> That's why I don't delete any emails marked as spam; too many false
> positives. I route all marked spam to a special mailbox, and clear it
> periodically. This way, you never lose an email.
Like I said, I'm only deleting extremely high scores at this time, 20
or more hits. Actually, they're
On Thu, Jul 18, 2002 at 05:57:11PM -0500, Shane Williams wrote:
>
> Also, if a single line of yelling scores -0.036, why not just round
> it off to 0 and not have the test run at all?
Because a single line of yelling seems to be a sign of a legitimate mail
and thus is worth substracting some poi
Rossz Vamos-Wentworth said:
>> Rossz Vamos-Wentworth said:
>> >> * ^X-Spam-Level: \*\*\*\*\*\*\*
>> >
>> > I noticed you escaped the *, but Russ did not in his example. Is
>> the escape necessary?
>> >
>> > BTW, it's that easy? Dang.
>>
>> Isn't "^X-Spam-Status: Yes" even easier? less typing, an
> Rossz Vamos-Wentworth said:
> >> * ^X-Spam-Level: \*\*\*\*\*\*\*
> >
> > I noticed you escaped the *, but Russ did not in his example. Is
> > the escape necessary?
> >
> > BTW, it's that easy? Dang.
>
> Isn't "^X-Spam-Status: Yes" even easier? less typing, and no worry
> about missing an aste
Rossz Vamos-Wentworth said:
>> * ^X-Spam-Level: \*\*\*\*\*\*\*
>
> I noticed you escaped the *, but Russ did not in his example. Is the
> escape necessary?
>
> BTW, it's that easy? Dang.
Isn't "^X-Spam-Status: Yes" even easier? less typing, and no worry about
missing an asterisk.
---
(C) Copyright 2002, Onion, Inc.
---
www.theonion.com/onion3825/anti-spam_legislation.html
AMERICA'S FINEST NEWS S
On Thu, 18 Jul 2002, Martin Nile wrote:
> Yes I see this on a regular basis. In my case the secondary MX forwards
> to the spamassassin machine so most of it gets caught anyway. A
> quick grep of the last 2 months of spam shows that 533 out of 6057
> spams came in via my secondary MX.
I just c
I added the lines to procmailrc to nuke high scoring spam, and
broke things. Here's what my mail log shows
Jul 18 15:47:19 vife sendmail[15402]: g6IMlJe15402:
from=smadmin, size=3092, class=-60, nrcpts=0,
msgid=<[EMAIL PROTECTED]>,
relay=smadmin@localhost
Jul 18 15:47:19 vife sendmail[15396]
I came across an email today that made me think the PROFITS rule
should be:
/\bPROFITS/ instead if /PROFITS?
For instance, NONPROFITS would seem to be more likely to be legitimate
email. (Two such messages were delivered to users today)
Also, if a single line of yelling scores -0.036, why not
Clearly, since I just setup this machine and have never emailed out or used this
email... they have just scanned my network for smtp servers... I was a bit
surprised.
I've only had this machine up and running for about 48 hours.
Original Message
Subject: FlowGo.com Customer Su
So sprach Theo Van Dinter am 2002-07-18 um 16:42:41 -0400 :
> Perhaps you should try "spamc < sample-nonspam.txt" ... spamd is a
> daemon, spamc is the client. You can't just netcat spam to spamd and
> expect it to know what the fsck you're talking about.
Hm, okay, I did "spamc < sample-nonspam
No need to recompile...
I believe if you use 10_misc.cf as a template of what to do you can create/use
the local.cf file for what you want to accomplish.
Christopher Crowley wrote:
>
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> This is an old thread. But my question is relevant to it.
Thursday, July 18, 2002, 10:15:48 AM, Craig R . Hughes wrote:
> Hmm, does this count as spam?
Nah...
X-Spam-Status: No, hits=0.0 required=4.0
tests=none
version=2.31
--
Matt
---
This sf.net email is sponsored by:ThinkGeek
> * ^X-Spam-Level: \*\*\*\*\*\*\*
I noticed you escaped the *, but Russ did not in his example. Is the
escape necessary?
BTW, it's that easy? Dang.
---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.
Quoting Brad Koehn <[EMAIL PROTECTED]>:
> | /usr/local/bin/spamc -f
>
> And I have a test file in /etc/mail/spamassassin/tests.cf:
Did you restart spamd after you modified/created tests.cf?
--
Patrice Fournier
[EMAIL PROTECTED]
---
Thi
Hey all,
I'm trying to use both SpamBouncer and SpamAssassin on my system, and
I'm having troubles.
My /etc/procmailrc file looks like this:
[Misc setup code snipped]
DROPPRIVS=yes
FILTER=yes
INCLUDERC=/usr/local/spambnc/sb.rc
#
# SpamAssassin
#
:0fw
| /us
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Could there be a simple explanation? I can't see "SMTPD32" as a
particularly unique string... could something other than Imail also
stick this string in there?
I don't have any spam that trips this, or I'd look at the identifier a
little more clo
Oh, you actually pay for software? Just kidding :P
It could be pirated.
-Original Message-
From: Tom Grandgent [mailto:[EMAIL PROTECTED]]
Sent: Thursday, July 18, 2002 3:55 PM
To: [EMAIL PROTECTED]
Subject: RE: [SAtalk] SMTPD_IN_RCVD test is unfair discrimination...?
That software co
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
This is an old thread. But my question is relevant to it.
I want to prepend each message with a notification. But I do not want
each line of my message to have
SPAM:
SPAM:
SPAM:
in front of it.
If there is not a place where I can configure this b
Of 185 spams I have that were tagged correctly by SA, 10 have SMTPD32
received headers, only one of which was an eval version. Looking at the
headers, all of the SMTPD's were open-relays, and many operated on
cable/dsl subnets. Perhaps it's popular for DSL/cable subscribers to pirate
this app
Those are some discouraging numbers, but it sounds like the
algorithm is a good one. Thanks for answering my questions -
that's exactly what I wanted to know.
Tom
Craig R.Hughes ([EMAIL PROTECTED]) wrote:
>
> TOTALSPAMNONSPAM
>32142280 934 SMTP
Well then that answers that!
Since I just installed Razor 2 I don't have to worry about it until SA is
updated. Then when I upgrade SA it will automatically kick in. Right!
Theo Van Dinter wrote:
>
> On Thu, Jul 18, 2002 at 01:25:22PM -0700, Kevin Gagel wrote:
> > I've installed and configured S
On Thu, Jul 18, 2002 at 10:23:05PM +0200, Alexander Skwar wrote:
> Well, seems like something is wrong with my SA installation. What's the
> expected result, when I netcat the sample-nonspam.txt to spamd? I get:
>
> host:~/.cpan/build/Mail-SpamAssassin-2.31 # netcat localhost 783 <
>sample-non
Title: Message
Hello,
Whenever I'm doing a make
I get this error.
/usr/bin/pod2man: bad option in
paragraph 95 of spamproxy/spamproxyd: ``-o'' should be
[CB]<-o>/usr/bin/pod2man: bad option in paragraph 95 of
spamproxy/spamproxyd: ``-o'' should be [CB]<-o>/usr/bin/pod2man: bad
option in par
On Thu, Jul 18, 2002 at 01:25:22PM -0700, Kevin Gagel wrote:
> I've installed and configured SpamAssassin and have it running smoothly now. I
> just downloaded and installed Vipul's Razor. The test indicates it is working
> correctly too. I'm not sure on how to configure SA to use VR though? Is it
TOTALSPAMNONSPAM
32142280 934 SMTPD_IN_RCVD
So there's about twice as much spam as nonspam sent through that
mail server. The way scores are set is related to the relative
frequency of spam vs nonspam triggering a particular rule, but
the optimizat
I guess you missed the FAQ page which talks about how we're
building an enterprise version which integrates to Exchange
Server :)
Probably about a month or so till we're into serious testing
with our beta accounts; could be a bit longer till general
availability.
C
On Thursday, July 18, 200
I've installed and configured SpamAssassin and have it running smoothly now. I
just downloaded and installed Vipul's Razor. The test indicates it is working
correctly too. I'm not sure on how to configure SA to use VR though? Is it
Automatic or do I need to set something in SA? If so what do I nee
Hello.
I think I've got some problems getting spamd to work properly. I'm
trying to get SpamAssasin 2.31 to work on my SuSE 7.2 server running
qmail. To use SA with qmail, I tried to install qmail-scanner 1.12, and
that's where my problems started...
When I'm running ./configure from qmail-sca
Actually I did it...
Unfortunatly I stoped doing it real quick.
You need to have perl installed and working then install sa through that, have
your mta call perl which calls sa etc... It took up 100% cpu cycles until the
message was processed, usually 10-20 seconds for a small message. I've added
Right before resending, kill the bad ones. Just test for 20 *'s. I write
the killed to a MBOX I can review later for collateral damage. Just send to
/dev/null to kill. If you kill, you don't need locking so the :0 should be
used instead of :0: BTW.
<>
# Save SPAM to SPAM MBOX and kill
# Tes
I was all exited about this until I noticed it was just for Outlook. I was
hoping for SA that would run on a Windows SMTP server...
Todd
[EMAIL PROTECTED]
-Original Message-
From: Craig R.Hughes [mailto:[EMAIL PROTECTED]]
Sent: Thursday, July 18, 2002 12:16 PM
To: SpamAssassin ML
Sub
That software costs $1000 minimum. However, there is an evaluation
version available. I don't see why spammers would use the eval version
of a full-fledged mail server instead of one of the great many free
or cheap programs designed solely to do mass mailing, but I accept that
it's within th
> From: Bart Schaefer <[EMAIL PROTECTED]>
>
> On Thu, 18 Jul 2002, Malte S. Stretz wrote:
>
> > > Thus I suspect that using spamtrap addresses is like arresting the
> > > junkies while the cartel goes right on smuggling in the drugs.
> >
> > That's why I have the date, time and IP in the address;
It's probably because a lot of small-time, DYI spammers use that
software to perform bulk mailing.
-Original Message-
From: Tom Grandgent [mailto:[EMAIL PROTECTED]]
Sent: Thursday, July 18, 2002 3:30 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] SMTPD_IN_RCVD test is unfair discrimination..
Hi,
I run Ipswitch Mail Server, a popular mail server on Win32, and recently
one of my users had a legitimate email he sent flagged as spam by
SpamAssassin running on the receiving server. What caught my attention
was the line:
SMTPD_IN_RCVD (2.1 points) Received via SMTPD32 server (SM
I'm still in the learning process for both SA and procmail, so pardon
my ignorance.
I want my server to nuke spams with exceptionally high scores, e.g.
>20 (I may adjust this down). My short term tests have indicate (at
least for my personal mail), that items either have a very low score
(5-
On Thursday 18 July 2002 21:06 CET Kelley Lingerfelt wrote:
> I was just looking at the man page for spamd, and noticed the -S option.
> How well does it work, I take it as soon as the magic number is hit,
> that it quits processing. Just wondering if it gets many false hits,
> some scores have ne
> For my personal use (in qmail) if I can have it also look at "Delivered-To:"
> then my problem will be solved. I'm not sure how to handle this in sendmail,
> but if someone can help me figure out where SA is determining the recipient of
> a message I'd like to try to fix this myself by making i
I was just looking at the man page for spamd, and noticed the -S option.
How well does it work, I take it as soon as the magic number is hit,
that it quits processing. Just wondering if it gets many false hits,
some scores have negative and subtract form the total score, just
wondering if anybody
> "SE" == Steve Evans <[EMAIL PROTECTED]> writes:
SE> I have SpamAssassin installed on Yoda but not SkyWalker. I'm receiving
SE> spam and it is going through SkyWalker. Has anyone ever heard of
SE> spammers purposely avoiding the higher MX value? It doesn't appear that
SE> any non-spam is
Tony Hoyle said:
>> -Original Message-
>> From: Michael Leone [mailto:[EMAIL PROTECTED]]
>> Sent: 18 July 2002 16:15
>> To: [EMAIL PROTECTED]
>> Subject: Re: [SAtalk] newbie question about rule base
>>
>>
>> Hmmm. Well, I can try it again. What info should I post, to determine
>> whether I
On Thursday 18 July 2002 19:49 CET Bart Schaefer wrote:
>[...]
> However, I don't know of anyone who's actually tracking harvesters. What
> are you going to do? Block HTTP connections from the harvester's IPs?
> Email can take the performance hit of pausing to DNSBL every incoming
> connection,
On Thu, 18 Jul 2002, Malte S. Stretz wrote:
> > Thus I suspect that using spamtrap addresses is like arresting the
> > junkies while the cartel goes right on smuggling in the drugs.
>
> That's why I have the date, time and IP in the address; I compare them
> to my access.log and if they aren't f
Can someone point out to me where spamc/spamd identifies the recipient of a
message when comparing it to all/more_spam_to entries in local.cf ?
I've found a bug in SA where if the recipient is not listed in the To: or cc:
line of the message SA is ignorant of the true recipient. This causes it
On Thu, Jul 18, 2002 at 10:10:53AM -0700, Craig R.Hughes wrote:
> fallback". Unfortunately, the spammers have caught on to that
> now.
Well, it's also a good idea because if your backup mail server is run
by your ISP or the like, they're much less likely to block open relays
and such. Since yo
Hmm, does this count as spam?
Deersoft announced today the release of their first
SpamAssassin-derived product for windows:
http://biz.yahoo.com/bw/020718/180175_1.html
Basically, an outlook plugin with an SA backend. Now Windows
users can share the benefits of SA.
For those of you who are
Smarter spammers who are trying to avoid Postini etc. will also
be smarter at avoiding our filters.
C
On Thursday, July 18, 2002, at 09:56 AM, Martin Nile wrote:
> However it seems that a higher percentage of SPAM that slips in beneath
> spamassassin came in via the secondary MX.
-
I think this is a side effect of the way Postini (and some
others) do mail filtering for enterprises -- basically they sell
a mail forwarding service, which you create as your low-score MX
record, they scrub mail, then forward to your "real" mail
server. The sales pitch says "If our service g
On Thu, Jul 18, 2002 at 12:13:38PM -0400, Rick Macdougall wrote:
> Yes I get that all the time myself. Instead of hitting the main (lower mx)
> value, they always hit the higher MX value. Not much you can do about it
> really, since the second mail server needs to accept the mail in case the
> p
Yes I see this on a regular basis. In my case the secondary MX forwards
to the spamassassin machine so most of it gets caught anyway. A
quick grep of the last 2 months of spam shows that 533 out of 6057
spams came in via my secondary MX.
However it seems that a higher percentage of SPAM that s
On Thursday 18 July 2002 17:42 CET Bart Schaefer wrote:
>[...]
> That is, somebody's harvesting those addresses, but somebody else who
> bought a list of them will be sending the mail. That second somebody
> might be two or three times removed from the original harvest and has no
> idea where the
On Thursday 18 July 2002 18:04 CET Kevin Gagel wrote:
> Mark wrote:
> > I hate to rain on your parade, but I believe this method is
> > self-defeating. In order to allow "random" mail-addresses to be valid
> > on your system -- and you do, I checked -- you basically open yourself
> > up to even mo
On Thursday 18 July 2002 17:21 CET Tony L. Svanstrom wrote:
> On Thu, 18 Jul 2002 the voices made Malte S. Stretz write:
> > That's why I'm currently working on a way to obscure the localpart;
> > compress and encipher it and encode it in a way that it is made of
> > (lower case) characters and a
> Has anyone ever heard of spammers purposely avoiding
> the higher MX value?
I've seen them do that, as well as try and connect to the host directly
(i.e. example.com instead of mailhost1.example.com or
mailhost2.example.com).
St-
---
This
Hi,
Yes I get that all the time myself. Instead of hitting the main (lower mx)
value, they always hit the higher MX value. Not much you can do about it
really, since the second mail server needs to accept the mail in case the
primary server is down.
I've also seen my primary mail server refuse
Title: Message
I have two sendmail
boxes that are front-end servers for my Exchange server.
Yoda has a MX value
of 10.
Skywalker has a MX
value of 20.
Under normal
circumstance all mail comes in through Yoda and all mail is Sent through
SkyWalker. They both take over each others r
I agree with this, I have an option that would allow me to accept all incoming
email. When it was active I had more spam incoming. When I deactivated it there
was a drop in the resource usage. I know this because my mail server is behind a
relay and the level in bounced email droped. The email wou
On Wed, 2002-07-17 at 16:10, Malte S. Stretz wrote:
> Very nice!
>
> On my website [1] I have a public e-mail address which is created every
> time you visit a page and contains date, time and IP of the visit.
> Now, finally, I got some spam on some of those dummy addresses.
I hate to rain on yo
On Wed, 17 Jul 2002, John Rudd wrote:
> The technique I've wondered about using (and I wonder how ethical it is)
Tell you what, I'll consider you to be an aggressive RBL person, and set
up a similar thing on my web site that's a CNAME for your domain. How
happy would that make you?
> So, essen
> -Original Message-
> From: Michael Leone [mailto:[EMAIL PROTECTED]]
> Sent: 18 July 2002 16:15
> To: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] newbie question about rule base
>
>
> Hmmm. Well, I can try it again. What info should I post, to determine
> whether I have a problem with my
On Thu, 18 Jul 2002 the voices made Malte S. Stretz write:
> That's why I'm currently working on a way to obscure the localpart; compress
> and encipher it and encode it in a way that it is made of (lower case)
> characters and a few numbers only. But this won't work with SSI (at least
> without
Lars Hansson said:
> On Wednesday 17 July 2002 20:49, [EMAIL PROTECTED] wrote:
>> It *is* faster than spamd, tho - when I was using spamc/spamd, it
>> would take 30+ seconds to scan; amavisd-new does it in like 3 or 4.
>
> Something must be wrong with your installation or setup.
> My average time
On Thursday 18 July 2002 16:13 CET Tony L. Svanstrom wrote:
> > On Thursday 18 July 2002 03:51 CET Kenneth Porter wrote:
> > > On Wed, 2002-07-17 at 16:10, Malte S. Stretz wrote:
> > > > On my website [1] I have a public e-mail address which is created
> > > > every time you visit a page and conta
> On Thursday 18 July 2002 03:51 CET Kenneth Porter wrote:
> > On Wed, 2002-07-17 at 16:10, Malte S. Stretz wrote:
> > > Very nice!
> > >
> > > On my website [1] I have a public e-mail address which is created every
> > > time you visit a page and contains date, time and IP of the visit. Now,
> >
On Mit, 17 Jul 2002, Michael Leone wrote:
>Mike Burger said:
>> if you're using the default behavior of letting SA mark the subject
>> line, then filtering via postfix works just fine.
>>
>> It might mean, however, that you have to enable procmail as the default
>> MDA in your postfix/main.cf fi
On Thursday 18 July 2002 03:51 CET Kenneth Porter wrote:
> On Wed, 2002-07-17 at 16:10, Malte S. Stretz wrote:
> > Very nice!
> >
> > On my website [1] I have a public e-mail address which is created every
> > time you visit a page and contains date, time and IP of the visit. Now,
> > finally, I g
67 matches
Mail list logo
