MMEDIATELY on any FPs you may encounter. This version runs even
faster and is smaller then all previous versions.
http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rule
> -Original Message-
> From: Matt Kettler [mailto:[EMAIL PROTECTED]
> Sent: Friday, January 30, 2004 10:55 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] [RD] spammer reactions to antidrug (humorous)
>
>
> Today I got an interesting form of obfuscation, apparently to avoid
> antidrug.c
Yeah, my bigevil thoughts post was sent ages ago! almost 2 weeks before it
showed up on the list. I posted a bigevil update and haven't seen it yet!
WTF?
--Chris
> -Original Message-
> From: Gary Funck [mailto:[EMAIL PROTECTED]
> Sent: Thursday, January 29, 2004 1:08 PM
> To: Spamassassin
report them to playaudiomessage.com. But by the looks from their
website, they don't want to hear from you anyway.
They stay.
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the strongest of the sp
story :-)
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the strongest of the species that survives,
not the most intelligent, but the one most responsive to change.'
2:02 AM
> To: Chris Santerre; '[EMAIL PROTECTED]';
> [EMAIL PROTECTED]
> Subject: Re: [SAtalk] bigevil_54 smonitor
>
>
> On Monday 26 January 2004 10:53 am, Chris Santerre wrote:
> > There is a '\b' before that. So it is bound. Should not hit
> that ru
"Negative Ghostrider, the pattern is full."
:)
There is a '\b' before that. So it is bound. Should not hit that rule ever.
Go ahead. Send yourself an email with that in it. Try it if you don't think
so. :)
Then again, maybe I should mark them as spammersOh, but that is for
another list ;)
I'm sure this is an FP left over from my pull from initial scripts. I don't
remember adding them by hand. They check out as legit. They will be removed
from next update. (Which was meant for last Sat. but something came up.
--Chris
> -Original Message-
> From: Paul Barbeau [mailto:[EMAIL
> -Original Message-
> From: sckot [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, January 21, 2004 3:45 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Multi-line matching workarounds?
>
>
> Some archive searching has revealed that multi-line
> matching isn't
> available yet. Is the
> Brad
>
header __CS_FROM_ME From =~ /[EMAIL PROTECTED]/i
header __CS_TO_ME To =~ /[EMAIL PROTECTED]/i
meta CS_SPAM_TRICK __CS_FROM_ME && __CS_TO_ME
describe CS_SPAM_TRICK Spammer forged From + To my domain.
score CS_SPAM_TRICK 114.11 # Silly, isn't it?
Change to your own
Very interesting. Notice the attempt to get confuse the url. Not sure if
that is attempted at my old bigevil mining scripts.
I'll add plus66.com into bigevil for next update. MrWiggly rule is only for
that one type V-drug spam. It has had NO false positives to date. So I'm
jacking my score up to
Soon there will be one place to go ;)
> -Original Message-
> From: Frank Pineau [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, January 20, 2004 8:51 PM
> To: Spamassassin-Talk (E-mail)
> Subject: Re: [SAtalk] UPDATES Tripwire 1.16 and Bigevil 2.06k
>
>
>
> >http://www.merchantsoverseas.com/
egit and not a scam, then why oh why on earth would they
hire a spammer. Also the products website is no where to be found in the
email source. Only thru a redirect.
I'm thinking the product website should be larted just for hiring the
spammers!
mesg attached.
Chris Santerre
System Admi
I agree and disagree :)
How many times have you heard this:
"I don't understand, I have antivirus software."
"When was the last time you updated it?"
"Update?"
:-)
I know tons of people with broadband connections that might be on only a few
times a week. Some don't even notice their cpu
aaap :)
Just send them to me offlist. However FP reports you might want to copy
here. As I remove them from the NEXT update. But people might want to remove
them right away. They still trickle in now and then.
--Chris (bored today for some reason)
> -Original Message-
> Fro
technology obviously
> exists and
> I think is a much better option.
>
> Thanks,
> James
>
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Pierre Thomson
> Sent: Wednesday, January 21, 2004 10:13 AM
> -Original Message-
> From: Fred [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, January 21, 2004 9:39 AM
> To: AltGrendel; Spamassassin-Talk (E-mail)
> Subject: Re: [SAtalk] [OT] - The current state spam.
>
>
> AltGrendel wrote:
> > On Tue, 2004-01-20 at 18:28, Fred wrote:
> >>
> >> I ca
I'm not sure where the post is, but about 3 weeks ago I think Dallas put a
semi-end to the spell-checker debate :) He ran one and the outcome wasn't so
good.
--Chris
> -Original Message-
> From: Charles Gregory [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, January 20, 2004 4:37 PM
> To: [EM
> -Original Message-
> From: Matt Kettler [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, January 20, 2004 4:04 PM
> To: Adrian Simmons
> Cc: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] how many spam/ham do I have in my bayes db?
>
>
> At 03:36 PM 1/20/2004, Adrian Simmons wrote:
> >Ralf Vitas
Just posted 2.06M wich contains 1 single additional entry for:
oem-expert.biz
Why just for one domain? Because they are doing a dictionary attack on a
fellow list member resulting in a DOS.
Let the larting begin!
http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
Chris Santerre
http://sandgnat.com/cmos/rules_du_jour
I save
WY to many emails :)
--Chris
-Original Message-From: JRiley
[mailto:[EMAIL PROTECTED]Sent: Tuesday, January 20, 2004 1:52
PMTo: [EMAIL PROTECTED]Subject:
[SAtalk] Automated ruleset download
Just curious, if there is
Just posted 2.60L.
http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the strongest of the species that survives,
not the most intelligent, bu
3 Fax -- 4156341323
Domain servers in listed order:
NS0O01.GOODWEBRX.COM
NS0O01.MYEFUTURE.NET
Chris Santerre
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integrati
> -Original Message-
> From: Scott Williams , Area4 [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, January 20, 2004 9:50 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Schools Slapped? FVGT
>
>
> I just started using the FVGT rules and got this FP.
> Do I understand this right, the rule belo
Bah! What was that quote? Something about real men put there files on the
internet and letting the world be their backup? Theo has it. :)
--Chris (OH I hate EDI! Standard my #$^!)
> -Original Message-
> From: Gary Smith [mailto:[EMAIL PROTECTED]
> Sent: Monday, January 19, 2004 4:21 PM
>
> -Original Message-
> From: SpamTalk [mailto:[EMAIL PROTECTED]
> Sent: Monday, January 19, 2004 3:32 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] BigEvil Archive
>
>
> > -Original Message-----
> > From: Chris Santerre [mailto:[EMAIL PROTECT
> -Original Message-
> From: Evan Platt [mailto:[EMAIL PROTECTED]
> Sent: Monday, January 19, 2004 12:36 PM
> To: SpamAssassin
> Subject: Re: [SAtalk] Three that got through yesterday
>
>
>
>
> --On Monday, January 19, 2004 10:51 AM -0500 "Christopher X. Candreva"
> <[EMAIL PROTECTED]
Huh? That was posted 2 days ago! And I had tested it longer then that! IF
there was an error, I would have heard about it within an hour of posting.
What kind of errors in the log? ANyone else having a problem
--Chris
> -Original Message-
> From: Carl Chipman [mailto:[EMAIL PROTECTED]
igevil 2.06k
>
>
> Chris,
>
> What about
> http://www.merchantsoverseas.com/wwwroot/gorilla/90_FVGT.cf file
> you submitted? Is that rule set superceded by bigevil and tripwire?
>
> thanks,
> Donald
>
> -Original Message-
> From: Chris Santerre [mai
I was hoping more people would be running this by now. What is the average
scan time per msg when using this? Any timeouts? I know this was being
worked on for 2.70, but heck you got it here as a patch already!
--Chris (Really needs to upgrade but still proving a point.)
> -Original Message
Inline below
> -Original Message-
> From: Robert Menschel [mailto:[EMAIL PROTECTED]
> Sent: Sunday, January 18, 2004 11:02 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Re: [RD] Offered Rules
>
>
> Here's my next set of possible rules for submission to the
> SpamAssassin
> distribu
vid A. Carter [mailto:[EMAIL PROTECTED]
> Sent: Sunday, January 18, 2004 12:18 PM
> To: Chris Santerre
> Cc: Spamassassin-Talk (E-mail)
> Subject: Re: [SAtalk] UPDATES Tripwire 1.16 and Bigevil 2.06k
>
>
> Quoting Chris Santerre <[EMAIL PROTECTED]>:
>
> >
> -Original Message-
> From: Fred [mailto:[EMAIL PROTECTED]
> Sent: Saturday, January 17, 2004 3:54 PM
> To: [EMAIL PROTECTED]
> Cc: Spamassassin-Talk (E-mail)
> Subject: Re: [SAtalk] Image-ONLY e-mails not filtered?
>
>
> [EMAIL PROTECTED] wrote:
> > FYI -- I'm noticing SPAMs which con
to find them
by now, you must be under a rock (Or a Colts Fan!) ;) Go Pats!
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the strongest of the species that survives,
not the most intelligent, but the
oned a few times of
course. :)
There is some other small things I still want to digest and talk to the rule
writers about. Talk about becoming less reactive got me thinking on some
stuff. I urge anyone with the time to view the webcasts. I understood a HELL
of a lot more then last year ;)
Hopefuly I&
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: Friday, January 16, 2004 8:08 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Image-ONLY e-mails not filtered?
>
>
> FYI -- I'm noticing SPAMs which contain ONLY an image are not
> being filtered
> at all.
This is some pretty good info. Can you trow something up on either wiki
about exim users/lots of rules/long headers/and default buffer size? I'm
sure others might start having this problem.
good find!
--Chris
> -Original Message-
> From: Zarjazz [mailto:[EMAIL PROTECTED]
> Sent: Friday,
UBE/UCE policy, or I
will put them back in.
--Chris (cold, so very cold) Santerre
> -Original Message-
> From: JRiley [mailto:[EMAIL PROTECTED]
> Sent: Friday, January 16, 2004 10:16 AM
> To: Overdijk, Harrie; 'Chris Santerre'
> Cc: 'Spamassassin-Ta
As you can see, I'm in my office now. I was halfway there! Its really a
thrilling tail that starts with arctic temperatures, a faulty water pump or
thermostat. Me in the cold with no heat for over an hour. My precious sports
car on a flat bed with possible valve damage, and a HUGE tow bill because
Wow that is weird! I think I'm running Tripwire 1.13 because they came so
fast and furious I didn't get a chance to upgrade my own server today. Is
there some limit to mimedefang? I haven't seen these errors but don't use
mimedefang. But I run more rules then almost anyone. I only have 64 megs! SA
! lol.
--Chris
> -Original Message-
> From: Daniel Kleinsinger [mailto:[EMAIL PROTECTED]
> Sent: Thursday, January 15, 2004 10:10 PM
> To: Chris Santerre
> Subject: BigEvil FP
>
>
> BigEvilList_37 hits on biz.yahoo.com which gave me an FP on an email
> from t
://sthomas.net/spam.txt
>
>
> On Thu, Jan 15, 2004 at 02:10:24PM -0500, Chris Santerre is
> rumored to have said:
> >
> > This thread is useless without pics!
> >
> > Oh wait, sorry.
> >
> > This post is useless without the spam! :)
> >
&
that you don't fully understand to under .50 (Well
except for Bigevil!)
So the answer to your questions is.soon. We are woking on cleaning up
what we have now.
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
$/
What do you think?
And I've looked at the numbers. The spam traffic is still increasing since
the begining of the year, but my MTA level denials have also increased. The
guys at the DNSRBLs are really doing a bang up job. So the amount of spams
that gets caught for me to play with have gone
Fred thawd out. Added the PGP stuff that was requested. Update posted to my
site. Link in sig.
Who says opensource doesn't respond quickly?
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the
This thread is useless without pics!
Oh wait, sorry.
This post is useless without the spam! :)
Try the new version of Tripwire (1.14) posted today. It's been beechwood
aged for twice the flavor!
--Chris
> -Original Message-
> From: Steve Thomas [mailto:[EMAIL PROTECTED]
> Sent: Thursda
Not that I don't like this discussion, but this really is getting way off
topic for Spamassassin.
Can it be taken offlist now?
--Chris
> -Original Message-
> From: Brian May [mailto:[EMAIL PROTECTED]
> Sent: Thursday, January 15, 2004 12:30 PM
> To: Greg Cirino - Cirelle Enterprises; Ba
Sorry it took so long, I was waiting to hear back from Fred. He is trapped
in the North :)
Veriosn 1.14 has been posted to web with Bart Schaefer's changes! Nice work
Bart!
http://www.merchantsoverseas.com/wwwroot/gorilla/99_FVGT_Tripwire.cf
Chris Santerre
System Admin and SA Custom
"holdontrynow.com" is actually in my list to add. I'm sorry to say that at
my fastest, additions to Bigevil will take at least 2 days. With sooo many
people using, and a promise of ZERO FPs, I need to test overnight. Sometimes
I like to test more if the update was signifigant.
I search for all so
> -Original Message-
> From: Kurt Yoder [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, January 14, 2004 4:54 PM
> To: Chris Santerre
> Cc: 'Matthew Trent'; Spamassassin-Talk
> Subject: RE: [SAtalk] RE: New Ruleset Available!!! TRIPWIRE! You don't
> want
> -Original Message-
> From: Kurt Yoder [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, January 14, 2004 4:45 PM
> To: Chris Santerre
> Cc: 'Matthew Trent'; Spamassassin-Talk
> Subject: Re: [SAtalk] RE: New Ruleset Available!!! TRIPWIRE! You don't
> want
> -Original Message-
> From: Mike Batchelor [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, January 14, 2004 2:39 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] Spamwriter
>
>
> --On Wednesday, January 14, 2004 8:28 AM -0600 Bob Apthorpe
> <[EMAIL PROTECTED]> wrote:
>
> > IDP broadba
*SNIP*
>
> Well I tried to send this through the GMANE mail-to-news thing but it
> complained about me not being subscribed to the list, so I'm
> just sending
> it directly to you:
>
> After installing the tripwire rules I see the following in my
> Exim paniclog
> (I'm using exiscan):
> 2004-01
I've had a rule like this from way back. Works great!
header MY_IP Received =~/\b(from xxx\.xxx\.xxx\.xxx)\b/i
describe MY_IP WHy would I get email from myself?
score MY_IP 1.0
Where xxx is your server ip address.
I highly recommend people use this rule. 81 hits in December. It used to be
a LOT
And just like that we have an update already. A few FPs fixed thanks to some
SATALK members. So Bigevil 2.06i and Tripwire 1.13 have been posted.
(I still think emode.com is spam! But removed.)
For those of you who sent me domains to add to bigevil this week, they will
be in the next update. I h
*snip*
>
> It may be a coincidence, but all these emails have a subject like
> that. The body of the mail is just a random collection of words, about
> 4 lines long. Some examples:
>
> Re: FQCDW, thousand years waiting
> Re: YAS, here the investigator
> Re: SAHQSC, of the gift
> Re: IN, that you
is about to go thru EVERY rule in the SARE. We are looking at
the highest spam + ham hitters first. So this should be cleared up soon.
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the strongest of
I suggest an additional meta for airport ham :) Nice find!
Yeah Fred is like a pitbull for this stuff! Most of the rule writers in the
group think about spam a little too much. Myself included. We won't even go
into someone's Wizard of Oz dream ;)
--Chris(Cursing Apple today!) Santerre
> -Or
>
> Thanks all, I hope they work great for everyone and at the
> time I am writing
> this, I don't see anymore spam with this stuff in it, now it's all
> high-level bayes busting words..
>
Isn't that project #105738 for us? Bayes poison here we come ;)
Yeah this is strictly based on english.
group of people! So it gives me great
pleasure to post in Fred's honor, the link to Tripwire:
http://www.merchantsoverseas.com/wwwroot/gorilla/99_FVGT_Tripwire.cf
It can also be found on my SARE page under Fred's section.
Enjoy!
Chris Santerre
System Admin and SA Custom Rules
Negative
rules should be left off list. The lurkers eat them up :)
The only way
I know of to configure this is by procmail skipping email larger then a certain
size. But it has been a while since I looked at that part of SA. Otherwise, a
rule like this would be fine.
(How long
until we
Someone just emailed me about this. The link added to the end of every post
is no longer archiving since last year.
http://www.spamassassin.org/lists.html
Archive #1 is my Favorite :)
We should get that changed!
--Chris
> -Original Message-
> From: Jonathan Nichols [mailto:[EMAIL PR
> -Original Message-
> From: Dallas L. Engelken [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, January 13, 2004 11:38 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [WL] [SAtalk] How to count pattern matches?
>
>
> > > On Tue, 13 Jan 2004, Christian Recktenwald wrote:
> > > > is there a possibil
> -Original Message-
> From: Charles Gregory [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, January 13, 2004 11:16 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [WL] [SAtalk] How to count pattern matches?
>
>
> On Tue, 13 Jan 2004, Christian Recktenwald wrote:
> > is there a possibility to coun
> -Original Message-
> From: Chip Paswater [mailto:[EMAIL PROTECTED]
> Sent: Monday, January 12, 2004 9:32 PM
> To: Chris Santerre
> Cc: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] Low score for so many hits?
>
>
> > *sigh*
> > HABEAS_SWE
> >
*snip*
> savvy users. Mary Youngblood, abuse team manager at
> EarthLink, suggests
> putting numbers in the middle of your e-mail address to make it more
> difficult to guess and using a separate address for online
> shopping and
> newsgroup postings. [AP, Jan 11 2004; NewsScan Daily, 12 Jan 200
What MTA are
you running on the MX server?
-Original Message-From: Pankaj Shrestha
[mailto:[EMAIL PROTECTED]Sent: Tuesday, January 13, 2004 1:28
AMTo: [EMAIL PROTECTED]Subject:
[SAtalk] setting up spamassassin on Gateway server (MX)
Dear all,
I have a MX serv
> -Original Message-
> From: Brian McGroarty [mailto:[EMAIL PROTECTED]
> Sent: Monday, January 12, 2004 11:36 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] filter suggestions
>
>
> What's the proper way to suggest a new filter to the SA developers?
>
> I'm getting a TON of mail with a
*sigh*
HABEAS_SWE
Do people read this list or just post questions? Sorry, not meant to lash
out, but this Habeas topic has been all the rage today. Don't know how
anyone could miss it.
--Chris
> -Original Message-
> From: Chip Paswater [mailto:[EMAIL PROTECTED]
> Sent: Monday, January
It was discussed a while back how the phrases like:
"This message conforms to the requirements of the 'CAN-SPAM Act of 2003' and
was sent to you by .."
Just wanted to let you guys know I'm seeing it in legit ham now. Careful
using a rule for this stuff.
Chris Sant
Comments inline...
>
>
>
> This is a resubmission of a question that I have been trying
> to sort out
> for about a week now. I am trying to tag messages that have more than
> 10 random words in the message body of an incoming e-mail I am running
> the following
>
*snip*
>
> This is the .c
I'm attaching one that was posted to another list. Unix Text format.
(receiver address munged.)
It is UGLY.
--Chris
> -Original Message-
> From: Scott Lambert [mailto:[EMAIL PROTECTED]
> Sent: Sunday, January 11, 2004 6:34 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Obscured web site
Check the SARE site for a rule called "AF_MEDICAMENTOS". I believe it was
submitted by a guy from Mexico. It tags a lot.
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
'It is not the strongest of t
.0 or higher though procmail scripts. They get
diverted to a spam bucket to be checked by me. I consider spam marked
between 5-7 a failure, because I don't want my users to see any spam :)
I've had great success in scoring spam over 7 even without Bigevil.
Chris Santerre
System Admi
I was going to post my stats as well. Slight increase in spam. Not getting
thru, but increase in being sent ;) *sigh*
"The goggles, they do nothing!" - McBane
I also get a lot of "Survey" calls at home now. *Deep sigh*
--Chris
> -Original Message-
> From: Gary Funck [mailto:[EMAIL PRO
Updated and tested over the weekend.
I'm still working on a good rule to catch the G.Bush V-drug look-a-like
spam. This guy changes domain names all the time. Something soon I hope.
http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
Chris Santerre
System Admin and SA Custom
Spam (tm.) Patent pending...blah blah lol..
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
"A little nonsense now and then, is relished by the wisest men." - Willy
Wonka
-
> -Original Message-
> From: Nix [mailto:[EMAIL PROTECTED]
> Sent: Friday, January 09, 2004 3:29 PM
> To: Robert Menschel
> Cc: Bert Rapp; [EMAIL PROTECTED]
> Subject: Re: [SAtalk] Is BigEvil for me?
>
>
> On Thu, 8 Jan 2004, Robert Menschel uttered the following:
> > Yes, there are thr
I'm just getting to my 2 day corpus of spam and noticed this whacko:
mdpillsource.com
All over the place. You may want to right a rule for him or manually enter
him just for the weekend until I update Monday or Tuesday. I'm not going to
let any quick updates get posted without testing. But I figu
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: Friday, January 09, 2004 2:58 PM
> To: Chris Santerre
> Cc: 'AltGrendel'; Spamassassin-Talk (E-mail);
> [EMAIL PROTECTED]
> Subject: adding rules to the core set: need a vo
Did you get that from my SARE? I'm not sure if there is a comment that it
requires 2.60 or not. Let me know. I've got sooo many fules by Fred its
silly :)
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
I didn't know that! I added this info to the cf file for debian users.
Thanks!
--Chris
> -Original Message-
> From: Chris Thielen [mailto:[EMAIL PROTECTED]
> Sent: Friday, January 09, 2004 4:38 AM
> To: [EMAIL PROTECTED];
> [EMAIL PROTECTED]
> Subject: RE: [SAtalk] BigEvil and Debian ama
> -Original Message-
> From: AltGrendel [mailto:[EMAIL PROTECTED]
> Sent: Friday, January 09, 2004 8:14 AM
> To: Spamassassin-Talk (E-mail)
> Subject: RE: [SAtalk] Bigevil 2.06f posted.
>
>
> On Thu, 2004-01-08 at 20:33, Chris Santerre wrote:
> > Sorry it
> -Original Message-
> From: Robert Menschel [mailto:[EMAIL PROTECTED]
> Sent: Thursday, January 08, 2004 10:40 PM
> To: Steve Thomas
> Cc: John Fleming; [EMAIL PROTECTED]
> Subject: Re[2]: [SAtalk] Simple newbie question
>
>
> Hello Steve,
>
> Thursday, January 8, 2004, 11:25:20 AM, y
www.exit0.us has a section on catching viri with spamassassin. Debate if
this is a good thing to do if you like. All I'm saying is it _is_ possible
to tag it.
--Chris
> -Original Message-
> From: Jeff Lasman [mailto:[EMAIL PROTECTED]
> Sent: Friday, January 09, 2004 9:57 AM
> To: [EMAIL
How did you download the file? Did you go from a windows machine to a *nix
server? If there was a problem with this file, I would have heard about it
real fast :)
You might have PC characters in it if you d/l'd it from a PC. Try using
TextPad to save it in unix format.
HTH,
--Chris
> -Orig
bigevil
poisons :)
Thank goodness that stage of the project is over :P But this is something
to keep in mind if a URI-ABL is ever to be tried.
I'm surprised google has this. I guess they want to offere _everything_
yahoo does ;)
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
Someone has been working on different methods of tagging on the bayes
poison. Some ideas failed, but some new one look promising. Just have to
wait and see how the numbers pan out.
--Chris
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: Friday, January 09
: RE: [SAtalk] Bigevil 2.06f posted.
>
>
>
>
> >-Original Message-
> >From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Chris
> Santerre
> >Sent: Thursday, January 08, 2004 6:42 AM
> >To: Spamassassin-Talk (E-mail)
> &g
Another update. Bunch of stragler FPs removed. Thank you Robert M!
Faster and smaller again. I hope to try to convert all the regex code this
weekend. But I'm not holding my breath :)
Tested overnight with no problems.
http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
Chris San
It will be in the next update ;)
Thanks
--Chris
> -Original Message-
> From: Rubin Bennett [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, January 07, 2004 2:46 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Sneaky spam
>
>
> another one...
> only scored 0.9 on my sitewide SA, and 2.5 on m
Yes you may post the spam. Is it the white image with a doctor standing
there looking like G.W.Bush contemplating his exhistence? The one selling 6
kinds of Mr. Wiggly enhancing drugs?
If so..I'm working on it :)
--Chris
> -Original Message-
> From: Geoff Soper [mailto:[EMAIL PROTEC
I gained 12 lbs over the holidays and time off from hockey. I plan to lose
the weight off again. But lots of people talk about losing weight. Some of
these phrases would be in legit casual emails.
--Chris (So far: no goals, no assists, plenty of penalties.) Santerre
> -Original Message-
> -Original Message-
> From: Scott A Crosby [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, January 06, 2004 7:01 PM
> To: Chris Santerre
> Cc: Spamassassin-Talk (E-mail)
> Subject: Making bigevil faster by finding common prefixes
>
>
> On Wed, 24 Dec 2003 10:
>
> Thanks, Billy
>
> - Original Message -
> From: "Jonathan Nichols" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Tuesday, January 06, 2004 11:29 AM
> Subject: Re: [SAtalk] Smart SPAM
>
>
> > Chris Santerr
ebaymarketer.com will be added to bigevil in the next update :)
> -Original Message-
> From: Scott Williams , Area4 [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, January 06, 2004 10:10 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Smart SPAM
>
>
> Below is a SPAM that came through with a s
Is it just me or is the wikki down?
www.exit0.us
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
"A little nonsense now and then, is relished by the wisest men." - W
describe MAKEPENIBIG Terra.es penil patch spammer
score MAKEPENIBIG .33
First one to mention how the Bruins are playing this season gets blacklisted
;)
Chris Santerre
System Admin and SA Custom Rules Emporium keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
"A little non
More added, smaller in size, and faster! Tested overnight with no problems.
http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
"Like sands thru the hourglass, so are the spams of our lives."
Enjoy :P
Chris Santerre
System Admin and SA Custom Rules Emporium ke
Don't go crazy! Wait a little longer. A LOT of work has already been done.
Soon. Very soon ;)
Just hate to see you do a lot of work that someone already has. Great
ruleset coming
--Chris
> -Original Message-
> From: Adam Schneider [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, December
1 - 100 of 579 matches
Mail list logo
