>...
>Just got an ebay phish. The "update your account info" link points to
>
>To update your eBay records click on the following link:
>http://www.fraud-control.net/partner/ebay";
>target="_blank">http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate
>
>Loren
>
>
Compare to wamu4u. com
Just got an ebay phish. The "update your account info" link points to
To update your eBay records click on the following link:
http://www.fraud-control.net/partner/ebay";
target="_blank">http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate
Loren
Hello Matt,
Friday, June 10, 2005, 8:01:08 PM, you wrote:
MK> Robert Menschel wrote:
>> I just installed SA 3.0.4 on my Cygwin machine. I used the tarball,
>> extracted it into a new directory of its own making, and installed via
>> "perl Makefile.pl", "make", "make test", and "make install".
>>
Robert Menschel wrote:
> I just installed SA 3.0.4 on my Cygwin machine. I used the tarball,
> extracted it into a new directory of its own making, and installed via
> "perl Makefile.pl", "make", "make test", and "make install".
> "make test" seemed to run OK.
> But when I attempt to use SA, whethe
On Fri, Jun 10, 2005 at 07:50:52PM -0700, Robert Menschel wrote:
> But when I attempt to use SA, whether on an email or --lint,
> I get:
>
> failed to create instance of plugin Mail::SpamAssassin::Plugin::Pyzor:
> Can't locate object method "register_commands" via package
> "Mail::SpamAssassin::Co
I just installed SA 3.0.4 on my Cygwin machine. I used the tarball,
extracted it into a new directory of its own making, and installed via
"perl Makefile.pl", "make", "make test", and "make install".
"make test" seemed to run OK.
But when I attempt to use SA, whether on an email or --lint,
I get:
Tim Boyer wrote:
> I'm using SpamAssassin as a Sendmail milter, called from MIMEDefang.
> With spamd, it's possible to send the log somewhere else. Is it
> possible to do so with the Mail::SpamAssassin module? I've read
> Mail::SpamAssassin::Conf a couple of times, and can't find anything.
>
> T
I'm using SpamAssassin as a Sendmail milter, called from MIMEDefang.
With spamd, it's possible to send the log somewhere else. Is it
possible to do so with the Mail::SpamAssassin module? I've read
Mail::SpamAssassin::Conf a couple of times, and can't find anything.
Thanks...
--
Tim Boyer
[EMAI
Nate Kroll wrote:
> something in spamassassin or amavis that sets a score lower since
> it's from inside our own domain
ALL_TRUSTED
--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer
perl -e"map{y/a-z/l-za-k/;p
On 6/10/2005 3:04 PM, Eric A. Hall wrote:
> [I should state the obligitory -- this module won't do much for people
> who call SA from procmail.
Actually there is the possibility of using a rule that adds ~1.0 to the
score, instead of adding a header. I can check for the presence of the
rule to a
I'm looking to do a quick-n-dirty plugin that:
1) reads the spam threshold score from config (eg, default is "5.0")
2) reads the spam score for the current message
3) compares if the current score is greater than the threshold score,
AND if the auto-whitelist learner has not seen this s
Why such teeny tiny letters? None of us here seem
to have teeny tiny eyes.
{O.O}
- Original Message -
From:
Andy
Jezierski
To: users@spamassassin.apache.org
Sent: 2005 June, 10, Friday 11:22
Subject: Re: Advice for a weekend spam
assassin?
Dimitri Yioulos <
Recently we have had some computers on our network become infected with
viruses that send emails to random users on our exchange server and our
list server. While we can't stop the emails going to the exchange server,
we can filter the ones going to the list server because it is on our main
mail e
Dimitri Yioulos <[EMAIL PROTECTED]> wrote
on 06/10/2005 01:00:51 PM:
>
> I hope you don't mind my breaking into this thread, but I have a question
> regarding SA helpers. My mail setup is sendmail with spamassassin,
and I'm
> using SARE rules and bayes. Ours is a small shop (mail vol.
about
On Friday June 10 2005 11:16 am, Thomas Cameron wrote:
> On Fri, 2005-06-10 at 08:06 -0700, James Bucanek wrote:
> > Greetings,
> >
> > I consider myself a "weekend" spam assassin. I run my own server
> > (co-located), and have about a dozen users (mostly friends and family,
> > but a few paying c
1) You need to visit http://www.rulesemporium.com/ and select at least
a few of the SARE rules sets. They do really help SA performance.
2) I found best results here if I bucked up the BAYES_99 rule to 5
points. So far I have not seen that trigger a ham message with per
user Bayes. That pe
On Fri, 2005-06-10 at 08:06 -0700, James Bucanek wrote:
> Greetings,
>
> I consider myself a "weekend" spam assassin. I run my own server
> (co-located), and have about a dozen users (mostly friends and family, but a
> few paying customers). But running a mail server isn't my day job. I don't
On Fri, 10 Jun 2005, Justin Mason wrote:
|# btw, have you reported this to the Net::DNS maintainers?
|# it'd be good to fix this upstream (as I don't think there's
|# much we can do inside SpamAssassin).
|#
0.51 has already been released that addresses the overlooked debug
statement (http://www
On Friday, Jun 10th 2005 at 11:49 -0400, quoth Theo Van Dinter:
=>On Fri, Jun 10, 2005 at 11:45:16AM -0400, Steven W. Orr wrote:
=>> If I pipe it through sa -r -d I don't ever get a report to confirm from
=>
=>FYI: there's no point in adding -d to the report line. In fact, you're just
=>causing
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
btw, have you reported this to the Net::DNS maintainers?
it'd be good to fix this upstream (as I don't think there's
much we can do inside SpamAssassin).
- --j.
Tim Rosmus writes:
> On Fri, 10 Jun 2005, E. Falk wrote:
>
> |# I should mention that I
Running SpamAssassin is more of an art than a science. You'll probably
catch more spam by picking up most of the rules at:
http://www.rulesemporium.com/rules.htm
Or better yet, use RulesDuJour:
http://www.exit0.us/index.php?pagename=RulesDuJour
Configure it up to get the rulesets you want, ru
Matt Kettler wrote:
While that fact is true, the recipient list is known BEFORE the data phase
begins.
Since SA isn't invoked until the DATA phase, you can decide to skip SA before
the DATA phase starts.
All you'd have to do is bypass scanning if any of the RCPT To: addresses are
part of the b
Interesting... I checked the Base.pm file for 0.48 and that line doesn't
exist. I guess the failed tests were just a coincidence, and I ended up
doing the right thing for the wrong reasons. :)
Evan
Tim Rosmus wrote:
Here's what I did for this
*** lib/Net/DNS/Resolver/Base.pm.orig Fr
On Fri, 10 Jun 2005, E. Falk wrote:
|# I should mention that I cannot determine the source of this problem exactly,
|# but if I ran "make test" on 0.50 the "escapedchar" tests failed. If I went
|# ahead and installed it anyway, I got the remote addr struc errors unless I
|# told SpamAssassin that
A slightly more detailed explanation -
I should mention that I cannot determine the source of this problem
exactly, but if I ran "make test" on 0.50 the "escapedchar" tests
failed. If I went ahead and installed it anyway, I got the remote addr
struc errors unless I told SpamAssassin that dns w
I *just* finished fixing exact problem this on my own machine.
The issue is indeed with Net-DNS 0.50. Remove it and install 0.48 and
all your troubles will go away.
Evan
Rolf Kraeuchi wrote:
Hi!
I just upgraded one of our Gateway (scan)servers from SA 2.61 to 3.04
(System is SuSE Linux Ente
Hi!
I just upgraded one of our Gateway (scan)servers from SA 2.61 to 3.04
(System is SuSE Linux Enterprise9/i386, SA invoked by amavisd-new 2.3.1).
Can anybody explain me the following message:
--
scanhub02:~ # spamassassin --lint
;; remote addr struc: 02357f01
-
Hi everybody,
I have been struggling with this problem for a while with no luck
(qmailscanner 1.24st + spamassassin 3.0.3).
Once in a while I get a message wich is correctly scanned but it is
delivered with this header:
X-Spam-Status: No, hits=? required=?
This happens only sometimes with messag
On Fri, Jun 10, 2005 at 11:45:16AM -0400, Steven W. Orr wrote:
> If I pipe it through sa -r -d I don't ever get a report to confirm from
FYI: there's no point in adding -d to the report line. In fact, you're just
causing SA to do more work. (report already removes the markup, but -d causes
the
I have both spamcop
spamcop_from_address [EMAIL PROTECTED]
spamcop_to_address [EMAIL PROTECTED]
in my local.cf
and when I get spam coming through I always forward it to spamcop. I also
pipe it through sa-learn --spam but my question is:
If I pipe it through sa -r -d I don't ever get a repor
Steven Dickenson wrote:
> Matt Kettler wrote:
>
>> qmail-scanner may have many positive attributes, but flexible control
>> of scanning is not one of them.
>
>
> I don't think it's so much their problem, as it is a general limitation
> of SMTP-time rejection. Since a single message could be int
Ben O'Hara wrote:
Hi Guys,
Unfortunately we use Exchange 5.5 for backend storage of
email within our company (something which isnt likely to change!
although an upgrade to 2003 is on the books)
Anyways, Ive installed SpamAssassin and ClamAV on a dedicated *nix box
with exim which works
James Bucanek wrote:
Greetings, As you can see, the Bayes filter has nailed it as spam,
but it still only gets a score of 3.6.
Bayes scores are really quite low in SA v3 - 3.0.2. You may want to
upgrade to 3.0.3 to get the newer Bayes scores, or revert to the v2.6x
scores in your local.cf.
> I consider myself a "weekend" spam assassin. I run my own
> server (co-located), and have about a dozen users (mostly
> friends and family, but a few paying customers). But running
> a mail server isn't my day job. I don't run Razor or any of
> the cooperative spam filters simply because I did
Sinks will work with SA, I have one pretty much ironed out for 2000/2003
-- a lot better than it was a year ago :) .. (pure perl -- PerlScript).
But I'm not sure how it will do on volume servers. With my small
server/volume, it works well for me.
P.S. to all that need it.. MS put out a COM ob
Hi,
> Check out the interesting idea at www.rulesemporium.com/forums/
> entitled: Image attachment MD5 footprint RBL
Yes, that sounds cool. I wouldn't use MD5 though, since it would
be rather easy to work around cryptographical hashes with simple
automation.
Not going into details here, don't
Hi,
> I did receive an email with a lot of recipients but all of
> them where on a
> new line. Is this a spamsign?
Not only a spammer, but stupid as well.
In my experience very few spammers use those kind of headers.
Some still use multiple recipient in one To: or CC: header,
but even those
From: "Niek" <[EMAIL PROTECTED]>
> On 6/10/2005 5:05 AM +0200, jdow wrote:
> > Out of curiosity what TTL exists on the surbl server lookups?
>
> man dig
I figure a meatware solution was suitable for something this unimportant.
{^_-}
Ben O'Hara wrote:
Anyways, Ive installed SpamAssassin and ClamAV on a dedicated *nix box
with exim which works great for filtering the mail...however, id
rather deliver ALL mail onto exchange and have "spam" messages moved
into a "SPAM" Folder within the users Private Information Store.
You can
Greetings,
I consider myself a "weekend" spam assassin. I run my own server (co-located),
and have about a dozen users (mostly friends and family, but a few paying
customers). But running a mail server isn't my day job. I don't run Razor or
any of the cooperative spam filters simply because
Matt Kettler wrote:
qmail-scanner may have many positive attributes, but flexible control of
scanning is not one of them.
I don't think it's so much their problem, as it is a general limitation
of SMTP-time rejection. Since a single message could be intended for
multiple recipients (and thus
On 6/10/05, Kang, Joseph S. <[EMAIL PROTECTED]> wrote:
> > -Original Message-
> > From: Ben O'Hara [mailto:[EMAIL PROTECTED]
> > Sent: Friday, June 10, 2005 9:36 AM
> >
> > Anyways, Ive installed SpamAssassin and ClamAV on a dedicated
> > *nix box with exim which works great for filtering t
> -Original Message-
> From: Ben O'Hara [mailto:[EMAIL PROTECTED]
> Sent: Friday, June 10, 2005 9:36 AM
>
> Anyways, Ive installed SpamAssassin and ClamAV on a dedicated
> *nix box with exim which works great for filtering the
> mail...however, id rather deliver ALL mail onto exchange a
Hi Guys,
Unfortunately we use Exchange 5.5 for backend storage of
email within our company (something which isnt likely to change!
although an upgrade to 2003 is on the books)
Anyways, Ive installed SpamAssassin and ClamAV on a dedicated *nix box
with exim which works great for filtering
At 02:51 AM 6/10/2005, Phibee Network operation Center wrote:
i use SpamAssassin 3.0.3 with qmail-scanner 1.25st for relaying
emails to another server after scan and check ...
I want know if it's possible that say at spamassasin don't scan
a email for the destination [EMAIL PROTECTED] ? or put i
FYI,
Made a small rule for this and it gets hit every day sofar without any FP's.
So if anyone is interested:
header PORT_HELO Received =~ /from \[[0-9\.]*\]
\(port\=[0-9][0-9][0-9][0-9] helo\=\[[a-zA-Z]*\]\)/
describe PORT_HELO Header contains special port and helo
score PORT_HELO 10.00
Menno
>
Kelson wrote:
Ben Hanson wrote:
Hmm, scoring certain attachments (.gif, .jpg, etc) based on a
calculated checksum (md5 or otherwise).
Now that I think about it, I recall Razor used to run into false
positives with one of the background images in a set of Outlook
stationery (because some s
On Thursday, June 9, 2005, 11:00:50 PM, Bob Proulx wrote:
> Kenneth Porter wrote:
>> Bob Proulx wrote:
>> > In both cases you would need to modify /etc/resolv.conf to use the
>> > local nameserver instead of the current one.
>>
>> Wiki fodder?
> Good point. Okay, here is the initial page with th
On Thursday, June 9, 2005, 8:05:53 PM, jdow jdow wrote:
> Out of curiosity what TTL exists on the surbl server lookups?
It's 15 minutes for most blacklist records and 1 week for the
testpoints.
Jeff C.
--
Jeff Chan
mailto:[EMAIL PROTECTED]
http://www.surbl.org/
Hello,
I did receive an email with a lot of recipients but all of them where on a
new line. Is this a spamsign? Maybe we could check for multiple instances of
a TO: line in a messageheader.
Example from the messageheader I did notice.
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
To:
50 matches
Mail list logo
