Re: EmailBL hit count

On Dienstag 19 Mai 2009 Karsten Bräckelmann wrote: > Again, I believe the "your fault" wasn't the intention. But that this > is a test, *needs* testers, and you can do it without *any* impact to > your results. Yes of course. I just meant you can't ask people to use your tests and then blame them

Re: Got dead domains that get a lot of spam?

LuKreme wrote: On 19-May-2009, at 20:34, Karsten Bräckelmann wrote: Other than that, I recently enabled Hostkarma blacklists here, just to check. FWIW, it's scoring *really* good for me. So good, I seriously toned it down. I want to evaluate it first. For that, I need something even close to a

Re: one domain gets 99% of spam

Aaron Wolfe wrote: On Wed, May 20, 2009 at 1:09 AM, Marc Perkel wrote: option8 wrote: on my small server setup, i host around 30 domains. between SA and a fairly aggressive exim setup, very little spam gets through to the end users. most of it doesn't even get far enough to hit my lo

Re: Got dead domains that get a lot of spam?

On 19-May-2009, at 20:34, Karsten Bräckelmann wrote: Other than that, I recently enabled Hostkarma blacklists here, just to check. FWIW, it's scoring *really* good for me. So good, I seriously toned it down. I want to evaluate it first. For that, I need something even close to a considerable, div

Re: one domain gets 99% of spam

On Wed, May 20, 2009 at 1:09 AM, Marc Perkel wrote: > > > option8 wrote: >> >> on my small server setup, i host around 30 domains. between SA and a >> fairly >> aggressive exim setup, very little spam gets through to the end users. >> most >> of it doesn't even get far enough to hit my logs. >> >>

Re: one domain gets 99% of spam

option8 wrote: on my small server setup, i host around 30 domains. between SA and a fairly aggressive exim setup, very little spam gets through to the end users. most of it doesn't even get far enough to hit my logs. however, one domain that i host gets constantly bombarded, and has since i to

Re: BOUNCE_MESSAGE problem

On Wed, May 20, 2009 at 02:21:42AM +0200, Karsten Bräckelmann wrote: > On Wed, 2009-05-20 at 02:42 +0300, Jari Fredriksson wrote: > > Another one. This is from Washington Post. Still with fetchmail. > > http://.pastebin.ca/1427982 > > > > Marked as BOUNCE. > > > > meta __BOUNCE_RPATH_NULL

one domain gets 99% of spam

on my small server setup, i host around 30 domains. between SA and a fairly aggressive exim setup, very little spam gets through to the end users. most of it doesn't even get far enough to hit my logs. however, one domain that i host gets constantly bombarded, and has since i took it over from an

Re: over-representing non-English spam?

On 05/20/2009 12:37 PM, Karsten Bräckelmann wrote: > > The ok_locales setting defaults to all, effectively disabling all > CHARSET_FARAWAY rules. It is intended to be set voluntarily to charsets > you cannot even decipher, let alone read. > > Doh! I run a separate instance of SA for my own mail

Re: Got dead domains that get a lot of spam?

Karsten Bräckelmann wrote: And I do have a goal of !00% accuracy although that is difficult to attain. While I guess most blacklist operators do aim at a perfect blacklist, regardless of specific definitions and whether others agree or not... That's probably one of the worst shift typos

Re: Got dead domains that get a lot of spam?

> And I do have a goal of !00% accuracy although that is difficult to > attain. While I guess most blacklist operators do aim at a perfect blacklist, regardless of specific definitions and whether others agree or not... That's probably one of the worst shift typos in history. ;-) Other than tha

Re: over-representing non-English spam?

While I agree with all the good info (snipped) above, and pretty much said exactly that myself... > Using the OpenProtect channel means that you (or your admin) have > decided to trust OpenProtect to decide for you wich rules to add to your > ruleset. If you find that you don't agree with OpenPr

Re: over-representing non-English spam?

On Wed, 2009-05-20 at 12:01 +1200, Jason Haar wrote: > Hi there > > I just got a very large Chinese spam (>4M) - I seem to get several of > these a month. Anyway, while I was fiddling with it I saw the score SA > gave it when it could actually swallow the whole thing (see below). > > As you can s

Re: over-representing non-English spam?

Jason Haar wrote: As you can see, MIME_CHARSET_FARAWAY, CHARSET_FARAWAY_HEADER, and SARE_SUB_ENC_GB2312 (from openprotect rules) all triggered - total of 8.0 points. Sounds good - but of course that's very bad! Doesn't that mean an actual legitimate Chinese email would *default to a score of 8.0

Re: BOUNCE_MESSAGE problem

On Wed, 2009-05-20 at 02:42 +0300, Jari Fredriksson wrote: > Another one. This is from Washington Post. Still with fetchmail. > http://.pastebin.ca/1427982 > > Marked as BOUNCE. > > meta __BOUNCE_RPATH_NULL 0 > > should be working. $ spamassassin --cf="meta __BOUNCE_RPATH_NULL 0" < 142

Re: should the spam score increase

On Wed, 2009-05-20 at 11:46 +1200, Kate wrote: > Karsten Bräckelmann wrote: > > On Wed, 2009-05-20 at 09:42 +1200, Kate wrote: > > > I had to up the score as they were all still getting through due to > > > bayes_00 (score -3) > > > > That is a *custom* score. You should NOT arbitrarily adjust sc

over-representing non-English spam?

Hi there I just got a very large Chinese spam (>4M) - I seem to get several of these a month. Anyway, while I was fiddling with it I saw the score SA gave it when it could actually swallow the whole thing (see below). As you can see, MIME_CHARSET_FARAWAY, CHARSET_FARAWAY_HEADER, and SARE_SUB_ENC_

Re: should the spam score increase

Karsten Bräckelmann wrote: On Wed, 2009-05-20 at 09:42 +1200, Kate wrote: I recently implemented a rule kindly provided by John Hardin - MIME_IMAGE_ONLY I watched it carefully and it only caught spam YAY It is very unlikely to ever catch ham -- unless, maybe, you are using fax by emai

Re: BOUNCE_MESSAGE problem

>> On Tue, 2009-05-19 at 21:59 +0300, Jari Fredriksson >> wrote: >> >> Try disabling the __BOUNCE_RPATH_NULL constraint, by >> overriding it in local.cf: >> meta __BOUNCE_RPATH_NULL 0 > Another one. This is from Washington Post. Still with fetchmail. http://.pastebin.ca/1427982 Marked a

Re: should the spam score increase

On Wed, 2009-05-20 at 09:42 +1200, Kate wrote: > I recently implemented a rule kindly provided by John Hardin - > MIME_IMAGE_ONLY > I watched it carefully and it only caught spam YAY It is very unlikely to ever catch ham -- unless, maybe, you are using fax by email systems or other similar auto-g

Re: learning from IMAP spam collection

Michael Monnerie schrieb: Nope. It needs to modify the body as well. [...] And sometimes messages are encrypted twice, when they arrive over certain paths. But that's an extra mess. If the processing is that difficult you might consider to save a copy of every incoming mail (before filters) a

Re: should the spam score increase

Jari Fredriksson wrote: As the mail contains no text, there propably is not much to learn. Why not? Bayes learns from headers as well, and headers can be just as useful as body text for classifying mail. (Note: I haven't seen a single one of these PNG-only spams, so I don't know how tellin

Re: should the spam score increase

Lists wrote: question is should they system now be 'learning' these and thus changing the bayes_00 to bayes_50 etc It's actually quite hard for us to know if you have autolearn turned on or off. If not, what is the best method to go about 'learning' these spam. If you have shell access:

Re: should the spam score increase

> Hi all, > > I recently implemented a rule kindly provided by John > Hardin - MIME_IMAGE_ONLY > I watched it carefully and it only caught spam YAY > I had to up the score as they were all still getting > through due to bayes_00 (score -3) > Having done that it is all now getting blocked which is

Re: learning from IMAP spam collection

On 19-May-2009, at 09:56, Martin Gregorie wrote: Thats a much more complex problem than your original requirement to strip out headers. You'll not get good solutions if you hide part of the problem. His original problem was the very slow speed of spamassassin -d OP from post #1 I like to r

Re: Got dead domains that get a lot of spam?

Ned Slider wrote: John Hardin wrote: On Tue, 19 May 2009, Neil Schwartzman wrote: On 19/05/09 10:55 AM, "Marc Perkel" wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that

Re: should the spam score increase

On 19-May-2009, at 15:42, Lists wrote: what is the best method to go about 'learning' these spam are you looking for an answer that is not sa-learn? -- A ship should not ride on a single anchor, nor life on a single hope

Re: learning from IMAP spam collection

On 19-May-2009, at 06:45, Jeff Mincy wrote: You can use formail to remove headers. It is way faster than spamassassin -d. The only trick is listing all of the headers that can be added by SpamAssassin. formail -b -t -I X-Spam-Status: -I X-Spam-Flag: -I X-Spam-Checker- Version: -I X-Spam-Rbl:

Re: Got dead domains that get a lot of spam?

Neil Schwartzman wrote: On 19/05/09 10:55 AM, "Marc Perkel" wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not current legitimate email. Good for you! You

Re: should the spam score increase

Lists wrote: Hi all, I recently implemented a rule kindly provided by John Hardin - MIME_IMAGE_ONLY I watched it carefully and it only caught spam YAY I had to up the score as they were all still getting through due to bayes_00 (score -3) Having done that it is all now getting blocked which i

should the spam score increase

Hi all, I recently implemented a rule kindly provided by John Hardin - MIME_IMAGE_ONLY I watched it carefully and it only caught spam YAY I had to up the score as they were all still getting through due to bayes_00 (score -3) Having done that it is all now getting blocked which is great but my

Re: BOUNCE_MESSAGE problem

> On Tue, May 19, 2009 22:34, Jari Fredriksson wrote: >>> On Tue, 2009-05-19 at 21:59 +0300, Jari Fredriksson >>> wrote: Try disabling the __BOUNCE_RPATH_NULL >>> constraint, by overriding it in local.cf: >>> meta __BOUNCE_RPATH_NULL 0 >> Thanks! It works. > > next question is why does maillist

Re: BOUNCE_MESSAGE problem

> On Tue, May 19, 2009 22:28, Karsten Bräckelmann wrote: > >> Sorry, but that's just utterly wrong. See my previous >> post. > > List-Unsubscribe: > > > is wroung too ? :) I'm a subscriber of that list. And the mail is not a BOUNCE or any k

Re: BOUNCE_MESSAGE problem

On Tue, 2009-05-19 at 22:37 +0200, Benny Pedersen wrote: > On Tue, May 19, 2009 22:28, Karsten Bräckelmann wrote: > > > Sorry, but that's just utterly wrong. See my previous post. > > List-Unsubscribe: > > is wroung too ? :) What's that got to

Re: BOUNCE_MESSAGE problem

On Tue, May 19, 2009 22:34, Jari Fredriksson wrote: >> On Tue, 2009-05-19 at 21:59 +0300, Jari Fredriksson wrote: >> Try disabling the __BOUNCE_RPATH_NULL constraint, by >> overriding it in local.cf: >> meta __BOUNCE_RPATH_NULL 0 > Thanks! It works. next question is why does maillist mails boun

Re: BOUNCE_MESSAGE problem

On Tue, May 19, 2009 22:28, Karsten Bräckelmann wrote: > Sorry, but that's just utterly wrong. See my previous post. List-Unsubscribe: is wroung too ? :) -- http://localhost/ 100% uptime and 100% mirrored :)

Re: BOUNCE_MESSAGE problem

> On Tue, 2009-05-19 at 21:59 +0300, Jari Fredriksson wrote: > > Try disabling the __BOUNCE_RPATH_NULL constraint, by > overriding it in local.cf: > meta __BOUNCE_RPATH_NULL 0 Thanks! It works.

Re: BOUNCE_MESSAGE problem

On Tue, 2009-05-19 at 22:18 +0200, Benny Pedersen wrote: > On Tue, May 19, 2009 21:40, Jari Fredriksson wrote: > > > err.. So why does VBounce mark is as BOUNCE? It is not a bounce. > > spamassassin see it as a mail sent localy if i remember how fetchmail > headers confuse it Bullshit! OK, let

Re: BOUNCE_MESSAGE problem

On Tue, May 19, 2009 21:40, Jari Fredriksson wrote: > err.. So why does VBounce mark is as BOUNCE? It is not a bounce. spamassassin see it as a mail sent localy if i remember how fetchmail headers confuse it > Does it mark all fetchmailed mail as BOUNCE_MESSAGE? yes its related try debug it

Re: BOUNCE_MESSAGE problem

> > > What might be wrong here? > > > > fetchmail Please feel free to ignore Benny. > Does it mark all fetchmailed mail as BOUNCE_MESSAGE? No, it does not. And unless your fetchmail is setting the Return-Path, it is not related to fetchmail in any way. SA works just fine with fetchmail, and ev

Re: BOUNCE_MESSAGE problem

On Tue, 2009-05-19 at 21:59 +0300, Jari Fredriksson wrote: > I get lots of false BOUNCE_MESSAGES from VBounce-plugin. > > Sample: http://www.pastebin.ca/1427728 > What might be wrong here? It triggers on the NULL Return-Path. With a somewhat fuzzy look at the rule and some abstraction, BOUNCE_M

Re: BOUNCE_MESSAGE problem

> On Tue, May 19, 2009 20:59, Jari Fredriksson wrote: > >> What might be wrong here? > > fetchmail > > bounces do not make sense in rfc1918 err.. So why does VBounce mark is as BOUNCE? It is not a bounce. Does it mark all fetchmailed mail as BOUNCE_MESSAGE?

Re: BOUNCE_MESSAGE problem

On Tue, May 19, 2009 20:59, Jari Fredriksson wrote: > What might be wrong here? fetchmail bounces do not make sense in rfc1918 -- http://localhost/ 100% uptime and 100% mirrored :)

Re: catch22: MIRRORED.BY wrong, sa-update won't

just fyi, I left spamassassin.kluge.net up for over a month after removing it from the MIRRORED.BY file, and forced a new update to deal with https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6083. I figured that anyone using sa-update would run it at least once a month, and then get the new

Re: EmailBL plugin released - I like it!

Yet Another Ninja wrote: from the descriptions you are using, you are speaking about a totally different BL... this is not the one "in googlegroups". ah, my bad. I didn't know that the term 'EmailBL' was used generically. Jesse -- Jesse Thompson Division of Information Technology, Univer

BOUNCE_MESSAGE problem

I get lots of false BOUNCE_MESSAGES from VBounce-plugin. Sample: http://www.pastebin.ca/1427728 local.cf: whitelist_bounce_relays wellington.fredriksson.dy.fi smtp.localnet.fi posti.saunalahti.fi Those my local server and two smarthosts it uses. What might be wrong here?

Re: Got dead domains that get a lot of spam?

John Hardin wrote: On Tue, 19 May 2009, Neil Schwartzman wrote: On 19/05/09 10:55 AM, "Marc Perkel" wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not current legit

RE: learning from IMAP spam collection

On Tue, 2009-05-19 at 15:05 +0200, Michael Monnerie wrote: > Nope. It needs to modify the body as well. We have a lengthy "this is > SPAM" text in the beginning of recognized Spam, with the original mail > attached. this way, it cannot "happen" that users "accidentally" click > on stupid Viagra lin

Re: Another yukky email

On Tue, May 19, 2009 at 11:05:36AM -0400, Adam Katz wrote: > Henrik K wrote: > > I'm not sure what you are implying. BOUNCE_MESSAGE only requires > > Return-Path: <>, which many non-bounce things use (newsletters, > > order confirmations etc). So your rule catches all of them. It's > > been like t

Re: Got dead domains that get a lot of spam?

On Tue, 19 May 2009, Neil Schwartzman wrote: On 19/05/09 10:55 AM, "Marc Perkel" wrote: That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not current legitimate email. Good

Re: Another yukky email

http://www.backscatterer.org/ May help. Here's another e-mail that got through SpamAssassin: > > http://rafb.net/p/cFMnIy61.html > > As you can see I've effectively disabled the BAYES_00 rule as it's giving > false credit to a ton of backscatter crud messages, but is there really a > way to bloc

New Message Sniffer Plugin Released SNF4SA

Hello SA folks, We have significantly upgraded our plugin for SpamAssassin. You can find it here: http://www.armresearch.com/products/index.jsp Or more specifically here: http://www.armresearch.com/message-sniffer/download/snf4sa-0.9.2.tar.gz Please take a look and let us know what you think

Re: Got dead domains that get a lot of spam?

On 19/05/09 10:55 AM, "Marc Perkel" wrote: > That's not how I would define dead. Our system can tell the difference between > a good email sent to a dead domain and a spambot. Our definition is any domain > that has not current legitimate email. Good for you! You are one up on the CBL, then, w

Re: Another yukky email

Henrik K wrote: > I'm not sure what you are implying. BOUNCE_MESSAGE only requires > Return-Path: <>, which many non-bounce things use (newsletters, > order confirmations etc). So your rule catches all of them. It's > been like this forever, but I guess people are happy enough with it > not to fix

Re: Got dead domains that get a lot of spam?

That's not how I would define dead. Our system can tell the difference between a good email sent to a dead domain and a spambot. Our definition is any domain that has not current legitimate email. Neil Schwartzman wrote: I think it would be a very good idea to define 'dead' before setting or a

Re: Got dead domains that get a lot of spam?

I think it would be a very good idea to define Œdead¹ before setting or accepting such a domain. I hope dead = Œhas bounced 550 5.1.1 for at least a year to all attempts to previously valid addresses¹, otherwise, for all intents and purposes, especially this one, ³I¹m not dead yet². On 19/05/09

Re: EmailBL plugin released - I like it!

On 5/19/2009 4:02 PM, Jesse Thompson wrote: Henrik K wrote: First we should test if there actually are such FPs and not speculate. ;) There are FPs by nature. Some of the accounts are legitimate accounts co-opted by spammers to send the phishing attempts to compromise more accounts. Use t

Re: EmailBL hit count

On Mon, 2009-05-18 at 21:19 -0600, LuKreme wrote: > On 18-May-2009, at 19:02, Michael Monnerie wrote: > > I didn't mean that the final result be a FP, just this one ruleset. > > Shouldn't the goal be to have no FPs and lots of corrects? > > In a word? No. I don't think you understood what that DN

Re: EmailBL plugin released - I like it!

Henrik K wrote: First we should test if there actually are such FPs and not speculate. ;) There are FPs by nature. Some of the accounts are legitimate accounts co-opted by spammers to send the phishing attempts to compromise more accounts. Use the list with caution, and pay attention to th

Got dead domains that get a lot of spam?

Looking for people with dead domains that still get a lot of spam, especially spambot spam. I'm trying to get more spambot data for our hostkarma spam list. If you have such a domain that you aren't using can you set the MX to tarbaby.junkemailfilter.com. It will help stop spammers at the sourc

RE: learning from IMAP spam collection

> I don't think it does that, but it should be easy enough to add the > option and submit the result as a patch. spamc seemed pretty straight > forward last time I looked at its source. Yeah, maybe some good hacker could do that. I'm not a programmer, unfortunately. mfg zmi

Re: learning from IMAP spam collection

From: Michael Monnerie Date: Tue, 19 May 2009 09:34:53 +0200 On Sonntag 17 Mai 2009 Michael Monnerie wrote: > Why is it so extremely > slow and CPU consuming just to remove any existing markups? There really seems to be no other way than calling "spamassassin -d" to r

Re: explicit spam not tagged?

On Tue, 2009-05-19 at 09:43 +0200, Geert Batsleer wrote: > since a couple of days I'm receiving huge amounts of explicited spam > wich doesn't get tagged. > > For example email with subject "Breast Orgasms Will Give Her the Most > Explosive Orgasm ..." only results in a 2.0 score Now that's a

Re: EmailBL plugin released

Justin Mason wrote: > http://ruleqa.spamassassin.org/20090516-r775436-n/T_EMAILBL_TEST_LEM/detail Would be interesting to see if the 5 ham hits really were ham or whether they were accidentally misclassified and what the e-mail address was. Cheers, Steve.

Re: EmailBL plugin released

http://ruleqa.spamassassin.org/20090516-r775436-n/T_EMAILBL_TEST_LEM/detail --j. On Tue, May 12, 2009 at 15:54, Justin Mason wrote: > I've added it to SVN for testing -- my sandbox for now, but I'll move > it to Alex's once his acct is set up ;) > > is there a test entry for this zone? > > --j.

Re: learning from IMAP spam collection

On Tue, 2009-05-19 at 03:03 +0200, Michael Monnerie wrote: > Yes, I want to use spamc. But what parameters does it need to remove > existing spam markup, just like "spamassassin -d" does? > I don't think it does that, but it should be easy enough to add the option and submit the result as a pat

Re: learning from IMAP spam collection

On Dienstag 19 Mai 2009 Michael Monnerie wrote: > On Sonntag 17 Mai 2009 Rick Macdougall wrote: > > Why not use > > http://www.sonologic.nl/pub/Projects/ImapSaLearn/imap-sa-learn.pl.t > >xt > > I've improved it a bit: http://zmi.at/x/imap-sa-learn.pl > * debug 1 or 2 selectable > * no debug is good

Re: learning from IMAP spam collection

On Sonntag 17 Mai 2009 Michael Monnerie wrote: > Why is it so extremely > slow and CPU consuming just to remove any existing markups? There really seems to be no other way than calling "spamassassin -d" to remove existing markups. I guess I will create an account where a script takes all message

Re: does MIME_QP_LONG_LINE applies to email headers?

On 19.05.09 03:04, Gabriel Sosa wrote: > I've been looking on the archives about this but I couldn't find anything > about. Hello, please configure your mailer to wrap lines below 80 characters per line. 72 to 75 is usually OK. Thank you. > Any email that goes out trough my server is being mark

Re: learning from IMAP spam collection

On Sonntag 17 Mai 2009 Rick Macdougall wrote: > Why not use > http://www.sonologic.nl/pub/Projects/ImapSaLearn/imap-sa-learn.pl.txt I've improved it a bit: http://zmi.at/x/imap-sa-learn.pl * debug 1 or 2 selectable * no debug is good for interactive use, debug 1 for scripts, debug 2 for real debu