Re: Updated rules are not regarded

2010-05-25 Thread Adam Katz
Please note that the ZMI German rules are very old, and while there have been a few recent tweaks to the file, it doesn't look terribly useful to any system that uses the Bayesian filter (more on this later). I would expect these rules to fire quite rarely, even in environments that have lots of G

Re: Arabic Spam

2010-05-25 Thread Karsten Bräckelmann
On Wed, 2010-05-26 at 10:35 +1200, Jason Haar wrote: > On 05/26/2010 05:24 AM, Karsten Bräckelmann wrote: > > Unfortunately, in this case, the fact that it isn't a proper, raw > > message is not irrelevant. The ok_locales setting, which is part of your > > original question, depends on the char-set

Re: Interesting link in spam message

2010-05-25 Thread Daniel McDonald
On 5/25/10 5:22 PM, "fchan" wrote: > I'm recently got some spam with link to bit.ly A fairly common url shortening service >if > this could be a compromise of Google or something. Nope, just someone abusing a link shortener. -- Daniel J McDonald, CCIE # 2495, CISSP # 78281

Re: Arabic Spam

2010-05-25 Thread Jason Haar
On 05/26/2010 05:24 AM, Karsten Bräckelmann wrote: > > Unfortunately, in this case, the fact that it isn't a proper, raw > message is not irrelevant. The ok_locales setting, which is part of your > original question, depends on the char-set used. Which is missing from > the sample. We only can assu

Interesting link in spam message

2010-05-25 Thread fchan
I'm recently got some spam with link to bit.ly which I did a Whois and it appears to MX server for Google/GoogleMail which is from NTT America, Inc and I'm checking if any other people seen this and if this could be a compromise of Google or something. Here is an excerpt of the message with the

Re: new error

2010-05-25 Thread John Hardin
On Tue, 25 May 2010, Jari Fredriksson wrote: Now I've got new message when starting spamd and don't know how to fix it: "info: rules: meta test T_OBFU_ATTACH_MISSP has dependency 'OBFU_TEXT_ATTACH' with a zero score" I see this kind of errors almost every day, but I just ignore them. They do

Re: protocol is caSE sensitive, but should not be

2010-05-25 Thread Benny Pedersen
On Tue 25 May 2010 08:38:29 PM CEST, Karsten Bräckelmann wrote On Tue, 2010-05-25 at 14:20 +0200, Benny Pedersen wrote: i see spam mails that using Http://example.com Yes, it is a known issue. Fixed in SVN already, and will be shipped with the next release 3.3.2. super # save rule as 99_lo

Re: protocol is caSE sensitive, but should not be

2010-05-25 Thread Karsten Bräckelmann
On Tue, 2010-05-25 at 14:20 +0200, Benny Pedersen wrote: > i see spam mails that using Http://example.com Yes, it is a known issue. Fixed in SVN already, and will be shipped with the next release 3.3.2. -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ cha

Re: Arabic Spam

2010-05-25 Thread Karsten Bräckelmann
On Tue, 2010-05-25 at 12:51 -0400, Jason Bertoch wrote: > On 2010/05/25 10:48 AM, Karsten Bräckelmann wrote: > > It is not a FN. It isn't even a proper message. > > > > That's some headers, plus a screen-scraped, rendered version of the > > message, including the most common headers displayed to th

Re: new error

2010-05-25 Thread daniel_agra
Maybe I'm a little obessive... hahahaha, but that's ok, I've managed to get rid of that warning -- Daniel Iserhard CPD - UFRGS Departamento de Redes e Suporte Divisão de Suporte a Software Citando Jari Fredriksson : Now I've got new message when starting spamd and don't know how to fix it:

Re: new error

2010-05-25 Thread Jari Fredriksson
> Now I've got new message when starting spamd and don't know how to fix it: > > "info: rules: meta test T_OBFU_ATTACH_MISSP has dependency > 'OBFU_TEXT_ATTACH' with a zero score" > I see this kind of errors almost every day, but I just ignore them. They do not sound dangerous to me. I may be wro

Re: Arabic Spam

2010-05-25 Thread Jason Bertoch
On 2010/05/25 10:48 AM, Karsten Bräckelmann wrote: On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: A user reported the following FN [...] It is not a FN. It isn't even a proper message. That's some headers, plus a screen-scraped, rendered version of the message, including the most com

RE: Arabic Spam

2010-05-25 Thread Giampaolo Tomassoni
> On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: > > A user reported the following FN [...] > > It is not a FN. It isn't even a proper message. > > That's some headers, plus a screen-scraped, rendered version of the > message, including the most common headers displayed to the user. > >

Re: Arabic Spam

2010-05-25 Thread Karsten Bräckelmann
On Mon, 2010-05-24 at 09:27 -0400, Jason Bertoch wrote: > A user reported the following FN [...] It is not a FN. It isn't even a proper message. That's some headers, plus a screen-scraped, rendered version of the message, including the most common headers displayed to the user. Without a RAW sam

RE: new error

2010-05-25 Thread daniel_agra
Actually I added the line "score OBFU_TEXT_ATTACH 0.1" and it seemed to work. thnx, i'll keep testing -- Daniel Iserhard CPD - UFRGS Departamento de Redes e Suporte Divisão de Suporte a Software Citando Giampaolo Tomassoni : On Tue, 2010-05-25 at 10:25 -0300, Daniel Iserhard wrote: Have yo

RE: new error

2010-05-25 Thread Giampaolo Tomassoni
> On Tue, 2010-05-25 at 10:25 -0300, Daniel Iserhard wrote: > Have you tried setting a non-zero score for OBFU_TEXT_ATTACH? Martin, it seems to me the problem is in some SA rule update. 72_scores.cf states: score OBFU_TEXT_ATTACH 2.299 0.000 2.299 0.000 which means 0 in network-based SA

Re: new error

2010-05-25 Thread Martin Gregorie
On Tue, 2010-05-25 at 10:25 -0300, Daniel Iserhard wrote: > Now I've got new message when starting spamd and don't know how to fix > it: > > > "info: rules: meta test T_OBFU_ATTACH_MISSP has dependency > 'OBFU_TEXT_ATTACH' with a zero score" > Have you tried setting a non-zero score for OBFU_TEX

Re: Arabic Spam

2010-05-25 Thread Jason Bertoch
On 2010/05/24 6:17 PM, Jason Haar wrote: On 05/25/2010 09:47 AM, RW wrote:. My guess is that none of of these is being hit because there's enough English mixed-in with the Arabic. I think the "FARAWAY" rules and other locale checks are dependent on email using the old, pre-Unicode "charset" fo

new error

2010-05-25 Thread Daniel Iserhard
Now I've got new message when starting spamd and don't know how to fix it: "info: rules: meta test T_OBFU_ATTACH_MISSP has dependency 'OBFU_TEXT_ATTACH' with a zero score" This is a Ubuntu Lucid test server with MailScanner, Spamassassin, Postfix & ClamAV -- Daniel Agra Iserhard iserh...@gmail

protocol is caSE sensitive, but should not be

2010-05-25 Thread Benny Pedersen
i see spam mails that using Http://example.com to bypass url hits :( where http://example.com is url blacklisted in 3.3.1 -- xpoint

Additional load from fuzzyocr

2010-05-25 Thread Joel Merrick
Hi all, I manage a number of mail servers for $ISP and was wondering what kind of average load is placed on the servers. I realise this is a 'finger in the air' kind of measurement, but if anybody's got any facts, that'd be great... Cheers, Joel -- $ echo "kpfmAdpoofdufevq/dp/vl" | perl -pe 's