Filtering based on the recipients

2006-04-04 Thread Philip Prindeville
I was looking on the FAQ and the Wiki, but couldn't find this... How do I filter based on the recipient mailbox address? For instance, I'm running Linux, so if I get email sent to [EMAIL PROTECTED] or [EMAIL PROTECTED] then I know they're bogus... And can probably block it, even if some of the r

Re: Is Spamassassin failing math?

2006-04-04 Thread Matt Kettler
Philip Prindeville wrote: > Matt Kettler wrote: > > >> The "real" answer would be to always display 3-decimal place scores, but >> that's >> rather of ugly and creates a cluttered report. However, you'd always be 100% >> accurate. >> >> >> > > You'd still have rounding issues, just of a

Re: Is Spamassassin failing math?

2006-04-04 Thread Philip Prindeville
Matt Kettler wrote: >The "real" answer would be to always display 3-decimal place scores, but that's >rather of ugly and creates a cluttered report. However, you'd always be 100% >accurate. > > You'd still have rounding issues, just of a different sort. This is floating point, right? -Philip

Re: Stopping recent stock pumping spam

2006-04-04 Thread Tristan Miller
Greetings. In article <[EMAIL PROTECTED]>, Tristan Miller wrote: >> The first message in that example SHOULD have triggered >> RCVD_IN_NJABL_DUL and RCVD_IN_SORBS_DUL. >> >> As per this header: >> >> Received: from M696P000.adsl.highway.telekom.at >> (M696P000.adsl.highway.telekom.at [62.47.246.

Re: Stopping recent stock pumping spam

2006-04-04 Thread Daryl C. W. O'Shea
[EMAIL PROTECTED] wrote: Tristan Miller wrote: debug: is DNS available? 0 What is the output of $ cat /etc/resolv.conf ? It's likely that spamd is being called with -L. If on a RedHat/Fedora system, it'll be set in /etc/sysconfig/spamassassin.

RE: Re: Stopping recent stock pumping spam

2006-04-04 Thread Matthew.van.Eerde
Tristan Miller wrote: > debug: is DNS available? 0 What is the output of $ cat /etc/resolv.conf ? -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer

Re: Stopping recent stock pumping spam

2006-04-04 Thread Tristan Miller
Greetings. In article <[EMAIL PROTECTED]>, Matt Kettler wrote: >> Nonetheless, there's one >> particular kind of spam lately that always seems to slip through; it >> consists of a bunch of random words plus a graphic attachment. The >> graphic is usually a page of text advertising something -- al

Re: Stopping recent stock pumping spam

2006-04-04 Thread Doc Schneider
Tristan Miller wrote: Greetings. In article <[EMAIL PROTECTED]>, Doc Schneider wrote: [1] SARE rulesets: SARE_REDIRECT_POST300 SARE_EVILNUMBERS0 SARE_EVILNUMBERS1 SARE_EVILNUMBERS2 SARE_BAYES_POISON_NXM SARE_HTML SARE_HEADER SARE_SPECIFIC SARE_ADULT SARE_BML SARE_FRAUD SARE_SPOOF SARE_RANDOM SA

false positive on FORGED_MUA_OUTLOOK (v.3.1)

2006-04-04 Thread Tony Finch
The following headers come from a legitimate message - I have obscured the sender's name, but that's all. The "SlipStream SP Server" seems to have appended the client username and IP address to the message-ID, causing the FP. See also: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200

Re: Stopping recent stock pumping spam

2006-04-04 Thread Tristan Miller
Greetings. In article <[EMAIL PROTECTED]>, Doc Schneider wrote: >> [1] SARE rulesets: SARE_REDIRECT_POST300 SARE_EVILNUMBERS0 >> SARE_EVILNUMBERS1 SARE_EVILNUMBERS2 SARE_BAYES_POISON_NXM SARE_HTML >> SARE_HEADER SARE_SPECIFIC SARE_ADULT SARE_BML SARE_FRAUD SARE_SPOOF >> SARE_RANDOM SARE_SPAMCOP_TO

Re: Stopping recent stock pumping spam

2006-04-04 Thread Matt Kettler
Tristan Miller wrote: > Greetings. > > I'm using SpamAssassin 3.0.4 with local Bayesian filtering, Vipul's Razor, > and several daily-updated SARE rulesets [1]. Nonetheless, there's one > particular kind of spam lately that always seems to slip through; it > consists of a bunch of random words pl

Re: Stopping recent stock pumping spam

2006-04-04 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 [ forgot to copy list - d'oh ] Tristan Miller wrote: [snip image-only stock p&d spam comments] > Does anyone have a filterset or other recommended settings that will block > this kind of spam? > > Regards, > Tristan I ran a couple of those messages

Re: Stopping recent stock pumping spam

2006-04-04 Thread Doc Schneider
Tristan Miller wrote: Greetings. I'm using SpamAssassin 3.0.4 with local Bayesian filtering, Vipul's Razor, and several daily-updated SARE rulesets [1]. Nonetheless, there's one particular kind of spam lately that always seems to slip through; it consists of a bunch of random words plus a graph

sa-learn & Lotus Notes

2006-04-04 Thread Andy Jezierski
There have been numerous threads on how to have end users drop misclassified mail to spam/ham folders in Exchange, but I don't recall seeing any mention of a way of doing this with Notes. Is anyone doing this with Notes that would care to share the secret? Thanks Andy

Re: Stopping recent stock pumping spam

2006-04-04 Thread Mike Robinson
Tristan Miller wrote: Greetings. I'm using SpamAssassin 3.0.4 with local Bayesian filtering, Vipul's Razor, and several daily-updated SARE rulesets [1]. Nonetheless, there's one particular kind of spam lately that always seems to slip through; it consists of a bunch of random words plus a graph

Re: running SA on multiple machines

2006-04-04 Thread Matt Kettler
Dave Stern wrote: > On Mon, 3 Apr 2006, Matt Kettler wrote: >> >> (who on earth still uses SRV records for anything?) > > > Actually, I'm told it's used a lot for windoze services (active dir?) Ok, who that actually uses a real DNS server. :)

Re: running SA on multiple machines

2006-04-04 Thread Daryl C. W. O'Shea
Dave Stern wrote: As to the format spamc -d 1.2.3.4,10 2.3.4.5,10 That was from a google search. I believe that allows you to specify timeouts per host rather than a more universal "-t". I'm not aware of that being valid. In any case, anything beyond a single host would either not fail to

Re: running SA on multiple machines

2006-04-04 Thread Dave Stern
On Mon, 3 Apr 2006, Matt Kettler wrote: Dave Stern wrote: I'm trying to get SA working by remote connections and don't see it consistantly working. Users kick off SA in their .procmailrc on our mail server which can't handle a more recent version of SA so we only have v2.64 installed locally.

auto-whitelist

2006-04-04 Thread Andrea Bencini
Is it possible to manage auto-withelist? I am testing auto-whitelist and with my check_whitelist I have -2.8(-2.8/1) -- [EMAIL PROTECTED]|ip=none -2.7(-2.7/4) -- [EMAIL PROTECTED]|ip=none -1.7(-1.7/3) -- [EMAIL PROTECTED]|ip=none -2.3

RE: Randomly Not Scanning Messages

2006-04-04 Thread Michael Shuler
That was it. Thank you! Michael Shuler, C.E.O. OmniLEC And BitWise Communications, Inc. 682 High Point Lane East Peoria, IL 61611 OmniNumber: (309) 670-0575 Fax: (309) 213-3500 E-Mail: [EMAIL PROTECTED] Customer Service: (877) New-Omni > -Original M

Re: Moving bayes from bdb to MySQL

2006-04-04 Thread Michael Monnerie
On Montag, 3. April 2006 14:34 Lars Ringh wrote: > Now, since in each case the source data can come from two different > servers scanning the same kind of mails, should I try to merge the > bayes-data from servers home1 and home2 into the the same myqsl-db > and then merge the data from corp1 and c

Re: Broken FORGED_MUA_OUTLOOK checks

2006-04-04 Thread Michael Monnerie
On Freitag, 31. März 2006 14:40 Sander Holthaus wrote: > > (almost) full message at http://zmi.at/x/ham01.txt > > > > mfg zmi > > Are you sure that is a valid OE-email? Doesn't appear to me as such, > hence I'd say the tests fired correctly. Hi, I got feedback today that they use "Mass Mailer" to