Re: spamd not well after crash

2006-08-06 Thread John Andersen
On Sunday 06 August 2006 16:30, kalin mintchev wrote: > hi all... > > last week we had a power outage and our mail sever went down with it. the > spamd performance has been disappointing ever since. crap like "Re: > veaooVzlAGRA" is passing through without a hitch. here is what spamd added > to t

Re: testing for empty text/plain

2006-08-06 Thread Theo Van Dinter
On Mon, Aug 07, 2006 at 12:07:58AM -0400, Eric A. Hall wrote: > Anybody written a rule that tests for empty text/plain, preferably only > when a non-empty text/html or some other media-type is provided? Sounds very similar to MPART_ALT_DIFF. -- Randomly Generated Tagline: "Deja Fu: The feeling t

testing for empty text/plain

2006-08-06 Thread Eric A. Hall
Anybody written a rule that tests for empty text/plain, preferably only when a non-empty text/html or some other media-type is provided? Thanks -- Eric A. Hallhttp://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

BENCHMARK SOFTWARE

2006-08-06 Thread sokka
Dear Groupmembers,     Do we have any benchmark software for testing spamd/spamc load.     regards

Oh goodie! Script-kiddie phish mails!

2006-08-06 Thread Loren Wilton
Looking at an incredibly poorly formatted phish for Chase Bank, I find the following stuff after the closing tag: src="http://hostingprod.com/js_source/geov2.js";> geovisit(); http://visit.webhosting.yahoo.com/visit

Re: SPF Relay

On 6-Aug-06, at 9:54 PM, Benu wrote: On Sunday 06 August 2006 14:07, you wrote: On 6-Aug-06, at 2:36 PM, Benu wrote: On Sunday 06 August 2006 09:39, you wrote: Unless you post real domains it is very difficult to help with SPF questions. Since we cannot query your DNS, we can't determine wh

Unparseable header

An extra received line is generated by Sendmail's submit service when mimedefang calls stream_by_recipient, making headers that look like:Received: from vtn1.victoria.tc.ca (localhost [127.0.0.1])        by vtn1.victoria.tc.ca (8.13.7/8.13.7) with ESMTP id k73LncS0012140        for <[EMAIL PROTECTE

spamd not well after crash

hi all... last week we had a power outage and our mail sever went down with it. the spamd performance has been disappointing ever since. crap like "Re: veaooVzlAGRA" is passing through without a hitch. here is what spamd added to the headers: X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-

Re: What changes would you make to stop spam? - United Nations Paper

From: "Magnus Holmgren" <[EMAIL PROTECTED]> For that matter, how in would an IMAP MUA handle BCC? {^_-} In much the same way as when you send mail with sendmail -t, I suppose. The MUA adds a Bcc field and the IMAP server removes it. That means the IMAP server must communicate with two SMTP

Re: 0451.com

| 2250 0733.com | 1882 0451.com | 89 072.com | 62 006.com | 58 1039.com | 52 163.com | 32 0668.com | 31 004.com | 19 126.com | 13 mail.0451.com | | Panagiotis Here are my numbers from last week: 5006 0451.com 3845 53.com 2253 0733.com 440 mail.0451.com 204 006.com 1

Re: What changes would you make to stop spam? - United Nations Paper

On Friday 04 August 2006 05:06, jdow took the opportunity to say: > From: "Kenneth Porter" <[EMAIL PROTECTED]> > > > --On Wednesday, August 02, 2006 12:02 PM -0700 MennovB > > <[EMAIL PROTECTED]> > > > > wrote: > >> Anyway, IMHO with SYN throttle you would only be rate-limiting the > >> zombies, I

Re: Always add report headers

Ollie, thanks for the explanation... I was really looking at the wrong place. Cheers, Arik Ollie Acheson wrote: > Arik - > > I think the problem is one of understanding what is happening with the > .qmail + ifspamh processing. > > The first line of .qmail invokes ifspamh with a copy of the emai

Re: 0451.com

On Sun, 6 Aug 2006, Panagiotis Christias wrote: > and not only them according to our daily sendmail logs: > > 2484 0733.com > 2449 0451.com ...etc I've also seen 0541.com in my logs. -- John Hardin KA7OHZICQ#15735746http://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174

Re: Always add report headers

Arik - I think the problem is one of understanding what is happening with the .qmail + ifspamh processing. The first line of .qmail invokes ifspamh with a copy of the email on stdin. ifspamh then invokes spamassassin and, if spam, delivers to the designated spam destination and exits 99 so the .q

use (misguided?) of SA sandbox's SendMailID.pm plugin?

hi. i've SA r429169 built from src on OSX 10.4.7. i'm attemtpting to use/explore the sandbox's SendMailID.pm plugin. to do so, as part of install, i've: cp /usr/ports/spamassassin/rules/SendmailID.pm /var/MailServer/Conf/SA/Dist/ and, in my init.pre, i've: loadplugin Mail::SpamAss

Re: 0451.com

and not only them according to our daily sendmail logs: # egrep '@[0-9]+\.com' YESTERDAY | sed -e 's/^.*@//' -e 's/>.*$//' | sort | uniq -c | sort -rn | head 2484 0733.com 2449 0451.com 100 072.com 66 1039.com 52 006.com 51 0668.com 40 004.com 37 163.com 18 126.com 15 mail.0451.com # egrep

Includes Question.

I have SA set up to run per user, my question is does the user_prefs file support any include commands like Apache's httpd.conf or Bind's named.conf file does? I basically don't want to re-write the maing user_prefs file when a user updates their White or Black lists via the web interface I'm p

Re: postini.com

On Tue, 1 Aug 2006, [EMAIL PROTECTED] stipulated: > From: "Nix" <[EMAIL PROTECTED]> > >> On Mon, 31 Jul 2006, negativescore gibbered uncontrollably: >>> Find a floppy disk. Format it. Move cpanel over to the floppy disk. Remove >>> the floppy disk from the system. Wrap the floppy in >>> alternati

Re: Inline Image Message not bring properly caught

Made some changes and waiting to see if it fixes it. Gotta wait for another one of these annoying messages to come in.

sa-learn and universal spamassassin configuration file

I have a mailbox that accepts spam if the address is bogus. How do I train sa-learn to user the spam mail box as --spam and universally block such mail? -- Member - Liberal International This is [EMAIL PROTECTED] Ici [EMAIL PROTECTED] God Queen and country! Beware Anti-Christ rising! Bew

Re: spamd config vs spamassassin config

Is it possible for spamc/d to be reading from a different set of configuration files than spamassassin? If so, how can I determine this? Sure. Usually if it is running under a different usercode. You will have to figure out how you start spamd and see what parameters are passed to it and wha

spamd config vs spamassassin config

Is it possible for spamc/d to be reading from a different set of configuration files than spamassassin? If so, how can I determine this? Thanks... Pat...

Re: SPF Relay

Unless you post real domains it is very difficult to help with SPF questions. Since we cannot query your DNS, we can't determine whether there are errors in the SPF record.   On 5-Aug-06, at 4:29 PM, Benu <[EMAIL PROTECTED]> wrote:I need help also, I am seeing the same messages. In /etc/mail/spama

RE: Making the OCR software work

Marc Perkel wrote: > Maybe I missed something but I installed the gocr program and fedd it > some stock spam files and the accuracy of what it read was really really > poor - unusable. Is there something else I need to install? I had the same experience. Have you tried feeding one of thos gi

Making the OCR software work

Maybe I missed something but I installed the gocr program and fedd it some stock spam files and the accuracy of what it read was really really poor - unusable. Is there something else I need to install?

Re: Idea for deobfuscator, could be combined with OCR too

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daryl C. W. O'Shea wrote: > On 8/6/2006 7:50 AM, decoder wrote: >> -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 >> >> Hello there, >> >> I recently had the idea to write a plugin, which scans for >> obfuscated words according to a given list of words,

Re: Idea for deobfuscator, could be combined with OCR too

On 8/6/2006 7:50 AM, decoder wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello there, I recently had the idea to write a plugin, which scans for obfuscated words according to a given list of words, which are often obfuscated (to avoid simple word filters). Looking at most of my spam, s

New users query on clustering SA using ultramonkey with mysql

Hi I am new user to spamassassin , I am planning to setup a high availability(redundancy ),Load Balancing environment of spamassassin , I plan to user MySQL as database for this purpose . After a lot of google search I decided to follow the following steps. Step 1 , Cluster M

Idea for deobfuscator, could be combined with OCR too

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello there, I recently had the idea to write a plugin, which scans for obfuscated words according to a given list of words, which are often obfuscated (to avoid simple word filters). Looking at most of my spam, spammers seem to obfuscate always the s

Re: Inline Image Message not bring properly caught

On 8/6/2006 4:39 AM, Loren Wilton wrote: Suggestions? The obvious questions: did you restart spamd? (Or however you call SA?) Were you running under the same usercode when you did the -D run as the normal run? Also note that if the rules are user rules, ie. in your ~/.spamassassin/user_p

Re: Inline Image Message not bring properly caught

Suggestions? The obvious questions: did you restart spamd? (Or however you call SA?) Were you running under the same usercode when you did the -D run as the normal run? I can't see any immediately obvious problem with the rules, so they *should* work. Loren

Re: Spamassassin placing headers into body of email

From: "Phill Edwards" <[EMAIL PROTECTED]> My set up is: - Fedora Core 5 - Postfix 2.2.8-1.2 - Spamassassin 3.1.3-1.fc5 - Procmail 3.22-16.2.1 - Fetchmail 6.3.4-0.fc5.1 I use fetchmail to get mail from all my different ISP mailboxes. These then get delivered on my local machine by postfix which

Inline Image Message not bring properly caught

I receive one of the image spams it was sent through spamassassin via procmail and was came through with the following score and hits. X-Spam-Status: No, hits=3.3 required=5.0 tests=CP_RANDOMWORD_10=0.5, DATE_IN_FUTURE_12_24=2.767,HTML_MESSAGE=0.001 autolearn=no version=3.1.3 I have several loc