Re: [SAtalk] LOL (fwd)

2003-08-23 Thread jvanasco
whenever i see my email address in a spam url, i visit that url with all the whois contact info for the domain in question. On Friday, August 22, 2003, at 07:31 PM, Jonathan Nichols wrote: ARGH I want to SHOOT this spammer. Repeatedly. These ALWAYS pop in at 4.9, always using "jnichols@(faked.co

Re: [SAtalk] virus bounce rules

2003-08-21 Thread jvanasco
as to routing them somewhere else... does SA have a custom header even possible? ie – if certain tests pass, throw in a SA: Virus_Bounce cos the only way i can think of tossing them into another bucket would be to run a series of regexs in a filter to toss them elsewhere which amounts to doubl

Re: [SAtalk] Exim 4.22 and SA 2.55

2003-08-19 Thread jvanasco
Check here too: http://www.timj.co.uk/linux/exim.php On Tuesday, August 19, 2003, at 01:30 PM, Martin Bretschneider wrote: "Christopher M. Iarocci" <[EMAIL PROTECTED]> wrote: Hi Christopher, Anybody have Exim and SA running as a SPAM filtering/blocking gateway that would want to share their co

Re: [SAtalk] Exim 4.22 and SA 2.55

2003-08-19 Thread jvanasco
Or Exim with Sa-Exim exim.org sa-exim.sf.net On Tuesday, August 19, 2003, at 11:26 AM, Covington, Chris wrote: Why don't you consider Postfix and Amavisd-new, since you're switching to a new mailer anyway? http://www.geocities.com/scottlhenderson/spamfilter.html Chris -Original Message---

[SAtalk] PMAREEXCHANGE.pmare.com

2003-07-29 Thread jvanasco
is anyone else on this list getting bouncebacks from the above server ([EMAIL PROTECTED]) for 'sensitive content' or 'profanity'? --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and

Re: [SAtalk] Block an entire Network?

2003-07-29 Thread jvanasco
i said _a friend_ did that. not myself. believe it or not, i speak french -- and would rather be living there than this piece of shit country i do like the anti-french movement for one thing though -- i bought a lot of wine on clearance for 60% off when there was the whole 'boycott france'

Re: [SAtalk] Block an entire Network?

2003-07-28 Thread jvanasco
a friend blocked all mail from france as a joke once, cos he didn't like the french and didn't know anyone there cut down on spam by 95% not that i agree, but i'm just saying... On Sunday, July 27, 2003, at 07:12 PM, Tony Earnshaw wrote: Nix wrote: however, blocking entire IP classes such as

Re: [RD] RE: [SAtalk] rules needed: iraq "most wanted" playing ca rds

2003-07-25 Thread jvanasco
yeah.. its really interesting -- because reading it, it reads like a lot of emails i get bayes didn't score it at all On Friday, July 25, 2003, at 01:51 PM, Chris Santerre wrote: OK that is much better to have the example. And this is kind of perfect for what I wanted to discuss about rule w

Re: [SAtalk] reporting idea

2003-07-25 Thread jvanasco
double traffic. eek. didn't think of that. since it would be a sitewide application though, it could just run nightly and report cumulative amounts. the real thing that i want to accomplish, is alerting bandwidth providers of the activity. whether its an abusive customer or an insecure box

[SAtalk] reporting idea

2003-07-25 Thread jvanasco
i dont know how useful this would be, but i was thinking of a spam reporting tool that did the following: sends a message to root/webmaster/whatever of the mailing ip traceroutes the ip, and finds the location facility and/or isp -- then mails root/webmaster and all whois contacts for that comp

Re: [RD] RE: [SAtalk] rules needed: iraq "most wanted" playing cards

2003-07-25 Thread jvanasco
if it were only so easy.. i think i might just give a couple points for "playing cards" in the body. maybe that and 'support american soldiers' the newest one reads : Subject: Saddam's evil biological weapons -- his sons Body: Big news yesterday. Saddam's two sons, Uday and Qusay Huss

[SAtalk] rules needed: iraq "most wanted" playing cards

2003-07-25 Thread jvanasco
I've been getting dozens of these, and they've got pretty clever senders who don't seem to be doing things that other rules or bayes catch. anyone have some good custom rules they use? does 2.6 already have rules for this (or planned inclusion) ? -

Re: [SAtalk] Recommendations

2003-07-23 Thread jvanasco
you can do exim compiled in with spamassassin. there's a patch that does this called sa-exim sa-exim.sf.net exim.org someone asked how to do this last week, and there were some posfix and sendmail approaches as well On Wednesday, July 23, 2003, at 09:29 AM, Christopher M. Iarocci wrote: I h

Re: [SAtalk] Re: SPAM rule for big@boss.com

2003-07-22 Thread jvanasco
My mta is set to reject all .pif's at smtp time.. i've just been getting so damn many of 'em On Tuesday, July 22, 2003, at 01:51 PM, Shane Williams wrote: On Tue, 22 Jul 2003 [EMAIL PROTECTED] wrote: just wondering-- does anyone know what virus causes that one? Sobig.c, and it seems like you'd

Re: [SAtalk] SPAM rule for big@boss.com

2003-07-22 Thread jvanasco
just wondering-- does anyone know what virus causes that one? On Tuesday, July 22, 2003, at 01:05 PM, John McGivern wrote: Hi everyone. I would like to use SA to block this an email with this in the freom field: "[EMAIL PROTECTED]" I've tried creating a rule but I haven't been successful bec

Re: [SAtalk] which is 'better' for reporting/learning? sa-learn+razor vs. spamassassin -r

2003-07-17 Thread jvanasco
On Thursday, July 17, 2003, at 04:26 PM, Nix wrote: On Wed, 16 Jul 2003, [EMAIL PROTECTED] muttered drunkenly: but by doing sa-learn, one has the option to skip rebuilding the bayes database after the scan -- which has significantly reduced my execution time and resources used spamassassin -r doe

Re: [SAtalk] OT - spamassassin - mailserver recommendations - passthru to exchange after scan

2003-07-17 Thread jvanasco
if you want to do scan for virus with clam av scan with spamassassin there's an excelllent how-to here for use with the exim mail server: http://www.timj.co.uk/linux/exim.php forwarding to an exchange server shouldn't be hard on any system i just switched over to exim

Re: [SAtalk] which is 'better' for reporting/learning? sa-learn+razor vs. spamassassin -r

2003-07-16 Thread jvanasco
On Wednesday, July 16, 2003, at 04:14 PM, Nix wrote: You'd have to run the files through spamassassin -d before passing them to razor, and sa-learn also has to do that, so spamassassin -r is faster (you're only doing the equivalent of a -d once) as well as being more effective (you're reporting to

[SAtalk] which is 'better' for reporting/learning? sa-learn+razor vs. spamassassin -r

2003-07-15 Thread jvanasco
spamassassin -r reports to razor/pyzor and bayes sa-learn only does bayes? what would be best for reporting a maildir of spam? spamassassin -r each file? or sa-learn the directory and then report each file to razor? i can imagine there's a speed tradeoff between sa-learn and spamassassin -r .