Re: Image spam - FuzzyOCR?

2016-08-31 Thread Olivier
Richard, > I am looking at Fuzzy ocr to detect more image spam and I had a couple > of questions; FuzzyOCR does not detect image spam per se, it detects spam text in an image. To classify image spam, you could consider image Cerberus that does a classification on images metadata (size, presence o

Re: How to exclude internal networks from DNS based checks?

2016-08-31 Thread RW
On Wed, 31 Aug 2016 14:13:41 -0500 Jason Voorhees wrote: > Hello guys: > > I'm an old spamassassin user but not an experienced one indeed. I have > a Zimbra server and a dedicated antispam with MailScanner like this: > > Zimbra: 192.168.1.25 > Antispam: 192.168.1.5 > > All incoming and outgoing

Re: sa-update errors

2016-08-31 Thread Benny Pedersen
On 2016-08-31 14:19, Groach wrote: On 31/08/2016 10:32, Axb wrote: I get no errors with spamassassin --lint Nor me. All ok. it possible already fixed ? :=) (ioT humor)

Re: spample of "data" URL in well-crafted Phish

2016-08-31 Thread Axb
On 08/31/2016 08:56 PM, John Hardin wrote: On Wed, 31 Aug 2016, Chip M. wrote: ** Mitigation: The easiest way to catch these is with a simple body word match. Here's the exact matches I am currently using (some of them are recent additions, listed in date of addition order): href="data:

Re: How to exclude internal networks from DNS based checks?

2016-08-31 Thread David Jones
>From: Jason Voorhees >Hello guys: >I'm an old spamassassin user but not an experienced one indeed. I have >a Zimbra server and a dedicated antispam with MailScanner like this: >Zimbra: 192.168.1.25 >Antispam: 192.168.1.5 >All incoming and outgoing mail traffic goes through my antispam box.

How to exclude internal networks from DNS based checks?

2016-08-31 Thread Jason Voorhees
Hello guys: I'm an old spamassassin user but not an experienced one indeed. I have a Zimbra server and a dedicated antispam with MailScanner like this: Zimbra: 192.168.1.25 Antispam: 192.168.1.5 All incoming and outgoing mail traffic goes through my antispam box. Well, I have already working DNS

Re: spample of "data" URL in well-crafted Phish

2016-08-31 Thread John Hardin
On Wed, 31 Aug 2016, Chip M. wrote: ** Mitigation: The easiest way to catch these is with a simple body word match. Here's the exact matches I am currently using (some of them are recent additions, listed in date of addition order): href="data: href='data: http://data:

spample of "data" URL in well-crafted Phish

2016-08-31 Thread Chip M.
Freshly caught Spample: http://puffin.net/software/spam/samples/0042_data_embedded_phish.txt The only munging was inserting ".EXAMPLE" between "wellsfargo" and ".com". Four years ago, I read this fascinating article: http://isc.sans.edu/diary/%22Data%22+URLs+used+for+in-URL+phishin

Re: sa-update errors

2016-08-31 Thread John Hardin
On Wed, 31 Aug 2016, li...@rhsoft.net wrote: Am 30.08.2016 um 22:03 schrieb John Hardin: On Tue, 30 Aug 2016, Joseph Brennan wrote: > We've had errors the past 2 nights for all of the uridnsbl_skip_domain > rules. It's just us? It's been fixed, waiting for a new update to be generated by

Image spam - FuzzyOCR?

2016-08-31 Thread Richard Mealing
Hi everyone, I am looking at Fuzzy ocr to detect more image spam and I had a couple of questions; 1) Is this being used? Does it detect image spam, or should I be looking at something else? 2) I'm getting some horny date spam coming through with just images and text inside an image

Re: sa-update errors

2016-08-31 Thread Groach
On 31/08/2016 10:32, Axb wrote: I get no errors with spamassassin --lint Nor me. All ok.

Re: sa-update errors

2016-08-31 Thread li...@rhsoft.net
Am 31.08.2016 um 13:18 schrieb Martin Gregorie: On Wed, 2016-08-31 at 12:25 +0200, Axb wrote: Blame it on the boogie Another data point: I haven't seen this problem. I've just searched my Considering that it doesn't seem to hit everybody, I wonder if it could be software related, i.e. con

Re: sa-update errors

2016-08-31 Thread Martin Gregorie
On Wed, 2016-08-31 at 12:25 +0200, Axb wrote: > > Blame it on the boogie > Another data point: I haven't seen this problem. I've just searched my  Considering that it doesn't seem to hit everybody, I wonder if it could be software related, i.e. connected with specific Perl package versions. I'm

Re: sa-update errors

2016-08-31 Thread Axb
On 08/31/2016 12:03 PM, li...@rhsoft.net wrote: Am 31.08.2016 um 11:56 schrieb Axb: On 08/31/2016 11:41 AM, li...@rhsoft.net wrote: however, what annoys me more is that "uridnsbl_skip_domain entries have not yet been removed" and obviosuly nobody knows why - what if there would be a issue lea

Re: sa-update errors

2016-08-31 Thread li...@rhsoft.net
Am 31.08.2016 um 11:56 schrieb Axb: On 08/31/2016 11:41 AM, li...@rhsoft.net wrote: however, what annoys me more is that "uridnsbl_skip_domain entries have not yet been removed" and obviosuly nobody knows why - what if there would be a issue leading to fatal errors for everybody running "sa-up

Re: sa-update errors

2016-08-31 Thread Axb
On 08/31/2016 11:41 AM, li...@rhsoft.net wrote: Am 31.08.2016 um 11:32 schrieb Axb: On 08/31/2016 11:25 AM, li...@rhsoft.net wrote: Am 31.08.2016 um 11:15 schrieb Axb: On 08/31/2016 10:57 AM, li...@rhsoft.net wrote: Am 30.08.2016 um 22:03 schrieb John Hardin: On Tue, 30 Aug 2016, Joseph

Re: sa-update errors

2016-08-31 Thread li...@rhsoft.net
Am 31.08.2016 um 11:32 schrieb Axb: On 08/31/2016 11:25 AM, li...@rhsoft.net wrote: Am 31.08.2016 um 11:15 schrieb Axb: On 08/31/2016 10:57 AM, li...@rhsoft.net wrote: Am 30.08.2016 um 22:03 schrieb John Hardin: On Tue, 30 Aug 2016, Joseph Brennan wrote: We've had errors the past 2 nigh

Re: sa-update errors

2016-08-31 Thread Axb
On 08/31/2016 11:25 AM, li...@rhsoft.net wrote: Am 31.08.2016 um 11:15 schrieb Axb: On 08/31/2016 10:57 AM, li...@rhsoft.net wrote: Am 30.08.2016 um 22:03 schrieb John Hardin: On Tue, 30 Aug 2016, Joseph Brennan wrote: We've had errors the past 2 nights for all of the uridnsbl_skip_domain

Re: sa-update errors

2016-08-31 Thread li...@rhsoft.net
Am 31.08.2016 um 11:15 schrieb Axb: On 08/31/2016 10:57 AM, li...@rhsoft.net wrote: Am 30.08.2016 um 22:03 schrieb John Hardin: On Tue, 30 Aug 2016, Joseph Brennan wrote: We've had errors the past 2 nights for all of the uridnsbl_skip_domain rules. It's just us? It's been fixed, waiting f

Re: sa-update errors

2016-08-31 Thread Axb
On 08/31/2016 10:57 AM, li...@rhsoft.net wrote: Am 30.08.2016 um 22:03 schrieb John Hardin: On Tue, 30 Aug 2016, Joseph Brennan wrote: We've had errors the past 2 nights for all of the uridnsbl_skip_domain rules. It's just us? It's been fixed, waiting for a new update to be generated by mas

Re: sa-update errors

2016-08-31 Thread li...@rhsoft.net
Am 30.08.2016 um 22:03 schrieb John Hardin: On Tue, 30 Aug 2016, Joseph Brennan wrote: We've had errors the past 2 nights for all of the uridnsbl_skip_domain rules. It's just us? It's been fixed, waiting for a new update to be generated by masscheck i doubt that the process is working prop

10_uridnsbl_skip_financial.cf

2016-08-31 Thread Axb
I've moved 10_uridnsbl_skip_financial.cf to SVN /trunk/rules-extras/ http://svn.apache.org/repos/asf/spamassassin/trunk/rules-extras/10_uridnsbl_skip_financial.cf This new path should not affect ppl's sa-updates scripts. This is work in progress - there WILL NOT be daily or regular updates. Ple