FTC Finds Affiliates and Hosts both responsible in spam case

2005-11-17 Thread Jeff Chan
This case gives CAN-SPAM some teeth to go after both affiliates and the hosts they advertise. It's also a precedent worth mentioning to those who say they have no responsibility for their affiliates. http://www.ftc.gov/opa/2005/11/globalnet.htm For Release: November 17, 2005 Spammers Barred f

Re: 'lngd' etc

2005-11-17 Thread Maurice Lucas
Jonathan Nichols wrote: You know, these days, the *only* spam that slips through is "product test panel" and similar crap. The URL is always similar to this one: http://lngd-pp.com/link/91268749298550548/ Usually 4 letters, dash, 1 or 2 letters, and what looks like a 'hashbuster' Anyone

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread jdow
From: "Kelson" <[EMAIL PROTECTED]> Magnus Holmgren wrote: Question: Is there any knowledge as to how spammers deal with different kinds of failure? Does it matter if I reject the RCPT command or the MAIL command, or even drop the connection right away I'm sure it depends on the spammer, but a

Re: uol.com.br

2005-11-17 Thread jdow
From: "Elton Ramos Carvalho" <[EMAIL PROTECTED]> jdow wrote: Does that ISP have ANY redeeming virtues? I'm about to blacklist it completely due to its repeated "AntiSpam UOL" messages clogging my machine. {^_^} It is the uol.com.br (Universo Online) anti spam system. This antispam have a o

'lngd' etc

2005-11-17 Thread Jonathan Nichols
You know, these days, the *only* spam that slips through is "product test panel" and similar crap. The URL is always similar to this one: http://lngd-pp.com/link/91268749298550548/ Usually 4 letters, dash, 1 or 2 letters, and what looks like a 'hashbuster' Anyone found a way to effectively

Re[2]: RATWARE_ZERO_TZ=4.1

2005-11-17 Thread Robert Menschel
Hello Steven, Wednesday, November 16, 2005, 1:47:24 PM, you wrote: SL> I guess if this is the case I need to lower SL> the score for that rule as my kill value is a 3.5, ... SpamAssassin scores are optimized for a "this is spam" threshold of 5. Anyone who changes their threshold significantly a

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Christian Recktenwald
On Thu, Nov 17, 2005 at 11:42:44AM -0800, John Woolsey wrote: > It would be an interesting addition to a honeypot. Make the mail server > just hang up and not respond to tie up connections on the spammer. There's a cool piece of software holding tcp connections alive as long as possible called "la

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread mouss
Roger Taranto a écrit : If it didn't tie up sockets on our machines, it seems like instead of rejecting the mail, we should just hold on to the mail connection for as long as possible. It wouldn't take too long to tie up all of their outbound connections and back up their mail server. Unfortu

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Matt Kettler
Roger Taranto wrote: > On Thu, 2005-11-17 at 10:17, Matt Kettler wrote: > >>Magnus Holmgren wrote: >> >>>Spammers need to clean their address lists once in a while, lest they >>>end up with a very low proportion of valid addresses, right? >> >>No, they don't have to clean it. > > > If it didn't

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread John Woolsey
It would be an interesting addition to a honeypot. Make the mail server just hang up and not respond to tie up connections on the spammer. - bfn - JAW -- Original Message -- From: Roger Taranto <[EMAIL PROT

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Roger Taranto
On Thu, 2005-11-17 at 10:17, Matt Kettler wrote: > Magnus Holmgren wrote: > > Spammers need to clean their address lists once in a while, lest they > > end up with a very low proportion of valid addresses, right? > > No, they don't have to clean it. If it didn't tie up sockets on our machines, it

Patching in Windows

2005-11-17 Thread Joshua Graham
Hey all,   Sorry if this has been hashed over before. I’ve googled until my fingers bled, and I’ve searched through the archives and FAQs already.   I have been running an older version of SA with Chris Lewis’ Exchange Sink for quite a while now with no problems. In fact it works extrem

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Kelson
Magnus Holmgren wrote: Question: Is there any knowledge as to how spammers deal with different kinds of failure? Does it matter if I reject the RCPT command or the MAIL command, or even drop the connection right away I'm sure it depends on the spammer, but a while back I started looking at the

Re: OT: Spammers' reactions to rejection

2005-11-17 Thread Matt Kettler
Magnus Holmgren wrote: > Spammers need to clean their address lists once in a while, lest they > end up with a very low proportion of valid addresses, right? No, they don't have to clean it. Let's face it.. spammers are currently making extensive use of dictionary attacks to add more addresses to

OT: Spammers' reactions to rejection

2005-11-17 Thread Magnus Holmgren
Spammers need to clean their address lists once in a while, lest they end up with a very low proportion of valid addresses, right? Question: Is there any knowledge as to how spammers deal with different kinds of failure? Does it matter if I reject the RCPT command or the MAIL command, or even drop

Re: [Fwd: Re: uol.com.br]

2005-11-17 Thread Gene Heskett
On Thursday 17 November 2005 10:07, Gene Heskett wrote: >On Thursday 17 November 2005 00:14, jdow wrote: >> >>These bozoids are executing a minor DOS attack of these confirm >> emails. I sent 6. I have received at LEAST 36 challenge/response >> messages from the [EMAIL PROTECTED](((@)(*#$)(& . They

Re: uol.com.br

2005-11-17 Thread Elton Ramos Carvalho
jdow wrote: Does that ISP have ANY redeeming virtues? I'm about to blacklist it completely due to its repeated "AntiSpam UOL" messages clogging my machine. {^_^} It is the uol.com.br (Universo Online) anti spam system. This antispam have a option that you need request for authorization to s

better write a rule for this early..

2005-11-17 Thread Ryan L. Sun
be4 bad guys using it:   Free .be domain name registrations http://www.e3internet.com/domain-registration/conditions/register-be/

Impressive - almost 23 points for a blank zombie spam

2005-11-17 Thread List Mail User
Lots of "real" spam doesn't score this high. 22.9 points on SA 3.0.4. Someone's zombie ratware misfired. Is this some record for points per line - infinite. The only change was to substitute {VICTIM} for the actual account. Paul Shupak [EMAIL PROTECTED] pts rule name

Re: [Fwd: Re: uol.com.br]

2005-11-17 Thread Gene Heskett
On Thursday 17 November 2005 00:14, jdow wrote: >From: "Justin Mason" <[EMAIL PROTECTED]> > >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> Doc Schneider writes: >>> I'm having one of those days. >>> >>> >>> >>> Original Message >>> Subject: Re: uol.com.br >>> >>> jdow w

Re: Configuration Question

2005-11-17 Thread Matt Kettler
At 06:40 AM 11/17/2005, Joey wrote: OK I have converted over to the latest version and have mosting things running well. I wanted to confirm how to properly use SURBL's in the previous version I used a .cf file, however the docs say 3.0 and higher come with SURBL support. is the URIDNSBL the same

Re: spam stats

2005-11-17 Thread Pál László
I've tried Vispan, but unfortunately I still at this point Number::Format: {thousands_sep} and {decimal_point} may not be equal at /usr/lib/perl5/site_perl/5.8.7/Vispan/Print.pm line 477 I'm searhing the net for weeks, but it looks like there is some compatibility issue between Vispan and some p

Re: spam stats

2005-11-17 Thread Dhawal Doshy
Pál László wrote: Hi, I'm looking for some stat maker which can analyse my mail log. I'm using SA 3.1.0 with Mailscanner and Postfix and I've tried spamstats-0.6b on my mail.log but it does not produce any output. Could you please recommend a working solution? Thank you Laszlo See (all on on

spam stats

2005-11-17 Thread Pál László
Hi, I'm looking for some stat maker which can analyse my mail log. I'm using SA 3.1.0 with Mailscanner and Postfix and I've tried spamstats-0.6b on my mail.log but it does not produce any output. Could you please recommend a working solution? Thank you Laszlo -- "Bár megírták a Sorsod, de od

Configuration Question

2005-11-17 Thread Joey
OK I have converted over to the latest version and have mosting things running well. I wanted to confirm how to properly use SURBL's in the previous version I used a .cf file, however the docs say 3.0 and higher come with SURBL support. is the URIDNSBL the same thing which you activate from init.p

Re: [Fwd: Re: uol.com.br]

2005-11-17 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 jdow wrote: > > procmail: > :0: > # was from one specific person > * ^From: AntiSpam UOL <[EMAIL PROTECTED]> > /dev/null > > ... > # I just got pissed. > :0: > * ^From: .*uol.com.br > $HOME/mail/uol_crap Or (assuming you are your own MX) /etc/mail/a

RE: RATWARE_ZERO_TZ=4.1

2005-11-17 Thread Martin Hepworth
> -Original Message- > From: Kelson [mailto:[EMAIL PROTECTED] > Sent: 16 November 2005 22:42 > To: users@spamassassin.apache.org > Subject: Re: RATWARE_ZERO_TZ=4.1 > > Steven Lamb wrote: > > I guess if this is the case I > > need to lower the score for that rule as my kill value is a 3.5