Kohn; Spam Assassin Talk
Subject:Re: [SAtalk] Habeas Responds to Spammer Violation of Habeas Warrant
Mark
On Tuesday 13 January 2004 12:40 pm, Dan Kohn wrote:
> "It is interesting that this spam attack appears to be originating
> from a distributed set of zombie cable/DSL
[* Here's our official response. My personal comments are below. - dan
*]
Habeas, the leading provider of emailer reputation services, has
recently come under attack from an as yet unidentified spammer. The
spammer is illegally utilizing the Habeas Warrant Mark in emails which
are promoting websi
rules, he wasn't able to avoid all spammy words that Bayes had
trained on and still get across his semantic content.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: T
2.60 works great. It works much better when you use Bayes and network
checks. Note that both of the latter have been significantly improved
over 2.55.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: Jess Anderson [m
See the bottom of
http://www.stearns.org/doc/spamassassin-setup.current.html.
Unfortunately, it doesn't include kmail.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: Michael V. Sokolov [mailto:[EMAIL
be a good idea.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: Colin A. Bartlett [mailto:[EMAIL PROTECTED]
Sent: Wednesday, November 12, 2003 12:52
To: Scott Antonivich; [EMAIL PROTECTED];
[EMAIL PROTECTED]
Sub
I think challenge/response systems have no future, but if your clients
insists on wanting that functionality, you might consider setting up
TMDA for him and leaving everyone else on SpamAssassin.
http://tmda.net/
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.da
bug.cgi?id=2498> will continue to get confused
by this until it's fixed.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED]
Sent: Monday, November 10, 2003 14:56
To: Bob R
Sorry about that. Try adding an l:
http://www.dankohn.com/archives/000323.html
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: Lukreme [mailto:[EMAIL PROTECTED]
Sent: Sunday, November 09, 2003 19:04
To: [EMA
a Bayes machine with
thousands of users, but if 99.9+% true positives with essentially no
false negatives is important to them, then it may be work finding a
$1000 server to just run spamd. For me, SA is now eliminating over 200
spam a day, so email would be utterly unusable without it.
-
spamassassin -D is your friend. Use it to show whether your SQL access
is working or not. Once it is, spamd will probably work, or you can try
spamd -D, and run spamc from a different window.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-
Yes, though while my server-side virus scanner removes the attachment
before my client-side scanner can even see it, the email still gets
through unless I increase the score for that rule.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Orig
Andrea, please read the documentation before asking questions on this
list.
<http://useast.spamassassin.org/doc/Mail_SpamAssassin_Conf.html#scoring%
20options>
P.S. What you want is:
score FORGED_YAHOO_RCVD 10
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://
This should be a FAQ:
Q. How do I get SpamAssassin to mark as spam all Window patch emails
that include an executable?
A. Add the following line to your user-prefs (normally
~/.spamassassin/user_prefs):
score MICROSOFT_EXECUTABLE 10
- dan
--
Dan Kohn <mailto:[EMAIL PROTEC
r triggers in the former but not
the latter?
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
---
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is do
I figured it out. The issue was that my procmail was using
/usr/bin/spamassassin which had the razor compile-time option turned
off. I needed to be using ~/bin/spamassassin. The different results
were due to different executables.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
This is a common enough header from all the Exchange servers out there that it should
not be acting as a spam or ham indicator. So, I wouldn't worry about it.
From: [EMAIL PROTECTED] on behalf of Mike Schrauder
Sent: Tue 2003-10-21 5:13
To: [EMAIL PROTECTED]
Sub
Here's the link to that Perl script for fetching spam from an Exchange
Public Folder or other IMAP repository:
http://marc.theaimsgroup.com/?l=spamassassin-talk&m=104806917615490&w=2
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
it could
be.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
christof graf
Sent: Sunday, October 19, 2003 00:24
To: [EMAIL PROTECTED]
Subject: [SAtalk] Mistake-based training
ow to setup mistake-based Bayes training.
<http://www.dankohn.com/archives/000323.html>.
Of course, if you really just want to stop spam from ournames.com, then
add the line "blacklist_from [EMAIL PROTECTED]" to your user_prefs.
- dan
--
Dan Kohn <mailto:
It's not that big a deal, but every message I have (ham and spam) is
hitting RCVD_IN_SORBS and getting 0.1 points. Is the rule broken, or is
there something strange about my mail?
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://w
ALUP 0
score RCVD_IN_OSIRU_PROXY 0
score RCVD_IN_OSIRU_RELAY 0
score RCVD_IN_OSIRU_SPAMWARE 0
score RCVD_IN_OSIRU_SPAM_SRC 0
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
---
This sf.net email is
logies to me, but I'm wondering why AWL is not recommended by
default.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
---
This SF.net email is sponsored by: VM Ware
With VMware you can ru
eturn Path matches the Satalk list
score RETURN_PATH -50
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: Randy Bush [mailto:[EMAIL PROTECTED]]
Sent: Monday, July 22, 2002 22:03
To: spamassassin list
Subject: [SAta
el free to post the rules that you think are most valuable in
bugzilla.spamassassin.org. However, please make sure you are at least
using SA 2.31, if not the CVS version, so that you can confirm that the
newest rules don't catch your spam.
- dan
--
Dan Kohn <mailto:[EMAIL
Great NYT [1]overview by Jennifer Lee on the state of the spam
problem
today: ISPs say that "50 percent of incoming e-mail traffic is spam."
--
Posted by Dan Kohn to [2]Dan Kohn's Blog at 6/26/2002 6:55:16 PM
Powered by [3]Blogger Pro
References
1.
http://www.n
ing.
Therefore, we have:
http://bugzilla.spamassassin.org/show_bug.cgi?id=440
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: Andy Higgins [mailto:[EMAIL PROTECTED]]
Sent: Thursday, June 13, 2002 10:28
Cc: [EMAIL PROTECTED]
Subject: Re: [S
http://www.hughes-family.org/bugzilla/show_bug.cgi?id=440
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
-Original Message-
From: Daniel Quinlan [mailto:[EMAIL PROTECTED]]
Sent: Thursday, June 13, 2002 11:20
To: Dan Kohn
Cc: [EMAIL PROTEC
AWL every
hour or so, but what a kludge.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
___
Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vega
we each add these whitelists individually, it's much
less likely that the results will be consistent enough to make it
worthwhile for a spammer to forge. I'd suggest that commenting out the
whitelist is a good compromise.
- dan
--
Dan Kohn <mailto:[EMAIL PROT
1
score RCVD_IN_BL_SPAMCOP_NET4
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
Essays announced on <mailto:[EMAIL PROTECTED]>
-Original Message-
From: Craig R Hughes [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, May 29, 2
sible Spam" folder
and stop processing more rules
The rest of my rules than filter mailing lists into mailboxes. I check
the Possible Spam for false positives everyday, and the Spam once a week
or so.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankoh
I got this same spam. Is there a way to override the preset whitelists?
Does adding a blacklist entry in my own user_prefs set it to -100,
summing to 0?
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
Essays announced on <mailto:[
Yes. Use spamproxy, which is included in the 2.20 distribution. It was
designed to work with postfix.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
Essays announced on <mailto:[EMAIL PROTECTED]>
-Original Message-
From: Onie Cam
CVD_IN_RBL 10
score RCVD_IN_RSS 1
score RCVD_IN_DUL 1
score RCVD_IN_BL_SPAMCOP_NET4
required_hits 5
rewrite_subject 0
defang_mime 0
Any suggestions?
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dan
from [EMAIL PROTECTED], edit
.spamassassinrc/user_prefs on the Unix box and add the following line:
whitelist_from [EMAIL PROTECTED]
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
Essays announced on <mailto:[EMAIL PROTECTED]>
__
really want to get that's
marked as spam) from [EMAIL PROTECTED], edit
.spamassassinrc/user_prefs on the Unix box and add the following line:
whitelist_from [EMAIL PROTECTED]
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]&g
eases and changes in formatting.
- dan
--
Dan Kohn <mailto:[EMAIL PROTECTED]>
<http://www.dankohn.com/>
Essays announced on <mailto:[EMAIL PROTECTED]>
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourcefo
38 matches
Mail list logo
