On Monday 26 January 2004 10:53 am, Chris Santerre wrote:
> There is a '\b' before that. So it is bound. Should not hit that rule ever.
> Go ahead. Send yourself an email with that in it. Try it if you don't think
> so. :)
That's right - a '\b' followed by a 'c'
Collapse all the alternatives out
Hello Who,
Friday, January 23, 2004, 5:08:57 AM, you wrote:
WK> Anthony Martinez wrote:
>> I got a spam today where the X-Originating-IP header wasn't a number. Hotmail
>> always puts the dotted quad in the header.
WK> I have been receiving a good many of these lately. I am hestant to add
WK> an
Changes:
Harvested more entries
Local Language Packs.
Added Dutch file
Updated German file with a better translation
Ruleset:
http://www.yackley.org/sa-rules/evilnumbers.cf
Language packs:
http://www.yackley.org/sa-rules/98_text_de_evilnumbers.cf -Updated
http://www.yackley.org/sa-rules/98_text_
Bob...
Once again, excellent work.
I think my only complaint now is that my master.cf is messing with your
script's ability to report the top spam receivers.
I followed the master.cf examples for Postfix located at:
http://advosys.ca/papers/postfix-filtering.html
Using this example, this page
Hi List.
Is anyone else having issues with spamd dying without notice.
All I can see in the logs is included below
Jan 25 02:30:03 jp-mx-1 spamd[10532]: clean message (-16.4/4.4) for
xadmin:501 in 74.9 seconds, 516 bytes.
Jan 25 02:30:52 jp-mx-1 spamd[10487]: identified spam (32.8/4.4) for
xad
This is a forwarded message
From: Robert Menschel <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Date: Saturday, January 24, 2004, 7:10:18 PM
Subject: [RulesEmporium] Longwords
===8<==Original message text===
Received an email this morning which reminded me about my longwords
ru
I've noticied in a lot of these phishing messages they will have links hiding the real
URL behind a fake but genuine looking URL, like the following:
http://www.visa.com:UserSession=2f6q9uuu88312264trzzz55884495&usersoption=Securit
yUpdate&[EMAIL PROTECTED]/~gotiere/verified_by_
visa.htm">http://
I an running SA on a remote machine and various users check their email from
various remote Windows machines. The spam gets filtered by Outlook into
each users spam folders on their remote machines. (Thus all my spam
messages are in a spam folder on my Windows machine, not th Linux machine
runnin
"Negative Ghostrider, the pattern is full."
:)
There is a '\b' before that. So it is bound. Should not hit that rule ever.
Go ahead. Send yourself an email with that in it. Try it if you don't think
so. :)
Then again, maybe I should mark them as spammersOh, but that is for
another list ;)
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Monday 26 January 2004 08:03 am, PieterB wrote:
> Is there some way to prevent spamassassin from using SA-talk messages
> for Bayes auto_learning. My bayes filter seems to be less effective
> since a lot of spamphrases/tokens are discussed on this l
On Mon, 26 Jan 2004, lists wrote:
> We use them as well, but I think the possible problem Thorsten is
> thinking of, is the validity of these rule-sets in a foreign language
> (i.e. German). Has anyone done any tests on this?
>
> Sure 95% of the spam coming to our (swiss) domains is in english
> (
> What is your opinion to that cf's?
> Does it make sence to take them all, or maybe only parts of
> them? Is it a good solution to install them whithout realy
> knowing how the rules are build? Only for private or also
> good at company?
It's always good to start slow in my opinion. We have backh
On Sat, Jan 24, 2004 at 03:32:39PM -0600, Harry Putnam wrote:
> Just wanted to find out if verson 2.63 inserts lines into message
> body of messages it sees as spam. Currently using 2.60 which does do
> that.
No 2.6x version will insert lines into the message body (no 2.5x
version either). You
On Mon, 2004-01-26 at 11:38, Kenneth Andresen wrote:
> Hello all,
>
> I am noticing that the majority of the current spam coming through are
> all html messages with invalid html tags, like "spam".
> Since it is rendered as html the invalid tag is removed, so we on the
> screen only see "spam".
>
Yea same here. Emails have been dead since around the 23rd or so. I got
your email through the list though, so maybe it's working now.
--
Jon
Tim B said:
> did I get booted off the list, no list traffic or is sourceforge down?
> I haven't gotten anything really since friday
>
>
>
> ---
> But now I'm faced with the daunting task of upgrading (via
> CPAN on RH 7.2,
> and I don't know squat about CPAN) from 2.55.
Upgrading is a good thing. However, since I know pretty well nothing
about Linux and precious little about CPAN, I'll leave this part for
someone else...
> Beyond that "m
On Mon, 26 Jan 2004 10:31:58 -0600 (CST)
Keith Olmstead <[EMAIL PROTECTED]> wrote:
> Hello,
>
> I hope someone can help me out. I have searched though the archives, and
> did not find my anwser. I am running 2.63 with sendmail 8.12.11 and
> procmail 3.22 on Solaris 9. From what information tha
We use them as well, but I think the possible problem Thorsten is
thinking of, is the validity of these rule-sets in a foreign language
(i.e. German). Has anyone done any tests on this?
Sure 95% of the spam coming to our (swiss) domains is in english
(well, if you clean up the bad english :-)) but
same here.
Tim B wrote:
did I get booted off the list, no list traffic or is sourceforge down?
I haven't gotten anything really since friday
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Developme
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
AltGrendel writes:
>On Fri, 2004-01-23 at 00:14, Bob Apthorpe wrote:
>> Hi,
>>
>> On Thu, 22 Jan 2004 15:12:06 -0600 Wagner One <[EMAIL PROTECTED]> wrote:
>>
>> > On 1/22/2004 1:15 PM, Bob Apthorpe wrote:
>> >
>> > > Note: I think this my hacked-up
Yea same here. Emails have been dead since around the 23rd or so. I got
your email through the list though, so maybe it's working now.
--
Jon
Tim B said:
> did I get booted off the list, no list traffic or is sourceforge down?
> I haven't gotten anything really since friday
>
>
>
> --
I am getting a lot of BigEvilList_72 (http://www.exclaimer.co.uk) FP as one
of my group clients get mail from lawyer that uses this product. Can someone
provide some feed back on why this is a rule so insted of just deleting it i
know have an educated answer to my client
Thank
Paul
-
Hello all,
Is there a setting anywhere in sa-2.55 that will allow me to change the
saved name of the files that are the saved copies of each email that sa
processes in the etc/mail/ s/d? I am specifically wanting to force sa to
change the name of the file if it IS classified as a spam message or
Actually, we can do better than that. Check out Jennifer's Backhair set.
http://www.emtinc.net/spamhammers.htm
It'll find invalid HTML tags used to break up words, and give a message points
simply for having them (so your message would have triggered BACKHAIR_22 even
though the word it's breakin
Hi Guys.
I have attached the contents on spamd -D.
I have no idea as to why the scan time is so high.
The other, identical server, runs at about 4 seconds...
Thanks to all.
Tom
> -Original Message-
> From: Mailing Lists [mailto:[EMAIL PROTECTED]
> Sent: 23 January 2004 06:52
> C
Hi fellow assassins...
I recently received an FDIC phish scam mail (tagged as spam by SA
which is good) with this embedded url:
http://www.fdic.gov=01
(inserting this into the middle of the url so the list malware
scanner doesn't reject it)
@211.191.98.216:3180/index.htm">htt=
p://www.fdic.gov/i
On Thu, 22 Jan 2004, Robert Menschel wrote:
> Would you have any objection to submitting for consideration,
> and sending in an Apache Contributor License Agreement so the SA
> developers can use this rule?
I don't object, and I'd be happy to do it. However, from what I can
find (unless I'm misu
Hello all,
I am noticing that the majority of the current spam coming through are
all html messages with invalid html tags, like "spam".
Since it is rendered as html the invalid tag is removed, so we on the
screen only see "spam".
Wouldn't it be possible to simply make a html rendering tool to f
On Monday, January 26, 2004 @ 8:03:45 AM [-0700], PieterB wrote:
> Is there some way to prevent spamassassin from using SA-talk messages
> for Bayes auto_learning. My bayes filter seems to be less effective
> since a lot of spamphrases/tokens are discussed on this list.
Do you have access to proc
On Mon, 26 Jan 2004, Keith Olmstead wrote:
[...]
> Jan 26 10:20:29 testserver.server.net spamd[623]: debug: bayes: no dbs
> present, cannot scan: /.spamassassin/bayes_toks Jan 26 10:20:29
> testserver.server.net spamd[623]: debug: Score set 1 chosen. Jan 26
> 10:20:29 testserver.server.net spamd[6
On Mon, Jan 26, 2004 at 05:03:45PM +0100, PieterB is rumored to have said:
>
> Is there some way to prevent spamassassin from using SA-talk messages
> for Bayes auto_learning. My bayes filter seems to be less effective
> since a lot of spamphrases/tokens are discussed on this list.
It depends on
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Monday 26 January 2004 07:28, Thorsten Schacht wrote:
> Hey,
>
> What is your opinion to that cf's?
> Does it make sence to take them all, or maybe only parts of them?
> Is it a good solution to install them whithout realy knowing how the rules
> a
Your Bayes must be hosed if what you think is spam gets BAYES_00.
Chris
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Paul
Diaguila
Sent: Monday, January 26, 2004 10:44 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] too much spam...
Greetings
Us
No Bayes db yet, but I would think the one rule would score it a 5
Paul
Covington, Chris wrote:
Your Bayes must be hosed if what you think is spam gets BAYES_00.
Chris
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Paul
Diaguila
Sent: Monda
I wanted to check that I wasn't missing something obvious.
1) Could sa-learn --mbox be made to ignore the fake message pine and UW imap
adds to mailboxes, or is there already a way to do that ?
2) Currently to process an entire mbox file via spamassassin -r , I use
formail -s spamassassin -r htt
I'm sure this is an FP left over from my pull from initial scripts. I don't
remember adding them by hand. They check out as legit. They will be removed
from next update. (Which was meant for last Sat. but something came up.
--Chris
> -Original Message-
> From: Paul Barbeau [mailto:[EMAIL
I want to make it so all email sent through my SMTP server from my
customers doesn't go through spamassassin. Is there a way to do that?
Kevin
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development a
There is something wrong.. My posts have been bouncing back to me with
[EMAIL PROTECTED]
Delay reason: SMTP error from remote mailer after end of data:
host sc8-sf-list1-b.sourceforge.net [10.3.1.7]:
421 Unexpected failure, please try later
> -Original Message-
> From: Gar
We use them all (bigevil; chicknpox; weeds; blackhair; tripwire...) and
haven't looked back
Todd
IT Director
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Thorsten
Schacht
Sent: Monday, January 26, 2004 9:28 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] bi
In an earlier posting I pointed out that I had noticed that a
db_verify on bayes_toks frequently yields errors of the form
db_verify: Page 2289: hash page has bad prev_pgno
db_verify: Page 2110: hash page has bad prev_pgno
and I asked if I should just ignore the errors since bayes seemed
to b
- Original Message -
From: "Arpi" <[EMAIL PROTECTED]>
> After upgrading chichekpox to Version 1.11, spamassassin --lint fails on
> every server i tried (spamassassin 2.62, perl 5.8.2).
> i've tried re-downloading many times, no change, the error is still there:
>
> [EMAIL PROTECTED]:~$ sp
I (and a few other people) have reported this with Tripwire, but I've just
installed Backhair and now the problem is much worse.
Basically those two rulesets output an entry in the report for every hit on
each of a gazillion rules. This is nice FYI stuff, but it results in headers
that exceed a
On Sun, 25 Jan 2004 15:01:24 +1100
"David Hooton" <[EMAIL PROTECTED]> wrote:
> Hi All,
>
> I've been playing with bayes on my home machine and have been very impressed
> with it. I was however wondering to what degree everyone else trusts
> BAYES_99? Is it generally accepted as a sure spamsign
LOL
Please do not send photos :-)
-Ursprungliche Nachricht-
Von: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Auftrag von Tim
B
Gesendet: Samstag, 24. Januar 2004 00:18
An: JRiley
Cc: Spamassassin-Talk (E-mail)
Betreff: Re: [SAtalk] thank you guys
> HolyMoly...69.27 seconds?!
> How'd
Sending this time from the address I'm subscribed to the list... sorry for
the double posting, but my SpamAssassin relay server has just stopped
filtering mail again. This time, while it was misbehaving, I sent a known
spam to SPAMD through SPAMC at the command line:
$ spamc -c < test
yielded
Hey,
What is your opinion to that cf's?
Does it make sence to take them all, or maybe only parts of them?
Is it a good solution to install them whithout realy knowing how the rules
are build?
Only for private or also good at company?
Best regards,
Thorsten Schacht
IT-Dept.
* TC Works So
Please disregard my previous under this subject. It never fails - I
fight with the problem for 2 days, 10 minutes after I yell for help, I
figure out what I was doing wrong.
Mike-
Mornings: Evolution in action. Only the grumpy will survive.
---
This one even has the V word spelled correctly as part of a bigger word.
How is it getting past the DRUGS and MRWIGGLY rules?
http://wa9als.com/spam2.html
I've gotten a couple of these now and have added a body check for the "grax"
word, but that seems like a bandaid.
Tnx - John
Just wanted to find out if verson 2.63 inserts lines into message
body of messages it sees as spam. Currently using 2.60 which does do
that.
Or maybe its configurable and I can set it so it doesn't do that.
Confining insertion to headers only?
Sending this time from the address I'm subscribed to the list... sorry for
the double posting, but my SpamAssassin relay server has just stopped
filtering mail again. This time, while it was misbehaving, I sent a known
spam to SPAMD through SPAMC at the command line:
$ spamc -c < test
yielded
Hi fellow assassins...
I recently received an FDIC phish scam mail (tagged as spam by SA
which is good) with this embedded url:
http://[EMAIL PROTECTED]:3180/index.htm">htt=
p://www.fdic.gov/idverify/cgi-bin/index.htm
This seems like it could be a pattern worth tagging for many points.
Almost no
At 05:02 AM 1/26/2004, Tom Meunier wrote:
You're asking why would "exotic playthings" or "excellentoffers" be a
spam indicator?
No, he's asking why exclaimer.co.uk would be considered a spam sign:
At 12:02 PM 1/23/2004, Paul Barbeau wrote:
I am getting a lot of BigEvilList_72 (http://www.exclaimer
It took two hours to bounce the email beloew around inside of SF. They
must be having some significant problems this weekend. I never got the
second email I end right after the first one.
Received: from sc8-sf-list1.sourceforge.net (lists.sourceforge.net
[66.35.250.206])
by vjo-lxutil-06
Hello,
I hope someone can help me out. I have searched though the archives, and did not find
my anwser. I am running 2.63 with sendmail 8.12.11 and procmail 3.22 on Solaris 9.
From what information that I have gathered, my user can not run spamc with out the
spamc binary having suid bit. He
On January 26, 2004 11:03 am, PieterB wrote:
> Is there some way to prevent spamassassin from using SA-talk messages
> for Bayes auto_learning. My bayes filter seems to be less effective
> since a lot of spamphrases/tokens are discussed on this list.
>
> I did a "sa-learn --mbox --forget Mail/spama
On Mon, 2004-01-26 at 10:43, Paul Diaguila wrote:
> Greetings
>
> Using SA Ver. 2.63 with Mimedefang, and still quite a bit of spam is
> getting through. Have all the current BigEvil, ect... As an
> example, a rule is in place in local.cf
>
> header SUBJECT_ENCODED_MY_TEST Subject:raw =~ /
On 24 January 2004 14:29 +0100 Arpi <[EMAIL PROTECTED]> wrote:
Hi,
After upgrading chichekpox to Version 1.11, spamassassin --lint fails
on every server i tried (spamassassin 2.62, perl 5.8.2).
Fixed in version 1.14 (which RulesduJour downloaded yesterday).
--
Mike Zanker
Northampton, UK
PGP Pub
Whenever I use sa-learn,it spits this at me:
sa-learn --dump data
Use of uninitialized value in numeric lt (<) at
/usr/local/share/perl/5.6.1/Mail/SpamAssassin/BayesStore.pm line 1284.
Any ideas?
sa-learn --version
SpamAssassin version 2.61
Jeremy Lowery
___
Is there some way to prevent spamassassin from using SA-talk messages
for Bayes auto_learning. My bayes filter seems to be less effective
since a lot of spamphrases/tokens are discussed on this list.
I did a "sa-learn --mbox --forget Mail/spamassassin-talk", which
removed the bayes learning for 99
HolyMoly...69.27 seconds?!
How'd you port SpamAssassin to run on a Commodore Vic-20?
-JR
BAHAHA... that ALMOST got me to spew coffee out my nose.
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Developm
I found the following on Dwight Halstead:
http://www.autosndeals.com/ur/ur,,_t,,itemview,,itemid,,1310.ne.aspx
http://www.thewellcommunity.org/Forums/topic.asp?TOPIC_ID=173
http://www.nexx.iact1.com/88191/index.cfm
Some even have phone numbers :)
> -Original Message-
> From: [EMAIL P
Greetings
Using SA Ver. 2.63 with Mimedefang, and still quite a bit of spam is
getting
through. Have all the current BigEvil, ect... As an example, a rule
is in place in local.cf
header SUBJECT_ENCODED_MY_TEST Subject:raw =~ /=\?.*\?=/i
describe SUBJECT_ENCODED_MY_TEST Subject begi
On Mon, 2004-01-26 at 10:21, Webmaster wrote:
> > Message: 26
> > Subject: RE: [SAtalk] Spamassassin doesn't appear to be running...?
> > From: AltGrendel <[EMAIL PROTECTED]>
> > To: SA-Talk <[EMAIL PROTECTED]>
> > Date: Fri, 23 Jan 2004 10:31:52 -0500
> >
> >
> > You may also need something like t
> Message: 26
> Subject: RE: [SAtalk] Spamassassin doesn't appear to be running...?
> From: AltGrendel <[EMAIL PROTECTED]>
> To: SA-Talk <[EMAIL PROTECTED]>
> Date: Fri, 23 Jan 2004 10:31:52 -0500
>
>
> You may also need something like this:
> http://qmail-scanner.sourceforge.net/
>
> --
> AltGrend
Hello Mark,
Friday, January 23, 2004, 7:19:45 AM, you wrote:
MS> Hi all,
MS> I have been training SA manually for a couple of weeks now. I estimate
MS> a good 2000 emails for both Spam and Ham have been learned by it.
MS> Coupla questions though . . . I want to put it into auto-learn mode
MS> be
--On Friday, January 23, 2004 6:15 PM + Technical Services
<[EMAIL PROTECTED]> wrote:
> I'm receiving some spam through my spamassassin with
> X-Spam-Status: hits=? required=?
>
> Whats the cause of this, does any one know?
Does it say '?' or another number, like 0?
Can you post the full he
Upgrade to 1.14.
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Arpi
> Sent: Saturday, January 24, 2004 7:29 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] new chicnpox --lint failed
>
> Hi,
>
> After upgrading chichekpox to Version 1.11, spa
You're asking why would "exotic playthings" or "excellentoffers" be a
spam indicator? If it gives you FPs, just lower the score in your
local.cf. Or view the source of the email in question and look at
what's tripping it. 3.0 isn't enough to FP all on its own, after all -
there's some other spa
>From [EMAIL PROTECTED] Thu Jan 22 20:18:10 2004
Date: Thu, 22 Jan 2004 20:18:08 -0800
From: Robert Menschel <[EMAIL PROTECTED]>
To: Regis Wilson <[EMAIL PROTECTED]>
CC: [EMAIL PROTECTED]
Subject: Re: [SAtalk] [RD] spammers write rules for us
>Hello Regis,
>RW> Got a spam that's so easy, the spam
Anyone seen this? NB:The From, Subject and Sender headers...
I googled for the name (as a phrase) and came up with less then 2 pages
of results and only one email address tagged to the name. Who knows if
it is him (not trying to initiate a witch hunt) but anyone else seen
this email?
Tom
Return
Whew... thought I maybe I offended or something
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.ecli
On Fri, Jan 23, 2004 at 05:22:55PM +0100, Eric Friedlingstein wrote:
> Hello,
>
> i'm using qmail with spam assassin.
>
> I was wondering if it was possible to forward all mails detected as spam
> to a specific email address instead of sending it to the originial 'to:'
> user ?
>
> (The idea
I am getting a lot of BigEvilList_72 (http://www.exclaimer.co.uk) FP as one
of my group clients get mail from lawyer that uses this product. Can someone
provide some feed back on why this is a rule so insted of just deleting it i
know have an educated answer to my client
Thank
Paul
-
Sorry for this, I stopped receiving spamassassin-talk emails late
Friday night...
--
Regards,
Matt
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
Se
did I get booted off the list, no list traffic or is sourceforge down?
I haven't gotten anything really since friday
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the
Hi,
After upgrading chichekpox to Version 1.11, spamassassin --lint fails on
every server i tried (spamassassin 2.62, perl 5.8.2).
i've tried re-downloading many times, no change, the error is still there:
[EMAIL PROTECTED]:~$ spamassassin --lint
Failed to compile body SpamAssassin tests, skippin
Slow all weekend. Only like 3 posts...
Gary
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tim
B
Sent: Sunday, January 25, 2004 8:44 PM
To: Spamassassin List
Subject: [SAtalk] the list itself???
did I get booted off the list, no list traffic or is sour
77 matches
Mail list logo
