Re: Could THIS have doubled my SA Speed...

On Friday, November 17, 2006, 12:13:20 PM, Rob Systems) wrote: > I tried adding a "resolv.conf" file (which wasn't previously there) and > entered my local DNS caching server there. > Then, I restarted SpamD and ran a corpus of 50 test files through SA (using a > batch file, processing them one-

Re: URI obfuscation that confuses SA

Jeff Chan wrote: > It seems that the particular URI obfuscation in: > > http://www.surbl.org/evidence/seruikiontunhfasnde.com.txt > > successfully confuses SpamAssassin 3.1.6 into not detecting the > SURBL blacklisted URI. > Does that even work as a link? Doesn't seem to work in firefox or IE

Fuzzy OCR - first time user

OK - trying out the FuzzyOCR plugin. So far it all the default stuff with minimal installation. I'm running Fedora Core 6. Used the gocr RPM and didn't patch the source. Everything is default and it doesn't seem to be complaining so . If I like this what do I need to change to really do it

Re: TORA.08 rule

Theo Van Dinter wrote: > On Fri, Nov 17, 2006 at 08:15:21PM -0500, Matt Kettler wrote: > >> 5 >> 4 >> 3 >> 2 >> 1 >> blastoff! >> Should match. >> > > You shouldn't be launching rockets via email. > > Hey, I don't know about your network, but I have mission control critical email :)

Re: TORA.08 rule

On Fri, Nov 17, 2006 at 08:15:21PM -0500, Matt Kettler wrote: > 5 > 4 > 3 > 2 > 1 > blastoff! > Should match. You shouldn't be launching rockets via email. -- Randomly Selected Tagline: "The only thing this show had in common with 'Cirque' is the fact that I had no idea what was going on."

Re: TORA.08 rule

From: "Matt Kettler" <[EMAIL PROTECTED]> Rejaine Monteiro wrote: Is safe to use this?? Seems to work... body ASCIISPAM /([0123456789] ){5}/i describe ASCIISPAM ASCII SPAM score ASCIISPAM 1.0 Depends.. do you ever get ascii-text numeric reports emailed to you? Mind you,

Re: TORA.08 rule

Rejaine Monteiro wrote: > > Is safe to use this?? Seems to work... > > body ASCIISPAM /([0123456789] ){5}/i > describe ASCIISPAM ASCII SPAM > score ASCIISPAM 1.0 > Depends.. do you ever get ascii-text numeric reports emailed to you? Mind you, SA will condense whitespace to a s

Re: would SA benefit from port to Java

Eric A. Hall wrote: > Thinking about the GPL Java announcement some, and trying to imagine the > kinds of opportunities this allows for, it occurs to me that SpamAssassin > might be a natural fit for Java. > > I'm just thinking out loud here, not advocating anything... > > Would it run better? Woul

Re: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

Giampaolo, > > These commands will only exit after they have completed their job, > > i.e. waiting for the existing daemon to have stopped. > ...So, I don't have a Linux distribution running on my servers? > May you suggest to me the kind of OS brand I'm running? Not sure what you are asking her

Re: Bayes column 'token'

Mark wrote: -Original Message- From: Stuart Johnston [mailto:[EMAIL PROTECTED] Sent: vrijdag 17 november 2006 23:30 To: users@spamassassin.apache.org Subject: Re: Bayes column 'token' CREATE TABLE bayes_token ( id int(11) NOT NULL default '0', token char(5) COLLATE latin1_bin NOT

RE: Bayes column 'token'

> -Original Message- > From: Stuart Johnston [mailto:[EMAIL PROTECTED] > Sent: vrijdag 17 november 2006 23:30 > To: users@spamassassin.apache.org > Subject: Re: Bayes column 'token' > > > CREATE TABLE bayes_token ( > > id int(11) NOT NULL default '0', > > token char(5) COLLATE latin1_

Accurately deprecating charsets

I'll ask again... Can someone who handles a fair mix of email content (i.e. not just western European languages) do a triage (individually) of the rules below for ham versus spam? I'd suspect that very little genuine ham contains "IBM852" or "Unicode" or "CP12[0-8]" these days. Thanks, -Philip

FuzzyOcr failing 'png' tests

(seems like the 'action' is over here ...) i'm running SA v3.1.8-r454679, with the FuzzyOCR v3.4.2-release $SA --lint is error-free. testing the plugin with provided test messages, $SA -t -x < /tmp/ocr-gif.eml $SA -t -x < /tmp/ocr-jpg.eml $SA -t -x < /dev/FuzzyOcr-3.4.2/samples/animated-gif.em

Re: Rules Du Jour briken?

Thanks Chris, Appreciate the effort. I emailed him yesterday but just with notification that the link was broken. I didn't hear back, but my request was informative, not inquisitive. Wes Chris Thielen <[EMAIL PROTECTED]> wrote: I emailed the maintainer of exit0.us asking about

Re: Bayes column 'token'

Mark wrote: -Original Message- From: Mark [mailto:[EMAIL PROTECTED] Sent: woensdag 15 november 2006 18:15 To: 'users@spamassassin.apache.org' Subject: RE: Bayes column 'token' Well, bayes_mysql.sql does not specify collation; so, like you said, the collation will be your MySQL server-

Re: image exception with FuzzyOCR??

Thiago LPS wrote: On 11/17/06, *Sietse van Zanen* <[EMAIL PROTECTED] > wrote: To be more exact, the procedure would be: 1. Save the image file, and the message 2. Calculate the hash and delete it from the bad hash db with the fu

RE: Bayes column 'token'

> -Original Message- > From: Mark [mailto:[EMAIL PROTECTED] > Sent: woensdag 15 november 2006 18:15 > To: 'users@spamassassin.apache.org' > Subject: RE: Bayes column 'token' > > > > Well, bayes_mysql.sql does not specify collation; so, like > > > you said, the collation will be your MySQL

more ascii "art" spam

I just got a new one with the usual drugs displayed in larged ascii art. It was nearly unreadable, and it didn't pass my SA checks either. Peter

Re: Rules Du Jour briken?

I emailed the maintainer of exit0.us asking about the wiki site. Here is what he said: "Thanks for the concern Chris, I appreciate it. To make a long story short, the person that offered to host the site (Matt) no longer works at that company. So without contacting me, they removed the site.

Re: would SA benefit from port to Java

Giampaolo Tomassoni wrote: Thinking about the GPL Java announcement some, and trying to imagine the kinds of opportunities this allows for, it occurs to me that SpamAssassin might be a natural fit for Java. I'm just thinking out loud here, not advocating anything... Would it run better? What

RE: would SA benefit from port to Java

> Thinking about the GPL Java announcement some, and trying to imagine the > kinds of opportunities this allows for, it occurs to me that SpamAssassin > might be a natural fit for Java. > > I'm just thinking out loud here, not advocating anything... > > Would it run better? Would it be faster, ha

Could THIS have doubled my SA Speed...

RE: Could THIS have doubled my SA Speed... First, I'm using a windows Port of SA... and I use this as a helper application in addition to my own custom programmed spam filter. Along these lines, I purposely have RBL checks and URI checks disabled in SA because I do these myself. But I **do** ha

RE: Can it get any simpler and not work?

A subject like: "I'm attesting your knowledge of SA" would match. See? atTESTing matches. You probably would do something like Subject =~ /\wtest\w/i (\w means "word boundary"). Which subjects got matched? giampaolo -Original Message- From: twofers [mailto:[EMAIL PROTECTED]

Re: image exception with FuzzyOCR??

On 11/17/06, Sietse van Zanen <[EMAIL PROTECTED]> wrote: To be more exact, the procedure would be: 1. Save the image file, and the message 2. Calculate the hash and delete it from the bad hash db with the fuzzy-find.pl script 3. In the body of mail marked as spam , i have th

Can it get any simpler and not work?

I'm just doing some basic testing and what I think should be tagged as spam just goes right on thru. I've added this to local.cf headerMY_RULESubject =~ /test/i describe MY_RULE There is test in the Subject score MY_RULE100 I restart spamassassin. Then

TORA.08 rule

Is safe to use this?? Seems to work... body ASCIISPAM /([0123456789] ){5}/i describe ASCIISPAM ASCII SPAM score ASCIISPAM 1.0

RE: New Spam

We've all got at least one. We've been talking about it on other lists. Either a goof or a spammer got haxored. The real question is, how soon before we see "You one a free Playstation 3!" spam? :-) --Chris (No, I didn't wait in line for one. )

would SA benefit from port to Java

Thinking about the GPL Java announcement some, and trying to imagine the kinds of opportunities this allows for, it occurs to me that SpamAssassin might be a natural fit for Java. I'm just thinking out loud here, not advocating anything... Would it run better? Would it be faster, have smaller me

Re: I've got TORA.08 spelled with numbers? - Tora Acquires www.makeup.com

how to block this ascii art spams?? i've got many spams with this tora.ob too... Thiago LPS escreveu: i've got this spam too looks like a ASCI ART with TORA writed in the body of mail... :( On 11/17/06, ** < [EMAIL PROTECTED] > wrote: http://biz.yahoo.c

Re: I've got TORA.08 spelled with numbers? - Tora Acquires www.makeup.com

i've got this spam too looks like a ASCI ART with TORA writed in the body of mail... :( On 11/17/06, <[EMAIL PROTECTED]> wrote: http://biz.yahoo.com/iw/061020/0175176.html TORA TECHNOLOGIES INC. Robert E. Rook - President Contact: Contacts: Tora Technologies Inc.

RE: image exception with FuzzyOCR??

To be more exact, the procedure would be: 1. Save the image file, and the message 2. Calculate the hash and delete it from the bad hash db with the fuzzy-find.pl script 3. Create an empty wordlist, or fill it with some bogus words, that don't appear in the image 4. Up

Re: image exception with FuzzyOCR??

Sietse van Zanen wrote: Ofcourse, save the image, calculate the hash and then use the fuzzy-find.pl script to delete it from the bad hash db. Next you’ll have to use a little trick to get it into the good hash db, as that’s not possible from the fuzzy-find.pl script. Simply make an empty w

RE: image exception with FuzzyOCR??

Ofcourse, save the image, calculate the hash and then use the fuzzy-find.pl script to delete it from the bad hash db. Next you'll have to use a little trick to get it into the good hash db, as that's not possible from the fuzzy-find.pl script. Simply make an empty word list and yank the image

Re: Sending Marked up mail to another address

On Fri, Nov 17, 2006 at 01:41:03PM -0500, Luke Shannon wrote: > I just got my system going. For the short term I would like to send all > mail marked as spam to another address (not served from the box spam > assassin is on). > > I am using sendmail/procmail/spamassissin > > Here is my .spamassas

Re: procmail and virtual domain

On Fri, November 17, 2006 10:08 am, [EMAIL PROTECTED] wrote: > Hi list > I have postfix with a virtual domain, where I have to create a .procmailrc > file for procmail? ( I have to create a file or a directory? ) > How to configure a system wide? > Thanks > I recommend searching on the internet f

Sending Marked up mail to another address

I just got my system going. For the short term I would like to send all mail marked as spam to another address (not served from the box spam assassin is on). I am using sendmail/procmail/spamassissin Here is my .spamassassin.rc file. Any ideas why this won't work? When the forward rule is in plac

RE: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

> > The guy who made the script did simply test shutting and restarting the > > amavis/spamd daemon up and down in its own test environment, > which basicly > > is low mail load or even no mail at all. > > > > After a while amavis is doing it's dirty job, I noticed it > needs a lot of > > time to

Re: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

> The guy who made the script did simply test shutting and restarting the > amavis/spamd daemon up and down in its own test environment, which basicly > is low mail load or even no mail at all. > > After a while amavis is doing it's dirty job, I noticed it needs a lot of > time to shut down. It tak

Re: I've got TORA.08 spelled with numbers? - Tora Acquires www.makeup.com

http://biz.yahoo.com/iw/061020/0175176.html TORA TECHNOLOGIES INC. Robert E. Rook - President Contact: Contacts: Tora Technologies Inc. Robert E. Rook President 1-866-347-5057

RE: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

From: Peter H. Lemieux [mailto:[EMAIL PROTECTED] > Giampaolo Tomassoni wrote: > > # Check for amavis termination > > while [[ ! -z "${PIDS}" ]]; do > > sleep 1 > > PIDS=$( /sbin/pidof "${AMV_NM}" ) > > done > > In cases like this I usually ju

image exception with FuzzyOCR??

Hello everybody... there is a way to do a exception to some image that isn't a SPAM... but the FuzzyOCR thinks that it is a spam image?? i really dont want to disable the Hashdb...

procmail and virtual domain

Hi list I have postfix with a virtual domain, where I have to create a .procmailrc file for procmail? ( I have to create a file or a directory? ) How to configure a system wide? Thanks JeAn __ LLama Gratis a cualq

Re: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

Giampaolo Tomassoni wrote: # Check for amavis termination while [[ ! -z "${PIDS}" ]]; do sleep 1 PIDS=$( /sbin/pidof "${AMV_NM}" ) done In cases like this I usually just put the "sleep" command in the init script like this: ... case "$

RE: New Spam

TORA TECHNOLOGIES (TORA.OB) ??? - Darren. -Original Message- From: Bob McClure Jr [mailto:[EMAIL PROTECTED] Sent: Friday, November 17, 2006 11:18 AM To: users@spamassassin.apache.org Subject: Re: New Spam On Fri, Nov 17, 2006 at 10:40:17AM -0500, Billy Huddleston wrote: > I'm getting so

Re: I've got TORA.08 spelled with numbers?

On Fri, 17 Nov 2006 17:46:08 +0100, Charlie Clark <[EMAIL PROTECTED]> wrote: > >Am 17.11.2006 um 17:32 schrieb Nigel Frankcom: > >> If the company is still trading in a month I'd be surprised. I >> wouldn't be at all surprised if it's just a shell anyway. >> >> Create the company, run out the spam

Re: I've got TORA.08 spelled with numbers?

Ray Anderson wrote: Wouldn't a better solution to be check the e-mail for NOT having any alpha chars? All numbers seems like a no-brainer to me, but I'm fairly new at this. :) Something like Body ~= /[^a-zA-A]/ ? Too many false positives with that one. You'd need to be sure you didn't

Re: I've got TORA.08 spelled with numbers?

Am 17.11.2006 um 17:32 schrieb Nigel Frankcom: If the company is still trading in a month I'd be surprised. I wouldn't be at all surprised if it's just a shell anyway. Create the company, run out the spam, then shut it all down before the SEC/Local Securities equivalent start the investigation

Re: I've got TORA.08 spelled with numbers?

possibly. ;) --j. Billy Huddleston writes: > Will that not get legit mail from someone sending via Microsoft Outlook ? > > - Original Message - > From: "Justin Mason" <[EMAIL PROTECTED]> > To: "Billy Huddleston" <[EMAIL PROTECTED]> > Cc: > Sent: Friday, November 17, 2006 11:10 AM > Su

Re: I've got TORA.08 spelled with numbers?

Wouldn't a better solution to be check the e-mail for NOT having any alpha chars? All numbers seems like a no-brainer to me, but I'm fairly new at this. :) Something like Body ~= /[^a-zA-A]/ ? Cheers, -=Ray Justin Mason wrote: this seems to catch them: header __MAILER_OL_6626 X-Mai

RE: I've got TORA.08 spelled with numbers?

Is this safe to try? Warm Regards, Suhas System Administrator QualiSpace - A QuantumPages Enterprise An ICANN Accredited Domain Registrar === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91 (22) 2530 - 3166 URL: http://www.qualispace.com

Re: I've got TORA.08 spelled with numbers?

On Fri, 17 Nov 2006 09:20:39 -0700, "" <[EMAIL PROTECTED]> wrote: >| >| >| >| http://finance.yahoo.com/q?s=TORA.OB >| > >| >Trading up 4.5%! >| > >| >Geez... >| >| At a rough guess that would be 'salt' money. So when someone does >| click on it/look it up they see rising stock and buy. Check

[OT] Re: New Spam

Bob McClure Jr wrote: Speaking of which, I have a policy such that if I have to deal with a piece of spam, I use whois to find the abuse reporting point for the network the zombie is on, and send them a copy of the spam, headers and all. Am I spitting (to use a nicer term) in the ocean, or is

Re: I've got TORA.08 spelled with numbers?

There's another version too. To get around the rather obvious rule they enlarge the text, although that goes beyond their mailers linewrap so it comes through as: heh. and this gets GMAIL to suggest: "Would you like to... Track FedEx package 708060336862" i'm sure glad FedEx

Re: Real fix for stock spams - pick up a pen

Robert Braver wrote: On Thursday, November 16, 2006, 8:00:09 PM, Michael Scheidell wrote: MS> It was $500, and the law changed to make it impossible to collect MS> anymore. MS> Before, it was a 'first strike' and you owe $500. Now you have to 'opt MS> out' (they can still send you one) Opt-ou

Re: I've got TORA.08 spelled with numbers?

| >| | >| http://finance.yahoo.com/q?s=TORA.OB | > | >Trading up 4.5%! | > | >Geez... | | At a rough guess that would be 'salt' money. So when someone does | click on it/look it up they see rising stock and buy. Check it again | in a few days. | | Nigel Hey...there is money to be made! Let's

Re: I've got TORA.08 spelled with numbers?

Will that not get legit mail from someone sending via Microsoft Outlook ? - Original Message - From: "Justin Mason" <[EMAIL PROTECTED]> To: "Billy Huddleston" <[EMAIL PROTECTED]> Cc: Sent: Friday, November 17, 2006 11:10 AM Subject: Re: I've got TORA.08 spelled with numbers? this s

Re: New Spam

On Fri, Nov 17, 2006 at 10:40:17AM -0500, Billy Huddleston wrote: > I'm getting some new spam coming through.. It's ASCII art (using nothing but > numbers) and spells out TORA.08 and nothing else.. > > It looks to be coming from a Bot-Net.. Anyone seen this? > > Thanks, Billy Yes, one of my vi

Re: I've got TORA.08 spelled with numbers?

In article <[EMAIL PROTECTED]>, Jeff Moss <[EMAIL PROTECTED]> writes >I'm getting a bunch of spams this morning that have >TORA.08 spelled out with numbers like this. There's another version too. To get around the rather obvious rule they enlarge the text, although that goes beyond their mailers

Re: I've got TORA.08 spelled with numbers?

On Fri, 17 Nov 2006 17:09:21 +0100, "Giampaolo Tomassoni" <[EMAIL PROTECTED]> wrote: >> From: Stuart Johnston [mailto:[EMAIL PROTECTED] >> >> Evan Platt wrote: >> > At 07:44 AM 11/17/2006, you wrote: >> >> I'm getting a bunch of spams this morning that have >> >> TORA.08 spelled out with numbers

RE: I've got TORA.08 spelled with numbers?

Lol Warm Regards, Suhas System Administrator QualiSpace - A QuantumPages Enterprise An ICANN Accredited Domain Registrar === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91 (22) 2530 - 3166 URL: http://www.qualispace.com =

Re: I've got TORA.08 spelled with numbers?

this seems to catch them: header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/ header __MOLE_2962 X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/ meta JM_TORA_XM (__MAILER_OL_6626 && __MOLE_2962) --j. Billy Huddleston writes: > So, here is a q

Re: Real fix for stock spams - pick up a pen

Coffey, Neal wrote: Bookworm wrote: Pick up a pen, and write to your local congressman, or even to the SEC, and insist that they penalize those companies who are being pimped and pumped through spam emails. Why should they? The companies being advertised in the stock spams aren't resp

Re: I've got TORA.08 spelled with numbers?

On Fri, 17 Nov 2006 09:03:54 -0700, "" <[EMAIL PROTECTED]> wrote: > >| > Wasn't there a stock image spam with TORA.TORA or something? >| >| AH HA! It is not a url, its a stock symbol! >| >| http://finance.yahoo.com/q?s=TORA.OB > >Trading up 4.5%! > >Geez... At a rough guess that would be '

RE: I've got TORA.08 spelled with numbers?

> From: Stuart Johnston [mailto:[EMAIL PROTECTED] > > Evan Platt wrote: > > At 07:44 AM 11/17/2006, you wrote: > >> I'm getting a bunch of spams this morning that have > >> TORA.08 spelled out with numbers like this. > >> > >> 4216775 0611576 215556 7 3308011 3258576 > >>

RE: I've got TORA.08 spelled with numbers?

> So, here is a question... Why spam everyone with TORA.08, I > don't even know > what the heck that means!!! I guess it is a (japanese?) nickname. Maybe the nickname of the bot/worm/virus maker? It is possible that this advertising is targeted to spammers, not to "real" customers: it looks

Re: I've got TORA.08 spelled with numbers?

| > Wasn't there a stock image spam with TORA.TORA or something? | | AH HA! It is not a url, its a stock symbol! | | http://finance.yahoo.com/q?s=TORA.OB Trading up 4.5%! Geez...

Re: I've got TORA.08 spelled with numbers?

Evan Platt wrote: At 07:44 AM 11/17/2006, you wrote: I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this. 4216775 0611576 215556 7 3308011 3258576 6 7 5 153 85 2 7 3 8 3

Re: RelayChecker 0.3

Stuart Johnston wrote: Michael Alan Dorman wrote: On Thu, 16 Nov 2006 17:56:21 -0800 Derek Harding <[EMAIL PROTECTED]> wrote: On Sun, 2006-11-12 at 17:26 -0800, John Rudd wrote: http://people.ucsc.edu/~jrudd/spamassassin/RelayChecker.tar I've been running this for a few days now and am find

Re: I've got TORA.08 spelled with numbers?

> >I'm getting a bunch of spams this morning that have > >TORA.08 spelled out with numbers like this. lordy, lordy! i'm just *SURE* i'm missing the whole point of this sort of spam ... ... but WHY do these spammers even bother with this sort of stuff? even if it *does* temporarily get past fi

RE: Funny spamd failure... (Maybe SARE/rules-du-jour related?)

> The other night my default gentoo RulesDuJour for Spamassassin > acquired new > Adult and General rule-sets from SARE. Thereafter spamd refused all > connections and subsequently received mail was not spam filtered. > Issuing '/etc/init.d/spamd restart' as root resolved the situation... > but

Re: I've got TORA.08 spelled with numbers?

So, here is a question... Why spam everyone with TORA.08, I don't even know what the heck that means!!! - Original Message - From: "Evan Platt" <[EMAIL PROTECTED]> To: Sent: Friday, November 17, 2006 10:48 AM Subject: Re: I've got TORA.08 spelled with numbers? At 07:44 AM 11/17/2

Re: New Spam

Evan Platt wrote: At 07:40 AM 11/17/2006, you wrote: I'm getting some new spam coming through.. It's ASCII art (using nothing but numbers) and spells out TORA.08 and nothing else.. It looks to be coming from a Bot-Net.. Anyone seen this? Thanks, Billy Just got 2 also to 2 different e-mail

Re: email appears to que all the time - sendmail,spamssassin,amavis-new

Patrick Sherrill wrote: I seem to be getting significant delays in delivery (queue times are set to 15m). I am currently using amavis-new to hook SA with sendmail (tx and rx queue). What would be the best approach to minimizing delays beyond more RAM. Reject more messages with (good) DNSBLs

Re: I've got TORA.08 spelled with numbers?

Hey I got the same thing. On 11/17/06, Evan Platt <[EMAIL PROTECTED]> wrote: At 07:44 AM 11/17/2006, you wrote: >I'm getting a bunch of spams this morning that have >TORA.08 spelled out with numbers like this. > >4216775 0611576 215556 7 3308011 3258576 >6 7

Re: I've got TORA.08 spelled with numbers?

At 07:44 AM 11/17/2006, you wrote: I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this. 4216775 0611576 215556 7 3308011 3258576 6 7 5 153 85 2 7 3 8 3 6 50

RE: I've got TORA.08 spelled with numbers?

Even I have started getting it. Have any one cracked any rules for this? Warm Regards, Suhas System Administrator QualiSpace - A QuantumPages Enterprise An ICANN Accredited Domain Registrar === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91 (22

Re: New Spam

At 07:40 AM 11/17/2006, you wrote: I'm getting some new spam coming through.. It's ASCII art (using nothing but numbers) and spells out TORA.08 and nothing else.. It looks to be coming from a Bot-Net.. Anyone seen this? Thanks, Billy Just got 2 also to 2 different e-mail addresses.

I've got TORA.08 spelled with numbers?

I'm getting a bunch of spams this morning that have TORA.08 spelled out with numbers like this. 4216775 0611576 215556 7 3308011 3258576 6 7 5 153 85 2 7 3 8 3 6 50 4 1 2 7 0 5

Funny spamd failure... (Maybe SARE/rules-du-jour related?)

The other night my default gentoo RulesDuJour for Spamassassin acquired new Adult and General rule-sets from SARE. Thereafter spamd refused all connections and subsequently received mail was not spam filtered. Issuing '/etc/init.d/spamd restart' as root resolved the situation... but I don't want

Re: New Spam

Hi Billy, I got one of these for the first time just 15 minutes ago. TORA.08 as well. James Billy Huddleston wrote: > I'm getting some new spam coming through.. It's ASCII art (using > nothing but numbers) and spells out TORA.08 and nothing else.. > > It looks to be coming from a Bot-Net..

New Spam

I'm getting some new spam coming through.. It's ASCII art (using nothing but numbers) and spells out TORA.08 and nothing else.. It looks to be coming from a Bot-Net.. Anyone seen this? Thanks, Billy

email appears to que all the time - sendmail,spamssassin,amavis-new

I seem to be getting significant delays in delivery (queue times are set to 15m). I am currently using amavis-new to hook SA with sendmail (tx and rx queue). What would be the best approach to minimizing delays beyond more RAM. TIA Pat... [EMAIL PROTECTED] CocoNet Corporation SW Florida's Fir

Re: RelayChecker 0.3

Michael Alan Dorman wrote: On Thu, 16 Nov 2006 17:56:21 -0800 Derek Harding <[EMAIL PROTECTED]> wrote: On Sun, 2006-11-12 at 17:26 -0800, John Rudd wrote: http://people.ucsc.edu/~jrudd/spamassassin/RelayChecker.tar I've been running this for a few days now and am finding it to be pretty effe

RE: amavisd

> Can someone please help me with this message in my maillog. > > ClamAV-clamd av-scanner FAILED: Too many retries to talk to > /var/spool/amavisd/clamd.sock (Can't connect to UNIX socket > /var/spool/amavisd/clamd.sock: Connection refused) Your clamd is not running OR it is not listening on /va

Re: Thoughts on using DCC

Hi, Magnus Holmgren wrote: On Thursday 16 November 2006 12:59, Anthony Peacock wrote: I realise that DCC is not a direct indicator of spamminess but an indicator of bulkiness. And I also realise that the correct answer to my question is 'it depends on your local needs'... Given that what are

Re: RelayChecker 0.3

John Rudd wrote: Stuart Johnston wrote: Peter H. Lemieux wrote: Billy Huddleston wrote: Reverse DNS is a must. I'm surprised at how many people still haven't got that yet in the IT world.. (Consultants mostly..) It's not uncommon outside the industrialized world. Last few days I got a few f

Re: Bayes failure on "hi, it's Somebody" spam

On 11/16/06, Jon Trulson <[EMAIL PROTECTED]> wrote: Hmm, that has not been my experience at all... Bayes (99) is still catching every one for me. In this instance, SpamAssassin is running after POP download from gmail, so I'm only seeing the samples that have already made it t

Ignoring outgoing mail

I have looked through the SA list archives for any method to make SA ignore outgoing emails but nothing found that helped. I'm using the flag that I thought helped do this when I load the scanner spamass-milter: "-i 127.0.0.1" (plus a few more IPs) I do not see any flages on spamd to help with thi

Re: MIMEHeader question

On Fri, Nov 17, 2006 at 03:46:28PM +0100, Jeremy Fairbrass wrote: > >> mimeheader __RULE1 Content-Type =~ /image\/gif/ > >> mimeheader __RULE2 Content-Transfer-Encoding =~ /quoted-printable/ > >> meta MY_META_RULE (RULE1 && RULE2) > > Okay - so you're saying that the two mimeheader rules wil

Re: RelayChecker 0.3

Michael Alan Dorman wrote: On Thu, 16 Nov 2006 17:56:21 -0800 Derek Harding <[EMAIL PROTECTED]> wrote: On Sun, 2006-11-12 at 17:26 -0800, John Rudd wrote: http://people.ucsc.edu/~jrudd/spamassassin/RelayChecker.tar I've been running this for a few days now and am finding it to be pretty effe

Re: MIMEHeader question

"Justin Mason" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > > Jeremy Fairbrass writes: >> Hi all, >> I have a question about the MIMEHeader plugin: if I have multiple >> mimeheader >> rules, are they all checked against the same part in a multipart message? >> >> So let me give

RE: Hi !

What else do you have in your local.cf? Wes Cristi Tudose <[EMAIL PROTECTED]> wrote: v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} HI .. I never tried with

Re: Hi !

On Friday 17 November 2006 13:52, Cristi Tudose wrote: > Hi .. One tip for the future: "Hi !" is not a good subject line. > I have installed qmail with qmail-scan, spamassassin and clamav. > The installation was going well. > > The clamav and spamassassin is running under qscand user. > The mails

Re: bayes?

Netlink Tech wrote: > Hello, > It seems bayes is not working properly for me. > I have sendmail/MailScanner/Spamassassin setup for my users. > MailScanner version 4.56.8 > Spamassassin version 3.1.3 > autolearn is on > -- >> sa-learn --dump magic > > The last journal syn

failed to run FUZZY_OCR test, skipping:

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Since upgrading my FuzzyOcr from version 2.3b to version 3.4.2 I am seeing these entries in the logs: spamd[27790]: rules: failed to run FUZZY_OCR test, skipping: spamd[27790]: Insecure dependency in require while running with -T switch at /usr/lib/

Re: RelayChecker 0.3

On Thu, 16 Nov 2006 17:56:21 -0800 Derek Harding <[EMAIL PROTECTED]> wrote: > On Sun, 2006-11-12 at 17:26 -0800, John Rudd wrote: > > > http://people.ucsc.edu/~jrudd/spamassassin/RelayChecker.tar > > I've been running this for a few days now and am finding it to be > pretty effective, especially

Re: bayes before spamassassin?

[EMAIL PROTECTED] wrote: > I mean, I want the sa-learn examine the message before the spamassassin and > then goes to spamassassin > > > > -If the sa-learn determine it's spam the message will be deleted > But there's the problem. sa-learn doesn't determine if a message is spam or not. In f

Re: Hi !

Cristi, Have you tried lowering your required_score to something like between 5 and 7 ? also change rewrite_header Subject SPAM(_SCORE_) to: rewrite_header subject SPAM(_SCORE_) Keep it lower case. You can also run spamassassin -D --lint to check for s

bayes?

Hello, It seems bayes is not working properly for me. I have sendmail/MailScanner/Spamassassin setup for my users. MailScanner version 4.56.8 Spamassassin version 3.1.3 autolearn is on -- sa-learn --dump magic 0.000 0 3 0 non-token data: ba

Re: bayes before spamassassin?

I mean, I want the sa-learn examine the message before the spamassassin and then goes to spamassassin The reasons for that: -I think the incoming mail maybe a spam, but this is relative because the concept to spam for an user is not equal to another one ( I have many users on my domain ) -At t

  1   2   >