Re: The 'believe-it' spams

2008-02-24 Thread Kathryn Allan
How do you set a rule to expire? Kate Bob Proulx wrote: Jonathan Nichols wrote: What was the rule you added? :) I just did the brute force thing and looked for an entire phrase from that message. It really isn't worthy and this will change very quickly such that any rule I post now

Re: The 'believe-it' spams

2008-02-24 Thread Bob Proulx
Jonathan Nichols wrote: > What was the rule you added? :) I just did the brute force thing and looked for an entire phrase from that message. It really isn't worthy and this will change very quickly such that any rule I post now won't be interesting to have in a ruleset in a couple of days. It n

Re: The 'believe-it' spams

2008-02-24 Thread Jonathan Nichols
On Feb 24, 2008, at 7:39 PM, Bob Proulx wrote: Jonathan Nichols wrote: Anyone catching these? Here's a sample: http://pastebin.ca/916902 Those have been slipping right through these days. Scores are in the pastebin post. Even with a current sa-update and also Justin's (very wonderfully ap

Re: The 'believe-it' spams

2008-02-24 Thread Bob Proulx
Jonathan Nichols wrote: > Anyone catching these? > > Here's a sample: > > http://pastebin.ca/916902 > > Those have been slipping right through these days. Scores are in the > pastebin post. Even with a current sa-update and also Justin's (very wonderfully appreciated) sought.cf scores I only

The 'believe-it' spams

2008-02-24 Thread Jonathan Nichols
Anyone catching these? Here's a sample: http://pastebin.ca/916902 Those have been slipping right through these days. Scores are in the pastebin post. SpamAssassin version 3.2.3 running on Perl version 5.8.7 (From the Ubuntu package, which I cannot for the life of me figure out how to e

Re: match emails starting with _

2008-02-24 Thread Loren Wilton
Which part of the address? [EMAIL PROTECTED] or "-Foo Bar"? Loren

match emails starting with _

2008-02-24 Thread Vlad Mazek
How does one pattern match email addresses that start with _ or - Looking through my logs, I can't find a single message sent by a _ or - thats legit. -Vlad

Re: ALL_TRUSTED and DOS_OE_TO_MX

2008-02-24 Thread giga328
Matus UHLAR - fantomas wrote: > > We've had similar problem. It was caused by our clients who did not SMTP > authentication and sent mail to our clients, so they were really sending > mail from outlook express to the destination server (we use the same > servers > for primary MX as for outgoing

Re: Low scores

2008-02-24 Thread Matus UHLAR - fantomas
> Micah Anderson schrieb: > > | [surprisingly low scores] > | The spams can be pulled from here: http://micah.riseup.net/spams On 24.02.08 02:15, Matthias Leisi wrote: > Most (all?) of the samples are forwarded through some debian.org > mechanism. In order for blacklists to take full effect, you

Re: ALL_TRUSTED and DOS_OE_TO_MX

2008-02-24 Thread Matus UHLAR - fantomas
On 23.02.08 17:34, giga328 wrote: > I'm testing SpamAssassin and I'm getting false positives. Both tests > ALL_TRUSTED and DOS_OE_TO_MX are firing for emails sent by Outlook Express > for local clients and it seems like I have something wrong in *_networks. > Here is my setup: > All my servers and

Re: Low scores

2008-02-24 Thread Micah Anderson
On Sun, 24 Feb 2008 02:15:24 +0100, Matthias Leisi wrote: > Micah Anderson schrieb: > > | [surprisingly low scores] > | The spams can be pulled from here: http://micah.riseup.net/spams > > Most (all?) of the samples are forwarded through some debian.org > mechanism. In order for blacklists to ta

Re: Low scores

2008-02-24 Thread Micah Anderson
On Sat, 23 Feb 2008 18:52:01 -0800, Loren Wilton wrote: >> I'm looking for people to have a look over these spams and give me some >> ideas of some possible areas for improvement (either score adjustments, >> configuration tweaks, plugins that I should try, etc.). >> >> The spams can be pulled fro

Re: ALL_TRUSTED and DOS_OE_TO_MX

2008-02-24 Thread giga328
Daryl C. W. O'Shea wrote: > > > Please post the full received headers of the problem message and your > trusted/internal/msa networks config. If you're paranoid about publicly > posting them you can send them to me directly. > > Daryl > > Hi Daryl, Email system will not use NAT so IP adre

Re: "Nice girl like to chat" spam

2008-02-24 Thread Nix
On 18 Feb 2008, Jari Fredriksson told this: > All it takes is a Unix/Linux user who does not know about smart hosts Or who doesn't have one because it costs a lot extra and/or because the smarthost is unreliable (and, no, `just change ISP' doesn't work: in much of the world one ISP has a quasi-mon

Re: Low scores

2008-02-24 Thread Michael Scheidell
> From: Micah Anderson <[EMAIL PROTECTED]> > Date: Sat, 23 Feb 2008 22:54:19 + (UTC) > To: > Subject: Low scores > > > I feel like a lot of pretty obvious spams are getting through my system > with appallingly low scores. I'm starting to wonder if something may be > wrong with my setup. Loo