Re: Spam from Gmail & Blogspot

2008-05-28 Thread Bob Proulx
Joseph Brennan wrote: > Just a few months ago we did not get much spam at all from gmail. > Something changed. One change seems to be that Google's captcha has been broken. http://www.google.com/search?q=google+captcha+broken Bob

Re: Spam from Gmail & Blogspot

2008-05-28 Thread Sahil Tandon
Joseph Brennan <[EMAIL PROTECTED]> wrote: >> I have checked the Received: headers several times and the messages are >> coming from or . Maybe they should be listet in >> . > > We have 200 complaints a day about spam that really comes from gmail. > It's the biggest sou

Re: Spam from Gmail & Blogspot

2008-05-28 Thread Joseph Brennan
I have checked the Received: headers several times and the messages are coming from or . Maybe they should be listet in . We have 200 complaints a day about spam that really comes from gmail. It's the biggest source of spam that gets through. Obviously it's also a very big source of l

Re: rDNS none in stats with IPv6

2008-05-28 Thread Steve Bertrand
Greg Troxel wrote: In my SA stats, the majority (+90%) of email inbound is classified as rdns_none. (I presume you are trying to make this server IPv6 only instead of dual stack. When my machine had a globally routable v6 address I got some mail over v6 and some over v4, but didn't used m

Re: MySQL and Size Of bayes_expiry_max_db_size

2008-05-28 Thread Kris Deugau
Larry Nedry wrote: Of course. But how would I figure out what works best? How can I tell if it is working poorly or very well? Results.Customer/user complaints are always useful (if perhaps not really desireable); customer/user *feedback* is critical on anything bigger than a trivial p

RE: MailChannels Traffic Control

2008-05-28 Thread Dan Barker
Robin: Of course we are not interested. This is a one-man shop with an annual budget of about $50K. Why you put out the teaser on the Spamassassin User list is totally beyond me. Your "entry" level definition is very poorly defined. You'd get a lot more small shops if you found a pricing struc

Re: can we make AWL ignore mail from self to self?

2008-05-28 Thread Jo Rhett
On May 23, 2008, at 3:45 AM, Jonas Eckerman wrote: 1: Just read it as of when I said "your own users" I meant the users of the host in question (the ones you mention above). More specifically, the users using your host as a MSA (authenticated or locally). I don't trust "my users" in this c

Re: rDNS none in stats with IPv6

2008-05-28 Thread Greg Troxel
In my SA stats, the majority (+90%) of email inbound is classified as rdns_none. I have a suspicion that this is due to the IPv6-IPv4 mapped address being written into the headers when I am speaking to a non-native IPv6 MTA: Received: from unknown (HELO mail.apache.org) (:::140.21

Re: rDNS none in stats with IPv6

2008-05-28 Thread SM
Hi Steve, At 06:28 28-05-2008, Steve Bertrand wrote: This may not be the appropriate list, but I'm hoping someone can help me. It is the appropriate list. I have an email server based on Matt Simerson's mail toaster (http://www.tnpi.biz/internet/mail/toaster/) that I've managed to get IPv6 c

Re: SQL DB schema issue

2008-05-28 Thread Michael Parker
On May 28, 2008, at 10:38 AM, Rocco Scappatura wrote: Hello, I'm using SA with SQL support under Amavid-new. My DBMS is MySQL. I 'm preparing one another Antispam server and I ve installed the latest stable software available. I ve dumped bayes DB (schema + data) from an already working

RE: What are some of the most frequently used strings?...

2008-05-28 Thread Bowie Bailey
On Wed, 28 May 2008, Don Saklad wrote: > a. > What are a dozen or so of the most frequently used > strings of characters in spam messages?... like rolex, maxgain, ...? Common spam strings change constantly and are frequently obfuscated to avoid simple string matches. There is a rule set called "S

Re: Spam from Gmail & Blogspot

2008-05-28 Thread Michelle Konzack
Am 2008-05-25 23:44:33, schrieb Sahil Tandon: > I have tried contacting postmaster@ but their auto-response is uselessly > disingenuous. In it, they insist that spam is never sent from Google > servers, and only from "miscreants" who forge @gmail.com addresses. END OF RE

Re: What are some of the most frequently used strings?...

2008-05-28 Thread Chris St. Pierre
On Wed, 28 May 2008, Don Saklad wrote: a. What are a dozen or so of the most frequently used strings of characters in spam messages?... like rolex, maxgain, ...? Define "string." If you mean "word," then here are the 12 most common words in the TREC 2005 corpus, with the number of times they

SQL DB schema issue

2008-05-28 Thread Rocco Scappatura
Hello, I'm using SA with SQL support under Amavid-new. My DBMS is MySQL. I 'm preparing one another Antispam server and I ve installed the latest stable software available. I ve dumped bayes DB (schema + data) from an already working machine and I ve restore them on the new machine. But when I

Re: uri rules

2008-05-28 Thread mouss
Randy Ramsdell wrote: Matt Kettler wrote: Joseph Brennan wrote: I was surprised that this rule... uri CU_CN_LINK /http:..\w+\.cn\b/ matches not only this... http://foobar.cn";> but also this... http://www.columbia.edu/foo.html";>KooXoo Buys Kuxun.cn Domain First, I did not rea

Re: uri rules

2008-05-28 Thread mouss
Joseph Brennan wrote: Thanks, Mouss and Matt. So a uri regexp will match a "http://"; that is not there. OK, well... SA tries to check based on what MUAs do. if you write "please visit www.example.com" then so-called "modern" MUAs will highlight www.example.com and if you bring your mou

Re: uri rules

2008-05-28 Thread Randy Ramsdell
Matt Kettler wrote: Joseph Brennan wrote: I was surprised that this rule... uri CU_CN_LINK /http:..\w+\.cn\b/ matches not only this... http://foobar.cn";> but also this... http://www.columbia.edu/foo.html";>KooXoo Buys Kuxun.cn Domain First, I did not realize that SpamAssassin'

Re: uri rules

2008-05-28 Thread Joseph Brennan
Thanks, Mouss and Matt. So a uri regexp will match a "http://"; that is not there. OK, well... Joe Brennan

SARE RULES bugs

2008-05-28 Thread jdow
[12734] dbg: rules: meta test DIGEST_MULTIPLE has undefined dependency 'DCC_CHECK' [12734] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_XMAIL_SUSP2' [12734] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'X_AUTH_WARN_FAKED' [12734] dbg: rules: meta

Possible denial of service bug ?

2008-05-28 Thread Rick Macdougall
Hi, I've got have a message that seems to tie up spamd forever. I'm not sure if it's my setup or spamd itself. I run a very generic stable release setup with bayes in mysql, although the hang up does not appear to be bayes. Would one of the developers like to contact me off list to get a co

Re: uri rules

2008-05-28 Thread Matt Kettler
Joseph Brennan wrote: I was surprised that this rule... uri CU_CN_LINK /http:..\w+\.cn\b/ matches not only this... http://foobar.cn";> but also this... http://www.columbia.edu/foo.html";>KooXoo Buys Kuxun.cn Domain First, I did not realize that SpamAssassin's idea of "uri" inclu

rDNS none in stats with IPv6

2008-05-28 Thread Steve Bertrand
Hi everyone, This may not be the appropriate list, but I'm hoping someone can help me. I have an email server based on Matt Simerson's mail toaster (http://www.tnpi.biz/internet/mail/toaster/) that I've managed to get IPv6 compliant. However, I'm having a very hard time determining exactly w

Re: uri rules

2008-05-28 Thread mouss
Joseph Brennan wrote: I was surprised that this rule... uri CU_CN_LINK /http:..\w+\.cn\b/ matches not only this... http://foobar.cn";> but also this... http://www.columbia.edu/foo.html";>KooXoo Buys Kuxun.cn Domain First, I did not realize that SpamAssassin's idea of "uri" inclu

uri rules

2008-05-28 Thread Joseph Brennan
I was surprised that this rule... uri CU_CN_LINK /http:..\w+\.cn\b/ matches not only this... http://foobar.cn";> but also this... http://www.columbia.edu/foo.html";>KooXoo Buys Kuxun.cn Domain First, I did not realize that SpamAssassin's idea of "uri" includes not only the uri, but

What are some of the most frequently used strings?...

2008-05-28 Thread Don Saklad
a. What are a dozen or so of the most frequently used strings of characters in spam messages?... like rolex, maxgain, ...? b. Around the web where are they any such lists?...

Re: Spam from Gmail & Blogspot

2008-05-28 Thread Matus UHLAR - fantomas
> Sahil Tandon wrote: > > Jonathan Nichols <[EMAIL PROTECTED]> wrote: > >> I've been getting quite a lot of spam that's coming *directly* from > >> Google, > >> using Google servers and referencing blogspot.com (also a Google property) > >> URLs. I've been submitting them to URIBL but naturally,

Re: MySQL and Size Of bayes_expiry_max_db_size

2008-05-28 Thread Benny Pedersen
On Wed, May 28, 2008 00:04, Larry Nedry wrote: > I'm looking for a way to calculate or experimentally find the sweet spot > for bayes_expiry_max_db_size. Is there an ideal range? Or a maximum size? > What happens if the size is too high? what happen is when the size is to big the more ham/spam