Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Gene Heskett
On Thursday 23 February 2006 23:20, Bob McClure Jr wrote: >On Thu, Feb 23, 2006 at 10:59:02PM -0500, Gene Heskett wrote: >> On Thursday 23 February 2006 22:45, Bob McClure Jr wrote: >> >On Thu, Feb 23, 2006 at 10:36:19PM -0500, Gene Heskett wrote: >> >> >> >> >> >> Also, where would it put it if i

Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Bob McClure Jr
On Thu, Feb 23, 2006 at 10:59:02PM -0500, Gene Heskett wrote: > On Thursday 23 February 2006 22:45, Bob McClure Jr wrote: > >On Thu, Feb 23, 2006 at 10:36:19PM -0500, Gene Heskett wrote: > >> > >> > >> Also, where would it put it if it did dl a new version of itself? > > > >Probably in /etc/mail/s

Re: unable to connect to database: DBI module not available

2006-02-23 Thread Joshua Tinnin
On Thu 23 Feb 06 20:04, "Jeff Peng" <[EMAIL PROTECTED]> wrote: > Hi, > That seems your Perl installation lack the DBI module,which is needed > for accessing mysql in Perl.You should install the DBI and DBD::Mysql > modules by hand.Certainly,you could go to http://search.cpan.org and > get them. In

Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Gene Heskett
On Thursday 23 February 2006 22:45, Bob McClure Jr wrote: >On Thu, Feb 23, 2006 at 10:36:19PM -0500, Gene Heskett wrote: >> >> I don't seem to be getting any email from RDJ recently. Maybe since >> the time I switch this system from fetchmail to a mailfile, and from >> there had kmail running SA

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Gene Heskett
On Thursday 23 February 2006 15:48, Christopher X. Candreva wrote: >On Thu, 23 Feb 2006, Mike Jackson wrote: >> that AOL would never remove from the headers. Now if only I could >> make Mailman do the same thing... > >Enable verp for the list. This sends out every e-mail with a custom >return-addre

Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Bob McClure Jr
On Thu, Feb 23, 2006 at 10:36:19PM -0500, Gene Heskett wrote: > > I don't seem to be getting any email from RDJ recently. Maybe since the > time I switch this system from fetchmail to a mailfile, and from there > had kmail running SA which was a cpu killer. Now I have fetchmail > handing it o

Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Gene Heskett
On Thursday 23 February 2006 09:50, Bowie Bailey wrote: >Doc Schneider wrote: >> Gene Heskett wrote: >> > On Thursday 23 February 2006 01:06, Doc Schneider wrote: >> > > I just committed version 01.00.08 of this ruleset to: >> > > >> > > http://rulesemporium.com/rules/70_sare_stocks.cf >> > > >> >

Re: unable to connect to database: DBI module not available

2006-02-23 Thread Jeff Peng
Hi, That seems your Perl installation lack the DBI module,which is needed for accessing mysql in Perl.You should install the DBI and DBD::Mysql modules by hand.Certainly,you could go to http://search.cpan.org and get them. HTH -- Joshua Tinnin <[EMAIL PROTECTED]> wrote: Using FreeBSD 6.0-RELEAS

unable to connect to database: DBI module not available

2006-02-23 Thread Joshua Tinnin
Using FreeBSD 6.0-RELEASE-p4, mysql 4.1.18, p5-Mail-SpamAssassin-3.1.0_6 Using the debug flag, I get: [25618] dbg: bayes: unable to connect to database: DBI module not available: No such file or directory [25618] dbg: bayes: using username: krinklyfig Now, I don't know why it would be using tha

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Rick Macdougall
Dave Pooser wrote: If you are seeing the AOL members addresses then I'd like to know what you did to receive them, because you appear the only one is several list I belong to that are discussing this very issue that is seeing those addresses. I'd also like to get the AOL member's address, 'caus

RE: Take a look at this spam

2006-02-23 Thread Ruben Cardenal
> HelLo -at-use! I fouNd yoUr profile in seaRch result Here. whEn I read > it I deCidEd to wriTe you and intRoduce mysElf. sO, mY > nAme iS AnAstasia. I Know tHat my letteR may get loSt among oThers that > comE to you evEry day, but It will be coOL if yoU'll write > me. If yoU really searChing

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Dave Pooser
> If you are seeing the AOL members addresses then I'd like to know what you > did to receive them, because you appear the only one is several list I > belong to that are discussing this very issue that is seeing those > addresses. I'd also like to get the AOL member's address, 'cause I don't get

attachment policy?

2006-02-23 Thread OpenMacNews
hi all, question: what's this list's policy for sending attachments to the list ? i'm noticing, e.g., *.pl scripts as attachments ... rather than links to posts at code-paste sites. iiuc, in general attachments are 'bad form', but given that the list-mgr is NOT apparently blocking them , it tho

Re: Problem with false-positives for SASL users

2006-02-23 Thread martin f krafft
also sprach mouss <[EMAIL PROTECTED]> [2006.02.23.2324 +0100]: > how do you integrate SA with postfix? I don't. It's called by procmail. -- martin; (greetings from the heart of the sun.) \ echo mailto: !#^."<*>"|tr "<*> mailto:"; [EMAIL PROTECTED] invalid/expired pgp (sub)ke

Re: Problem with false-positives for SASL users

2006-02-23 Thread mouss
martin f krafft a écrit : > > Well, sure, this makes sense, but how can I support this standard > use-case? Postfix adding a SASL-header that causes Spamassassin then > to ignore the message isn't the solution as spammers would simply do > that sooner or later. Short of whitelisting people, what s

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Kelson
mouss wrote: In the case of an aol address, one may require that the browser connected from an aol IP. Not practical. AOL offers a lower "bring your own connection" rate for people who want to keep the app and the email, but have broadband access through another provider. As I understand it

Re: postfix integration

2006-02-23 Thread Noel Jones
On 2/23/06, Rodney Richison <[EMAIL PROTECTED]> wrote: > Is there a howto somewhere to have postfix reject spam with a high score? > I found one for exim, but not postfix. > amavisd-new can be used as a pre-queue smtpd_proxy_filter in postfix. This works fairly well for low-volume sites. High vol

RE: How I keep my SA rules up to date

2006-02-23 Thread Bret Miller
> At the risk of starting another "Why are you duplicating > Rules_du_jour ?" > aregument . . . :-) > > Since people say it needs to be updated, here is a little > piece of perl I > use to update my scripts. I wrote it after being completely > perplexed by the > rules_du_jour shell script(s). > > I

Re: postfix integration

2006-02-23 Thread mouss
Rodney Richison a écrit : > Is there a howto somewhere to have postfix reject spam with a high score? > I found one for exim, but not postfix. > you should not discard mail "frivolously" (false positives occur). use a quarantine mechanism instead (a Junk folder for instance. then you can quickly

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread mouss
[EMAIL PROTECTED] a écrit : > Michael Clark wrote: > >>No, because then I could use the system to sign you up for lists you >>didn't sign up for. The token (step 6) must be sent to the email >>address that was submitted in step 2). Mike > > > There are two distinct tokens. One embedded in the e

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread mouss
Michael Clark a écrit : > No, because then I could use the system to sign you up for lists you > didn't sign up for. The token (step 6) must be sent to the email address > that was submitted in step 2). Mike > I guess there is no solution for the first message (requesting confirmation by sending

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread JamesDR
Vivek Khera wrote: On Feb 23, 2006, at 1:08 PM, Mike Jackson wrote: So, I suppose the question is: How do you deal with getting forwarded mail through to AOL without being branded as a spammer? You stop forwarding email to AOL... really. Other option is to crank up the SA pickiness and tell

Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Sandy S
- Original Message - From: "Doc Schneider" <[EMAIL PROTECTED]> To: "Sandy S" <[EMAIL PROTECTED]> Cc: Sent: Thursday, February 23, 2006 2:24 PM Subject: Re: Updated Pump and Dump rules. 2006-02-23 > Sandy S wrote: > > - Original Message - > > From: "Doc Schneider" <[EMAIL PROTE

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Vivek Khera
On Feb 23, 2006, at 1:25 PM, Peter P. Benac wrote: Now AOL and Yahoo are going to join forces with GOODMAIL.COM. If you want to guarantee delivery to AOL then you must pay homage to GOODMAIL.COM at a rate of .25 to 1 cent per message. At the same time they will tighten filters for peo

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Vivek Khera
On Feb 23, 2006, at 1:08 PM, Mike Jackson wrote: So, I suppose the question is: How do you deal with getting forwarded mail through to AOL without being branded as a spammer? You stop forwarding email to AOL... really. Other option is to crank up the SA pickiness and tell the customers th

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Christopher X. Candreva
On Thu, 23 Feb 2006, Mike Jackson wrote: > that AOL would never remove from the headers. Now if only I could make > Mailman do the same thing... Enable verp for the list. This sends out every e-mail with a custom return-address, which you can use to tell who submitted the mail as spam. ===

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread DAve
[EMAIL PROTECTED] wrote: DAve wrote: We have not chosen a course of action yet. It looks as if the only *solution* is to not send any mail to AOL accounts. From a business standpoint this is not acceptable. But, if AOL users will tag a confirmation message as Spam, what's an admin to do? For a

Re: bogusmx.rfc-ignorant.org anybody else using it?

2006-02-23 Thread Mike Jackson
After reading Mike's emailing about AOL, this stuck out: I reject mail at the MTA level that's from IPs or domains listed in Spamhaus (both SBL and XBL) and bogusmx.rfc-ignorant.org (the only one of their lists I trust not to cause false positives when used in this manner). I think xbl-sbl is

Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Doc Schneider
Sandy S wrote: - Original Message - From: "Doc Schneider" <[EMAIL PROTECTED]> To: Sent: Thursday, February 23, 2006 12:06 AM Subject: Updated Pump and Dump rules. 2006-02-23 I just committed version 01.00.08 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It sh

Re: rule for spam with geocities link, multiline expression

2006-02-23 Thread Loren Wilton
> I am receiving, already several weeks, a lot of spam in the following > form: > - > \w+, > > http://\w\w.geocities.com/\w+\d+ > > \w+ \w+ > - > > For example: > > - > Beth, > > http://au.geocities.com/ethylic40187 > > Rocco Maldonado > - > > Is it possible to write

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Peter P. Benac
Don't tempt me, though that would pay for the goodmail payments. > Peter P. Benac wrote: >> Confirmation elimates bad addresses. The major problem comes >> from people too lazy to unsubscribe from a list. They just hit the >> spam >> button. AOL refuses to acknowledge that is happens. Even

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Matthew.van.Eerde
Peter P. Benac wrote: > Confirmation elimates bad addresses. The major problem comes > from people too lazy to unsubscribe from a list. They just hit the > spam > button. AOL refuses to acknowledge that is happens. Even when they > were shown the e-mail that their member marked as spam. Wel

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Matthew.van.Eerde
Michael Clark wrote: > No, because then I could use the system to sign you up for lists you > didn't sign up for. The token (step 6) must be sent to the email > address that was submitted in step 2). Mike There are two distinct tokens. One embedded in the email address the user has to send to, a

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Michael Clark
No, because then I could use the system to sign you up for lists you didn't sign up for. The token (step 6) must be sent to the email address that was submitted in step 2). Mike At 11:57 AM -0800 2/23/06, <[EMAIL PROTECTED]> wrote: DAve wrote: We have not chosen a course of action yet. It l

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Peter P. Benac
Matthew, This is the way list confirmation works with both Majordomo and Mailman. I tell all my list opwners to make sure they turn on confirmation even if the subscribe and unsubscribe functions are open to anyone. Confirmation elimates bad addresses. The major problem comes from peopl

bogusmx.rfc-ignorant.org anybody else using it?

2006-02-23 Thread qqqq
After reading Mike's emailing about AOL, this stuck out: > I reject mail at the MTA level that's from IPs or domains listed in Spamhaus > (both SBL and > XBL) and bogusmx.rfc-ignorant.org (the only one of their lists I trust not > to cause false positives when used in this manner). I think xbl-

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Matthew.van.Eerde
DAve wrote: > We have not chosen a course of action yet. It looks as if the only > *solution* is to not send any mail to AOL accounts. From a business > standpoint this is not acceptable. But, if AOL users will tag a > confirmation message as Spam, what's an admin to do? For an outside-the-box kin

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread DAve
Peter P. Benac wrote: Mike, You obviously haven't heard all the news about what AOL and Yahoo are about to do. First AOL blocked you be cause one or more of those people you forward mail for has hit that little button that says "This is SPAM". AOL doesn't really care if the user requ

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Peter P. Benac
Now that idea has some merit :) I am working on getting Majordomo to add the parsed header but an encrypted one is a better idea. Thanks.. >>I tried that Matthew. It too was changed to >> [EMAIL PROTECTED] >> >> What I haven't tried is removing the @aol.com. > > In a mailing list manager app I

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Mike Jackson
I tried that Matthew. It too was changed to [EMAIL PROTECTED] What I haven't tried is removing the @aol.com. In a mailing list manager app I wrote, I simply put a MD5 hash of the address in the headers. Then I have something to check against the subscriber list that AOL would never remove fr

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Peter P. Benac
I tried that Matthew. It too was changed to [EMAIL PROTECTED] What I haven't tried is removing the @aol.com. > Peter P. Benac wrote: >> Very true.. I went around and around with AOL over this every issue >> for three days. > > After inspecting some TOS reports... > > Sometimes (not always) the

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Matthew.van.Eerde
Peter P. Benac wrote: > Very true.. I went around and around with AOL over this every issue > for three days. After inspecting some TOS reports... Sometimes (not always) the To: field is replaced with . Sometimes the To: field is preserved. Sometimes the email is attached. Sometimes the ema

Re: spamassassin counts wrongly

2006-02-23 Thread Thomas Geldner
Ah, thanks, that is logical. I did not know this side :) Tom Theo Van Dinter schrieb: On Thu, Feb 23, 2006 at 06:52:36PM +0100, Thomas Geldner wrote: Is this a bug ? 4.5 + 0.5 = 5.0 or ? ;) Not really. It's covered in http://wiki.apache.org/spamassassin/RoundingIssues, but the short version

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Peter P. Benac
Very true.. I went around and around with AOL over this every issue for three days. I will be happy to forward the dang things to you as well. I may get one or two that have some how escaped the AOL edits. Those I do receive are somehow buried in a Receive: mail header. If you are seeing the A

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Bart Schaefer
On 2/23/06, Peter P. Benac <[EMAIL PROTECTED]> wrote: > Get enough of those TOS messages in one day and they will still block you > IP address and any IP address that you have assigned to you. FUD. They don't block multiple IPs at once as far as I can tell. > Furthermore, they have already annou

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Matthew.van.Eerde
Peter P. Benac wrote: > AOl will send you what they refer to as a TOS alert wherever anyone > hits that spam button. They are even nice enough to attach the > offending message. > > They expect you to immediately remove that user from your lists; > however, they will replace every instance of the

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Peter P. Benac
AOl will send you what they refer to as a TOS alert wherever anyone hits that spam button. They are even nice enough to attach the offending message. They expect you to immediately remove that user from your lists; however, they will replace every instance of the AOL members mail address from the

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Dimitri Yioulos
On Thursday February 23 2006 1:25 pm, Peter P. Benac wrote: > Mike, > > You obviously haven't heard all the news about what AOL and Yahoo are > about to do. > > First AOL blocked you be cause one or more of those people you > forward mail for has hit that little button that says "This is S

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Peter P. Benac
Mike, You obviously haven't heard all the news about what AOL and Yahoo are about to do. First AOL blocked you be cause one or more of those people you forward mail for has hit that little button that says "This is SPAM". AOL doesn't really care if the user requested the mail to be for

RE: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Greg Allen
You don't. Only idiots use AOL. AOL management are idiots, so it is a good match. One of those idiot users will push the AOL spam button on forwarded spam, that marks your server as a spam source to AOL admins. Nothing you can do about that. Once that happens a few times you're done. Better to

(OT, but relevant) Playing with AOL?

2006-02-23 Thread Mike Jackson
I know this isn't directly related to SpamAssassin, but I'm hoping you sys admins will have some advice to share... Here's the situation. I'm the sys admin for a web hosting/design company. We're using Sendmail, with SpamAssassin invoked from procmail. I reject mail at the MTA level that's fro

Re: spamassassin counts wrongly

2006-02-23 Thread Theo Van Dinter
On Thu, Feb 23, 2006 at 06:52:36PM +0100, Thomas Geldner wrote: > Is this a bug ? > 4.5 + 0.5 = 5.0 or ? ;) Not really. It's covered in http://wiki.apache.org/spamassassin/RoundingIssues, but the short version is: > - > X-Spam-Status: No, score=4.9 required=5.0 tests=BAYES_99,DATE_IN_PAS

Re: spamassassin counts wrongly

2006-02-23 Thread Maurice Lucas
On Thu, 2006-02-23 at 18:52 +0100, Thomas Geldner wrote: > Is this a bug ? > 4.5 + 0.5 = 5.0 or ? ;) > snip > - > X-Spam-Status: No, score=4.9 required=5.0 tests=BAYES_99,DATE_IN_PAST_03_06 > autolearn=no version=3.1.0 > X-Spam-Spam-Report: > * 0.5 DATE_IN_PAST_03_06 Date

spamassassin counts wrongly

2006-02-23 Thread Thomas Geldner
Is this a bug ? 4.5 + 0.5 = 5.0 or ? ;) snip - X-Spam-Status: No, score=4.9 required=5.0 tests=BAYES_99,DATE_IN_PAST_03_06 autolearn=no version=3.1.0 X-Spam-Spam-Report: * 0.5 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date * 4.5 BAYES_99 BODY: Ba

Re: Problem with false-positives for SASL users

2006-02-23 Thread Matthias Fuhrmann
On Thu, 23 Feb 2006, Justin Mason wrote: > > martin f krafft writes: > > Hi, > > > > we have a bunch of users who use our SASL-enabled SMTP server to > > relay their mail when on the road. This causes the following > > Received header: > > > > Received: from septumania (217-162-227-XXX.dclient.h

RE: rule for spam with geocities link, multiline expression

2006-02-23 Thread Chris Santerre
Title: RE: rule for spam with geocities link, multiline expression > -Original Message- > From: Maarten de Boer [mailto:[EMAIL PROTECTED]] > Sent: Thursday, February 23, 2006 5:06 AM > To: users@spamassassin.apache.org > Subject: rule for spam with geocities link, multiline _expressi

Re: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Sandy S
- Original Message - From: "Doc Schneider" <[EMAIL PROTECTED]> To: Sent: Thursday, February 23, 2006 12:06 AM Subject: Updated Pump and Dump rules. 2006-02-23 > I just committed version 01.00.08 of this ruleset to: > > http://rulesemporium.com/rules/70_sare_stocks.cf > > It should appea

postfix integration

2006-02-23 Thread Rodney Richison
Is there a howto somewhere to have postfix reject spam with a high score? I found one for exim, but not postfix. -- Highest Regards, Rodney Richison RCR Computing http://www.rcrnet.net 118 N. Broadway Cleveland, OK 74020 918-358-

Re: Plain text spam not scoring

2006-02-23 Thread Patrick von der Hagen
Patrick Sneyers wrote: Op 21-feb-06, om 16:08 heeft Matt Kettler het volgende geschreven: Patrick Sneyers wrote: These don't hit very much in my setup. They get caught with the new Reverse-Check feature in CommuniGate. Do you know what this test does? I've been getting wuite a few of these

Re: SpamAssassin large-scale users willing to comment?

2006-02-23 Thread Spam Admin
Large health care enterprise, ~6500 users on Novell Groupwise. We've been using SA on SusE with AmavisD, SARE, Razor, etc for two years (came from Guinievere on NT). ~20M inbound SMTP connections per year, ~65-68% spam/viruses, and we're blissfully happy with the SA setup. In fact, despite the vol

RE: New Spam? Ricky invites you to ZEBO !!!!

2006-02-23 Thread Bowie Bailey
Simon Leung wrote: > > I have been pulling my hair out from this "Ricky invites you to blah > blah blah..." getting through my server (SA3.1 + MD 2.56 + RDJ). I > added "[EMAIL PROTECTED]" into the blacklist_from, but it still gets > through ? There're SA tests matched as shown below but they

RE: Updated Pump and Dump rules. 2006-02-23

2006-02-23 Thread Bowie Bailey
Doc Schneider wrote: > Gene Heskett wrote: > > On Thursday 23 February 2006 01:06, Doc Schneider wrote: > > > I just committed version 01.00.08 of this ruleset to: > > > > > > http://rulesemporium.com/rules/70_sare_stocks.cf > > > > > > It should appear within the hour. > > > > I've copied this

Re: SpamAssassin large-scale users willing to comment?

2006-02-23 Thread Jeff Peng
Hi,jdow, I think you have misunderstood me.I'm not working for Netzero.In fact,our mail systems' end-users numbers are more than a hundred million far away.We use SA as part of our antispam mechanism.Certainly,it's not the original one written with Perl.We disable the Bayes currently,and only u

Re: SpamAssassin large-scale users willing to comment?

2006-02-23 Thread Jeff Peng
Hi,Jdow, I think you have misunderstood me.I'm not working for Netzero.In fact,our mail systems' end-users numbers are more than a hundred million far away.We use SA as part of our antispam mechanism. Certainly,it's not the original one written with Perl.We disable the Bayes currently,and only

From a mortgage spam:

2006-02-23 Thread jdow
Interesting subject words: Subject: *SPAM* 013.9 ** bayesian teetotal at blutwurst Rght! {^_-}

Re: SpamAssassin large-scale users willing to comment?

2006-02-23 Thread jdow
After I replied offline I did some looking around Er, I just looked up on a size ranking from November 20th last year. NetZero was set at 8,600,000 members. AOL is only 22,200,000 members. Do you mean 100,000,000 EMAILS PER DAY or something? That makes more sense and is maybe somewhat low. 8

Re: Problem with false-positives for SASL users

2006-02-23 Thread Justin Mason
martin f krafft writes: > Hi, > > we have a bunch of users who use our SASL-enabled SMTP server to > relay their mail when on the road. This causes the following > Received header: > > Received: from septumania (217-162-227-XXX.dclient.hispeed.ch > [217.162.227.XXX]) > (using SSLv3 wi

Problem with false-positives for SASL users

2006-02-23 Thread martin f krafft
Hi, we have a bunch of users who use our SASL-enabled SMTP server to relay their mail when on the road. This causes the following Received header: Received: from septumania (217-162-227-XXX.dclient.hispeed.ch [217.162.227.XXX]) (using SSLv3 with cipher RC4-MD5 (128/128 bits)) (

Re: SpamAssassin large-scale users willing to comment?

2006-02-23 Thread Tom Brown
I really mean a hundred million. that sounds like hotmail or something.

rule for spam with geocities link, multiline expression

2006-02-23 Thread Maarten de Boer
Hello, I am receiving, already several weeks, a lot of spam in the following form: - \w+, http://\w\w.geocities.com/\w+\d+ \w+ \w+ - For example: - Beth, http://au.geocities.com/ethylic40187 Rocco Maldonado - Is it possible to write a rule to detect these? I

Re: SpamAssassin large-scale users willing to comment?

2006-02-23 Thread jdow
From: "Jeff Peng" <[EMAIL PROTECTED]> I really mean a hundred million. Jeff, if you are ever permitted to and are moved to describe that installation sometime I'd be an avid reader. You must have an amazing array of equipment involved in the filtering and email handling. {^_^}

New Spam? Ricky invites you to ZEBO !!!!

2006-02-23 Thread Simon Leung
Hi there, I have been pulling my hair out from this "Ricky invites you to blah blah blah..." getting through my server (SA3.1 + MD 2.56 + RDJ). I added "[EMAIL PROTECTED]" into the blacklist_from, but it still gets through ? There're SA tests matched as shown below but they didn't stop it ???