[SAtalk] Suject not getting changed

I am running spamassassin 2.4.3 and qmail-scanner 1.15 and I it's not adding *SPAM* to the subject, below is my config, also any other things I Can Do to make it better would help as well.. Thanks -John Johnson # How many hits before a mail is consider

Re: [SAtalk] X-Rot version

On Tue, Dec 24, 2002 at 10:31:04PM -0600, Mike Loiterman wrote: > I keep getting these blank emails with this common element in the header: Wow... talk about ineffective spamming techniques. > X-Rot-Version: zvxr^nfpraqrapl(arg daf@green:~$ echo 'zvxr^nfpraqrapl(arg' | rot13 mike^ascendency(net

[SAtalk] X-Rot version

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I keep getting these blank emails with this common element in the header: X-Rot-Version: zvxr^nfpraqrapl(arg Could this ever be used for legitimate uses? Also - what sort of rule would be best to blacklist an email with this in the header? Shoul

[SAtalk] Roll back?

Hi, allI have installed SpamAssassin, but it doesn't do it's duty. Is there a  way to uninstall it or hands-on-proved HOW-TOs to make it work with vpopmail. I have read mail-toaster (all manuals, web sities, etc), but I am sure things are more complicated. I have spamd started, vpopmail patc

[SAtalk] Any spam using In-Reply-To/References-headers?

Has there been any confirmed cases of spammers using In-Reply-To/References-headers (to avoid spamfilters)? Ie, using those headers to make their spam look like a reply to something you've written on some list/news- group. /t -- # Per scientiam ad libertatem! // Through knowledge tow

Re: [SAtalk] Increase in low scoring spam?

I haven't received one in a while, I'm afraid. Mainly because of my MTA filtering. On Tue, 24 Dec 2002, Jeremy Nixon wrote: > On Tue, Dec 24, 2002 at 03:39:44PM -0500, Mike Burger wrote: > > > Check the footers...the end of their messages always have "High Speed > > Media" or "HighSpeed Media

Re: [SAtalk] Increase in low scoring spam?

I'm sure getting a variety. Here's a new example from the header: # Return-Path: <[EMAIL PROTECTED]> Received: from pin1.send-hsm-procyon-lotor-119-2873363.com (pin1.send-hsm-procyon-lotor-119-2873363.com [64.70.44.9]) by

Re: [SAtalk] Increase in low scoring spam?

On Tue, Dec 24, 2002 at 03:39:44PM -0500, Mike Burger wrote: > Check the footers...the end of their messages always have "High Speed > Media" or "HighSpeed Media" in them. And their domains always have > something like highspeed or hsm or h-s-m. > > But, if you're not getting slammed by HSM, c

Re: [SAtalk] How to remove a spam ?

Assuming you're using procmail as your system's delivery agent, and you wish to delete/forward on a systemwide level, just put this at the end of /etc/procmailrc: :0: * ^X-Spam-Status: Yes ! [EMAIL PROTECTED] # forwards to the admin mailbox or /dev/null #deletes the message right away I recom

Re: [SAtalk] Increase in low scoring spam?

Check the footers...the end of their messages always have "High Speed Media" or "HighSpeed Media" in them. And their domains always have something like highspeed or hsm or h-s-m. But, if you're not getting slammed by HSM, count your blessings and knock on wood...and pray that you don't fall vi

Re: [SAtalk] Increase in low scoring spam?

Well, you could add HSM to the blacklist_from lists, at the global level. I go a step farther...I block them at the MTA level, with a 550 message that their traffic isn't welcome here. Every time they slip through with a new domain, I add it to my spamlist for 550 rejection. On Tue, 24 Dec 200

Re: [SAtalk] Increase in low scoring spam?

On Mon, Dec 23, 2002 at 11:41:52PM -0500, Theo Van Dinter wrote: > Well, just so you know ... I took a random sampling from my corpus for > the hspeed folks... Which spams are these? I've got tens of thousands and I don't see anything which sticks out as "high speed media" or whatever... I do

Re: [SAtalk] perl startup script

On Tue, Dec 24, 2002 at 01:21:50PM +0200, Thomas Kinghorn wrote: > I see that spamd is in PERL but the redhat-rc-script is a shell script. > > Does anyone have a perl startup script for SA? Uh, why does it matter? I don't think anyone has a perl rc script for SA, there's no reason for it. -- R

Re: [SAtalk] False positive on blacklist check

Perhaps this bug would be worth a read: http://www.hughes-family.org/bugzilla/show_bug.cgi?id=1074 In short, X_OSIRU_DUL_FH should, in theory, be negative and that X_OSIRU_DUL is as it should be. However the GA assigned a small positive score to X_OSIRU_DUL_FH. I might theorize this as suggesti

Re: [SAtalk] Increase in low scoring spam?

On Tuesday, December 24, 2002, at 09:40 AM, Jonathan Duncan wrote: Have you not added them to your blacklist yet? Sure, I have. They use a new domain every time they send me spam. I can't keep up. I need some way to filter the source, like something based on NS records. Luckily, it looks like

Re: [SAtalk] Increase in low scoring spam?

Have you not added them to your blacklist yet? [EMAIL PROTECTED] said: > > >I've got my threshold set to 5, and stuff still slips through. It's > >usually *very* short spam, with cleverly spelled words like "p0rn" instead > >of "porn" and stuff like that. It's annoying, but spams like that have

Re: [SAtalk] Increase in low scoring spam?

[EMAIL PROTECTED] wrote: I've got my threshold set to 5, and stuff still slips through. It's usually *very* short spam, with cleverly spelled words like "p0rn" instead of "porn" and stuff like that. It's annoying, but spams like that have been few & far between. My threshold is at 3, other

[SAtalk] perl startup script

Good day. I see that spamd is in PERL but the redhat-rc-script is a shell script. Does anyone have a perl startup script for SA? Many thanks. Have a great Christmas and prosperous new year. Regards, Tom Kinghorn --- This sf.net email is

[SAtalk] How to remove a spam ?

Hi, I'm a new user of SA, and I want to know how I remove a mail tagged SPAM. Actually, the users receive the spam with the report of SA included in the body. When the hits are > 5.0, I want the mail to be deleted or sent to the admin's email ? Thanks a lot KARL :)