Re: Constant .info domain spam

2010-10-14 Thread Jason Bertoch
On 10/14/2010 8:26 PM, Julian Yap wrote: On Thu, Oct 14, 2010 at 4:24 AM, Jason Bertoch wrote: On 2:59 PM, Julian Yap wrote: NOTE: I changed the domains below to 'dot info' as the mailing list rejected my initial submission. I'm pretty sure it's not just me but there is some constant spammin

Re: What happened to SOUGHT rules' server?

2010-10-14 Thread Jason Bertoch
On 10/14/2010 5:30 PM, Karsten Bräckelmann wrote: any work has been done on the bug? > > https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6380 According to the bug, quite obviously, no one has been working on it. Until your patch just today. Thanks! Yes, I decided this was a logic is

Re: Checking FROM FIELD for Keywords

2010-10-14 Thread John Hardin
On Thu, 14 Oct 2010, John Hardin wrote: On Thu, 14 Oct 2010, wvpTV wrote: We've seen a recent explosion in spam that SpamAssassin does not flag, it seems mainly because the FROM (sender) field is being used for subject content, eg: VIAGRA, PORN etc etc Can anyone tell me how far off a sta

RAZOR2 and SpamAssassin version or configuration

2010-10-14 Thread Bart Schaefer
We have a couple of mail servers running SpamAssassin. One is stock CentOS5 and therefore running SA 3.2.4. The other is a test platform running SA 3.3.1 (installed from rpmforge in case that matters). Both have the latest sa-update configurations for their respective versions. On both hosts, w

Re: What happened to SOUGHT rules' server?

2010-10-14 Thread Karsten Bräckelmann
On Thu, 2010-10-14 at 12:30 -0400, Jason Bertoch wrote: > On 2010/03/16 5:03 PM, Karsten Bräckelmann wrote: > >> In order to properly open a feature request, I'd like to get a better > >> idea where you're going with this. It seems to me that a new exit code > >> from sa-update would be more app

Solved: which LWP::UserAgent for 3.3.1 install?

2010-10-14 Thread Diffenderfer, Randy
CPAN search is my friend... it's in libwww-perl! You get too soon old and too late smart... :-) rnd _ From: Diffenderfer, Randy Sent: Thursday, October 14, 2010 4:24 PM To: 'users@spamassassin.apache.org' Subject: which LWP::UserAgent for 3.3.1 install

which LWP::UserAgent for 3.3.1 install?

2010-10-14 Thread Diffenderfer, Randy
Looking at the 3.3.1 install, it wants (well, would like...) module LWP::UserAgent. OK ... off to CPAN, but no simple LWP-UserAgent, only a bunch of LWP-UserAgent-whatever. So, which one do I want? TIA, rnd

Re: Checking FROM FIELD for Keywords

2010-10-14 Thread wvpTV
Jared Hall-2 wrote: > > Use the From:name check. Example: > > headerBAD_NAMEFrom:name =~ /(Penny > Auctions|\bFree\b|\bCialis\b|\bViagra)/i > score BAD_NAME5.0 > > Thanks Jared -- View this message in context: http://old.nabble.com/Checking-FROM-FIELD-for

Re: What happened to SOUGHT rules' server?

2010-10-14 Thread Jason Bertoch
On 2010/03/16 5:03 PM, Karsten Bräckelmann wrote: How is this messing you up? This should not affect any of your other channels. The only effect is that the sought rules don't get updated. I'm not sure how everyone else is doing it, but my script checks for updates using --channelfile, then r

Re: Checking FROM FIELD for Keywords

2010-10-14 Thread Jared Hall
Use the From:name check. Example: headerBAD_NAMEFrom:name =~ /(Penny Auctions|\bFree\b|\bCialis\b|\bViagra)/i score BAD_NAME5.0 Use caution, as always. Mind your regexes. For instance, in this example, heaven forbid a user named Joe Viagraola sends an Email, bla

Re: Checking FROM FIELD for Keywords

2010-10-14 Thread John Hardin
On Thu, 14 Oct 2010, wvpTV wrote: We've seen a recent explosion in spam that SpamAssassin does not flag, it seems mainly because the FROM (sender) field is being used for subject content, eg: VIAGRA, PORN etc etc Can anyone tell me how far off a standard filter update might be to carry out c

Re: Constant .info domain spam

2010-10-14 Thread Jason Bertoch
On 2:59 PM, Julian Yap wrote: NOTE: I changed the domains below to 'dot info' as the mailing list rejected my initial submission. I'm pretty sure it's not just me but there is some constant spamming from dot info domains. Perhaps for the past 2 months or so. Often they send hundreds per day a

Checking FROM FIELD for Keywords

2010-10-14 Thread wvpTV
We've seen a recent explosion in spam that SpamAssassin does not flag, it seems mainly because the FROM (sender) field is being used for subject content, eg: VIAGRA, PORN etc etc Can anyone tell me how far off a standard filter update might be to carry out checks on the FROM field? Thanks. --