Re: How can I filter this kind of spam?

Thomas Booms wrote: Hi all, I have the following text of a spam not marked as spam. BAYES_40 I have set to 5. After I got it, I've increased the value of RCVD_BY_IP to 5 in the hope, that it works. Which other solutions are there to mark these mails as spam? I saw that more and more spams c

Re: Block messages with "null" sender

Joao Gazzoni wrote: Hello, Does anyone know how to block messages that come with a blank sender address in the "from" field, like "from=<>" ? We are using SA with MailScanner. Thanks for any suggestion. That's funny. There was just recently a big flame war on the Exim list about this topic.

possible wish list item

to be tagged as spam. It would be nice if I could show them in the header at the workstation, rather than run a test from my workstation and print it out. If this can already be done, let me know and I'll figure out how to do it. Thanks, Craig Jackson

Re: uri regex

Bret Miller wrote: I flunked the IQ test so I need some help. I want to match all domains in the body that are not in .com,.org.us,.edu,.gov and .mil. But there's more. I need to match some characters at the end of the URI that can often be found there such as >.?)*!"'; The rule would match

Re: uri regex

Stuart Johnston wrote: cjackson wrote: Hi, I flunked the IQ test so I need some help. I want to match all domains in the body that are not in .com,.org.us,.edu,.gov and .mil. But there's more. I need to match some characters at the end of the URI that can often be found there such as >.?)*!

Re: SA and Exchange 5.5

orks pretty well. In general I think it best to keep the junk off of Exchange. Craig Jackson

Re: return-path test

David B Funk wrote: On Sat, 4 Jun 2005, Craig Jackson wrote: I notice that the return-path: is often different from the from: But my return-path: tests all fail. Here's one: header RETPATH_NUMS_CJ Return-path =~ /[0-9]{6,}/ score RETPATH_NUMS_CJ 3.000 It will successfully match From

return-path test

I notice that the return-path: is often different from the from: But my return-path: tests all fail. Here's one: header RETPATH_NUMS_CJ Return-path =~ /[0-9]{6,}/ score RETPATH_NUMS_CJ 3.000 It will successfully match From:addr or Reply-To: but Return-path is silent. Yes, I tried Return-Path,

Re: Worst "Establishment" or "Household Name" Pseudo-Spammers

re, fishy. Any comments on Overstock and Staples? Has anyone else noticed others in this same category that sent at this frequency? (just want to compare notes) Rob McEwen PowerView Systems There's a good chance your users are actually signing up for that stuff. Ours do. Craig Jackson

Re: Couple of useful tests

D]" which would trigger your first rule. Pierre Thomson BIC -Original Message- From: Craig Jackson [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 01, 2005 2:50 PM To: users@spamassassin.apache.org Subject: Couple of useful tests Hi, I created these tests which I find very accurate fo

Re: Couple of useful tests

Wolfgang Zeikat wrote: On 06/01/05 20:50, Craig Jackson wrote: Hi, I created these tests which I find very accurate for detecting spam and so thought I'd let the list have a view. Lots of numbers or consonants in the reply-to usually bodes ill. Good point about the reply-to, t

Couple of useful tests

ve no mercy. Craig Jackson

Re: Top level domain test -- somewhat OT

Craig Jackson wrote: Hi, Our small business never receives mail from top level domains other than com,net,org,mil,edu,gov,and us -- except spam. Additionally, we never receive email with links containing other level domains -- except spam. The logic is that we are small and do no business

Top level domain test -- somewhat OT

many false positives. 1) What do the enclosing {} mean? 2) What is the ?If you would point to a tutorial that covers this I would be grateful. I have checked a few beginner regex sites and even read most of the regex book, but don't remember this particular syntax. Thanks, Craig Jackson

Re: Rules meaning and example?

Ryan L. Sun wrote: HI, Where can I find SpamAssassin rules' meaning and examples? Some rules are easy to understand from its name, while others are not easy to figure out what's the rule stands for. If there are some examples for a specific rule, that would be great. Thank you. man Mail::Spam

Re: false positives and negatives

Bayes in SA. We use Spamcop (in Exim) but I disable all of the DNS tests in SA. I think those SA DNS are actually very good and may try them. Until now I have been concerned with Network traffic. Good luck, Craig Jackson

[OT] Re: a question for exiscan and exim users

ion = ${if <{$message_size}{200k}{1}{0}} spam = mail:true/defer_ok warn message = X-Cheetah-Report: $spam_report condition = ${if ! def:h_X-Cheetah-Spam:} condition = ${if <{$message_size}{200k}{1}{0}} spam = mail:true/defer_ok Thanks Craig Jackson

Re: whitelist

Craig Jackson wrote: Where I can find docs for local.cf and usaer_templates rules and tests. For instance, I have added some whitelist entries like this, whitelist_from_rcvd [EMAIL PROTECTED]google.com which is not working. The spam score is 5.0/5.0 so it is still tagged. Thanks

Turn off AWL

I'd like to turn off AWL. I remember there used to be a switch in SA to do this but it's not there any more. I start spamd with -x -L Thanks, Craig Jackson

whitelist

Where I can find docs for local.cf and usaer_templates rules and tests. For instance, I have added some whitelist entries like this, whitelist_from_rcvd [EMAIL PROTECTED]google.com which is not working. The spam score is 5.0/5.0 so it is still tagged. Thanks, Craig Jackson

Adjusting the AWL value

Hi, I'd like to change/reset-to-zero the autowhite list value for a sender. I read the man page (Mail::Spamassassin::Autowhitelist) but don't comprehend the syntax. Can someone give me a hint? Thanks, Craig Jackson