Re: Missed SPAM

2012-03-30 Thread John Hardin
On Fri, 30 Mar 2012, joea wrote: Having some difficulty grasping why some SPAM is getting thru yet some similar is marked. They have different source email address and subject, yet identical "layout" 3 http links, 3 graphics items and like that. "Layout" generally isn't relevant. The link

Missed SPAM

2012-03-30 Thread joea
Having some difficulty grasping why some SPAM is getting thru yet some similar is marked. They have different source email address and subject, yet identical "layout" 3 http links, 3 graphics items and like that. When I save the message source (Mime.822 file) and do sa-learn --spam file it

Re: Spam from Moniker Privacy Services.

2012-03-30 Thread Frank Chan
On 30-03-2012 10:11, Robert Schetterer wrote: Am 30.03.2012 17:44, schrieb Richard Doyle: On 03/29/2012 05:10 PM, Frank Chan wrote: On 02-03-2012 15:49, Frank Chan wrote: Here are some samples of this spam in pastebin: http://pastebin.com/djidF7dg http://pastebin.com/DQan00ve http://pastebin.

Re: Spam from Moniker Privacy Services.

2012-03-30 Thread Frank Chan
On 30-03-2012 08:44, Richard Doyle wrote: On 03/29/2012 05:10 PM, Frank Chan wrote: On 02-03-2012 15:49, Frank Chan wrote: Here are some samples of this spam in pastebin: http://pastebin.com/djidF7dg http://pastebin.com/DQan00ve http://pastebin.com/1PizAzMv http://pastebin.com/Hd6vVpYi Thank

Re: spam report help

2012-03-30 Thread Dave Warren
On 3/30/2012 6:59 AM, Bowie Bailey wrote: I believe he is referring to a rule with multiple alternatives. body SPAMWORD /\b(word1|word2|word3|word4)\b/ You know you have a match, but you don't know WHICH word matched. I think debug mode is the only way to get this level of detail. That, or

Re: Spam from Moniker Privacy Services.

2012-03-30 Thread Robert Schetterer
Am 30.03.2012 17:44, schrieb Richard Doyle: > On 03/29/2012 05:10 PM, Frank Chan wrote: >> On 02-03-2012 15:49, Frank Chan wrote: >>> Here are some samples of this spam in pastebin: >>> >>> http://pastebin.com/djidF7dg >>> http://pastebin.com/DQan00ve >>> http://pastebin.com/1PizAzMv >>> http://pas

Re: Request to change rule RCVD_IN_RP_CERTIFIED

2012-03-30 Thread Kevin A. McGrail
On 3/30/2012 12:08 PM, Bowie Bailey wrote: I checked my logs for the last 30 days. RCVD_IN_RP_CERTIFIED hit 505 times, but did not hit a single spam message. There is also not a single case where it would have changed the ham/spam designation of the message if it had not hit. In other words,

Re: Request to change rule RCVD_IN_RP_CERTIFIED

2012-03-30 Thread Bowie Bailey
On 3/30/2012 11:51 AM, Kevin A. McGrail wrote: >> Some human being decided on the -3.0 score. > Yes, and I could argue based on my corpus that -3.0 is not harsh enough > is my basic point. > > I agree I'm not looking below the surface of the rules very much, > though. I am simply saying that XYZ

Re: Request to change rule RCVD_IN_RP_CERTIFIED

2012-03-30 Thread Axb
On 03/30/2012 05:52 PM, Kevin A. McGrail wrote: I would like to consider tflags for all 'spam for hire' scores be changed to net nice noautolearn this way, at least you aren't adding insult to injury. Please open a bug but what benefit do you see this having in particular for the RCVD_IN_RP_

Re: Request to change rule RCVD_IN_RP_CERTIFIED

2012-03-30 Thread Kevin A. McGrail
I would like to consider tflags for all 'spam for hire' scores be changed to net nice noautolearn this way, at least you aren't adding insult to injury. Please open a bug but what benefit do you see this having in particular for the RCVD_IN_RP_CERTIFIED? regards, KAM

Re: Request to change rule RCVD_IN_RP_CERTIFIED

2012-03-30 Thread Kevin A. McGrail
Some human being decided on the -3.0 score. Yes, and I could argue based on my corpus that -3.0 is not harsh enough is my basic point. I agree I'm not looking below the surface of the rules very much, though. I am simply saying that XYZ rule on my corpus has an extremely good S/O. Can any

Re: Spam from Moniker Privacy Services.

2012-03-30 Thread Richard Doyle
On 03/29/2012 05:10 PM, Frank Chan wrote: On 02-03-2012 15:49, Frank Chan wrote: Here are some samples of this spam in pastebin: http://pastebin.com/djidF7dg http://pastebin.com/DQan00ve http://pastebin.com/1PizAzMv http://pastebin.com/Hd6vVpYi Thank you, Frank On 02-03-2012 14:31, Jeremy McS

Re: spam report help

2012-03-30 Thread Bowie Bailey
On 3/30/2012 6:01 AM, Benny Pedersen wrote: > Den 2012-03-30 11:52, Tom Kinghorn skrev: >> On 30/03/2012 11:47, Benny Pedersen wrote: >>> body SPAMWORD /^spamword$/ >>> describe SPAMWORD spamword found in body >>> score SPAMWORD 0.1 >>> >>> untested :) >>> >> Thats exactly what I am doing. >> Its s

Re: Request to change rule RCVD_IN_RP_CERTIFIED

2012-03-30 Thread Michael Scheidell
On 3/30/12 2:26 AM, Dave Warren wrote: I'd argue that their inability to offer a functional opt-out is bordering on spam-support. months ago, it was non functional (you needed to join, which gave them permission to spam you in order to opt-out) they finally (and I hope it was my constant bitchin

Re: Request to change rule RCVD_IN_RP_CERTIFIED

2012-03-30 Thread Michael Scheidell
On 3/29/12 6:06 PM, Kevin A. McGrail wrote: As a side note, linkedin likely had someone from FreeBSD list use the email address to invite people. I doubt linkedin actually did it. They are an easily abused system but I've never seen them actually support spam. as in 'technically', yes li

Re: spam report help

2012-03-30 Thread Benny Pedersen
Den 2012-03-30 11:52, Tom Kinghorn skrev: On 30/03/2012 11:47, Benny Pedersen wrote: body SPAMWORD /^spamword$/ describe SPAMWORD spamword found in body score SPAMWORD 0.1 untested :) Thats exactly what I am doing. Its shows the description (from the 'describe' section) in the spam report, n

Re: spam report help

2012-03-30 Thread Tom Kinghorn
On 30/03/2012 11:47, Benny Pedersen wrote: body SPAMWORD /^spamword$/ describe SPAMWORD spamword found in body score SPAMWORD 0.1 untested :) Thats exactly what I am doing. Its shows the description (from the 'describe' section) in the spam report, not which word was matched. Thanks Tom

Re: spam report help

2012-03-30 Thread Benny Pedersen
Den 2012-03-30 10:34, Tom Kinghorn skrev: Good morning list. If I have a body rule checking for various banned words in a message body, is there a way to indicate which word matched in the spam-report? eg: when an IP is matched against an RBL, the ip is shown in the spam-report. body SPAMWOR

spam report help

2012-03-30 Thread Tom Kinghorn
Good morning list. If I have a body rule checking for various banned words in a message body, is there a way to indicate which word matched in the spam-report? eg: when an IP is matched against an RBL, the ip is shown in the spam-report. I would like to do the same for a text rule. Is this