Re: [SAtalk] sudden roll of FNs

e SA headers. Thanks for the response. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ Chemistry professors never die, they just fail to react.

Re: [SAtalk] Impotence!!

-- just feed them spam and > ham, and they will "do the right thing", even if you think you might be > confusing them. Both very good points. After considering your arguments subjectively, I guess I have to defer to your conclusions . . . Lou -- Louis LeBlanc [EMAIL

Re: [SAtalk] Impotence!!

er <[EMAIL PROTECTED]> wrote .. > > The rule hits "erectile dysfunction": > > > > SEX TIP FOR INVESTORS > > Pfizer shareholders all know there's a growing market for the=20 > > treatment of erectile dysfunction. Futura Medical is a share=20 > > tha

[SAtalk] this one slipped through and really ticked me off . . .

one more thing - forward each message to the government uce address, but I can't remember the exact address (is it [EMAIL PROTECTED]) If someone wants to correct or verify that address, I'd appreciate it. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlap

Re: [SAtalk] this one slipped through and really ticked me off . . .

On 08/15/03 07:57 AM, Kai MacTane sat at the `puter and typed: > At 8/15/03 05:08 AM , Louis LeBlanc wrote: > > I have a quick question. I received three copies of a spam > > message last night that all slipped through SA. Normally, I > > wouldn't give too much th

Re: [SAtalk] this one slipped through and really ticked me off . . .

On 08/15/03 02:04 PM, Louis LeBlanc sat at the `puter and typed: > > > > BTW, I've reported this incident to everyone I could even remotely > connect with the clearvisions.com domain, including avahost.net, who > supplies the dns service, ev1.net, who owns the IP addres

Re: [SAtalk] Is there a way to multiply the score if it matches 2+ rules

and the like. Very cool idea. There isn't a way to save the added value and simply use that as the score? Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ Experience, n.: S

Re: [SAtalk] Is there a way to multiply the score if it matches 2+ rules

On 08/17/03 02:53 PM, Martin Radford sat at the `puter and typed: > At Sun Aug 17 13:53:47 2003, Louis LeBlanc wrote: > > > > > >I want to do this w/ DNSBL -- if a mail comes from an MTA that is listed on > > > >2+ DNSBL lists, multiply the score by a bunch. >

Re: [SAtalk] Is there a way to multiply the score if it matches 2+ rules

On 08/17/03 11:59 PM, Louis LeBlanc sat at the `puter and typed: > > > I like the idea very much. I've written 5 rules based on those you've > provided above, and placed them in my ~/.spamassassin/user_prefs as > follows: > > meta LOCAL_MANY

[SAtalk] do not spam list spammer o_0

e with them will not send you spam. Right. Funny thing is, they want you to fill out a webform to get on their do not spam list, but to get off their personal spam list, they want you to email them. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlap

[SAtalk] I've got a couple more I want to go after

istrative contact. Maybe I should just report them there. If it doesn't stop, I can just set up a forward in procmail to bounce all the mail from those domains to him. Any ideas on the best way to get this guy to quit spamming me? Thanks. Lou -- Louis LeBlanc [EMAIL PR

Re: **SPAM RATING 12.50** [SAtalk] I've got a couple more I want to go after

than a petty thief picking pennies out of everyones pocket. I know full well that I am pretty much just ranting now, but not reporting these when there's a chance and the time to do so is essentially approval through indifference. SA catches things fine, but these people are working just as hard

[SAtalk] auto_report_threshold

ither. Is that an active configuration parameter? Thanks Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ Insults are effective only where emotion is present. -- Spock, "Who Mou

[SAtalk] trying something new to stop the 'enlarge your member' spam

. Regards -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ Genius, n.: A chemist who discovers a laundry additive that rhymes with "bright."

Re: [SAtalk] I've got a couple more I want to go after

On 08/21/03 09:15 AM, Louis LeBlanc sat at the `puter and typed: > I've gotten a couple interesting spams lately. Well, interesting in > the sense that I am perplexed by them. > > Here's a couple attached. They are from two different domains, > watchmeandlearn.com and

Re: [SAtalk] trying something new to stop the 'enlarge your member' spam

On 08/22/03 07:53 AM, Theodore Heise sat at the `puter and typed: > > > On Thu, 21 Aug 2003, Louis LeBlanc wrote: > > > My new method of stopping the spam . . . > > > > > > Good day sir. > > > > I am writing to inform you that I would like t

[SAtalk] pyzor help

#x27;t see how the path could be wrong. ~/.pyzor/servers contains: 66.92.49.157:24441 Has anyone out there gotten over this hurdle? TIA Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ Entropy i

[SAtalk] question/idea for whitelisted sender handling

this idea . . . reasons why it is a bad idea . . . how to do it in SA 2.55 . . . I'm interested in any and all discussion relevant to the above . Thanks all. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org

Re: [SAtalk] OT: Spam hell

a suggestion anyway. I'm not familiar with postfix - I run Sendmail myself and I'm hardly a guru there either - but can't you require validation to connect to the server? All users on my system have to validate before being allowed to send mail. Unless I'm mistaken, that

Re: [SAtalk] filter identifying vaild word as masked

he case insensitive flag on that regex. So pizza matches, as will PiZza, PIZZAZ, etc. > /\b(?:excIusive|GiangBiang|sIut|ganigbainged|duides|hairdciore|ExcIude|pIz)/i Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org

[SAtalk] spamd/spamc from procmail and per user bayes

;t be reached. And finally, I really need confirmation on the following before I do this: does spamd/spamc use per user bayes databases? This is really important, since what is spam to the rest of my users and myself is typically very different. Anyone have any suggestions here? TIA Lou -- Loui

Re: [SAtalk] heads-up: 2.60 will drop support for bayes dbs in non-DB_File formats

;s there somewhere, I'm missing the details regarding the bayes database formats. Thanks! BTW, Can't wait for 2.6! 2.55 is so effective - for me, anyway, I'd have figured there wasn't much else to do but keep the rules caught up with the spammers. Lou -- Louis LeBlanc

Re: [SAtalk] Re: heads-up: 2.60 will drop support for bayes dbs in non-DB_File formats

On 08/28/03 09:33 AM, Justin Mason sat at the `puter and typed: > > Douglas J Hunley writes: > > Louis LeBlanc shocked and awed us all by speaking: > > > Ok, just so I'm prepared, this means that the Berkley DB format > > > will remain? I'm afraid I'v

Re: [SAtalk] spamd & user_prefs

/user configs and bayes dbs in either case. Can you tell me if I'm totally off here? TIA Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org

Re: [SAtalk] OSIRUSOFT

ill takes resources to deal with it > (CPU, bandwidth, etc.) HERE HERE!!! Which is why the practice of sending spam can be seen as nothing more than plain ordinary theft. Sure it's theft of a virtual resource, but theft nonetheless. L -- Louis LeBlanc [EMAIL PROTECTED] Fully Fund

Re: [SAtalk] spamd & user_prefs

On 08/29/03 01:37 PM, Larry Gilson sat at the `puter and typed: > Hi Louis, > > > From: Louis LeBlanc > > > Sorry for barging in on this thread, but I'm trying to get this > > working myself right now (spamd/spamc with procmail). I have one > >

Re: [SAtalk] spamd & user_prefs

ust trying to keep my > understanding straight. Not at all. I appreciate the extra hassle you're going through to help! I don't know if I've got this right, but if you have any ideas, I'd appreciate a pointer. Either way, I'll probably take this back up Tuesday and te

Re: [SAtalk] spamd & user_prefs

On 09/01/03 04:41 PM, Larry Gilson sat at the `puter and typed: > Hi Louis, > > Please forgive the delay in responding. I was out of touch for a period of > time. Ditto . . . > > -Original Message----- > > From: Louis LeBlanc > > > After rereading a lot

Re: [SAtalk] spamd & user_prefs

) each time the backup mechanism is hit. Also, VERBOSE logging is turned on (normally off) before when the log file is reset, so there will be more detail for these messages, including the subject, so I can verify that they make it into the mailbox. Thanks for all the help with this. It seems

Re: [SAtalk] spamd & user_prefs

to get procmail to recognize when spamc cannot connect to spamd, and use the standard | spamassassin -a method as a fallback. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ Bombeck's R

Re: [SAtalk] SA being called twice?

watch the next few emails that come through. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ Captain Penny's Law: You can fool all of the people some of the time, and some of the peo

Re: [SAtalk] Help, Why doesn't this rule work?

ipe and remove the e from the spamassassin recipe. With a little creativity, you can even set the 'password' by putting it into a ~/.mailpw file and having procmail read that - but be aware that would add a disk access to each processed message. HTH Lou -- Louis LeBlanc

Re: [SAtalk] auto reporting to razor

nd my system tends to sieze while trying to handle 300 instances of spamassassin. I don't know that it's necessary, or even a good idea while using the lockfile, so I'd recommend you do your own due diligence on that. HTH Lou -- Louis LeBlanc [EMAIL PROTE

Re: [SAtalk] Rule(s) for W32/Swen.A@mm

not seen any FP either. Isn't there a page somewhere that posts these recipes as the Virii come out? I realize this is starting to get a little OT, but I know a good number of people here are fairly procmail savvy. Thanks. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Ho

Re: [SAtalk] Spam: The Screwfly Solution

dress and craft the IP packets/timing so that it does not need the > response that do not show up. But again, we are just sinking to > their level. Yes, but is it so bad to daydream about smiting the nasty little buggers? I hope not . . . L -- Louis LeBlanc [EMAIL PROTECTE

Re: [SAtalk] explosion of spam not getting caught

it should go in local.cf. amavisd.conf probably wouldn't recognize the recipe configuration. Lou > Thanks, > Anne > On Wednesday, October 8, 2003, at 12:22 PM, Louis LeBlanc wrote: > > > On 10/08/03 10:21 AM, Anne Ramey sat at the `puter and typed: > >> Is anyone els

Re: [SAtalk] Automatic Unsubscribe

nt and actually getting spam within a few days of dropping these unsubs. Even though the address never appeared in a web page, newsgroup, or email message of any kind - only in the unusb links. Seems like a decent way to seed a honeypot address. Lou -- Louis LeBlanc [EMAIL PROTECTED

Re: [SAtalk] Fan Mail!!! LOL We shut one down!

relished by the wisest men." - Willy > Wonka Ok, I'm in. What rules did you use for this? I've got honeypot addresses and legit ones. I'd love to start shutting down these buggers. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper

Re: [SAtalk] Fan Mail!!! LOL We shut one down!

On 10/14/03 01:52 PM, Chris Santerre sat at the `puter and typed: > > > > -Original Message- > > From: Louis LeBlanc [mailto:[EMAIL PROTECTED] > > Sent: Tuesday, October 14, 2003 11:57 AM > > To: Spamassassin-Talk (E-mail) > > Subject: Re: [SAta

Re: [SAtalk] [RD] Evil rules HUGE update!

; you should get a clean file. That works fine, or you could use: GET http://www.merchantsoverseas.com/wwwroot/gorilla/evilrules.cf > evilrules.cf L -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org

Re: [SAtalk] spamassassin/cyrus IMAP/sendmail problems (data format error)

welcome to email me offlist if you need more detailed help - particularly with the sendmail stuff. I'll send you any info on my configs you care to read. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapp

Re: [SAtalk] Spamassassin 2.50 rewrites Received: headers, how to stop it?

g the encapsulated spam/FP at the LDA stage, so no headers would be added to the newly extracted message. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ bureaucrat, n: A politician who has

Re: [SAtalk] Re: AutoResponse - Email Returned SAXK (KMM27083964V26088L0KM)

ow if (and how) one can remove an address from the auto-whitelist.db. I have no doubt there are ways to do it with home rolled perl scripts, but are there any tools in the distribution that will do it? Thanks for clearing that up. -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded H

[SAtalk] Autolearning question

ype: 127.0.0.6] * 0.1 -- Message only has text/html MIME parts End of SpamAssassin results Any idea why that one didn't get autolearned? I assume the answer is somewhere in these headers, but I can't see it. TIA Lou -- Louis LeBlanc [EMAIL PROTECTED] F

Re: [SAtalk] wrong header 2.50

tent-Type: text/plain; charset=us-ascii X-Spam-Status: No, hits=0.0 required=6.0 tests=none version=2.50 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) I know that doesn't solve your problem, but I hope it helps narrow things down. Lou -

Re: [SAtalk] carefully selected fakes for collecting negativ scores

BTW, I just upgraded from 2.44 to SA 2.50 and I REALLY am impressed. I've had much more extreme scores in general. Spam typically scores high (above 10) and non-spam typically scores low (usually well below 1). And the bayes scoring hasn't even kicked in yet! Nice job! Lou -- Louis LeBlan

Re: [SAtalk] Honeypot domain

I "unsubscribed" from some > spam lists I'd be deluged, but it just ain't so. > > -tom Actually, that's pretty good news. It seems to suggest that some of those 'unsubscribe' pages really are for unsubscribing, and not just refining the list.

[SAtalk] upgrading 2.53 to 2.55; moving to spamd?

th multiple users running with separate preferences (not in a database), I'd welcome comments and caveats there too. Thanks in advance Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ Fina

[SAtalk] whitelist/blacklist confusion

actually blacklisted? TIA Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ user, n.: The word computer professionals use when they mean "idiot."

[SAtalk] sudden roll of FNs

that. This sudden roll of FNs is a bit strange though. I have attached a few of them here. If anyone has any suggestions, I'm more than happy to hear them. Thanks everyone. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www

[SAtalk] sudden roll of FNs

that. This sudden roll of FNs is a bit strange though. I have attached a few of them here. If anyone has any suggestions, I'm more than happy to hear them. Thanks everyone. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www

Re: [SAtalk] reasons for these false positives

dition, you have your spam threshold set at 3.0, which is a little low. The default is 5.0. The message in question came in at 3.2, which would have been let through as real email, not spam. Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinai

Re: [SAtalk] sudden roll of FNs

On 08/11/03 01:57 PM, Hannu Liljemark sat at the `puter and typed: > On Sat, Aug 09, 2003 at 04:25:00PM +0300, Louis LeBlanc wrote: > > > I have attached a few of them here. If anyone has any suggestions, > > I'm more than happy to hear them. > > If I were you, I

Re: [SAtalk] Impotence!!

On 08/12/03 09:07 AM, Bart Schaefer sat at the `puter and typed: > On Tue, 12 Aug 2003, Louis LeBlanc wrote: > > > On 08/12/03 01:12 PM, [EMAIL PROTECTED] sat at the `puter and typed: > > > > > > Would it be wise to sa-learn that message as ham? > > >

Re: [SAtalk] sudden roll of FNs

On 08/11/03 05:12 PM, Hannu Liljemark sat at the `puter and typed: > On Mon, Aug 11, 2003 at 03:21:00PM +0300, Louis LeBlanc wrote: > > > > Most seem to score in BAYES_30 range in your current > > > environment, but with some training I'm willing to bet you'

Re: [SAtalk] Impotence!!

ending spree courtesy of low interest rates on lending >is fuelling bankruptcies. Without these two, you would have had no problem. Maybe you want to whitelist this sender? There were a couple other that caused the smaller scoring hits, including a pennystock scam reference. HTH Lou -- Lo

[SAtalk] How can I allow user rules with spamassassin?

s to spamd, and I have my users calling spamassassin -a directly from their ~/.procmailrc files. I'll almost certainly have more questions, but I'll take one hurdle at a time. TIA Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrord

Re: [SAtalk] New spammer trick - I got that one beat

in? I have defang_mime set to 0, but how can I get the reporting and subject modification turned off? Thanks Lou -- Louis LeBlanc [EMAIL PROTECTED] Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ program, n.: A magic spell cast over