that using --nogpg helps, but I'd like to use it to make it easier for users. But how would I create a new key pair just for SA? I have an auto script updating the channel, web and dns config, but that user already has gpg keys for other uses. Thanks. -- mit freundlichen Grüssen, Michael Monnerie

Re: Using ZMI_GERMAN ruleset

2011-12-19 Thread Michael Monnerie
do so, but I don't want to run around searching for that info, I'm too busy with other projects. I'd also need info what users would then need to do to get that updates. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at

Re: Using ZMI_GERMAN ruleset

2011-12-14 Thread Michael Monnerie
the time modifications from them, I get reports and modify the rules accordingly. And not to forget: Long sentences mean chance for a false positive drops -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee

Re: Using ZMI_GERMAN ruleset

2011-12-12 Thread Michael Monnerie
the __ZMIde_JOBEARN1-28 rules move false positives to 0, and I'm constantly adding stuff. I've now tried to remove all old cruft, that means single-line rules. Rulesize went from 350KB to 296KB, that should save some RAM and CPU. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management

Why not trust that header? And ALL_TRUSTED wrong?

2011-12-06 Thread Michael Monnerie
: X-Spam-Relays-External: Did I do something wrong? I can't see how 203.125.59.147 or 70.34.196.21 should be trusted or internal IPs? -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel: +43 660 / 415

Using ZMI_GERMAN ruleset

2011-10-31 Thread Michael Monnerie
it until now, and get german spam, download it from http://sa.zmi.at/rulesets/70_zmi_german.cf I'm seeking for people helping to cleanup and improve the filters. Please contact me at spam-ger...@zmi.at -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services

Re: channel 70_zmi_german.cf.zmi.sa-update.dostech.net update?

2011-09-04 Thread Michael Monnerie
- could you do that please? Is there something I can do to fix it? -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel: +43 660 / 415 6531 // Haus zu verkaufen: http://zmi.at/langegg/ signature.asc

Re: DOB list dead?

2011-04-25 Thread Michael Monnerie
idea where to report that? -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services: Protéger http://proteger.at [gesprochen: Prot-e-schee] Tel: +43 660 / 415 6531 // ** Radiointerview zum Thema Spam ** // http://www.it-podcast.at/archiv.html#podcast-100716

DOB list dead?

2011-04-21 Thread Michael Monnerie
Does anyone know about the state of the day old bread list? dob.sibl.support-intelligence.net doesn't seem to get any hits on new domains anymore, and on their contact e-mail address nobody responded to my requests. Any replacement known? -- mit freundlichen Grüssen, Michael Monnerie, Ing

BOTNET rules question

2011-01-05 Thread Michael Monnerie
Dear list, I received this info from a customer, whose order confirmation from the londontheatredirect.com got marked as spam because of BOTNET* rules. Are those rules too old, or is that server in a botnet? How to find out? Or which rules scores should I tune to optimize? --

GERMAN ruleset extended

2010-04-21 Thread Michael Monnerie
-ger...@zmi.at I don't follow the list regularly, so please contact me there in case of problems. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services http://proteger.at [gesprochen: Prot-e-schee] Tel: 0660 / 415 65 31 // Wir haben im Moment zwei Häuser zu

SA3.3: awl in PostgreSQL, lots of duplicate key messages on insert

2010-03-03 Thread Michael Monnerie
? Seems SA tries to insert without checking if the record exists already. What can we do? -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services http://it-management.at Tel: 0660 / 415 65 31 // Wir haben zwei Häuser zu verkaufen: // http://zmi.at/langegg/ // http

hostkarma false positive

2010-01-11 Thread Michael Monnerie
Another FP on hostkarma: bsmtp5.bon.at[195.3.86.187] Please investigate and fix. And put them on YELLOW, they are an ISP here in Austria. Please check bsmtp[1-9] also. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services http://it-management.at Tel: 0660

Re: Bug in Hostkarma black list found

2009-12-22 Thread Michael Monnerie
the last time in relation to false positives. Thank you Marc, good to hear. I guess I'll retry next year, now everybody stops working and I wouldn't get reports until Jan 11. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet Services http://it-management.at Tel

Re: FP on blacklist hostkarma

2009-12-22 Thread Michael Monnerie
those bytes and the environment, but I don't bother too much. BTW: 80.120.179.155 is mx.lk-oe.at, which is the agricultural chamber of Austria. I don't know if yellow or white would be suitable, I guess white. -- mit freundlichen Grüssen, Michael Monnerie, Ing. BSc it-management Internet

Re: FP on blacklist hostkarma

2009-12-11 Thread Michael Monnerie
spam, IMO. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 6531 .network.your.ideas. // // Wir haben zwei Häuser zu verkaufen: // http://zmi.at/langegg/ // http://willhaben.at/iad/realestate/object?adId=15306857 signature.asc

Re: FP on blacklist hostkarma

2009-12-11 Thread Michael Monnerie
already. Brutal, but it works. And it means a lot less work for our filters. Therefore, I can't use a blacklist with FPs, as it overloads our support team. Once Marc finds a way to reduce FPs substantially, I'm happy to use it again. mfg zmi -- // Michael Monnerie, Ing.BSc- http

Re: FP on blacklist hostkarma

2009-12-01 Thread Michael Monnerie
customers who want to send you mail :-( BTW, another FP: http://ipadmin.junkemailfilter.com/remove.php?ip=62.179.121.43 mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http

FP on blacklist hostkarma

2009-11-30 Thread Michael Monnerie
tarbaby. Please, Marc, don't list hosts just because they connect several times to your tarbaby. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg

Re: FP on blacklist hostkarma

2009-11-30 Thread Michael Monnerie
On Montag, 30. November 2009 Michael Monnerie wrote: http://ipadmin.junkemailfilter.com/remove.php?ip=80.245.199.162 I removed that IP now, in order to let pass mail through. But please check it. It seems you easily blacklist a host that connects to your tarbaby MX, but we had a network

Re: FP on blacklist hostkarma

2009-11-30 Thread Michael Monnerie
On Montag, 30. November 2009 Marc Perkel wrote: I'm investigating it further but what appears is that the IP also failed to close the connection with a QUIT. OK, but it really is a legitimate mail server, so shouldn't be listed. mfg zmi -- // Michael Monnerie, Ing.BSc- http

Re: Problem with sa-blacklist

2009-11-21 Thread Michael Monnerie
the postfix blacklist version of it, for a simple blacklist. Is there any replacement for it? mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg

Problem with sa-blacklist

2009-11-20 Thread Michael Monnerie
if something changed on http://www.sa-blacklist.stearns.org/sa-blacklist/ but obviously the information there is quite old: If I download the sa- blacklist.current.reject, it has a version of April: 200904171539 while my last rsync version is 200910142031 Any chance for a fix? mfg zmi -- // Michael

Re: Hostkarma: to be or not to be in SA defaults

2009-11-11 Thread Michael Monnerie
this, and as long as it's a free service, I can offer free mirrors. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5

Re: false positive on hostkarma blacklist

2009-11-11 Thread Michael Monnerie
On Mittwoch 21 Oktober 2009 Marc Perkel wrote: Michael Monnerie wrote: http://ipadmin.junkemailfilter.com/remove.php?ip=62.40.128.130 Just received this FP from a customer. That IP is indeed an MX for kabsi.at, a big cable provider in Austria. Please put it on YELLOW. Please, Marc, you fixed

Re: false positive on hostkarma blacklist

2009-11-11 Thread Michael Monnerie
Associtation ( www.ispa.at ), and they keep that list actual. Do you want that for your YELLOW list? Maybe you can subscribe for receiving updates automatically, too... mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31

false positive on hostkarma blacklist

2009-10-21 Thread Michael Monnerie
http://ipadmin.junkemailfilter.com/remove.php?ip=62.40.128.130 Just received this FP from a customer. That IP is indeed an MX for kabsi.at, a big cable provider in Austria. Please put it on YELLOW. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660

Re: Reminder: EmailBL test zone will shut down July 1st

2009-06-26 Thread Michael Monnerie
. Anything we can do to prevent this from happening? If only someone run a dns zone.. What'cha mean by that? mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at

Re: Suggested Change For FS_TEEN_BAD

2009-06-17 Thread Michael Monnerie
On Mittwoch 17 Juni 2009 Theo Van Dinter wrote: Yes, it matters (one path is tried then the other has to be tried, as opposed to having a single path) So which is better performance wise? I guess [sz]? but I'm not sure now. mfg zmi -- // Michael Monnerie, Ing.BSc- http

Re: ZMI-GERMAN: question to the users

2009-06-08 Thread Michael Monnerie
On Mittwoch 03 Juni 2009 Michael Monnerie wrote: But maybe, if response and urge is high, I will include them. What do you think? Is it spam for you? OK, there where only +1 to include that, without any single objection. Updates will follow. Thanks for your opinions and votes. mfg zmi

ZMI-GERMAN: question to the users

2009-06-03 Thread Michael Monnerie
--- -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4 // Keyserver

Re: AWL - lets change the name

2009-05-28 Thread Michael Monnerie
-- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4 // Keyserver: wwwkeys.eu.pgp.net

Re: EmailBL stats

2009-05-28 Thread Michael Monnerie
spam, and at least once it prevented a spam passing thru, while having no FPs. So its recommendable :-) mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc

RELEASE: ripdefang-dbmail 0.01

2009-05-28 Thread Michael Monnerie
/x/spambox.mbox.bz2) and ran a # formail -n 10 spambox.mbox -s /usr/bin/ripdefang but that got me only around 3343 mails, and ATM I don't know what the error is. But it's a start, and maybe others want to help improve the script. mfg zmi -- // Michael Monnerie, Ing.BSc- http

Re: problems with TVD_SPACE_RATIO

2009-05-27 Thread Michael Monnerie
this rule hit a normal, german, human-typed mail. I'll restore the original score now to see if I get more reports. mfg zmi -- // Michael Monnerie, Ing.BSc. -- Sorcerers have their magic wands: powerful, potentially dangerous tools with a life of their own. Witches have

Re: learning from IMAP spam collection

2009-05-25 Thread Michael Monnerie
directly, which can be undone automatically? mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38

Re: problems with TVD_SPACE_RATIO

2009-05-25 Thread Michael Monnerie
On Montag 25 Mai 2009 Justin Mason wrote: please attach FPs you can share to tickets on bugzilla.  they do help. I've decreased TVD_SPACE_RATIO to 1.2 points because I get FPs with it, at least since 2007-07-25. I'll try to find FPs and report to bugzilla. mfg zmi -- // Michael Monnerie

Re: learning from IMAP spam collection

2009-05-25 Thread Michael Monnerie
On Montag 25 Mai 2009 Yet Another Ninja wrote: fetchmail from spam box , set fetchmail to deliver via smtp, procmail pipe thru ripmime, save spam msg part, drop original, use spam part to learn... Ah, ripmime is the hint... Thx. mfg zmi -- // Michael Monnerie, Ing.BSc- http

Re: EmailBL hit count

2009-05-20 Thread Michael Monnerie
for FPs. Of course they happen, but it's in the maintainers hands to keep them as low as possible. I see he had no evil in mind, just wanted to remind. ;-) mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas

Re: learning from IMAP spam collection

2009-05-19 Thread Michael Monnerie
zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4 // Keyserver

Re: learning from IMAP spam collection

2009-05-19 Thread Michael Monnerie
On Sonntag 17 Mai 2009 Michael Monnerie wrote: Why is it so extremely slow and CPU consuming just to remove any existing markups? There really seems to be no other way than calling spamassassin -d to remove existing markups. I guess I will create an account where a script takes all messages

Re: learning from IMAP spam collection

2009-05-19 Thread Michael Monnerie
On Dienstag 19 Mai 2009 Michael Monnerie wrote: On Sonntag 17 Mai 2009 Rick Macdougall wrote: Why not use http://www.sonologic.nl/pub/Projects/ImapSaLearn/imap-sa-learn.pl.t xt I've improved it a bit: http://zmi.at/x/imap-sa-learn.pl * debug 1 or 2 selectable * no debug is good

RE: learning from IMAP spam collection

2009-05-19 Thread Michael Monnerie
I don't think it does that, but it should be easy enough to add the option and submit the result as a patch. spamc seemed pretty straight forward last time I looked at its source. Yeah, maybe some good hacker could do that. I'm not a programmer, unfortunately. mfg zmi

Re: EmailBL hit count

2009-05-18 Thread Michael Monnerie
-- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4 // Keyserver: wwwkeys.eu.pgp.net

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
. Are there no options? Or are the options from further down in the code meant? I'll have a look. Thx. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
over LAN. IMHO the best way from performance point of view is to integrated IMAP access and spam learning/reporting into one custom perl script. Yes I know. Sadly, that's not what we have. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
-message overheads of using spamc are minimal since its a small, simple C program. Yes, I want to use spamc. But what parameters does it need to remove existing spam markup, just like spamassassin -d does? mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
, I'll have a look. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
what I want. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4

learning from IMAP spam collection

2009-05-17 Thread Michael Monnerie
-- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4 // Keyserver: wwwkeys.eu.pgp.net

Re: learning from IMAP spam collection

2009-05-17 Thread Michael Monnerie
On Sonntag 17 Mai 2009 Michael Monnerie wrote: To clarify my posting, here some additions: Question 1: Do I need to call spamc twice, once with -L spam and once with -C report? Do I understand correctly that -L trains my bayes, while -C reports to spamcop etc.? The man page of spamc

Re: learning from IMAP spam collection

2009-05-17 Thread Michael Monnerie
Finally measured again, it takes 1h7m to fetch from imap plus remove all markups: # time fetchmail -kasnp IMAP --folder $spamfolder--user $spamuser -m formail -s |spamassassin -d /tmp/x $mailhost real67m10.352s user51m41.350s sys 3m27.170s mfg zmi -- // Michael Monnerie, Ing.BSc

Re: EmailBL hit count

2009-05-17 Thread Michael Monnerie
). They have a hard anti spam setup (e.g. not accepting mails from hosts without reverse IP DNS entries, aka PTR Records), so maybe it's not worth to list them? mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31

Re: False positive with FRT_VALIUM1

2009-05-04 Thread Michael Monnerie
not the maintainer of any rules. There's a bug, it needs a fix. Not a local one, but a global. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import

Re: False positive with FRT_VALIUM1

2009-05-04 Thread Michael Monnerie
as it will probably hit many lawyers, and those are important customers after all ;-) mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import

Re: False positive with FRT_VALIUM1

2009-05-03 Thread Michael Monnerie
or forged I can guarantee it's origin, and it's not spam nor forged. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19

Re: False positive with FRT_VALIUM1

2009-05-03 Thread Michael Monnerie
, hope we get a quick optimization. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7

False positive with FRT_VALIUM1

2009-05-02 Thread Michael Monnerie
: Nachricht enthält HTML 0.7 MPART_ALT_DIFF BODY: Nachrichtentext im Text- und HTML- Format unterscheiden sich 1.4 MIME_QP_LONG_LINE RAW: quoted-printable-kodierte Zeile länger als 76 Zeichen 0.1 AWLAWL: From: address is in the auto white-list -- // Michael

SARE false positives on MY_CID_* rules

2009-01-29 Thread Michael Monnerie
be dismissed by now? mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4

Re: rules

2008-11-17 Thread Michael Monnerie
On Montag, 17. November 2008 McDonald, Dan wrote: You know, it's that blog [1] [1] http://comics.com/pearls_before_swine/2008-11-16/ Buahaha, you made my day! Thanks a lot. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31

Re: rules

2008-11-14 Thread Michael Monnerie
# Maintainer: Michael Monnerie ([EMAIL PROTECTED]) from it- management.at # How to get it: # SpamAssassin Channel: 70_zmi_german.cf.zmi.sa-update.dostech.net # Also via RDJ (RulesDuJour) as: ZMI_GERMAN # RDJ is available at http://www.exit0.us/index.php?pagename=RulesDuJour # Home: http://sa.zmi.at

rawbody rules help

2008-11-13 Thread Michael Monnerie
class=MsoNormal\\span lang=DE style=\apsmso\-ansi\- language:DE\aps\/ rawbody y /\p class=MsoNormal\\span lang=DE style=\apsfont- size:6.0pt;color:\#DD;/ but that doesn't hit. What's my mistake? mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65

sa-update fails suddenly

2008-11-12 Thread Michael Monnerie
, at EOF Global symbol $plugin requires explicit package name at (eval 150) line 7. syntax error at (eval 150) line 11, near ; } Can't call method call_plugins on unblessed reference at /usr/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/Message/Metadata.pm line 83. -- // Michael Monnerie

Re: sa-update fails suddenly

2008-11-12 Thread Michael Monnerie
/Mail/SpamAssassin/PerMsgStatus.pm line 2669. Number found where operator expected at (eval 143) line 10, near } (and much more lines follow) *** mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel

Re: sa-update fails suddenly

2008-11-12 Thread Michael Monnerie
at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 2669. Number found where operator expected at (eval 143) line 10, near } (and much more lines follow) *** mfg zmi -- // Michael Monnerie, Ing.BSc

Re: sa-update fails suddenly

2008-11-12 Thread Michael Monnerie
On Donnerstag, 13. November 2008 Michael Monnerie wrote: Without changing anything Bah, found the bug, it was a PEBKAC. Some stupid installed SA 3.1.8 from the openSUSE DVD, while we were at 3.2.5. Reverted to 3.2.5, runs smooth as it should. Sorry for the fuzz. mfg zmi -- // Michael

sa-update fails suddenly

2008-11-11 Thread Michael Monnerie
requires explicit package name at (eval 150) line 7. syntax error at (eval 150) line 11, near ; } Can't call method call_plugins on unblessed reference at /usr/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/Message/Metadata.pm line 83. -- // Michael Monnerie, Ing.BSc- http

Re: Spam volumes down since last week

2008-06-26 Thread Michael Monnerie
in July/August isn't all that helpful and keep their Viagra in stock for September? mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import

Re: Train and use bayes on different adresses

2008-06-26 Thread Michael Monnerie
that your family gets also. Don't forget that bayes auto-learns also. So just take your ham/spam, keep bayes in training, and let it learn. Feed all e-mails with it, and the results will be good. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65

Re: Fake MX Record(s) Trick

2008-06-24 Thread Michael Monnerie
On Dienstag, 24. Juni 2008 Benny Pedersen wrote: 14400 is 4 hours (4*3660) which is a bit low for an MX 86400 (24 hours) is probably better. nice calc for 4 hours :-) mouss is french, you must know ;-) mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at

Re: hit frequencies (was Re: [Rule Set proposal] French Rules

2008-06-24 Thread Michael Monnerie
ruleset and it's hard without any reports from others. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED

Re: Invalid byte sequence for encoding

2008-06-19 Thread Michael Monnerie
by client_encoding. I guess you had encoding SQL_ASCII on mysql and use UTF8 on postgresql? Then you may have to let iconv parse the /tmp/bayes.backup into utf8, and import that. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31

Re: blocking country domains.

2008-06-18 Thread Michael Monnerie
with SARE rules and sa-update there should be almost no german spam passing. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint

Re: how to keep updated against german spam?

2008-06-11 Thread Michael Monnerie
. I won't write rules for spam that's already recognized by other rules - the ruleset would be too huge and slow. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http

Re: how to keep updated against german spam?

2008-06-10 Thread Michael Monnerie
within that ruleset: # License: Artistic - see http://www.rulesemporium.com/license.txt # Maintainer: Michael Monnerie ([EMAIL PROTECTED]) from it-management.at # How to get it: # SpamAssassin Channel: 70_zmi_german.cf.zmi.sa-update.dostech.net # Also via RDJ (RulesDuJour) as: ZMI_GERMAN # RDJ

Re: how to keep updated against german spam?

2008-06-10 Thread Michael Monnerie
, it was signed with the following keys:     856AA88A Sorry that problem is on Daryl's side already, cannot influence it. Daryl, did ya see this? mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas

Re: how to keep updated against german spam?

2008-06-10 Thread Michael Monnerie
. I won't write rules for spam that's already recognized by other rules - the ruleset would be too huge and slow. mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http

Spam without any rule hit?

2008-06-09 Thread Michael Monnerie
). *** --- -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: curl -s http://zmi.at/zmi.asc | gpg --import // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4

  1   2   3   4   >