Re: installing URIDNSBL

2006-12-15 Thread Jeff Chan
On Thursday, December 14, 2006, 8:23:44 AM, Theo Dinter wrote: > On Thu, Dec 14, 2006 at 11:19:43AM -0500, Kyle Quillen wrote: >> no errors then I run spamassassin -D and it just hangs at the last line. >> Is this normal or is there some other issue. > It's waiting for input, so it's normal. You

Re: Specification of sa-learn --backup format

2006-12-15 Thread Nigel Frankcom
On Fri, 15 Dec 2006 17:26:50 -0500, Theo Van Dinter <[EMAIL PROTECTED]> wrote: >On Fri, Dec 15, 2006 at 11:12:21PM +0100, Georg Sauthoff wrote: >> t 1 0 1162501869 >> ^ a) ^ b) >> >> a) I guess some time format? > >Yes, UNIX standard sec

Re: Specification of sa-learn --backup format

2006-12-15 Thread Theo Van Dinter
On Fri, Dec 15, 2006 at 11:12:21PM +0100, Georg Sauthoff wrote: > t 1 0 1162501869 > ^ a) ^ b) > > a) I guess some time format? Yes, UNIX standard seconds since epoch (time_t). > b) the spam/ham token string? how encoded? partial sha1

Re: How to tell why BAYES_00 is hit

2006-12-15 Thread Karl Auer
> FWIW, if you had left BAYES_00 with its default score, as opposed to > increasing it to -4.9, this mail would have been flagged as spam. At least in my case (admittedly using SA 2.64 not 3.x) -4.9 appears to be the default score for BAYES_00. At least, that's what it was before I set it to zero,

Re: questions about this list

2006-12-15 Thread Maurice Lucas
On Mon, 2006-12-11 at 19:51 -0600, René Berber wrote: > Mark Nienberg wrote: > > > In the welcome message that I received when I subscribed to this list it > > says: > > > > Send mail to the following for info and FAQ for this list: > ><[EMAIL PROTECTED]> > ><[EMAIL PROTECTED]> > > Usele

Specification of sa-learn --backup format

2006-12-15 Thread Georg Sauthoff
Hi, I couldn't find the specification of the sa-learn --backup or sa-learn --dump format in the documentation. I am mainly interested in the spam/ham token string and their observed frequency (and the totals of tokens/messages). E.g. t 1 0 1162501869

RE: How to tell why BAYES_00 is hit

2006-12-15 Thread Bret Miller
> I have a bayes question I am hoping someone may be able to > answer for me. Since implementing bayes it has been doing a > very good job except for one thing. > > One particular spam email is not getting tagged as spam. My > rules are scoring the email high enough to be tagged as spam, > but i

Re: How to tell why BAYES_00 is hit

2006-12-15 Thread Theo Van Dinter
On Fri, Dec 15, 2006 at 05:05:26PM -0500, John W Mickevich wrote: > I am very new to bayes so some of my terms may be incorrect. But it would > appear that bayes has "learned" something incorrectly. Not necessarily. It means that the tokens found in the message which are also found in the DB a

How to tell why BAYES_00 is hit

2006-12-15 Thread John W Mickevich
Hi all! I have a bayes question I am hoping someone may be able to answer for me. Since implementing bayes it has been doing a very good job except for one thing. One particular spam email is not getting tagged as spam. My rules are scoring the email high enough to be tagged as spam, but

Re: MSRBL

2006-12-15 Thread Chris Lear
Bret Miller wrote: >> I'm more interested in the Image signatures it has. If >> they're really >> useful and reliable. I expect that keeping up with image >> spam wouldn't >> be very scalable, but it might at least help reduce some load >> (since we >> do virus scanning before letting Spam Assas

Re: Newbie needs help with Spam/Spam Assassin

2006-12-15 Thread René Berber
Brooks Rimes wrote: > My email is through my website: www.rimesrv.net which is hosted on > www.totalchoicehosting.com and they use Spam Assassin for spam filtering. I > don't know a lot about SA. > > Over the last weeks or a month my spam has increased dramatically. What is > particularly frust

Re: Newbie needs help with Spam/Spam Assassin

2006-12-15 Thread Theo Van Dinter
On Fri, Dec 15, 2006 at 01:14:15PM -0500, Brooks Rimes wrote: > My email is through my website: www.rimesrv.net which is hosted on > www.totalchoicehosting.com and they use Spam Assassin for spam filtering. I > don't know a lot about SA. FWIW, you'll want to talk to your provider. The amount of

RE: Newbie needs help with Spam/Spam Assassin

2006-12-15 Thread Bret Miller
> - why doesn't Spam Assassin recognize all these with the same > subject/body as spam? Did you train your bayes database on one or more of these messages to tell it they were spam? It scored bayes_00 meaning it thinks it's not spam. > > - any suggestions/advice? www.rulesemporium.com. Get the 7

Re: MSRBL

2006-12-15 Thread Dirk Bonengel
John Rudd schrieb: Bret Miller wrote: On Wednesday 13 December 2006 11:35 am, Bret Miller wrote: Has anyone here tried MSRBL (http://www.msrbl.com/site/)? I'm running it in trial now, but thought I'd ask to see if anyone here had an opinion before doing anything serious with it. TIA, Bret

Re: Simple mail from Dynamic IP listed as spam

2006-12-15 Thread hamann . w
Hi Martin, you are not alone, but gmx should solve one part of the problem: mails from gmx probably do not indicate in a standard way that mail was received from an authenticated user. Once SA finds that information, it is supposed to consider the mta (in that case gmx) rather than the original s

Re: MSRBL

2006-12-15 Thread Rob McEwen (PowerView Systems)
John Rudd said: > I'm more interested in the Image signatures it has. If they're really > useful and reliable. I expect that keeping up with image spam wouldn't > be very scalable, but it might at least help reduce some load (since we > do virus scanning before letting Spam Assassin see a mess

RE: MSRBL

2006-12-15 Thread Bret Miller
> I'm more interested in the Image signatures it has. If > they're really > useful and reliable. I expect that keeping up with image > spam wouldn't > be very scalable, but it might at least help reduce some load > (since we > do virus scanning before letting Spam Assassin see a message) for > wh

Re: MSRBL

2006-12-15 Thread John Rudd
Bret Miller wrote: On Wednesday 13 December 2006 11:35 am, Bret Miller wrote: Has anyone here tried MSRBL (http://www.msrbl.com/site/)? I'm running it in trial now, but thought I'd ask to see if anyone here had an opinion before doing anything serious with it. TIA, Bret Bret, on my home sys

Newbie needs help with Spam/Spam Assassin

2006-12-15 Thread Brooks Rimes
My email is through my website: www.rimesrv.net which is hosted on www.totalchoicehosting.com and they use Spam Assassin for spam filtering. I don't know a lot about SA. Over the last weeks or a month my spam has increased dramatically. What is particularly frustrating is that I get many in the

Is digest available?

2006-12-15 Thread Brooks Rimes
Hi, Can I get a daily digest instead of individual emails? Brooks

Re: Topics for SA presentation?

2006-12-15 Thread Ken A
Chris Santerre wrote: -Original Message- From: Theo Van Dinter [mailto:[EMAIL PROTECTED] Sent: Wednesday, December 13, 2006 1:59 PM To: Spamassassin Users List Subject: Topics for SA presentation? Hey folks, ApacheCon EU will be in May, and they're currently running a Call For Pap

RE: BODY rule fails with double-spaced text

2006-12-15 Thread Chris Santerre
> -Original Message- > From: Theo Van Dinter [mailto:[EMAIL PROTECTED] > Sent: Thursday, December 14, 2006 1:26 PM > To: users@spamassassin.apache.org > Subject: Re: BODY rule fails with double-spaced text > > > On Thu, Dec 14, 2006 at 09:31:23AM -0800, Loren Wilton wrote: > > "body" un

RE: Topics for SA presentation?

2006-12-15 Thread Chris Santerre
> -Original Message- > From: Theo Van Dinter [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 13, 2006 1:59 PM > To: Spamassassin Users List > Subject: Topics for SA presentation? > > > Hey folks, > > ApacheCon EU will be in May, and they're currently running a > Call For Papers.

RE: MSRBL

2006-12-15 Thread Bret Miller
> > On Wednesday 13 December 2006 11:35 am, Bret Miller wrote: > > > Has anyone here tried MSRBL (http://www.msrbl.com/site/)? > I'm running it > > > in trial now, but thought I'd ask to see if anyone here > had an opinion > > > before doing anything serious with it. > > > > > > TIA, > > > Bret > >

Re: Simple mail from Dynamic IP listed as spam

2006-12-15 Thread Martin von Gagern
Jay Chandler wrote: > Not entirely sure what you're saying in the last two paragraphs, OK, let me put this in different words, let's be more concrete. As you all can see I have this Mail Address @gmx.net. GMX is my mail provider. They run a server mail.gmx.net for email submission, where I have to

Re: SURBL scored stronger than normal on the apache servers?

2006-12-15 Thread Matt Kettler
Jeff Chan wrote: > The test points were changed from returning a value of 127.0.0.2 > to 127.0.0.126 as of about a year ago. I neglected to announce > the change, though it was mentioned on the SURBL discussion list. > Announcing now. > > 127.0.0.126 represents all ones for the bits of all existin

RE: MSRBL

2006-12-15 Thread Leon Kolchinsky
> -Original Message- > From: Chris [mailto:[EMAIL PROTECTED] > Sent: Thursday, December 14, 2006 5:55 AM > To: users@spamassassin.apache.org > Subject: Re: MSRBL > > On Wednesday 13 December 2006 11:35 am, Bret Miller wrote: > > Has anyone here tried MSRBL (http://www.msrbl.com/site/)? I

RE: I got a lottery spam from this list id

2006-12-15 Thread Robert Swan
Me too, lol. Here is the header Robert Microsoft Mail Internet Headers Version 2.0 Received: from boylston.nskinc.com ([x.x.x.x]) by mail.nskinc.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 15 Dec 2006 06:53:19 -0500 Received: from spam1.nskinc.com ([x.x.x.x]) by boylston.nskinc.c

missing SA header scores

2006-12-15 Thread vertito
X-Spam-Status: No, score=2.8 required=5.0 tests=DATE_IN_PAST_96_XX,HTML_60_70, HTML_MESSAGE autolearn=disabled version=3.1.7 My SA now shows non-detailed score as shown above. Is there anyway I can bring it back to old header scoring before ? like below? X-Spam-Status: No, score=2.8 requ

Re: phone number spam

2006-12-15 Thread Rajkumar S
On 12/15/06, Dennis Davis <[EMAIL PROTECTED]> wrote: The sample indicates you're running SpamAssassin-3.0.3. That's *old*. Seriously consider upgrading to SpamAssassin-3.1.7. Then run sa-update. Install the Botnet plugin. That should score on the sample you've given. Also look at installing

Re: phone number spam

2006-12-15 Thread Dennis Davis
On Fri, 15 Dec 2006, Rajkumar S wrote: > From: Rajkumar S <[EMAIL PROTECTED]> > To: users@spamassassin.apache.org > Date: Fri, 15 Dec 2006 14:51:06 +0530 > Subject: phone number spam > > for last 2 days I am getting lot's of spam with phone numbers rather > than website or email address to contac

Re: How can I add to FuzzyOcr.hashdb manually a mail which contains spam text in gif/jpeg.

2006-12-15 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Halid Faith wrote: > I use spamassassin3.1.7 and fuzzyocr-2.3b. > it usually works well. > > Although Some mails which contain spam in gif/jpeg, fuzzyocr can't > see them. So it doesn't give them any score as FUZZY_OCR. > I want to add these mails to

Re: SURBL scored stronger than normal on the apache servers?

2006-12-15 Thread Jeff Chan
On Thursday, December 14, 2006, 5:03:33 PM, Matt Kettler wrote: > email containing the surbl permanent test point, and no spam quotes. > The test-point URL used to only be listed in SC, although tests at > uribl.com and rulesemporium.com both just report it as listed as a "test > point" and don't

How can I add to FuzzyOcr.hashdb manually a mail which contains spam text in gif/jpeg.

2006-12-15 Thread Halid Faith
I use spamassassin3.1.7 and fuzzyocr-2.3b. it usually works well. Although Some mails which contain spam in gif/jpeg, fuzzyocr can't see them. So it doesn't give them any score as FUZZY_OCR. I want to add these mails to FuzzyOcr.hashdb manually. How can I do that? Thanks.

phone number spam

2006-12-15 Thread Rajkumar S
Hi, for last 2 days I am getting lot's of spam with phone numbers rather than website or email address to contact spammer. Unfortunately the only rules that are matching for these spam are the rbl ones. Any one else seeing this type of new spam? Any one with some rule ideas? A sample is at http:

Re: UK/9420X2/68

2006-12-15 Thread Justin Mason
It does -- non-member posts are manually moderated. Sometimes the moderators slip up. (ahem ;) Volunteers to help moderate would, of course, be gratefully accepted ;) --j. Michael Scheidell writes: > Maybe apache should use only allow members to post to this list? > (yes, it slipped by MINE a

RE: UK/9420X2/68

2006-12-15 Thread Michael Scheidell
Maybe apache should use only allow members to post to this list? (yes, it slipped by MINE also, the -3 score added to hermes.apache.org. Microsoft Mail Internet Headers Version 2.0 Received: from mail.secnap.net ([10.70.1.3]) by secnap2.secnap.com with Microsoft SMTPSVC(5.0.2195.6713);

Re: Tagging for spam mails

2006-12-15 Thread jdow
From: "Theo Van Dinter" <[EMAIL PROTECTED]> Also acceptable: perldoc Mail::SpamAssassin::Conf This also works these days, at least on Fedora man Mail::SpamAssassin::Conf {^_^}

Re: SPF is hopelessly broken and must die! - is broken and must die!

2006-12-15 Thread jdow
May I second, third, fourth or whatever that comment? {+_+} - Original Message - From: "Justin Mason" <[EMAIL PROTECTED]> Folks -- as requested yesterday, can we drop this thread? --j. John D. Hardin writes: On Thu, 14 Dec 2006, Gino Cerullo wrote: > > Marc: Since you already requir

Re: Top 10 ASN and CIDR's for 18 Nov

2006-12-15 Thread Matthias Leisi
Mick Pollard wrote: > Chris wrote: >> Seems the huge network of compromised machines that started earlier >> this month are still going strong and appears to be growing. My spam >> input has grown today by about 700%. Below are the top ASN's and >> CIDR's for todays run: >> >> Report date: Sat N

RE: SPF is hopelessly broken and must die!

2006-12-15 Thread Ian Eiloart
--On 14 December 2006 10:50:34 -0500 "Coffey, Neal" <[EMAIL PROTECTED]> wrote: 3) Let's say you bank with Bank of MyBank BankCorp. MyBank.com specifies an SPF record. You receive a message claiming to be from mybank.com, and it passes SPF. You can be reasonably certain it is legitimate.

Re: SPF is hopelessly broken and must die!

2006-12-15 Thread Justin Mason
Folks -- as requested yesterday, can we drop this thread? --j. John D. Hardin writes: > On Thu, 14 Dec 2006, Gino Cerullo wrote: > > > > Marc: Since you already require that your customers modify their MX > > > records to have their email sent to your servers, why not update / > > > add the