Re: [SAtalk] [RD] spammer reactions to antidrug (humorous)

Chris Santerre wrote: -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Friday, January 30, 2004 10:55 AM To: [EMAIL PROTECTED] Subject: [SAtalk] [RD] spammer reactions to antidrug (humorous) Today I got an interesting form of obfuscation, apparently to avoid antidrug.

[SAtalk] Heh, interesting spam

A friend of mine got this spam and wanted to share: http://www.spiffariffic.com/homelandsec.txt --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activ

Re: [SAtalk] Ping

JRiley wrote: Pong! sfnet's lists are sss.again --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 i

[SAtalk] SOLVED! user_prefs on a gateway machine

I got it solved! Thanks again, Rick & everyone :-D Here's a sorta-sloppy writeup on what ended up working: http://www.pbp.net/~jnichols/filtering.html So far, everything is working great. The only things I cannot change the spam scores for are alias addresses, but that's ok. (ie when [EMAIL PR

Re: [SAtalk] More on: user_prefs on a gateway machine

Hi, How are you running spamd ? The filter.sh script shows it running spamassassin, not spamc. If you've modified it to run spamc instead of spamassassin, are you passing the username with the -c option to spamc ? Are you running spamd with the -q option to tell it to use SQL preferences?

[SAtalk] More on: user_prefs on a gateway machine

Here's my original post, to which I got some great replies (thanks!) but I've run into a bit of an odd snag, detailed below. Hey all, I'm working on a spamassassin gateway machine, and I'm a bit confused on how to set up the machine so users can have their own user_prefs files. * The machin

Re: [SAtalk] One that got through

5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100% [score: 1.] 1.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence between 51 and 100 [cf: 100] 1.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net

Re: [SAtalk] One that got through

Jonathan Worth changing the X-MailScanner header stuff to be X-%org-name%-Mailscanner in the MailScanner.conf. This was introduced at MS 4.24 (I think) as one of the virus's at the time was putting this in the header to stop MS hosts virus scanning the email! The other headers in there look '

[SAtalk] One that got through

http://www.pbp.net/~jnichols/spam.txt It also slipped right by Mailscanner on another host, but I'm surprised that it scored 0.0 on my SA setup (backhair, weeds, everything in rules_du_jour) --- The SF.Net email is sponsored by EclipseCon 20

Re: [SAtalk] Awfully OT but entertaining nontheless: Interesting Job Posting

Aren't there newsgroups that person can go to to find people ... ahem ... intimately familiar with goats? I'd rather not find out. :P --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integr

[SAtalk] Awfully OT but entertaining nontheless: Interesting Job Posting

Heh. If computers ever drive you nuts, there's always GOAT HERDING! http://www.craigslist.org/nby/etc/22688691.html I'd apply, but I lack the experience. :P -Jonathan --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference

Re: [SAtalk] Where to put new rules...

~/.spamassassin/user_prefs /usr/share/spamassassin /etc/mail/spamassassin Use /etc/mail/spamassassin Are there others? I hope not :) And the second questions is when i add a new .cf file, or change an existing one (including user_prefs), do i need to restart spamd? Is there some kind of log

Re: [SAtalk] user_prefs on a gateway machine

Rick Macdougall wrote: Hi, Since you are already using MySQL, why not use MySQL user prefs? You lose per user bays filtering but other that that it works great. I probably could, as sitewide Bayes will work fine.. but I'm just a bit lost on how to set it up. I have postfix/uw-imap/spamassass

[SAtalk] user_prefs on a gateway machine

Hey all, I'm working on a spamassassin gateway machine, and I'm a bit confused on how to set up the machine so users can have their own user_prefs files. * The machine has no local users at all * Mail is merely scanned by SA, f-prot, clamav, amavis, and anomy mailtools before it's passed along

[SAtalk] Yikes.. rules_du_jour

rules_du_jour is kind of neat, but I hope it's not going to drive up Chris & Jennifer's bandwidth bills or som 'em over a quota. :P Would it be possible to add a mirror or two? I've got a fairly empty T1 that could help out.. -Jonathan --- Th

[SAtalk] The CAN-SPAM act....

Ok, I just had my first spam with a remove link *AND* what appears to be a valid address & company name. As usual, they claim "You have received this notice by request or may have recently become a member of one of our network websites or simply signed up for this service. If you no longer wish

[SAtalk] bigevil addition?

Chris/et al.. JCEK Distributors EGW-JCE-BLK1 (NET-69-42-105-0-1) 69.42.105.0 - 69.42.105.255 Electric Globe Web Hosting EGWH-BLK1 (NET-69-42-96-0-1) 69.42.96.0 - 69.42.111.255 Electric Globe seems to have a bunch of domains used f

Re: [SAtalk] Low score for so many hits?

I agree, I felt bad after hitting send. :) But an extremely quick look at the archives would have had on page 1 info about this. Not even a need for a search. So for the people who don't check this regularly, that is what the archive is for. A little homework before a post goes a long way. ;) You

[SAtalk] MX Logic article

Well, *DUH*... First these guys applaud the CAN-SPAM act, now they say "Uh oh, it's totally useless and nobody is following it" http://www.mxlogic.com/news_events/01_08_04.html Also, check out this nifty little "remove" direction that I found on a spam this morning. How nice! All you need to d

Re: [SAtalk] hits over five yet not marked as spam...

Raquel Rice wrote: On Fri, 9 Jan 2004 06:57:04 -0800 Jeff Lasman <[EMAIL PROTECTED]> wrote: We're being hit by MS security update emails. I know they're not spam, but rather more accurately described as virii or worms. However, I'm wondering if anyone has a good rule that will mark these? Thank

Re: [SAtalk] Sneaky spam

Rubin Bennett wrote: another one... only scored 0.9 on my sitewide SA, and 2.5 on my personal with Bayes. Is this address in BigEvil? Dunno, I didn't think BigEvil had IPs in it http://211.158.7.146/ebooks/";>More Info Here Can we just add 211.0.0.0/8 into BigEvil? Run "host" against whatever d

Re: [SAtalk] Weightloss spam

Chris Santerre wrote: I gained 12 lbs over the holidays and time off from hockey. I plan to lose the weight off again. But lots of people talk about losing weight. Some of these phrases would be in legit casual emails. --Chris (So far: no goals, no assists, plenty of penalties.) Santerre Wow,

[SAtalk] [Fwd: remember ORBL.ORG?]

From NANOG: If anyone has any legacy mailhubs sitting around that used to use it, better check it out. It was a harmless until yesterday, when the domain was snagged by Pool.com and parked with wildcard DNS. -mark -- Time to check the mail servers and make sure they're not hitting dead RLBs! :)

Re: [SAtalk] Where's all my spam at?

Gary Smith wrote: This might sound really odd but I only got 7 spams in my account thus far today (usually 30 by now) and my spam catch account (which is whitelisted from receiving any spam) got 8 (whereas it normally recieves ~85 per day)... Has anyone else seen some kinda slow down this week?

Re: [SAtalk] Smart SPAM

Chris Santerre wrote: ebaymarketer.com will be added to bigevil in the next update :) Add these jerks too: https://secure.easyinternetbusiness.com/sites/EZ_Auctions_CD2/?lpID=26020 That's where ebaymarketer.com skulks off to anyway. ;) ---

[SAtalk] Annoying false positive & WTF is up with sf.net?

I tried to paste in a spam sample, and sourceforge.net rejected it with this message: <[EMAIL PROTECTED]>: host mail.sourceforge.net[66.35.250.206] said: 550-This message matches a blacklisted regular expression ([Vv] *[Ii] *[Aa] 550 *[Gg] *[Rr] *[Aa]) (in reply to end of DATA comman

HTML Free version (was:Re: [SAtalk] amavisd-new & spamassassin = no headers.)

Ryan Moore wrote: > Your postfix isn't stripping them right? I use amavisd-new and it >works like a charm. I do have $sa_tag_level_deflt set to -999, so it >adds headers to every email, but $sa_tag2_level_deflt and >$sa_kill_level_deflt are set to 7. I think the default for just $sa_tag >is 0,

Re: [SAtalk] amavisd-new & spamassassin = no headers. Ugh!

Ryan Moore wrote: Your postfix isn't stripping them right? I use amavisd-new and it works like a charm. I do have $sa_tag_level_deflt set to -999, so it adds headers to every email, but $sa_tag2_level_deflt and $sa_kill_level_deflt are set to 7. I think the default for just $sa_tag is 0, so a

Re: [SAtalk] amavisd-new & spamassassin = no headers. Ugh!

Vivek Khera wrote: "j" == jnichols <[EMAIL PROTECTED]> writes: 2. in your spamassassin local.cf file, make sure you have: report_safe 0 report_header 1 j> Done. I even removed all of the other .cf files to be safe Well, that's not gonna do much, since amavis doesn't use these parameters. Thi

Re: [SAtalk] [OT] Switching OS for Gateway

Skylar Thompson wrote: On Mon, Nov 17, 2003 at 09:01:24PM -0500, Larry Gilson wrote: I am running Postfix with SA, Procmail, and Webmin on Red Hat 8.0. I want to move away from RH and am soliciting opinions. I figure that for me, I have 3 viable choices: FreeBSD, Debian, and Slackware. I want

Re: [SAtalk] New Spam Source? Rules for this yet??

Robert Leonard III wrote: I have been getting several new spams that seem to get past my SA setup.. So far they have come from: @name-james.com @name-clark.com @smegheads.com They all have wording like.. but with minor variations.. anybody else seeing these/written any rules to stop these?? Oh,

Re: [SAtalk] Need advice on new SA setup.. Which delivery agent is best??

I'm running all three in various places, and they've all got their pros and cons. Personally though, for a pass-through relay server, I'd probably lean toward Sendmail. With Sendmail's ability to do account lookups through LDAP, you can reject mail to invalid accounts right at the border. Co

[SAtalk] New dnsbl to use?

Hey all, http://www.au.sorbs.net/ <---looks kind of neat. Is there any way to write a rule to have SpamAssassin peek at it? I'm guessing that the answer is "yes" but the obvious fact is that I have no idea how to do it. :) -Jonathan --- Thi

[SAtalk] How to filter this?

I've had 5 variants of this slip through, all of them have "ournames.com" in the source but varying "from" addresses. Thank you! :) Return-Path: <[EMAIL PROTECTED]> Received: from mailgate.pbp.net (mailgate.pbp.net [192.168.10.87]) by mail.pbp.net (Postfix) with ESMTP id D453317A0B

[SAtalk] Grr, another one!

Check this out. Here's a header from a common type of spam that slips through. PowerMTA is *always* the MTA, PowerMail is always the X-Mailer, and it's jnichols@(fake domain) for the "from" address. BAYES_80 always gets hit, but despite jacking up the score, they're still getting through. :( I have

[SAtalk] monkeys.dom UPL being DDOSed to death (fwd)

Great.. is this going to affect SpamAssassin like it did when osirusoft went offline? [Mimedefang] monkeys.dom UPL being DDOSed to death Jon R. Kibler [EMAIL PROTECTED] Tue Sep 23 14:15:01 2003 Greetings to all: I have some really sad news. I just got off the telephone with Ron Guilmette who ru

[SAtalk] upping BAYES_80 score

Ugh. How do I change the score again? I put: score BAYES_80 2.00 2.00 2.00 in local.cf - but it's not working. I'm trying to catch the stuff that's slipping through with only 4.4, etc. Thanks! --- This sf.net email is sponsored by:ThinkGe

Re: [SAtalk] grrr - Re: stuff (fwd)

> > Really to analyze one I'd have to see the body clean and unmodified (ie: > not copy-pasted).. Is the original message really a text/plain, or is that > just a copy-paste you made that lost the HTML encoding? > Nope, no HTML. It was really plain ol' text.. > A lot of garbage burried in the HTML

[SAtalk] grrr - Re: stuff (fwd)

I've been getting a *lot* of these. Not always from "mail.ihyphen.com" but they *always* have PowerMail as the X-Mailer (legit mailer, IIRC) and they put "jnichols@(spamdomain).com" - these are the *only* types that get through at all. Any ideas on how I can get rid of these? They used to hit BAYE

[SAtalk] adjusting a few things in local.cf

Does this look correct to y'all? #Adjusted a few scores because of issues with osirusoft/etc score SUBJECT_MONTH 0.00 score RCVD_IN_ORBS 0.00 score RCVD_IN_OSIRUSOFT_COM 0 score X_OSIRU_DUL 0 score X_OSIRU_DUL_FH 0 score X_OSIRU_OPEN_RELAY 0 score X_OSIRU_SPAMWARE_SITE 0 score X_OSIRU_SPAM_SRC 0

Re: [SAtalk] site

landy wrote: is the site down? Yes, along with a few other sourceforge sites, like the squirrelmail one. :( --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTIN

Re: [SAtalk] LOL (fwd)

Ron Gilbert wrote: That message hit with BAYES_80, that's a +5 for my rules. Anything over BAYES_50 is a +5 and it works like a charm. Although the other rules are still in effect, the BAYES filter does all the real work. I added this to local.cf a little while ago, after another 4.9'er slipped

[SAtalk] LOL (fwd)

ARGH I want to SHOOT this spammer. Repeatedly. These ALWAYS pop in at 4.9, always using "jnichols@(faked.com)" too. Grrr -- Forwarded message -- Return-Path: <[EMAIL PROTECTED]> Received: from mailgate.pbp.net (mailgate.pbp.net [192.168.10.87]) by mail.pbp.net (Postfix)

Re: [SAtalk] catching the Banned CD spam!

John McGivern wrote: Hi everyone, I don't know if you guys get the SPAM that advertises the "Banned CD" I get dozens of them. I get 7-9 per week, but SA has been catching each & every one of them. Have you fed them through sa-learn, by chance? -Jonathan --

[SAtalk] spamvertized rule?

Wasn't there a rule for "images hosted on a spamvertized domain" somewhere? Here's a snip from one that slipped through today.. Subject: HypnoTrick - See these dirty girls get hypnotised! [18+]xlpV8 Message-Id: <[EMAIL PROTECTED]> X-Spam-Status: No, hits=2.6 required=5.0 tests=BAYES_60,H

Re: [SAtalk] Bayes probs

Aug 9 23:03:45 shampoo spamd[19926]: logmsg: info: setuid to jknotzke succeeded I'm afraid to ask what the other machines are named. ;) -Jonathan --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-comm

[SAtalk] I just realized something..

uh... I whitelist this mailing list. I run everything through a SA mailgate box, with autolearn on... Have I been doing something really stupid? =/ I fear that I have..it's just been one of those days. -Jonathan --- This SF.Net email sponsore

[SAtalk] cannot open /usr/bin/pyzor

Posted to the pyzor list too, but no response yet. :( Hey guys - spamd[12954]: [debug] Pyzor is available: /usr/bin/pyzor spamd[12954]: [debug] entering helper-app run mode spamd[12954]: [debug] Pyzor: got response: /usr/bin/python: can't open file '/usr/bin/pyzor' spamd[12954]: [debug] leaving

Re: [SAtalk] Uh oh - Cannot open bayes_path

Whoops, forgot to add the log entry: spamd[10944]: [Cannot open bayes_path /var/spool/spamassassin/bayes R/O] spamd[10944]: [processing message <[EMAIL PROTECTED]> for filter] 1000. spamd[10944]: [identified spam (115.9/5.0) for filter] 1000 in 0.9 seconds, 1759 bytes. (wow, 115.9.. heh) ---

[SAtalk] Uh oh - Cannot open bayes_path

Hrm. Using SA 2.55, I'm getting errors when trying to use sa-learn. I was using auto-learn, but a few spams slipped through and I was trying to feed them into sa-learn. Anybody know a way to resolve this? I'm using Gentoo Linux on this particular machine, SA was installed from CPAN initially and

Re: [SAtalk] how to stop mails with from=<>

> > hi, I just wanna ask what rule should I aply to stop mails that have in > header from=<> . > thanks for any (hope there will be some hehe) replys > IIRC, that's a valid field.. some RFC somewhere talked about it. I forgot which one, but I've seen it pop up on the Postfix list a few times. Mab

Re: [SAtalk] Changing global scores for tests

I want to increase the value of the test VIAGRA from 0.0 to 5.0 site wide. How do I do this? Try adding this line to user_prefs: score VIAGRA 5.0 Well, /etc/mail/spamassassin/local.cf for it to be site-wide.. :) --- This SF.net emai

Re: [SAtalk] (OT) DSL/DIALUP manual BL Catch 22

If you've got the connection with the intention of running your own mailserver, check the IP address(es) you've got on an RBL lookup page such as: Fortunately, I'm not on any of the RBL lists. I don't have enough customers to spam! ;) The problem thing is that my IP block was still a "DSL IP

Re: [SAtalk] (OT) DSL/DIALUP manual BL Catch 22

I'm using a DSL line on my email server. Which is part of my ISP's static DSL pool. I don't send thru my ISP's mail server. I'm starting to see the error in this now. In my mind I had somehow split the difference of HOME DSL and BUSINESS DSL. I always agreed that HOME DSL users should always se

Re: [SAtalk] Sun Enterprise 10000, spamd relay

Paul Davies wrote: Hello All, Quite soon, I could possibly be inheriting a spare Enterprise 1 (possibly fully loaded, i.e. 64processors etc...), for use with spamassassin. Ok, dude. You totally win the "What hardware do YOU run SpamAssassin on?" contest. By far. ;) Beats out my lowly 700

[SAtalk] wtf? global destruction?

Now THIS is a scary thing to see in /var/log/mail: Jun 25 08:49:49 jezebel spamd[28618]: Attempt to free non-existent shared string during global destruction. I half expected a computer named Joshua to ask me if I'd like to play a game. What does that error mean, anyway? ;)

Joe-job? Re: [SAtalk] spamassassin-talk get you hacker toolz herecwgh

hihWaleska wrote: Dear spamassassin-talk 764 Free hacker toolz and bootleg downloads. Learn More: http://www.doxdesk.com All reports are in. Life is now officially unfair. Heh. Well, duh.. On a related note, I recognized the URL and thought it was odd that it'd be in spam, so I checked it,

[SAtalk] "bullet proof" - hah

heh, this hit the courier-users list: Bullet Proof Bulk Email Friendly Web Hosting If you want to promote your web site via commercial email, bullet proof web hosting is a must! As you may already know, many web hosting companies have Terms of Service (TOS) or Acceptable Use Policies (AUP)

[SAtalk] SpamAssassin & Apple Mail.app in Panther

SpamAssassin & Mail.app will play nicer! http://www.apple.com/macosx/panther/mail.html (I mean, they play nice already but.. oh, you know what I mean) "If, for example, your ISP uses Spam Assassin, Brightmail or another spam-analysis tool, Mail can now leverage that analysis. Youll find an optio

Re: [SAtalk] Catching fraudulent links?

Mathew Hendry wrote: Is there an easy way to detect fraudulent links like the following from a recent scamspam. http://hyperiod.hypermart.net/fraud.html";>BestBuy.com/fraud_department.html Wow, that one has changed already.. it was going to "digitalgamma.com" when it first came out. -

Re: [SAtalk] how much work to install and maintain

Scott Rothgaber wrote: Stephen Bannasch wrote: -- Time estimates for an open source solution: -- 60+ hours to setup and test sendmail/anti-virus/RBL/anti-spam software from source. -- 8 hours every month to verify that things are working and up to date -- 8 hours every month to upgrade software (

Re: [SAtalk] spammers aren't the only ones who can teach. (was WeTEACH you how to ...)

Benjamin A. Shelton wrote: There is, of course, one other thing we need to do: we need to find those people that BUY stuff from SPAM, take them out back and shoot them dead. CAUTION: before implementing said procedure, please check with your local law enforcement to determine if this is legal in

Re: [SAtalk] DUMBO! Send the SPAM for big $$$$

Steve Thomas wrote: On Tue, Jun 17, 2003 at 02:46:36AM +, MAKE BIG $$$ is rumored to have said: THIS IS NOT SPAM!! YOU and YOU ALONE Opted-In and Subscribed Directly with Us to receive the TWICE PER WEEK SPAM E-mail Money Making Newsletter" Uh, yeah. I think I remember that. That'

Re: [SAtalk] Oops

Sorry about that, folks. I should learn to drink more caffinated beverages by the afternoon... but what's the likelihood of that? :-) With cool places like http://www.wholelattelove.com - it's very likely! Trust me, I did it! ;) --- This S

Re: [SAtalk] want a quick laugh? Ironic!

Benjamin A. Shelton wrote: I just got this subject placed directly into my spamtrap folder: Hehehe, I've had a few that were advertising e-mail marketing along the lines of "Want to learn how to spam?" Pity I didn't notice it was in my junk folder until it was over three months old, I could'v

[SAtalk] whitelist file?

Hi everyone! Is there a way to have a "whitelist_from" file instead of individual entries in local.cf? Thanks, -Jonathan --- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.me

[SAtalk] Better way to feed Bayes?

Hey all, I've seen several ways to feed Bayes so far and I was wondering if there was any way that I could improve my method. I'm using Postfix/Courier with maildir boxes, no user accounts on the mail server. Everything is handled with mysql. "/home/vmail/$domain/$user/.maildir" is where mail

Re: [SAtalk] kinda OT - amavis & spamd logging

Pfargh. You're right, of course... not sure where that came from. Sorry Jonathan. Well, if you (Jonathan) don't have an amavisd.conf, then I won't be of any help anyway, since your setup is obviously quite different from mine. That's ok. ;) I'm sure there's another way to make it log.. I'll fig

Re: [SAtalk] Really OT: Microsoft buys out RAV

Hey...maybe Microsoft should start selling SUVs. "Where will you go today?" will get the same answer: nowhere adventurous, and I'll probably get into an accident. Sounds like a typical day driving into the Silicon Valley these days.. ;)

Re: [SAtalk] kinda OT - amavis & spamd logging

- I don't know exactly how you have your system set up, but if you're using SA with amavisd-new, you're probably invoking spamc to process mail, not using spamd. Ah, you're absolutely right! I'm actually basing the setup on the Anomy Mail Tools setup. In /usr/local/anomy/filter.sh I have: INS

Re: [SAtalk] [kinda OT]! - speakeasy.net bites the dust. (was "Ihate SpamAsssassin")

Matt Kettler wrote: At 05:25 PM 6/9/2003 -0700, Jonathan Nichols wrote: They do? Really? I ordered a T1 circuit from them on the 2nd of this month and they told me that they don't delegate reverse DNS to customers. =/ My current provider does, but I used to work with most of the NOC engi

[SAtalk] Really OT: Microsoft buys out RAV

http://www.microsoft.com/presspass/press/2003/jun03/06-10GeCadPR.asp --- This SF.net email is sponsored by: Etnus, makers of TotalView, The best thread debugger on the planet. Designed with thread debugging features you've never dreamed of,

[SAtalk] kinda OT - amavis & spamd logging

Hey all, I'm using spamd/SpamAssassin 2.54, and amavis - all from the Gentoo Linux ebuilds. i also tossed Anomy mail tools into the mix and although everything appears to be working great, spamd isn't logging to /var/log/mail/current anymore. Here's what I see in the logs: Jun 9 17:42:43 [pos

[SAtalk] [kinda OT]! - speakeasy.net bites the dust. (was "I hate SpamAsssassin")

Yes. Speakeasy are the most sweet, lovely and clueful people ever to do the ISP thang. They dole out static IPs (and even, as I discovered to my delight last week, let you set your own reverse DNS on them), encourage They do? Really? I ordered a T1 circuit from them on the 2nd of this month and

Re: [SAtalk] OT: AOL to Offer Security, Spam Tools

AOL is now trying to offset a slump in advertising and contraction in its dial-up subscriber base with paid features and its new bring-your-own-access service for high-speed Internet users. [...] Wow, sounds like they're trying to fight off MSN & "The Butterfly" for a while longer in addition to l

[SAtalk] Re:*SPAM* Blatant spammer

Why are we so successful?? 1. Because, simply put, NO ONE can bring us down! And 2. Because we KICK ASS with Our HACKER-PROOF and ANTI-SPAMMER-PROOF I found this on the Postfix mailing list this morning. Stupid spammer. His "anti-spammer-proof" stuff works SO WELL... that SA caught it and dumpe

Re: Enough with the conspiracy theories! (was Re: [SAtalk] (no subject))

It would help if the spam report that's generated clearly identified the host that added it. If that header included something like: Scanned for spam by host mail.small-web-host.com (172.17.2.3) I also *LOVE* that idea, but for another reason. I like to know which machines in the farm scanned

Re: [SAtalk] (no subject)

Troll is too good a word for these people, we need some new jargon to refer to a trolling spammer, suggestions? "lawyer?" ;) --- This SF.net email is sponsored by: Etnus, makers of TotalView, The best thread debugger on the planet. Designed

[SAtalk] web interface update?

Anybody know where I can find a current version of the SA web interface? The one I'm using now calls stuff that doesn't exist anymore (like report_header, I think) --- This SF.net email is sponsored by: Etnus, makers of TotalView, The best

[SAtalk] Where's the web-interface again?

Hey all, Seems the older version of the web interface I was using calls to stuff that doesn't exist in SA anymore, like report_header (at least I think that's the one) Where's the updated web interface again? Didn't run across it in Google, and sourceforge's mailing list archives are pretty u

[SAtalk] 2.55 install issue?

debug: is spam? score=3.6 required=5 tests=DATE_MISSING,MISSING_HEADERS,NO_REAL_NAME debug: bayes: 2752 untie-ing Insecure directory in $ENV{PATH} while running with -T switch at ../spamd/spamd line 1083. Maybe you need to kill a running spamd process? Not found: spamflag = X-Spam-Flag:

Re: [SAtalk] Spam Filtering System

Chadwick L. Sorrell wrote: Would there be any interest in me posting my current system of spam filtering and management for an ISP to offer its end users? To be honest with you, I'd say that you can't have enough how-to documentation available these days. :) But please, date it and note version n

Re: [SAtalk] Life after spam.

Now the spam's gone, life at the keyboard has gone a bit flat - there's nothing to hate anymore. Previously I used to get a bit of an adrenelin rush as I muttered 'bastards' when I deleted a spam! You, sir... need to invest in Quake II or Quake III Arena. Or may I suggest "Age of Empires II" or "A

[SAtalk] OT: Nigerian Email Conference

*spits espresso on keyboard* Saw this on craigslist.org a few minutes ago. heh http://j-walk.com/blog/docs/conference.htm --- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/7

Re: [SAtalk] (no subject)

[EMAIL PROTECTED] wrote: On Fri, 30 May 2003, Chris Santerre wrote: Has anyone gotten a reply from these kinds of posts after you answer them. I think the score is like 1-6. 1 reply after we all answered, and we've had about 6 of these kinds of posts. Didn't anyone call the person? I am s t

Re: [SAtalk] (no subject)

Keoki Kalune wrote: *TAKE ME OFF THIS SITE, KNOW ONE KNOW WHO OR HOW I GOT THIS BUT IT IS DISRUPTING BY BUSINESS. I WANT SOME ONE TO CONTACT ME ASAP* www.rkgllc.com Uh oh... sonic.net sounds familiar. ;) [10:[EMAIL PROTECTED] host -t mx rkgllc.com rkgllc.com. mail is ha

[SAtalk] report_header

Most of this is confusion, and a stubborn friend of mine that claims he saw otherwise. Has report_header been removed? I'm not seeing it in some docs, but I thought I saw it in others.. Now, what's taken its place again? report_safe? --- Thi

[SAtalk] Solved: spamstats graph

Greetings, Silly me and my lack of MRTG-fu. Swapping the "perminute" option for "perhour" worked. The box just doesn't get enough mail to make the "perminute" option work. http://www.pbp.net/mrtg/spam_jezebel.html <---the spam-stats graph, stats collected from a machine colocated here. Nearly

Re: [SAtalk] Attaboy

I now have users complaining that they receive as much as 5 spams out of 500. This is absurdity worthy of the Marx brothers. Nice job. Keep at it guys. Amen to that! 5 spams? Heh, show them how much they WOULD get if it wasn't for SpamAssassin. :) spam-stats from one of the co-lo machines: spa

[SAtalk] anomy and..spamd?

Hey guys - Over the weekend I set up a "mailgate" box, following the directions I found at http://www.advosys.ca/papers/printable/postfix-filtering.html and so far, everything is working ok. I'd like to know if there's a way to get the "filter.sh" script they call for to use spamd instead o

[SAtalk] Before I start a new project...

I'm going to replace a mail server that's running: SuSE 8.1, Postfix, uw-imap/pop, SA 2.43 with a box running: Gentoo Linux, Postfix 2.0.x, courier-imap/pop with SSL, virtual users in mysql I was pondering going for the new SA 2.51 setup, but I'd like to see if any of you have done anything simil

RE: [SAtalk] Web Frontend

> there is a newer version that the one posted in the link below > > i am currently running 0.6.2 and it works great > > you would have to email > > [EMAIL PROTECTED] to get the newest version... > D'oh.. he's been making new versions and not telling us all? ;) --

Re: [SAtalk] A new(?) way to fight spam, blocking their DNS

And I'm just going to ignore that stupid "you and the local council"-concept; because if you want to compare companies enforcing their no-spam policies by blocking spamfinanced websites with elected officials digging holes in public streets then there's something seriously wrong with you. Well,

Re: [SAtalk] fighting against "Say GOOD BY to spam"

> > On Wed, Feb 05, 2003 at 05:49:08PM -0800, John Rudd wrote: > > AOL). They always include their url, which is: > > > > http://(random string).junkfighter.com > > 0 hits for 'junkfighter' in my spam corpus of ~30k msgs. > Lucky you, Theo. :P I got about 20 yesterday alone.. ;) -Jonathan --

Re: [SAtalk] Mass-reporting spam with spamassassin -r?

> > Does "spamassassin -r" fork and run something in the background? It > doesn't appear so from a quick look at the source ... it does start up > one external command for each reporting service, but it appears those > should all run sequentially as well. > Just for fun, I tried this as well..it d

Re: [SAtalk] Repeat

> BA> > I guess I will try to ask this question again, last time I was attacked for > BA> > asking. > > A, were people not nice to you? Bad, bad, bad Internet... > > BA> No, last time you were roundly chastised for being a right, honorable > BA> bastard to anyone who tried to help you or get a

[SAtalk] My First Rule!

Greetings! I've made an attempt at my very first rule. *grin* Recently, a lot of short spam has been coming in, but there's one thing they all have in common: the lame misspelling "secks." I tried writing a rule that would give 4.0 to any email that has "secks" in it, and here's wha

Re: *SPAM* [SAtalk] Hi

On Tue, 21 Jan 2003, [EMAIL PROTECTED] wrote: > Date: Tue, 21 Jan 2003 19:14:28 > From: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: *SPAM* [SAtalk] Hi > > READ ON.this is not another hyped-up business scam. > > I'm making real money using my computer and I can sh

[SAtalk] SA + razor + pyzor working together

Greetings - Just a quick, informal survey: Has anybody managed to get SpamAssassin AND Razor 2 AND Pyzor working together successfully? I *thought* that I did, but by removing the "-H /etc/razor" switch from my spamd script, it let Pyzor work but caused Razor to function. When I add it ba

[SAtalk] Resolved:(?) pyzor errors with spamassassin

> Here's a snip from the spamd debug output: > Jan 8 23:19:36 mail spamd[4084]: debug: Razor1 is not available > Jan 8 23:19:36 mail spamd[4084]: debug: Pyzor is available: > /usr/bin/pyzor > Jan 8 23:19:36 mail spamd[4084]: debug: entering helper-app run mode > Jan 8 23:19:36 mail spamd[4084]:

  1   2   >