Cyrillic spam

For some strange reason, I'm seeing Cyrillic spams very frequently lately. None of my users read any Eastern European languages- is there a quick way to catch these? thanks -Mike

Re: Trying to catch spoofed ToCc

Loren Wilton wrote: Nasty to do without using a plugin or eval rule, but it can be done. The following is off the top of my head, and I almost guarantee it won't work correctly without testing and some minor tweak somewhere. But you can try it and/or fool with it if you like. header

Secure Quotes spam

Hi all, just a curiosity question: I seem to be getting an average of about 30 spams a week that all contain URLs that point to sites that look just like this (sample image, with several tabs with different URLs that point to identical copies of the same thing)

OT: HELO setting in Sendmail

Hi folks, this is a bit off topic, but I figured someone here may have an inkling as to what I could do. Some mail servers are now rejecting my email: (reason: 550 Don't like your HELO/EHLO. Hostname must contain a dot.) I checked and sure enough, the HELO just spits out the hostname, not

Re: OCR plugin doesn't seem to work

decoder wrote: Which OCR plugin are you using there? If it is the original OcrPlugin, then you might try FuzzyOcr instead. The original OcrPlugin was more proof-of-concept, and will cause you lots of headaches with the current image spam... I did upgrade to FuzzyOCR after I read your message.

OCR plugin doesn't seem to work

Hey guys, Running SA 3.1.1, on Fedora Core 3, with Perl 5.8.5 I installed gocr and imagemagick packages, copied the Ocr.pm and cf files into /etc/mail/spamassassin The tests don't seem to run, the pump 'n dump GIFs are still arriving and I don't see that the test is being run in the

Re: Bouncing spam vs. Blackholing spam

My personal opinion is that the spammers don't care either way. My guess would be that they probably don't even bother checking the logs of what worked and what didn't on the zombie PCs they hijack to send the crap in the first place. Probably far easier to just fire and forget. -Mike

same message, different scores

Hi folks, I got two spams through today and I'm a little confused as to why. Spam 1: From [EMAIL PROTECTED] Sat Apr 22 01:28:34 2006 Return-Path: [EMAIL PROTECTED] X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on quadzilla X-Spam-Level: ** X-Spam-Status: No, score=2.0 required=5.0

Re: same message, different scores

We need some background on your setup: How do you call SA to get your mail scanned at delivery time? Do you use spamd to scan your mail? If so, did you restart spamd after adding your rule? Where is your CATHY_CAPARULA rule declared (ie: what file)? Hi Matt, The system is FC3, running SA

SA 3.1.1 post-install error

Hi all, I built SA 3.1.1 on my FC3 system as an RPM Two errors I noted. First, the spamassasin rc startup script is not executable, so it fails to start. Not a big deal to fix, but it makes the post-install script error out since it can't start the service. Also, when I do this: # spamd

Re: Training SA with Thunderbird Junk folder

mouss wrote: Edward Diener a écrit : Does anybody know the instructions for training SA with the contents of the Thunderbird Junk folder ? My web host, where SA is tunning, suggests I do this in order to reduce the amount of spam I get, and I can login to my web host, transfer files from my

Re: Updated Pump and Dump rules. 2006-02-18

Doc Schneider wrote: I just committed version 01.00.06 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It should appear within the hour. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja) Why can't I add this to rules_du_jour? I added SARE_STOCKS to the rulesets thusly:

is teaching SA ham it already marked as ham bad?

I've been feeding messages from my inbox into a folder that SA reads as ham for quite some time now. Suddenly it occurs to me that this may be a bad idea, and I should only have SA learn messages as ham that it believes is spam. This strikes me as being as bad as forcing SA to re-learn spam

sa-stats.pl generates a zero report

Hi all, Any pointers on how to make sa-stats.pl work? I ran it in debug mode and it's scanning the right log, but at the end I get a report with all zeros. Maybe I'm missing a perl module? sample report: Report Title : SpamAssassin - Spam Statistics Report Date : 2005-08-03 Period

Re: not whitelist, but why are spams getting through?

There are two fairly obvious possibilities here: 1.Your server isn't normally running with net tests enabled, but they were for the manual test. Why would that be? 2.You ran the manual test 1/2hr after the automatic scan, and by then the domain had made it into all of the

not whitelist, but why are spams getting through?

OK, so it's not the autowhitelist doing it, but over the last couple of weeks an extraordinary amount of spam is getting through and I don't know why. A particular message just came into my inbox, with the following headers: X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on quadzilla

auto-whitelist is making spams sneak through

I'm getting more and more spams sneaking through lately. I'm running SA 3.0.4 on Fedora Core 3. In analyzing the ones that make it through, I see that other users in my domain are CC, which causes the auto-whitelist to score the spam lower than if I run it through manually without that test.