RE: Spam from compromised web mails

2009-12-16 Thread R-Elists
> > When running site wide, how do you get ham to train bayes? I > can manage spam by spam reporting and such, but getting ham > without breaching the privacy of our users is my problem. > > raj > Raj, one potential option is to setup bayes autolearn thresholds with proper scores for your

Re: Spam from compromised web mails

2009-12-16 Thread Thomas Harold
On 12/16/2009 9:42 AM, Rajkumar S wrote: On Wed, Dec 16, 2009 at 1:07 PM, Yet Another Ninja wrote: I don't do any "manual" training, ever. SA's butler, "autolearn", does it for me. bayes_auto_learn 1 In this case if a new spam comes and it does not score on any other rules, Would't this be

Re: Spam from compromised web mails

2009-12-16 Thread Rajkumar S
On Wed, Dec 16, 2009 at 1:07 PM, Yet Another Ninja wrote: > I don't do any "manual" training, ever. SA's butler, "autolearn", does it > for me. > > bayes_auto_learn  1 In this case if a new spam comes and it does not score on any other rules, Would't this be classified as a ham? Also I need bayes

Re: Spam from compromised web mails

2009-12-16 Thread Thomas Harold
On 12/15/2009 12:49 PM, LuKreme wrote: On 15-Dec-2009, at 09:12, RW wrote: On Tue, 15 Dec 2009 09:44:50 -0500 I'm exactly the opposite, hardly any of the lists I subscribe to do that, and I find it annoying when it's done. Every list mail comes with a List-Id header so you can filter, tag or wh

Re: Spam from compromised web mails

2009-12-15 Thread Yet Another Ninja
On 12/16/2009 8:24 AM, Rajkumar S wrote: On Tue, Dec 15, 2009 at 9:07 PM, Yet Another Ninja wrote: even using site wide, autolearning will help your detection a LOT. Don't underestimate it... When running site wide, how do you get ham to train bayes? I can manage spam by spam reporting and su

Re: Spam from compromised web mails

2009-12-15 Thread Rajkumar S
On Tue, Dec 15, 2009 at 9:07 PM, Yet Another Ninja wrote: > even using site wide, autolearning will help your detection a LOT. > Don't underestimate it... When running site wide, how do you get ham to train bayes? I can manage spam by spam reporting and such, but getting ham without breaching the

Re: Spam from compromised web mails

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, LuKreme wrote: As you may have noticed, I've got my procmail set to insert one (as seen above). But this has the unfortunate side-effect of messing with threading in some threaded mail clients and archives :( I just see "Subject: Re: Re: Spam from…" Changing the subject

Re: Spam from compromised web mails

2009-12-15 Thread LuKreme
On 15-Dec-2009, at 09:44, Charles Gregory wrote: > On Tue, 15 Dec 2009, Jeff Koch wrote: >> I have to say that it is extremely annoying that this mailing list does not >> put a tag identifying itself in the subject line. Every other mailing list >> of a similar technical nature that I participate

Re: Spam from compromised web mails

2009-12-15 Thread LuKreme
On 15-Dec-2009, at 09:12, RW wrote: > On Tue, 15 Dec 2009 09:44:50 -0500 > Jeff Koch wrote: > >> >> I have to say that it is extremely annoying that this mailing list >> does not put a tag identifying itself in the subject line. Every >> other mailing list of a similar technical nature that I pa

Re: [sa] Re: Spam from compromised web mails

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Toni Mueller wrote: As you may have noticed, I've got my procmail set to insert one (as seen above). But this has the unfortunate side-effect of messing with threading in some threaded mail clients and archives :( I don't know the abilities of Alpine, but if you use proc

Re: Spam from compromised web mails

2009-12-15 Thread Toni Mueller
Hi, On Tue, 15.12.2009 at 11:44:49 -0500, Charles Gregory wrote: > On Tue, 15 Dec 2009, Jeff Koch wrote: >> I have to say that it is extremely annoying that this mailing list does >> not put a tag identifying itself in the subject line. Every other >> mailing list of a similar technical natur

Re: [sa] Re: Spam from compromised web mails

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Jeff Koch wrote: I have to say that it is extremely annoying that this mailing list does not put a tag identifying itself in the subject line. Every other mailing list of a similar technical nature that I participate in has a tag. A tag of two characters would allow users t

Re: Spam from compromised web mails

2009-12-15 Thread RW
On Tue, 15 Dec 2009 09:44:50 -0500 Jeff Koch wrote: > > I have to say that it is extremely annoying that this mailing list > does not put a tag identifying itself in the subject line. Every > other mailing list of a similar technical nature that I participate > in has a tag. I'm exactly the op

Re: Spam from compromised web mails

2009-12-15 Thread Kai Schaetzl
Yet Another Ninja wrote on Tue, 15 Dec 2009 16:37:35 +0100: > even using site wide, autolearning will help your detection a LOT. Definitely. Been using site-wide for all my servers for years. No problems. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://

Re: Spam from compromised web mails

2009-12-15 Thread Matt Garretson
On 12/15/2009 10:37 AM, Yet Another Ninja wrote: > even using site wide, autolearning will help your detection a LOT. > Don't underestimate it... Heartily agreed. Site-wide bayes here (single database for 2000+ users) catches 40% of the spam here. It could certainly catch more, but the first

Re: Spam from compromised web mails

2009-12-15 Thread Yet Another Ninja
On 12/15/2009 4:07 PM, Rajkumar S wrote: On Tue, Dec 15, 2009 at 8:29 PM, Matt Garretson wrote: Do you use Bayes? Bogofilter (another bayesian filter) catches those here. The one you posted scored 0.94 here and would have been dropped. I am not using bayes as of now, SA is site wide and so

Re: Spam from compromised web mails

2009-12-15 Thread LuKreme
On 15-Dec-2009, at 04:39, Rajkumar S wrote: > On Tue, Dec 15, 2009 at 3:51 PM, Mike Cardwell > wrote: >> That particular email was sent from a host in Nigeria connecting to a host >> in Brazil. The Nigerian host is listed on Barracuda, the SBL and the XBL. > > Is there a way to write a rule to ta

Re: Spam from compromised web mails

2009-12-15 Thread Rajkumar S
On Tue, Dec 15, 2009 at 8:29 PM, Matt Garretson wrote: > Do you use Bayes?  Bogofilter (another bayesian filter) catches > those here.  The one you posted scored 0.94 here and would have > been dropped. I am not using bayes as of now, SA is site wide and so proper training is a problem. raj

Re: Spam from compromised web mails

2009-12-15 Thread Matt Garretson
On 12/15/2009 9:31 AM, The Doctor wrote: > On Tue, Dec 15, 2009 at 12:55:00PM +0530, Rajkumar S wrote: >> Occasionally I receive mail from compromised web mails asking user >> name and password from my users. The source IPs are usually clean (as >> they are legitimate mail servers) and do not catch

Re: Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 15:44:50 CET, Jeff Koch wrote in has a tag. A tag of two characters would allow users to quickly identify the email as coming from the SA mailing list and decide whether the email is worth opening. in the header: List-Id: in sieve filter: # spamassassin if anyo

Re: Spam from compromised web mails

2009-12-15 Thread Jeff Koch
I have to say that it is extremely annoying that this mailing list does not put a tag identifying itself in the subject line. Every other mailing list of a similar technical nature that I participate in has a tag. A tag of two characters would allow users to quickly identify the email as comin

Re: Spam from compromised web mails

2009-12-15 Thread The Doctor
On Tue, Dec 15, 2009 at 12:55:00PM +0530, Rajkumar S wrote: > Hi, > > Occasionally I receive mail from compromised web mails asking user > name and password from my users. The source IPs are usually clean (as > they are legitimate mail servers) and do not catch any ip based rules. > Usually one or

Re: Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 08:25:00 CET, Rajkumar S wrote I have pasted one such (slightly edited) mail at http://pastebin.ca/1715399 http://sa.hege.li/ to me it looks like a gmail user trying to get more users sending there login and passwords then what ever it really is ? -- xpoint http://www.u

Re: Spam from compromised web mails

2009-12-15 Thread Rajkumar S
On Tue, Dec 15, 2009 at 3:51 PM, Mike Cardwell wrote: > That particular email was sent from a host in Nigeria connecting to a host > in Brazil. The Nigerian host is listed on Barracuda, the SBL and the XBL. Is there a way to write a rule to tag mails which are hitting web mails via proxy? Receiv

Re: Spam from compromised web mails

2009-12-15 Thread Mike Cardwell
On 15/12/2009 07:25, Rajkumar S wrote: Occasionally I receive mail from compromised web mails asking user name and password from my users. The source IPs are usually clean (as they are legitimate mail servers) and do not catch any ip based rules. Usually one or two mail accounts are used to pump