Re: On bichromatic GIF stock spam

2006-06-24 Thread Philip Prindeville
Loren Wilton wrote: >>If, after excluding black, we find that 100% of the color map is that >>nasty pastel pink or pastel lime green (etc) then it's a spam and we >>toss it. >> >>Sound reasonable? >> >> > >I was thinking about this the other day. I think the concept is reasonable, >but as sta

Re: ZMI_GERMAN and using ifplugin: diskussion

2006-06-24 Thread Loren Wilton
We unfortunately don't have any scripts to deal with version differences. Our technique has been to make two (or more) versions of a file, typically a less aggressive version for 2.6x and older, and one using new features for the newer releases. Its a shame that there is no "if" clause that is usa

RE: SPF_SOFTFAIL not working properly

2006-06-24 Thread Jim Hermann - UUN Hostmaster
> On 6/24/2006 11:14 AM, Jim Hermann - UUN Hostmaster wrote: > > How do I debug the SPF Module during SA Operations? > > > > I have had another email marked as SPF_SOFTFAIL during the > first receipt and > > the From domain does not have a TXT SPF record. When I > isolated the message > > and r

Re: On bichromatic GIF stock spam

2006-06-24 Thread Loren Wilton
> If, after excluding black, we find that 100% of the color map is that > nasty pastel pink or pastel lime green (etc) then it's a spam and we > toss it. > > Sound reasonable? I was thinking about this the other day. I think the concept is reasonable, but as stated doesn't go far enough, and woul

Re: pyzor

2006-06-24 Thread Ed Kasky
At 06:51 PM Saturday, 6/24/2006, Somebody wrote -=> Hi, Is there a port which I have to open to allow pyzor to run properly? I keep having the below error. Try opening udp port 24441 ... . . . . . . . . . . . . . . . . . . Randomly Generated Quote (474 of 1056): Every time I close the door

pyzor

2006-06-24 Thread Spamassassin List
Hi, Is there a port which I have to open to allow pyzor to run properly? I keep having the below error. [26217] dbg: util: executable for pyzor was found at /usr/bin/pyzor [26217] dbg: pyzor: pyzor is available: /usr/bin/pyzor [26217] dbg: info: entering helper-app run mode [26217] dbg: pyzor:

Re: SPF_SOFTFAIL not working properly

2006-06-24 Thread Daryl C. W. O'Shea
On 6/24/2006 11:14 AM, Jim Hermann - UUN Hostmaster wrote: How do I debug the SPF Module during SA Operations? I have had another email marked as SPF_SOFTFAIL during the first receipt and the From domain does not have a TXT SPF record. When I isolated the message and ran it again, it was proces

Re: razor is not working ...

2006-06-24 Thread Matt Kettler
Screaming Eagle wrote: > I thought I had razor2 working. From the debug output, it does not > seem so. Am i missing something? If so, where can I download it and > install it? Thanks. > >From the looks of it, you enabled the plugin, but you never installed razor itself. http://razor.sf.net > [413

Re: my own email is in the BAYES_50...

2006-06-24 Thread Michael Monnerie
On Sonntag, 25. Juni 2006 00:55 Screaming Eagle wrote: > sa-learn can unlearn a message, but I do not have that message. Would > this work if I dump out a backup of it and take out any instances of > my email, then use sa-learn to restore back from it.  Thanks. Please keep answers on the list. BA

razor is not working ...

2006-06-24 Thread Screaming Eagle
I thought I had razor2 working. From the debug output, it does not seem so.  Am i missing something? If so, where can I download it and install it? Thanks. [4133] dbg: config: read file /usr/share/spamassassin/25_razor2.cf [4133] dbg: plugin: loading Mail::SpamAssassin::Plugin::Razor2 from @INC [4

ZMI_GERMAN and using ifplugin: diskussion

2006-06-24 Thread Michael Monnerie
Dear users, I am getting reports that the "ifplugin" statements in the ZMI_GERMAN ruleset are making lint errors for SA version <2.64, so some people seem to use such an old version. Currently the only use of ifplugin is to find an attachment namen ebay-rechnung.pdf.zip, which contains a virus

Re: my own email is in the BAYES_50...

2006-06-24 Thread Michael Monnerie
On Samstag, 24. Juni 2006 17:30 Screaming Eagle wrote: > How do i take my self out of the BAYES_50 test. man sa-learn man spamassassin-run mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660/4156531 .network.your.ideas. // PGP Key:

Re: SPF_SOFTFAIL not working properly

2006-06-24 Thread Michael Monnerie
On Samstag, 24. Juni 2006 17:14 Jim Hermann - UUN Hostmaster wrote: > When spf_timeout is set to 5 (default), during the initial email > receipt, I think that Mail::SPF::Query exceeds the timeout and the > timeout routine does not work properly.  The timeout error causes > Mail::Spamassassin::Plugi

Re: On bichromatic GIF stock spam

2006-06-24 Thread Philip Prindeville
Michael Scheidell wrote: >>-Original Message- >>From: Philip Prindeville [mailto:[EMAIL PROTECTED] >>Sent: Saturday, June 24, 2006 2:10 PM >>To: users@spamassassin.apache.org >>Subject: On bichromatic GIF stock spam >> >> >>I get a lot of spam that looks like: >> >>http://pastebin.com/729

RE: On bichromatic GIF stock spam

2006-06-24 Thread Michael Scheidell
> -Original Message- > From: Philip Prindeville [mailto:[EMAIL PROTECTED] > Sent: Saturday, June 24, 2006 2:10 PM > To: users@spamassassin.apache.org > Subject: On bichromatic GIF stock spam > > > I get a lot of spam that looks like: > > http://pastebin.com/729105 > > on the alsa-deve

On bichromatic GIF stock spam

2006-06-24 Thread Philip Prindeville
I get a lot of spam that looks like: http://pastebin.com/729105 on the alsa-devel mailing list, amongst others... And noticed the following. If you decompress the GIF file and decode it into a pixmap image, then do a color histogram of the image, you notice two things immediately. There are tw

Re: Adding Phishing Link rule

2006-06-24 Thread Philip Prindeville
What about combining this with a whitelist? I.e. I regularly get emails from target.bifn0.com that contain links that point to themselves, but say they are target.com And in fact, this is a 3rd party that Target has contracted to do outsource mailings for them, so in that respect they are leg

Re: [dns-operations] negative caching of throwaway spam domains

2006-06-24 Thread John D. Hardin
On Sat, 24 Jun 2006, Jeff Chan wrote: > Michael gives some good possibilities and a discussion of the > difference with greylisting. Note that whois can't really be done > on an automated, high-frequency basis. Back when I first suggested this a couple of years ago, it was possible to download a

Re: Bayes corrupt?

2006-06-24 Thread Loren Wilton
> One of our SA 3.1.0 installations is giving BAYES_00=-2.599 for > this definite spam. Does that mean our Bayes database is corrupt? I'd say that it is at the very least mis-trained as far as this spam is concerned. Without further evidence I'd hesitate to state outright that it is corrupt. If

Re: Why does FORGE_RCV_HELO not working for this email...

2006-06-24 Thread Loren Wilton
Then you should perhaps read the documentation on the setting for trusted_networks. - Original Message - From: Screaming Eagle To: Loren Wilton Cc: users@spamassassin.apache.org Sent: Saturday, June 24, 2006 8:28 AM Subject: Re: Why does FORGE_RCV_HELO not

RE: Sa-update and proxy servers

2006-06-24 Thread Michael Scheidell
> -Original Message- > From: Michael Scheidell > Sent: Saturday, June 24, 2006 11:28 AM > To: users@spamassassin.apache.org > Subject: Sa-update and proxy servers > Patch attached. (works here(tm)) In fact, my nightly cronjob runs 'sa-cover' script: (exit code 4 is for timeouts) Just in

my own email is in the BAYES_50...

2006-06-24 Thread Screaming Eagle
How do i take my self out of the BAYES_50 test. Thanks.

Re: Why does FORGE_RCV_HELO not working for this email...

2006-06-24 Thread Screaming Eagle
Hi, most unlikely, since it is commented out by default. On 6/24/06, Loren Wilton <[EMAIL PROTECTED]> wrote: Perhaps a problem with trusted_networks setting?           Loren - Original Message - From: Screaming Eagle To: spam mailling list Sent: Saturday, June 24,

Sa-update and proxy servers

2006-06-24 Thread Michael Scheidell
I think I noticed small change in sa-update for 3.13. It is now using port 8090 for outgoing connections. (or did it always?) This happened to make it immediately fail on servers in the DMZ which have a strict set of outgoing egress rules. I now need to set a proxy server to do sa-updates throug

Re: Why does FORGE_RCV_HELO not working for this email...

2006-06-24 Thread Loren Wilton
Perhaps a problem with trusted_networks setting?           Loren - Original Message - From: Screaming Eagle To: spam mailling list Sent: Saturday, June 24, 2006 7:46 AM Subject: Why does FORGE_RCV_HELO not working for this email... All,I am getting this type o

SPF_SOFTFAIL not working properly

2006-06-24 Thread Jim Hermann - UUN Hostmaster
How do I debug the SPF Module during SA Operations? I have had another email marked as SPF_SOFTFAIL during the first receipt and the From domain does not have a TXT SPF record. When I isolated the message and ran it again, it was processed without any errors. I suspect that there is a problem wi

Re: Various plugins for Windows version?

2006-06-24 Thread Loren Wilton
> There are some other plugins that i would also like to > implement (for example iXhash and OCR Plugin or OCR scanner > and image validator SA-plugin), but i don't know whether they > work on windows installations. How can i find out if these > are meant to function on windows? FWIW the ocr plugi

Why does FORGE_RCV_HELO not working for this email...

2006-06-24 Thread Screaming Eagle
All, I am getting this type of email: Return-Path: <[EMAIL PROTECTED]> X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) X-Spam-Virus: No X-Spam-Status: No, score=1.1 required=7.0 tests=BAYES_50,HTML_50_60, HTML_MESSAGE autolearn=no version=3.1.3 X-Spam-Level: * Received: from com

Noob config question

2006-06-24 Thread carnold5
Hello all! I am using SA-3.1.0 for OES-Linux (novell distro based on SLES9); mail server using Hula (Netmail) also a novell product. Clients are thunderbird. I guess my first problem is, i don't seem to have SA configured right, let me explain. I goto my yahoo account and send an email to me (which

Re: spamd / logging to terminal

2006-06-24 Thread Matt Kettler
numE wrote: > Now i have just a small issue left. > > i use the following /etc/init.d/spamd script: > http://kmail.kde.org/unsupported/spamd > > unfortunately now i get the log messages from spamd always on my root > account (displayed in terminal) > how may i change this behavior? > > Edit your

Re: [dns-operations] negative caching of throwaway spam domains

2006-06-24 Thread Maurice Lucas
On Sat, 2006-06-24 at 05:08 -0700, Jeff Chan wrote: > On Friday, June 23, 2006, 5:09:55 PM, jdow jdow wrote: > > Jeff, it's probably quite good when the lookup is implemented on > > spam traps and a small collection of servers. The domain registrars > > who are honest might like it. It'd reduce the

Re: [dns-operations] negative caching of throwaway spam domains

2006-06-24 Thread Jeff Chan
On Friday, June 23, 2006, 5:09:55 PM, jdow jdow wrote: > Jeff, it's probably quite good when the lookup is implemented on > spam traps and a small collection of servers. The domain registrars > who are honest might like it. It'd reduce the incentive and value > of domain kiting. Presumably the lis

Re: japanese mail get high score

2006-06-24 Thread alan premselaar
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Aabash Gurung wrote: > Hi, > > I'm using spamassassin 3.1.1 in freebsd, default confugiration with fred > and xHash rules added. > > Hope the provided information is enough, let me know if you need more > information. > > Here's the few enties from