Malware Patrol SA Rules

2015-01-10 Thread David Flanigan
cannot think this would do good things for performance. Any experience, comments, etc? -- Kind Regards, David David Flanigan Mobile: +1.513.560.8231 E: d...@flanigan.net W: http://www.flanigan.net --

Re: Can not disable checks against dnsbl.ahbl.org

2015-01-09 Thread David Flanigan
Juan, You did the correct thing. Setting the score to zero will disable the rule. How are you running spamassassin (spamd, milter, MailScanner, procmail)? --- Kind Regards, David David Flanigan Mobile: +1.513.560.8231 E: d...@flanigan.net W: http://www.flanigan.net On 2015-01-09

Re: Honeypot email addresses

2015-01-08 Thread David Flanigan
thousands (or tens of thousands) SPAM message but only a couple hundred HAM messages? Kind Regards, David David Flanigan Mobile: +1.513.560.8231 E: daveflanigan.net W: http://www.flanigan.net On 2015-01-08 18:13, David B Funk wrote: > On Thu, 8 Jan 2015, Alex Regan wrote: > How about u

Re: Precleaning SA market spam from Mbox?

2006-12-27 Thread David Flanigan
users@spamassassin.apache.org Sent: Wed, 27 Dec 2006 16:13:43 -0500 Subject: Re: Precleaning SA market spam from Mbox? > David Flanigan wrote: > > Spam [WINDOWS-1252?]Guru�s: > > > > I have a question that I am hoping one of you may be able to answer. > > > > We run the latest v

Precleaning SA market spam from Mbox?

2006-12-27 Thread David Flanigan
Spam Guru’s: I have a question that I am hoping one of you may be able to answer. We run the latest version of SA running spamc/spamd with a global (not per user) config, and tag messages as spam for latter filtering by the mail client, as is appropriate. However, now we have some people (me

SA Checking user unknown e-mail?

2006-06-08 Thread David Flanigan
Hello oh’ gurus of Spamassassin: I have a, hopefully, quick question with regards to my implementation of Spamassassin. In a nutshell it appears that Spamassassin is taking the time and energy to check user- unknown e-mail. I am running Spamassassin 3.1.1 Attached is my sendmail log showin

Re: stock market spam

2006-05-03 Thread David Flanigan
On Wed, 3 May 2006 09:14:11 -0400, Thomas Deaton wrote > Is there any way to block this flood of html stock market spam? > > thanks > > Tom Deaton > Guilford County Information Services Tom, Assuming you are running SA - have you looked at the SARE community rules? The SARE_STOCKS rule was u

Re: why is that the same sendin server is seen differently by spam assassin

2006-05-02 Thread David Flanigan
On Tue, 2 May 2006 22:20:16 0200, Michael Monnerie wrote > On Dienstag, 2. Mai 2006 18:57 David Flanigan wrote: > > My secondary MX has only rudimentary anti-spam filtering, and I > > thought SA was assuming it was safe if passed by that server. > > It would be safer to t

RE: why is that the same sendin server is seen differently by spam assassin

2006-05-02 Thread David Flanigan
On Tue, 2 May 2006 10:15:56 -0700, Matthew.van.Eerde wrote > You'll get better results by analyzing the hosts that talked to your > secondary > MX. The only way to analyze them is to believe the Received: headers added > by > your secondary MX. They only way to analyze those headers is to mak

RE: why is that the same sendin server is seen differently by spam assassin

2006-05-02 Thread David Flanigan
On Tue, 2 May 2006 10:04:47 -0700, Matthew.van.Eerde wrote > David Flanigan wrote: > > Since a inordinate % of spam seems to go through my secondary MX, I have > > been > > treating it as being outside of my trusted_network > > "Trusted" means you trust it

Re: why is that the same sendin server is seen differently by spam assassin

2006-05-02 Thread David Flanigan
> > ALL_TRUSTED doesn't mean the host that handed you the mail is trusted. > It means *all* servers in the Received: chain are trusted. > > So if servers A and B are trusted, but C is not... > > A->B->You > would trigger all_trusted > C->B->You > would NOT trigger all_trusted > >

Re: SA & Razor problem - help requested

2006-04-29 Thread David Flanigan
Theo, Thanks for this. Now I feel stubid for bother the list. I have been running SA for some time, and didn't notice that change. My bad. Thanks for the quick reply! Dave On Sat, 29 Apr 2006 10:39:48 -0400, Theo Van Dinter wrote > On Sat, Apr 29, 2006 at 08:58:42AM -0400, David

SA & Razor problem - help requested

2006-04-29 Thread David Flanigan
Hello Spamasssins, I am having an odd problem, I was hoping for some insight from those more adept than I. I am trying to get Razor working with Spamassassin to little effect. To put it simply, SA never uses RAZOR, and I have never in thousands of messages (http://www.flanigan.net/spam) s