> -Original Message-
> From: Matt Kettler [mailto:[EMAIL PROTECTED]
> Sent: Thursday, November 20, 2003 4:53 PM
> To: Alex van den Bogaerdt; [EMAIL PROTECTED]
> Subject: Re: {SPAM} [SAtalk] FYI
>
>
> At 10:08 AM 11/18/2003, you wrote:
> >Spammers now send templates to use... how nice
> -Original Message-
> From: ian douglas
> Sent: Thursday, November 20, 2003 4:19 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk]
>
>
> > Just my $0.02, but I'd make it this:
> >
> > color=("?\#?F[0-9A-F]F[0-9A-F]F[0-9A-F]"?|"?white"
>
>
> FYI, you should also change
>
> color=
>
> -Original Message-
> From: spamassassin
> Sent: Thursday, November 20, 2003 2:05 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] How to mark spam for certain users and
> still deliver it?
>
>
> Hello,
>
> I have one client who wants to receive any emails they get,
> irrespective of
> "KP" == Kenneth Porter <[EMAIL PROTECTED]> writes:
>> * 3.3 MSGID_FROM_MTA_SHORT Message-Id was added by a relay
KP> Perhaps you could have the originator fix the subject line and add a
KP> Message-Id at the point of origin? That would instantly bring the score down.
the MSGID_FROM_MTA_SH
At 01:19 AM 11/21/03 +, Mark wrote:
I dunno; why is everyone so enthusiastic about cbl.abuseat.org? I added it
today, in my Milter, right after bl.spamcop.net and dynablock.easynet.nl.
But, so far, I only got 1 (!) hit on it. Seems a bit lame. Unless the former
two cover pretty much everything
THANKS! I don't know what was worse - having my MTA 550 the attempted
message or listening to talk of it every day. ;) Seriously though, thank
you!
--Larry
> -Original Message-
> From: [EMAIL PROTECTED]
> Sent: Thursday, November 20, 2003 3:49 PM
> To: [EMAIL PROTECTED]
> Subject: [SAt
At 03:36 PM 11/20/03 +, Carlos Jorge Santos wrote:
The header X-Spam-Status shouldn't cause any trouble to sa-learn, right?
What about the other header ? Is there any problem removing all the
Received headers ? Something like this :
bayes_ignore_header Received
No.. X-Spam-Status is a standa
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hello Chris,
Thursday, November 20, 2003, 7:02:39 AM, you wrote:
CS> Great, now they are quoting the wizard of Oz in the spam Bayes
CS> poison: ...
CS> Should we write rules for this, maybe Moby Dick, War and Peace, and
CS> other works? :)
CS> *end
- Original Message -
From: "Lukreme" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, November 11, 2003 7:17 PM
Subject: [SAtalk] Re: Comments on CBL DNSBL (cbl.abuseat.org)
> On 11 Nov 2003, at 10:09, Robert James Kaes wrote:
> > Hi,
> > Does anyone have any comments on the qu
> >I'm having some trouble with Bayes. Occasionally, mail will stop flowing
> >in my system. This is because my procmail spamassassin.lock file becomes
> >stale. I've futher discovered that it's because the bayes DB gets locked
> >and somehow dies midway during a rebuild. This causes my whole m
At 14:29 20/11/2003 -0800, Chip Paswater wrote:
I'm having some trouble with Bayes. Occasionally, mail will stop flowing
in my system. This is because my procmail spamassassin.lock file becomes
stale. I've futher discovered that it's because the bayes DB gets locked
and somehow dies midway duri
At 05:02 PM 11/20/2003, Mike Kuentz (2) wrote:
I'm talking about going from 10 seconds to process a
message without bayes and is now up to a minute to do it with Bayes in.
Urgh.. 10 seconds with no bayes? Are you running network checks too, or are
you running this on a 386?
---
On Thursday 20 November 2003 03:02 pm, Mike Kuentz (2) wrote:
> I can find it. I'm talking about going from 10 seconds to process a
> message without bayes and is now up to a minute to do it with Bayes in.
Could you give some specs on cpu speed, amount of memory, drives (ide/scsi/
rpm), maximum n
I'm having some trouble with Bayes. Occasionally, mail will stop flowing
in my system. This is because my procmail spamassassin.lock file becomes
stale. I've futher discovered that it's because the bayes DB gets locked
and somehow dies midway during a rebuild. This causes my whole mail system
Right, you can make an entire word optional by "grouping" it (enclosing it
in parentheses) and marking the group as optional by tacking a question
mark on the end. In your case (a single character) it is better to use
one of the other examples where you mark either a character class that
only matc
> did you mean:
> rawbody W98_UNSUBSCRIBE4 /prefer not to(?: )?see/i
> Better yet:
> rawbody W98_UNSUBSCRIBE4 /prefer not to[ ]?see/i
> or even:
> rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
Ah, didn't know I needed a trailing ? after the set of parentheses, I
thought the syntax was only
I use Bayes in a site-wide config. (2.60 w/ postfix 2.0.16) It has been
running slower and slower with the addition of Bayes to the system. If
I remove the bayes stuff, it's a lot quicker. Is there something I'm
missing? I remember seeing a similar post before, but I'll be damned if
I can find
> Just my $0.02, but I'd make it this:
>
> color=("?\#?F[0-9A-F]F[0-9A-F]F[0-9A-F]"?|"?white"
FYI, you should also change
color=
to
color(=|=3D)
since I've had some spam slip through because the '=' is converted to =3D in
the raw body.
-id
Frederic Tarasevicius
Internet Information Services, Inc.
http://www.i-is.com/
810-794-4400
mailto:[EMAIL PROTECTED]
Hello,
Try this:
rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
? means 0 or 1 of the previous
So the previous space can appear 0 or 1 times ;)
ian douglas wrote:
> My rul
At 10:08 AM 11/18/2003, you wrote:
Spammers now send templates to use... how nice of them!
Subject: Re: %RND_UC_CHAR[2-8], one madman there
Yeah, the %RANDOM_WORD stuff has been around a long time..
I'd not noticed it moving into HTML tags however.. I just modded my rules
to have a rawbody lo
On Thu, Nov 20, 2003 at 12:42:25PM -0800, ian douglas wrote:
> My rule definition:
>
> rawbody W98_UNSUBSCRIBE4 /prefer not to(?: ) see/i
>
rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
--
Scott LambertKC5MLE Unix SysAdmin
[EMAIL PROTECTED]
Hi,
On Thu, 20 Nov 2003, Smart,Dan wrote:
> Is there a reason that the Bayes scoring is NOT a normal distribution from
> 50% to 100%, and negative from 0% to 50%?
Yes, check the [SAtalk] list archives; this may well be a FAQ.
Short answer: all scores including those from Bayes are generated by a
> rawbody W98_UNSUBSCRIBE4 /prefer not to(?: ) see/i
>
>
> I want this to catch "prefer not to see" and "prefer not tosee" but the
> (?: ) doesn't seem to catch whether the space exists or not.
rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
You simply want an optional space...
...guenther
Is there a reason that the Bayes scoring is NOT a normal distribution from
50% to 100%, and negative from 0% to 50%? Why is BAYES_00 not = -1*BAYES_99
? Why would BAYES_70 score higher than BAYES_80 or BAYES_90?
Same with BAYES_20 and BAYES_10?
I've updated/rescored the following rules as define
[EMAIL PROTECTED] has been unsubscribed. (I eventually wrote an LWP
crawler to download each of the 87 chunks of the address list from
sf.net so I could grep them ;)
--j.
---
This SF.net email is sponsored by: SF.net Giveback Program.
Does So
My rule definition:
rawbody W98_UNSUBSCRIBE4 /prefer not to(?: ) see/i
I want this to catch "prefer not to see" and "prefer not tosee" but the
(?: ) doesn't seem to catch whether the space exists or not.
Spam message contains:
If you'd prefer not tosee subsequent offers:
I searched through
--On Thursday, November 20, 2003 11:05 AM -0800 spamassassin
<[EMAIL PROTECTED]> wrote:
> Hello,
>
> I have one client who wants to receive any emails they get, irrespective
> of SPAM (they suspect that there are legitimate emails being eliminated
> as spam). What they want is that anything tha
Ian,
did you mean:
rawbody W98_UNSUBSCRIBE4 /prefer not to(?: )?see/i
Better yet:
rawbody W98_UNSUBSCRIBE4 /prefer not to[ ]?see/i
or even:
rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i
--
Chris Thielen
Easily generate SpamAssassin rules to catch obfuscated spam phrases:
http://www.sandgn
At 02:58 PM 11/20/2003, Marcio Merlone wrote:
local.cf:whitelist_from_rcvd * .com.br
be white-listing everything?
That will white-list every email that passes through a mailserver named
.com.br.
If .com.br is your mail server name... then yes, you're whitelisting
everything.
The po
If you install the textcat with user root, but run spamd as another user,
make sure that everyone can read the installed libraries. I had this
problem. Not sure what caused it. Some libraries had global read, some
didn't.
<>
| -Original Message-
| From: Frederick M Avolio [mailto:[
On Thu, 20 Nov 2003, Carlos Jorge Santos wrote:
> Thanks a lot for your answer.
>
> The problem now is that SpamAssassin (spamc to be more precise) is
> called by Qmail-Scanner, which in turn adds this headers to emails:
>
> Received: from [EMAIL PROTECTED] by mail.host-services.com by
> uid 101 w
>So, while I do not like the inefficiency of the iterations, the
>effectiveness on multiple levels is excellent. The only FPs I am seeing
>
I think you can see why we desperately need to try to get an accumlator
rule for spamassassin. Multiple rule hits add up, we need it!
-
Hello,
I have one client who wants to receive any emails they get, irrespective of SPAM (they
suspect that there are legitimate
emails being eliminated as spam). What they want is that anything that is addressed
to them (yadayada.com) be sent
through the spam checker and marked as spam, but s
I have recently installed SA 2.60 from the source code on OS X along side Tenon's
Post.Office mail server. This was a manual
upgrade from the Tenon supplied SA 2.55 release to be used with their supplied SA
'plug-in'. All is well and e-mail is being
filters via SA except SA is not adding the sc
Hello,
A spam just came through my server, and it got -100 from the rule
USER_IN_WHITELIST. But that is NOT in my white-list!
[EMAIL PROTECTED] spamassassin]# pwd
/etc/mail/spamassassin
[EMAIL PROTECTED] spamassassin]# grep -v "^#" *|grep -i white
local.cf:whitelist_to [EMAIL PROTECTED], [EMAIL
On Thu, 20 Nov 2003, Josh Dayberry wrote:
> I would appreciate any help that can be offered to me. I was using spamd and spamc,
> and everything was working fine. For some reason I upgraded spamassassin to the
> newest version and now spamd and spamc won't run the dcc and pyzor tests. If I us
I'm pretty close to giving them Ye Olde 550!!
Anyone in Ottowa?
http://openrbl.org/ip/199/85/4/230.whois.htm
Don't see an abuse email either, just [EMAIL PROTECTED] .
Maybe you should retry your email J, en francaise? :)
--Chris
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:
Sorry to have to reply to my own message :)
If anyone has feedback about the improvement of the speed of these, please
let me know. I'm hoping those who had problems using the whole list, can at
least use more of them now.
I've also found a nice way of getting more spam into the evilrules corpu
Here is a spam that should convince people to turn on Bayes. This
Nigerian spam was almost certainly continually resent against
SpamAssassin 2.60. Each time, the words were altered slightly until
none of the rules fired. However, SpamAssassin with untrained Bayes
turned on can still catch the sp
Randall J. Parr wrote:
Running
Red Hat 8.0 with all current updates, sendmail-8.12.8-9.80,
procmail-3.22-7, and spamassassin-2.60-0.fdr.2.rh80
I have /etc/procmailrc passing to SpamAssassin as below:
# send mail through SpamAssassin
:0fw
* < 256000
| /usr/bin/spamc -f
It works BUT I think somet
Hi all,
After goggling and digging a little bit into mailing list archives, and
of course with the help of this mailing list, i think we've managed to
get what we want, and here goes just in case someones needs something
similar.
Our system :
FreeBSD (4.8) + Qmail-Scanner (1.20rc4) + spamd+spa
Currently I'm just using the profile systems that amavisd provides,
which is basically that allows changing of the spam level and whether or
not they want spam tagged or rejected or SA disabled completely for
their account.
You can see what things you can key on in the amavisd polices by lookin
"Colin A. Bartlett" wrote:
> I would think you could write a mime boundries rule like Matt suggests
> but score it 0 on the site wide config. Then just score it something
> higher on the individual users config file. Crew, am I wrong here?
I've done exactly that for a few users with oddball email
Running
Red Hat 8.0 with all current updates, sendmail-8.12.8-9.80,
procmail-3.22-7, and spamassassin-2.60-0.fdr.2.rh80
I have /etc/procmailrc passing to SpamAssassin as below:
# send mail through SpamAssassin
:0fw
* < 256000
| /usr/bin/spamc -f
It works BUT I think something needs to be setup
This is more of a procmail question. But I can't seem to find the answer.
I have procmail handling the email and dealing with spam messages properly,
thanks to this forum! However the final step is that some people have
blackberries and although they get email through the .forward, they still
get
Simplest way is to use the basic
whitelist_from in your local.cf file
# Whitelist and blacklist addresses are
now file-glob-style patterns, so
# "[EMAIL PROTECTED]",
"[EMAIL PROTECTED]", or "*.domain.net" will all work.
So if I wanted to whitelist anyone with an
@sourceforge.net ad
On Thu, 20 Nov 2003, Daniel Kaliel wrote:
> :0
> *
> ! [EMAIL PROTECTED]
You don't need the "*" line there. No conditions is the same as an empty
condition.
> Does not deliver the email to the email on the server, instead fires
> everything off to there blackberry.
Right, a forwarded message i
- Original Message -
From: "Patrick T. Tsang" <[EMAIL PROTECTED]>
To: "Jason McCormick" <[EMAIL PROTECTED]>
Sent: Thursday, November 20, 2003 6:47 PM
Subject: Re: Postfix & Spamassassin - problem in mailling list?
> Dear Jason,
>
> Thanks for your help.
>
> In fact, I am doing exactly w
How do I to insert many domains in whitelist?? Help me please!!
Julio Cesar - ATN Network - Sao Paulo/Brasil
I would appreciate any help that can be offered to
me. I was using spamd and spamc, and everything was working fine.
For some reason I upgraded spamassassin to the newest version and now spamd and
spamc won't run the dcc and pyzor tests. If I use spamassassin however the
tests are run cor
Checks if Spam Assassin is being called somewhere upstream or if you are accidentally
checking each email twice.
--
Chris Thielen
Easily generate SpamAssassin rules to catch obfuscated spam phrases:
http://sandgnat.com/cmos/
-Original Message-
From: "Martin Hynd"<[EMAIL PROTECTED
>From the sa-learn man page:
"If the messages you are learning from have already been filtered
through SpamAssassin, the learner will compensate for this. In effect, it
learns what each message would look like if you had run `spamassassin -d'
over it in advance."
On Thu, 20 Nov 2003 12:39
I would appreciate any help that can be offered to
me. I was using spamd and spamc, and everything was working fine.
For some reason I upgraded spamassassin to the newest version and now spamd and
spamc won't run the dcc and pyzor tests. If I use spamassassin however the
tests are run cor
Thanks a lot for your answer.
The problem now is that SpamAssassin (spamc to be more precise) is
called by Qmail-Scanner, which in turn adds this headers to emails:
Received: from [EMAIL PROTECTED] by mail.host-services.com by
uid 101 wi
(spamassassin: 2.60. Clear:RC:0:SA:1(11.3/8.0):.
Proce
> -Original Message-
> From: Robert Menschel [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, November 19, 2003 9:57 PM
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> Hello Chris,
>
> Wednesday, November 19, 2003, 7:56:21 AM, you wrote:
>
> CS> Somtimes, and this may NOT be one of
At 12:39 PM 11/20/03 +, Carlos Jorge Santos wrote:
We're in the process of feeding sa-learn with spam and ham so we can use
The Bayes filters.
But a doubt has crossed our mind... All of our Spam has the SpamAssassin
header, feeding this mails to sa-learn will make the Bayes database thins
th
Great, now they are quoting the wizard of Oz in the spam Bayes poison:
"Ejcev wpgn gekqdakf The little party of strangers now followed the Prince
across a few more of the glass bridges and along several paths until they
came to a garden enclosed by a high hedge Do give the boy a chance, Belinda
"
At 03:48 PM 11/20/03 +1100, Zlatko Hristov wrote:
Does Razor and DCC do a direct lookup to same database on the internet
every time SA scans a message? Or its storing that database localy somehow.
I know that razor checks it's server each time a message is scanned. Razor
never stores a database l
On Thu, 20 Nov 2003, Matt Kettler wrote:
> Have you considered escaping the underscore? Although it's not required to
> escape an underscore in a URI by RFC standards, there's no reason you can't
> encode them as %2D.
>
> Thus:
> http://www.example.com/my_file_name.htm
> becomes
>
* Johann Spies ([EMAIL PROTECTED]) wrote:
> On Thu, Nov 20, 2003 at 11:27:38AM +0100, Sascha Huedepohl wrote:
>
> > is there a way to remove or manually alter an entry in the Bayes
> > database?
>
> sa-learn --forget
if i understand the manula this will make Spamassassin forget it has
learn fro
Hi all,
We're in the process of feeding sa-learn with spam and ham so we can use
The Bayes filters.
But a doubt has crossed our mind... All of our Spam has the SpamAssassin
header, feeding this mails to sa-learn will make the Bayes database
thins that all mails with a spamassassin tag are junk
On Thu, Nov 20, 2003 at 11:27:38AM +0100, Sascha Huedepohl wrote:
> is there a way to remove or manually alter an entry in the Bayes
> database?
sa-learn --forget
Regards
Johann
--
Johann Spies Telefoon: 021-808 4036
Informasietegnologie, Universiteit van Stellenbosch
"If my peo
Ditto, kinda, mine is specific to this list:
whitelist_to [EMAIL PROTECTED]
whitelist_from_rcvd [EMAIL PROTECTED] lists.sourceforge.net
Works for me and is harder for spammers to abuse.
Note that for this to work your mail system must be set up in such
a way that spamassassin can "see" the e
- Original Message -
From: "Patrick T. Tsang" <[EMAIL PROTECTED]>
To: "Matt Kettler" <[EMAIL PROTECTED]>
Sent: Thursday, November 20, 2003 6:57 PM
Subject: Re: [SAtalk] mysql spamc ignores the email in mailling list
> At 06:09 PM 11/19/03 +0800, Patrick T. Tsang wrote:
> > > From the ma
Dear Ryan,
Thanks for your help.
Do u have any worked examples?
Patrick
- Original Message -
From: "Ryan Moore" <[EMAIL PROTECTED]>
To: "Patrick T. Tsang" <[EMAIL PROTECTED]>; "spamassassin-Talk"
<[EMAIL PROTECTED]>
Sent: Thursday, November 20, 2003 6:24 AM
Subject: Re: [SAtalk] mysql
Hi,
is there a way to remove or manually alter an entry in the Bayes
database?
TIA
sascha
---
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? S
Razor does a lookup to the Razor server every time. Nothing is cached.
I assume the same for DCC
On Thu, Nov 20, 2003 at 03:48:51PM +1100, Zlatko Hristov wrote:
> Hello,
>
> Does Razor and DCC do a direct lookup to same database on the internet
> every time SA scans a message? Or its storing
This problem has caused me to stop using Spamassassin to do individual
reporting, and instead strip the emails and use razor itself to send spam
in batches. I've found this to decrease the errors substantially.
Additionally, now that I send in batches every 5 minutes, if razor refuses
the report,
I had a quick look through the archives to see if this was already
answered but I couldn't see it...apologies if I missed it!
I run SpamAssassin and use a .procmailrc file with what seems to be a
popular recipe:
:0fw: spamassassin.lock
| spamc
:0:
* ^X-Spam-Status: Yes
mail/SPAM
All spam mai
At 11/19/03 03:47 PM , Regis Wilson wrote:
Just thought I'd share. I don't have access to the rbls so I did a grep on
two day's worth of spam IPs (received: line from mailserver). I have this:
no. spamnetwork
472366.0.0.0
And then I broke it down smaller:
587 66.2
70 matches
Mail list logo
