Re: Spamassassin 4 and ClamAVMultipleScores.

t; > add_header spam Virus _VIRUSRESULT_ > > If this doesn't work, the ClamAV plugin might need to include > "put_metadata('X-Spam-Virus')" when it detects a virus. > > Jimmy > > > On Fri, Nov 3, 2023 at 4:06 AM Andrew Hearn wrote: > >> He

Spamassassin 4 and ClamAVMultipleScores.

Hello, We're using clam, some extra signatures, and the plugin/config as described on https://cwiki.apache.org/confluence/display/SPAMASSASSIN/ClamAVMultipleScores to give different signature families different scores. Since moving to v4, I don't think it's working... The only rule that is match

Re: Detecting very recently registered domain names

On Thu, 19 Dec 2013 10:02:39 -0500 Joe Quinn wrote: > We are noticing a lot of spam coming from domains that are less than > two months old. Is there a good way to detect this automatically? > > We've thought about whois, but do not want to get blocked for looking > like we are harvesting infor

Low scoring pill spam

Hello, I have a low scoring pills spam: http://pastebin.com/q6nWqzMR I only get the following on it: * 1.0 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3) * [219.94.129.82 listed in bl.mailspike.net] * 0.0 SUBJECT_FUZZY_CHEAP Attempt to obfuscate words in Subject: * 0.5 FROM_LOCAL_NOVOWEL

Re: URLs with Spaces

Kasper Sacharias Eenberg wrote: > There's been a rule circulating this mailing list for a couple of weeks. > This is the latest edition to catch those med-things (afaik). > > -- > body AE_MEDS35 /\bwww\s(?:\W\s)?\w{3,6}\d{2,6}\s(?:\W\s)?(?:c\s?o > \s?m|n\s?e\s?t|o\s?r\s?g)\b/i > descri

URLs with Spaces

Hello, I'm wondering if I'm missing some rules that would have given this message more points - I know it's missing bayes (I'm not sure why as our servers should use bayes, but it seems not to have been run for this message.) http://www.pastebin.ca/1473975 Thanks -- Andrew.

Not scoring well on 'claims of £500,000 pounds' type emails

Hello, Our setup seems to work pretty well, but some spams are slipping through. Has anyone got any suggestions of rules that will catch these types of emails: http://www.pastebin.ca/1266571 I do run Bayes, but seems that Bayes didn't run for this message, I also run sought rules. and greylist be

Re: using RHEL / CentOS / Fedora perl?

Randal, Phil wrote: Andrew Hearn wrote: Justin Mason wrote: have you seen this? http://blog.vipul.net/2008/08/24/redhat-perl-what-a-tragedy/ That bug in Red Hat perl will almost definitely slow down SpamAssassin, too, I would say. Can anyone verify? --j. This fixed it for me on a

Re: using RHEL / CentOS / Fedora perl?

Justin Mason wrote: have you seen this? http://blog.vipul.net/2008/08/24/redhat-perl-what-a-tragedy/ That bug in Red Hat perl will almost definitely slow down SpamAssassin, too, I would say. Can anyone verify? --j. This fixed it for me on a couple of centos servers: http://people.centos

Fraud spam text in .doc attachments

Hi, Any one else seen emails with word documents attached and the word document has text of an 'African fraud'? example: http://pastebin.com/mad34c97 I've not seen a Word Doc plugin for SpamAssassin, is there one? Thanks! -- Andrew Hearn

Not scoring high enough on this spam...

http://pastebin.ca/961075 I've only seen one so far but apart from the 0.0 BAYES_50 (I will learn this message), does anyone have rules that pushes this kind of message over 5.0? thanks! Andrew

Re: How many use CRM114?

Blaine Fleming wrote: > Slightly off-topic, but I'm curious, how many of you are using CRM114? > How well does it work for you? Was it difficult to train? I've been > looking at it and haven't found much except the official plugin guide > and a single page saying that it works better than other

Re: Lots Of SPAM

Tarak Ranjan wrote: > > Hi List, > > i have posted my RAW email in http://pastebin.ca/918849 , > > i'm receiving 1000 to 4000 per day this king of mesages. > > SA also skipping this kind of mails > > > > / > > TArak > > > > I get 8.2 without Bayes... 1.5 IXHASH2BODY: mail has

Not sure why DOS_OE_TO_MX fired

Hello, I'm not sure why DOS_OE_TO_MX fired on this message, as the headers say it was delivered to b.painless.aaisp.net.uk which relayed it on to z.hopeless.aaisp.net.uk. b.painless isn't the MX for the domain... Any ideas? -Thanks! Return-path: <[EMAIL PROTECTED]> Envelope-to: [EMAIL PROTECTE

Re: HELO_DYNAMIC_SPLIT_IP

Giampaolo Tomassoni wrote: >> -Original Message- >> From: Andrew Hearn [mailto:[EMAIL PROTECTED] >> Sent: Tuesday, December 11, 2007 12:04 PM >> >> Hi, >> >> Can anyone explain why this email: >> http://pastebin.ca/811938 >> is getting

HELO_DYNAMIC_SPLIT_IP

Hi, Can anyone explain why this email: http://pastebin.ca/811938 is getting a hit on HELO_DYNAMIC_SPLIT_IP. I'm seeing a few ham message being caught by this (SpamAssassin version 3.2.3, sa-update) Thanks! Andrew

Re: SQL-based AWL and Bayes not working with 3.2.3

one I'm running 3.2.3 on, and using the same config from our other 3.1.7 machines which are happy with Bayes... User preference is being used, as I can tell that as the required score is being set correctly from the preferences. -- Andrew Hearn

Score counting error

% * [score: 1.] Seems odd that score doesn't add up? (4.4 + 0.0 = 4.3!!) -- Andrew Hearn

Re: Sudden drop in spam-rate, parallel to a surge of new trojans - beware

006 > Sorry to be OT, but are these spam stats a built in feature of SA, or have you got a plugin to get this information? Thanks! -- Andrew Hearn