RE: [SAtalk] Country codes

There was a rule posted a while back that was header FROM_FOREIGN_DOMAIN From =~ /[EMAIL PROTECTED](?:at|au|be|biz|br|ca|cc|ch|cl|cn|cz|de|dk|fr|fi|hu|il|it|jp|kr|l v|mn|nl|no|nz|pl|ro|ru|se|sh|tr|tw|tv|za)\>/i describe FROM_FOREIGN_DOMAIN Domain is foreign address. Unfortunate I didn't write do

RE: [SAtalk] Oh Joy, another abusable URI redirector

Dave, thanks for this. Yet another redirector to sigh about. :( I was poking around and some variations of this apply, but don't hit your rule. Such as: SSL sites: http://www.google.com/url?q=https://www.etrade.com No www: http://google.com/url?q=http://cardtraffic.com Apparently any of Googl

RE: [SAtalk] RedHat init

This is for Redhat 9.0, I'm not sure if it's in the same place for other versions. The init script reads from: /etc/sysconfig/spamassassin and if it is not found has it defined in the init script itself. You could add into the init script a debug option ala: debug) #Put what ever oth

RE: [SAtalk] Any rule to catch this spam?

> > Mike, If you look at Rich's X-spam status header, he's already using > bigevil and netchecks, but at the time the message ran, the I'll make sure I look a little more closely next time. I just copied the message and ran it through to see what I came up with out of habit when I see these ty

RE: [SAtalk] Any rule to catch this spam?

Net tests and the BigEvil will do the trick. 3.0 BigEvilList_191 URI: Generated BigEvilList_191 1.1 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org [] 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blo

RE: [SAtalk] Bad Email Address

Regex guide: http://www.contactor.se/~dast/mail2sms/regex.shtml This will wrap more than likely: /\b(?:091|kim|oedi|gradych|president|sam|dawn|jason|jraikou|rhandley|(a? r)?beau)[EMAIL PROTECTED]/i Some one please correct me if I'm wrong here! You might as well drop the \S+ and make it \.ca also

RE: [SAtalk] New unsecure redirector.

> Bill Larson wrote: > Abused url > http://g.msn.com/1SUenus/CT?http://www.Nicole.name-williams.com/E/4156.h tml It works without the CT, also Mike --- This SF.net email is sponsored by: IBM Linux Tutorials. Be

RE: [SAtalk] suggestion: mail_grep - a tool for scanning e-mail

http://grepmail.sourceforge.net/ Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Gary Funck > Sent: Tuesday, December 30, 2003 12:30 PM > To: Spamassassin List > Subject: [SAtalk] suggestion: mail_grep - a tool for scanning e-mail > > >

[SAtalk] Big Evil FP?

One of my users got a link to this: http://www.ticz.com/homes/users/bob/On-A-Rock/On-A-Rock.htm Looks ticz.com is an ISP, but probably had some one set up shop to host images off of their site. Mike --- This SF.net email is sponsored by: IBM L

[SAtalk] Documentation question

What version of SA does this web page reference? http://www.spamassassin.org/doc/Mail_SpamAssassin_Conf.html It makes mention of deprecated items in version greater than 2.60. Having use_auto_whitelist in my local.cf file for SA v 2.61 gives me an error on --lint. The exact error is: Fail

[SAtalk] Updated Textpad Syntax file for SA

Updated to handle new keywords in versions 2.60 & 2.61. See for instructions on how to install if you use Textpad. Mike sasynfile.zip Description: sasynfile.zip

RE: [SAtalk] whitelist_from_rcvd question with multiple domains

the user is in the whitelist. I'm no Perl guru, so I could be completely wrong. When you add an identical key to a hash, the first one gets over written. >BTW What happened to Mike Kuentz (1) and will we be seeing a Mike Kuentz >(3) in the near future? Let's hope not, the f

RE: [SAtalk] sa-learn from Exchange 2000

> btw 42??? what did you mean by that. that was very > creepy to see, > because i've tried to convince my brother from an early age, that the > number 42 *haunts* me and turns up *everywhere*! that'll either be a > very good year for me, or that's the year i'll buy the farm per se! http://

RE: [SAtalk] whitelist_from_rcvd question with multiple domains

> Terry Milnes wrote: > I am not exactly sure what you want, sprintspectrum.com is > NOT the same > domain as sprint.com, its irelevant that it may be hosted on the same > servers and owned by the same people. I'm aware that sprintspectrum.com & sprint.com aren't the same domain, th

RE: [SAtalk] Question re: Rule

#This grabs the un-decoded subject, your # rule was looking at the decoded subject. # You probably don't want to change this and make it scorable # since a ton of legit mail uses this charset header __MK_CHARSET_01 Subject:raw =~ /ISO\-8859/i describe __MK_CHARSET_01 Uses a ISO-8859 #What the s

[SAtalk] whitelist_from_rcvd question with multiple domains

Can you have multiple whitelist_from_rcvd line for the same domain? I can't seem to get it to work or I am completely missing something. For example Sprint will send from different mail hosts at different domains (rDNS) whitelist_from_rcvd [EMAIL PROTECTED] sprint.com whitelist_from_rcvd [EMAIL

RE: [SAtalk] regex expansion tool

have you looked at the regex coach? Available for Linix & win32 Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Kirk Moore > Sent: Wednesday, December 17, 2003 6:40 PM > To: Gary Funck; Spamassassin List

RE: [SAtalk] Question on SUBJ_HAS_UNIQ_ID-test

from looking at the eval test that runs for that rule, it checks against an English dictionary. Maybe you should disable the test score SUBJ_HAS_UNIQ_ID 0 Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Mika A > Sent: Friday, December 1

RE: [SAtalk] Weird Word patch

how would you use this? Eval's return true/false if I'm not mistaken. So any line with a comma or period would hit. Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Brendan Burns > Sent: Wednesday, December 03, 2003 1:09 PM > To: [EMAIL PR

RE: [SAtalk] Changing user spamd runs as

modify /etc/sysconfig/spamassassin to have the -u username option it. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nichols, William Sent: Friday, December 05, 2003 12:04 PM To: SA Mailing list Subject: [SAtalk] Changing user spamd runs as I am having

RE: [SAtalk] disable RCVD_IN_SORBS_xxx feature

Set the score to 0 ala: score RCVD_IN_SORBS_HTTP 0 Osirusoft is dead. They return a positive for everything, so you should remove it. Not sure if all of these below are dead on, they were scavanged from the list. #2.60 final has them removed. #2.60 rc builds score RCVD_IN_OSIRU 0 score RCVD_

RE: [SAtalk] HTML rules...

yes and no. There is a rule that hits on weird tags if the mailer is outlook. It's called FORGED_OUTLOOK_TAGS. Chris has some misc. rules on his site to catch that. You should check it out. It's at http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm Popcorn is one rule set that will

RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!

Not to start a text editor war, but it can be done in Textpad with a regex search and replace. Hit F8, check the Regular Expression textbox -> Find: \t3.0$ -> Replace with: \t1.0 (or whatever you want the score to be). Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EM

RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!

spamassassin dir. > > I plan to just keep adding to this file!!! > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf Mike Kuentz, you are no longer allowed to put ideas into my head :) My fingers now hurt! Thanks for lighting the spark! Payment for use of this has to be more then the old evilrules.

RE: [SAtalk] WhiteListing and newbie

perldoc Mail::SpamAssassin::Conf is the way to go for the docs or http://www.spamassassin.org/doc.html. whitelist_from_rcvd [EMAIL PROTECTED] earthlink.net You might not want to whitelist a large ISP, though. You could just do whitelist_from_rcvd [EMAIL PROTECTED] earthlink.net >From the docs

RE: [SAtalk] SA: Moving spam mails(sitewide) to a separate Dir/Account

SA doesn't move mail. We'd need to know more about your setup to help you out. Postfix/qmail/procmail, versions, how you get mail from your MTA to SA, etc. Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Mail Monitor > Sent: Tuesday, De

RE: [SAtalk] Evilrules update and some more notes.

Are the old ones somehow merged in with the new ones? If big scary spammers already purchased the domain for 2 years or whatever amount of time the standard is, chances are it'll get used again. I have some domains that I put in my own rules close to a year ago, and still see them get hit sometim

RE: [SAtalk] Remember to score RCVD_IN_DYNABLOCK 0

It disables the test. *.Easynet.nl goes offline on Dec 1 (this coming Monday) > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Matt Van Gordon > Sent: Wednesday, November 26, 2003 3:55 PM > To: 'Smart,Dan'; Spamassassin-Talk > ([EMAIL PROTECTED

RE: [SAtalk] Ideas

Chris' EVILRULES gets the score up by 3 on that. See http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm. Also, Colin A. Bartlett had posted a spam sentences rule set that adds an additional 2 points to that email. His original score I think was 10 for each sentence, but I decreased it

RE: [SAtalk] Nigerian-type scores 0.00

One big problem you have is this X-Spam-Status: No, hits=0.0 required=5.0 tests=BAYES_50 autolearn=ham That autolearned it as ham, so now all other emails that come through with will be seen as hammy. If you use the additional rules on Chris' site at http://www.merchantsoverseas.com/wwwroot/gor

RE: [SAtalk] Score

http://spamassassin.taint.org/faq/index.cgi?req=show&file=faq04.017.htp > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Alan Munday > Sent: Sunday, November 23, 2003 4:57 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Score > > > > Just had a

RE: [SAtalk] Score

The score rounds up. If you pass the -e option spamassassin will exit with a non-zero exit code if it spam, but not with a hit count. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Alan Munday > Sent: Sunday, November 23, 2003 4:58 PM > To: [EM

[SAtalk] RE: *.easynet.nl DNSBL's ceasing on Dec 1, 2003 [OT]

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Todd Schuldt > Sent: Friday, November 21, 2003 10:54 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] *.easynet.nl DNSBL's ceasing on Dec 1, 2003 > > > > The easynet blacklists/spamfilters (blackhol

RE: [SAtalk] Bayes & speed.

ose that did reply. I hope this is something simple that I'm missing out of stupidity. Mike > -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: Thursday, November 20, 2003 5:46 PM > To: Mike Kuentz (2); [EMAIL PROTECTED] > Subject: Re: [S

[SAtalk] Bayes & speed.

I use Bayes in a site-wide config. (2.60 w/ postfix 2.0.16) It has been running slower and slower with the addition of Bayes to the system. If I remove the bayes stuff, it's a lot quicker. Is there something I'm missing? I remember seeing a similar post before, but I'll be damned if I can find

[SAtalk] [OT][RD] Those Citibank and other s[c|p]ams

Good article about it. Looks like a good rule or two can be pulled out of the discussion. http://www.securityfocus.com/infocus/1745 Mike --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more pro

RE: [SAtalk] SA and Microsoft Mail Internet Headers

Came in late on this, but we saw the header "raping" when our front-end spam server sent to 5.5 and then to a 2K public folder. The problem went away when it pointed directly to the 2K server. Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf

RE: [SAtalk] [RD] spam sentences

The usefulness of these rules came in handy today, thanks! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colin A. Bartlett Sent: Wednesday, November 05, 2003 9:49 AM To: Chris Santerre; [EMAIL PROTECTED] Subject: [SAtalk] [RD] spam sentences [this is

RE: [SAtalk] Abused redirector URLs ?

you could make it uri T_YAHOO_REDIR /^http:\/\/s?rd\.yahoo\.com\//i since http://rd.yahoo.com/*http://taint.org works also Mike -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Justin Mason Sent: Thursday, November 06, 2003 11:26 PM To: Keit

RE: [SAtalk] 'random' character sets

angstrom Armstrong Bergstrom birthplace birthplaces bremsstrahlung corkscrew Dijkstra downstream hardscrabble jockstrap Knightsbridge lengthly lengths lengthwise Lindstrom Longstreet Nietzsche nightclub Nordstrom offspring postscript postscripts Rothschild sportswriter sportswriting strengths switc

RE: [SAtalk] RegEx Question

Very helpful tool for regex http://weitz.de/regex-coach/ Mike -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Menschel Sent: Wednesday, November 05, 2003 12:00 AM To: Christopher Eykamp Cc: Spamassassin Talk Subject: Re: [SAtalk] RegEx Question W

RE: Undeliverable Mail: RE: [SAtalk] What is with all this ()*&(*& in my inbox?

EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 04, 2003 3:37 PM To: Mike Kuentz (2) Subject: Undeliverable Mail: RE: [SAtalk] What is with all this ()*&(*& in my inbox? We were unable to deliver your email. The domain you are sending to may have been recently reg

RE: [SAtalk] What is with all this ()*&(*& in my inbox?

Don't see the second one much. Slice and Dice is what this site has it called for that type of message. Do you have net tests disabled? That should have hit since it's a dynamic dial up address. Also, it may be

[SAtalk] FW: new pyzor host

In case any one didn't get this message... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frank Tobin Sent: Monday, November 03, 2003 11:17 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: new pyzor host The current pyzor host went down earlier toda

RE: [SAtalk] Popcorn, Backhair, and Weeds

Little behind in my reading here, so not exactly sure if this subject matches the original discussion? Textpad rocks! Unzip the attached syntax file into your TextPad 4\System directory. Make a new document class for local.cf/user_prefs files and enable syntax highlighting. Specify that it shoul

[SAtalk] Rule array?

Any one know if, without (or even with) writing an eval test, is there a way to make something similar to an array for tests that match? I have about 100 tests for h1d1ng w0rds w1th numb3r5 and l3tt3rs. I'd like to have something that would count how many got hit and then make a score based off o

[SAtalk] Did MSGID_GOOD_EXCHANGE get dropped in 2.60?

I can't seem to find it, but it's up on the rules page at spamassassin.org. Thanks, Mike --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassi

RE: [SAtalk] [RD] MSGID_GOOD_EXCHANGE

[mailto:[EMAIL PROTECTED] Sent: Wednesday, September 10, 2003 7:26 AM To: Mike Kuentz Cc: 'Larry Gilson'; '[EMAIL PROTECTED]' Subject: RE: [SAtalk] [RD] MSGID_GOOD_EXCHANGE > > IMHO, I think finding out if a message is legit carries just as much > weight > as findin

RE: [SAtalk] [RD] MSGID_GOOD_EXCHANGE

-- From: Larry Gilson [mailto:[EMAIL PROTECTED] Sent: Tuesday, September 09, 2003 6:49 AM To: '[EMAIL PROTECTED]' Subject: RE: [SAtalk] [RD] MSGID_GOOD_EXCHANGE Hey Mike, > -Original Message- > From: Mike Kuentz (2 > Good call, I'm sorry I missed that. What a shame,

RE: [SAtalk] [RD] Subject rule question

20 PM To: Mike Kuentz (2) Cc: [EMAIL PROTECTED] Subject: Re: [SAtalk] [RD] Subject rule question Mike Kuentz (2) writes: > I see a lot of spams coming through hiding the subject masked using > ISO-8859, like this > > Subject: =?ISO-8859-1?b?SGFsZiBQcmljZWQgU2lsZGVuYWZpbCBDaXRyYXRl? &

RE: [SAtalk] [RD] MSGID_GOOD_EXCHANGE

-- From: Larry Gilson [mailto:[EMAIL PROTECTED] Sent: Tuesday, September 09, 2003 6:49 AM To: '[EMAIL PROTECTED]' Subject: RE: [SAtalk] [RD] MSGID_GOOD_EXCHANGE Hey Mike, > -Original Message- > From: Mike Kuentz (2 > Good call, I'm sorry I missed that. What a shame,

[SAtalk] [RD] Subject rule question

I see a lot of spams coming through hiding the subject masked using ISO-8859, like this Subject: =?ISO-8859-1?b?SGFsZiBQcmljZWQgU2lsZGVuYWZpbCBDaXRyYXRl?= which translates back to a subject of: Half Priced Sildenafil Citrate obviously I can look for "Half Priced Sildenafil Citrate" in the subje

RE: Re[2]: [SAtalk] [RD] MSGID_GOOD_EXCHANGE

only hello, and from a yahoo mail account. You do bring up some good points I'm going to check out, thanks for the help. -Original Message- From: Robert Menschel [mailto:[EMAIL PROTECTED] Sent: Friday, September 05, 2003 9:51 PM To: SpamAssassin Talk Cc: 'Mike Kuentz (2)'; &

RE: [SAtalk] [RD] MSGID_GOOD_EXCHANGE

2000. --Larry > -Original Message- > From: Mike Kuentz (2) > There is always a lot of good talk here about different > methods for us to rack up points on SPAM, but I usually don't > see much about identifying HAM and applying negative points. > I don't know if

[SAtalk] [RD] MSGID_GOOD_EXCHANGE

There is always a lot of good talk here about different methods for us to rack up points on SPAM, but I usually don't see much about identifying HAM and applying negative points. I don't know if any one is interested, but Exchange 5.5 has a quirk in it where when you specify it to send a message a

RE: [SAtalk] whitelist_from_rcvd question.

Steve, did you hear back from any body about this? Any body know the answer? -Original Message- From: Cowles, Steve [mailto:[EMAIL PROTECTED] Sent: Thursday, August 07, 2003 12:11 PM To: '[EMAIL PROTECTED]' Subject: RE: [SAtalk] whitelist_from_rcvd question. Mike Kuentz

RE: [SAtalk] question/idea for whitelisted sender handling

I think that would be a bad idea. I jacked up the MS executable test to +110 to make sure if some one was dumb enough to send an MS executable, but was white listed, that the mail would still get tagged. Maybe as an option it would be nice for some, such as HALT_ON_WHITELISTED 1 or something s

[SAtalk] [SATalk][RD] some html based rules

Here's a bunch of rules I've put together, and partially pulled from here. I thought I'd share and try to get some feedback on some of them, especially the first one. Mike #Text outside of the last tag #Example: afejg32 #Unfortunately a new line breaks this. If there is a way to # to inc

RE: [SAtalk] Newbie

Title: Message Last I saw, RedHat is dropping it's retail distribution. They're still a good bet though. -Original Message-From: Ben Story [mailto:[EMAIL PROTECTED] Sent: Thursday, August 07, 2003 4:31

[SAtalk] whitelist_from_rcvd question.

Title: [SAtalk] whitelist_from_rcvd question. From the docs:     whitelist_from_rcvd [EMAIL PROTECTED] sourceforge.net    Use this to supplement the whitelist_from addresses with a check    against the Received headers. The first parameter is the address to    white

RE: [SAtalk] RD Message body/subject filter help

Title: RE: [SAtalk] RD Message body/subject filter help That's not all it matches, from the standard dictionary off of my Redhat box.  grep 'yb' /usr/share/dict/linux.words anybody bodybuilder bodybuilders bodybuilding capybara Charybdis cybernetic cybernetics cyberspace daybreak donnybr

RE: [SAtalk] RD Message body/subject filter help

e.  Combos like that could be used as a lower score, or in conjunction with other funky letter combos.    -Original Message-From: Fred I-IS.COM [mailto:[EMAIL PROTECTED] Sent: Thursday, August 07, 2003 4:33 PMTo: Chris Santerre; 'Mike Kuentz (2)'; [EMAIL PROTECTED