On Aug 14, 2012, at 14 9:03 AM, dar...@chaosreigns.com wrote:
> Have you looked at that link?
yes
> Are you running a local non-forwarding,
> caching DNS server?
I have a Plesk installation and am using the DNS server as provided by Plesk.
The nameservers are ns1.smallgod.net, ns2.smallgod.
I highly recommend it. But again, not the low MX. You'd be playing
with fire there.
--
Jon Trulson | A828 C19D A087 F20B DFED
mailto:j...@radscan.com | 67C9 6F32 31AB E647 B345
"What can be asserted without evidence, can also be dismissed
w
from a bot-net vs. a 'lone wolf'?
--
"I drank what?" | Jon Trulson
-Socrates | mailto:j...@radscan.com
| A828 C19D A087 F20B DFED
| 67C9 6F32 31AB E647 B345
On Fri, 9 Jan 2009, John Hardin wrote:
On Fri, 9 Jan 2009, Jon Trulson wrote:
On Wed, 7 Jan 2009, Anthony Peacock wrote:
I zeroed the scores for all of these rules about a year ago. They were
only hitting on SPAM emails and pushing them into the FN range.
I second that - habeas
about a year ago. They were only
hitting on SPAM emails and pushing them into the FN range.
I second that - habeas stopped being useful a long time ago (IMO of
course :). Just zero them out.
--
Happy cheese in fear | Jon Trulson
against oppressor, rebel!| mai
?
Best regards - Jon
Theo Van Dinter wrote:
On Fri, Dec 05, 2008 at 12:53:20AM +0100, Jon Essen-Moller wrote:
the mail was in HTML, so it's basically unreadable. text please.
I did get out of it:
"I wish to check a specific mail address and see if many mails are
classified as spam that a
Hi,
Thanks for quick answer!
I wish to check a specific mail address and see if many mails are
classified as spam that are sent to that address.
/jon
Tenka AB
Jon Essen-Moller
Djurgardsbrunnsvagen 54
115 25 Stockholm
Sweden
Direct +46 (0)70 779 33 03
Office +46 (0)8 32 25 06
Fax +46 (0)8 55
bayes_toks.expire26661
bayes_toks.expire31998
bayes_toks.expire4343
Best regards - Jon
cut your server load.
I'm also providing a public server to harvest fake MX info to help build my
blacklist. You can use this host for your fake high numbered MX. (Not a low
numbered MX though)
Que the spamvertising...
mail.yourdomain.com 10
tarbaby.junkemailfilter.
ail: Program failure (-25) of "/usr/bin/spamassassin"
procmail: Rescue of unfiltered data succeeded
From [EMAIL PROTECTED] Fri May 30 09:09:45 2008
Subject: RE: Customize the email list for you - 498485
Folder: /var/mail/jon1332
sometime
ttachments with email? I also use MailWatch on the frontend.
Info:
# spamassassin -V
SpamAssassin version 3.2.3
running on Perl version 5.8.8
# uname -a
Linux mail 2.6.18-5-686 #1 SMP Wed Sep 26 17:54:59 UTC 2007 i686 GNU/Linux
# cat /etc/debian_version
4.0
Thanks
--------
I just received around 2000 bounce messages from various servers
rejecting messages (supposedly) coming from my email address.
This has happened to me before but not on this scale. Any ideas on how
to tell if this is just a joe job or if someone has actually used my
server as a spam sending p
Justin Mason wrote:
sorry Marc, you weren't the first to come up with that idea.
He didn't say that he was, just that he was the first to raise it on the
list.
Jon
o the count there.
Has anyone done anything like this?
Any suggestions on how to do it?
Any other way to get the count?
man mailstats
--
Happy cheese in fear | Jon Trulson
against oppressor, rebel!| mailto:[EMAIL PROTECTED]
Brocolli, hostage. -Unknown| #include
ure!) spam.
I definitely love my spamassassins :)
--
Happy cheese in fear | Jon Trulson
against oppressor, rebel!| mailto:[EMAIL PROTECTED]
Brocolli, hostage. -Unknown| #include
On Wed, 12 Sep 2007, Luis Hernán Otegui wrote:
2007/9/12, Jon Trulson <[EMAIL PROTECTED]>:
On Wed, 12 Sep 2007, Jason Bertoch wrote:
On Tuesday, September 11, 2007 7:07 PM Marc Perkel wrote:
The details are a little to complex for this forum ...
OK - had quite a few trolls here wh
there any chance we can get a moderator on this, please? This is clearly not
a SA topic and I'm weary of insults, flames, and advertisements from Marc.
FWIW, +1
--
Jon Trulson
mailto:[EMAIL PROTECTED]
#include
"No Kill I" -Horta
yway, it is unwise to pin pass/fail on RBL's. They can be
wrong, or go away.
--
Jon Trulson
mailto:[EMAIL PROTECTED]
#include
"No Kill I" -Horta
would speculate that was the reason your messages started tagging as spam.
One such list I remember was ordb.org.
Yes, ordb. Knew it was something like that. It may be true that
they posted something to a list - unfortunately, I was not
subscribed.
Nonetheless, we won't do that ag
A eventually before
entering our internal mail system. Works great.
--
Jon Trulson
mailto:[EMAIL PROTECTED]
#include
"No Kill I" -Horta
e find it much more productive to have our MTA (Exim) check whether the
incoming email address is valid and reject invalid ones at the RCPT stage.
Then you don't need to pass them to SpamAssassin at all.
Further details on request---there have been other similar threads as well.
Jon
of local host.
>
Sushma,
The answer is probably, but please tell us which mail transport agent (Exim?
Sendmail? something else?) you are using.
Then someone on the list, possibly even me :), will be able to help you.
Jon
n with further details of your setup if you're not sure how to do
this, and I'm sure someone will explain.
BTW Doing this is a big win for us---we reject around half of all incoming
mail because the recipient is invalid. This saves SA an awful lot of work.
Jon
ve had one bounce from them---an email from a mailing list that we run.
I alerted the recipient, and he sorted it out at his end. I hope.
Jon
ores -100, the default
from the rules in /var/lib/sa.
Jon
> -Original Message-
> From: Steve Ingraham [mailto:[EMAIL PROTECTED]
>
> I will add the "score SARE_ADULT2 BODY 10.0" line to local.cf
Steve,
I've just checked for you. It's
score SARE_ADULT2 10.0
Ignore my earlier suggestion about adding an underscore.
Jon
ve a score of 10.0, but as you can
> see this email only received a score of 3.5 on that rule.
Steve,
I think the syntax is
score SARE_ADULT2_BODY 8.0
If that's what you've actually got I suggest you run spamassassin -D --lint
and look for any errors/problems in your setup.
Jon
ill do
what you want.
http://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Conf.txt
Jon
.
>
> If you are not running sa-update you are only updating a
> small section of your rules.
I believe there a way to use sa-update to get the SARE rules from
saupdates.openprotect.com.
Jon
)
and in v310.pre i have
loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
but still spam regarding penis enlargement (some) are getting through.
any other ideas ?
On mið, 2007-01-17 at 11:32 +, Martin.Hepworth wrote:
> Jon
>
> Yes this functionality has been built in since SA ve
Is it possible to have SA find URL in a mail and lookup the ipaddress
for the URL and check if that ipaddress is listed in some rbl zone and
score acordingly.
Example, I reveice lot of spam containing URL like
http://www.thesillyguy.info or thenopers.info and these sites all
resolve to the same ip
Loren Wilton <[EMAIL PROTECTED]> wrote:
> Taking a look at that and offering my opinions:
Thanks for taking the time to have a look at it. Apart from inline
images though, the other points either don't apply to our emails, or
don't appear to be contributing to the SpamAssassin score.
> In all hon
Noel Jones <[EMAIL PROTECTED]> wrote:
> So why not find which rules are triggered by your message
I already did - see my original post at the start of this thread.
> Can't be too hard, spammers do it all the time.
That's my point - why should I have to behave like a spammer in order
to avoid get
"John D. Hardin" <[EMAIL PROTECTED]> wrote:
> ...sign up with a service like Habeas or Bonded Sender and put their
> headers in your messages?
I suppose we could do. Does anyone know how much that costs?
It still seems wrong to me though that SpamAssassin is penalising mail
that doesn't look like
nd beside the point of my
question, which is: should I change our emails, and if so, in what
way - or do SpamAssassin's default settings as provided on
updates.spamassassin.org need changing?
Cheers
Jon
x27; mailbox
from approximately 3,000 a day to more like 10, so it's being very
helpful in that respect ;-)
Cheers
Jon
Jon Armitage <[EMAIL PROTECTED]> wrote:
> > I solved the problem by simply making my filter not bother passing the
> > message to spamc at all if it was over 200k.
>
> Yes, as I understand sa-exim, messages over 250K (the default in my case)
> should not be passed to S
> -Original Message-
> From: Jon Ribbens [mailto:[EMAIL PROTECTED]
>
> I solved the problem by simply making my filter not bother passing the
> message to spamc at all if it was over 200k.
>
Yes, as I understand sa-exim, messages over 250K (the default in my case)
sh
agree. I think it is more likely to be my config than a
bug in local_scan(), but you never know. I have posted to the sa-exim list.
Jon
Sietse van Zanen <[EMAIL PROTECTED]> wrote:
> > I have found the related Exim message...
> >
> > 2006-12-19 11:47:02 1GwdM9-0006Pd-35 local_scan() function timed out -
> > message temporarily rejected (size 320896)
>
> > ... so maybe I've posted this to the wrong list. Sorry.
>
>Unfortuna
I have found the related Exim message...
2006-12-19 11:47:02 1GwdM9-0006Pd-35 local_scan() function timed out -
message temporarily rejected (size 320896)
... so maybe I've posted this to the wrong list. Sorry.
Jon
returned different
SAmaxbody is left at the default (250KB) in sa-exim.conf.
I cannot see any corresponding entries from spamd in the Exim log.
Do I have a configuration issue, or is something else amiss?
Jon
Jon Armitage
Web Infrastructure Support
365 Media Group
to block by country.
I’ve tried adding “.cn” and “.jp”, etc. but many ‘invaders’ come in by IP
address alone.
Any suggestions?
Thanks!
Jon
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.5.432 / Virus Database: 268.15.16/582 - Release Date: 12
day's
stock onslaught. Without hard data available at the moment,
I'd guess we are seeing a less than a third of what we were
getting 24hrs ago.
--
Jon Trulson
mailto:[EMAIL PROTECTED]
#include
"No Kill I" -Horta
’ instead of a 1, so I’m
assuming I should I test for ‘314’, ‘3l4’ and ‘3|4’
_
From: Chris Santerre [mailto:[EMAIL PROTECTED]
Sent: Wednesday, November 29, 2006 7:49 AM
To: 'Jon D. Slater'; users@spamassassin.apache.org
Subject: RE: This is so obvious...
Yeah this slipp
99) is
still catching every one for me. There may be something else
going wrong with your setup - no idea what offhand though,
sorry.
--
Jon Trulson
mailto:[EMAIL PROTECTED]
#include
"No Kill I" -Horta
ee the previous threads
about bumping up the scores for bayes 95 and 99. YMMV of
course, but it has been *extremely* successful at work and at
home in the few years we've been using spamassassin.
Expect them to adapt. It's their job after all. Use a
0.0001 3.5 3.5
I would second that definitely. I only upped the bayes 95 and
99 rules to the pre3.0 scores - didn't mess with the others.
--
Jon Trulson
mailto:[EMAIL PROTECTED]
#include
"No Kill I" -Horta
aught with bayes 99
as well :)
I guess YMMV of course, but it's worked well here w/o the need
to come up with custom rules every time some new spammer trick
rolls around.
--
Jon Trulson
mailto:[EMAIL PROTECTED]
#include
"No Kill I" -Horta
27;s
definitely on the rise from where I sit.
At home, I've also seen an increase - approx 150 a
day from around 80-90 previously.
--
Jon Trulson
mailto:[EMAIL PROTECTED]
#include
"No Kill I" -Horta
Hi All,
I’m using:
70_sare_adult.cf
70_sare_specific.cf
70_sare_stocks.cf
What rule set do you suggest for the spoof Paypal and eBay
spam (and assorted fake links to assorted banks and credit unions).
Thanks!
Jon
I have SA 3.1.4 and FuzzyOCR 2.3b installed…I keep
getting these messages in the log whenever I test any gif and png samples…
[2006-10-03 11:24:33] Unexpected error in pipe to external
programs.
Please check that all helper programs are installed and in the correc
On Fri, 29 Sep 2006, Rob McEwen (PowerView Systems) wrote:
Jon Trulson said:
Hehe, that is an old spammer trick... Our secondary MX is
pretty much 100% spam.
I implemented greylisting on the secondary which reduced spam
through it by about 99% :) The secondary does not do spam
scanning, it&#
ndary which reduced spam
through it by about 99% :) The secondary does not do spam
scanning, it's simply store and forward. Greylisting really
helps in these cases.
--
Jon Trulson
mailto:[EMAIL PROTECTED] http://radscan.com/~jon
#include
"No Kill I" -Horta
-Original Message-
From: Brian Moses [mailto:[EMAIL PROTECTED]
Sent: Mon 6/5/2006 9:55 PM
To: users@spamassassin.apache.org
Cc:
Subject:Pyzor Issues
Everyone,
I'm pretty new to Spamassassin, so if I ask a dumb question please bear
with me a bit.
I'm trying to set
-Original Message-
From: Martin Hepworth [mailto:[EMAIL PROTECTED]
Sent: Thursday, May 04, 2006 8:43 AM
To: users@spamassassin.apache.org
Subject: RE: home owner
Jean-Paul
If can put the full email on a web page (headers and all)...
I can run it over my system, and let you know which
SpamAssassin 3.1.0 on FreeBSD 4. It's working great for me 99% of the
time, but there is one common type of spam that it lets through. I
can't seem to train it to ignore it, and what's worse, it has begun
hitting BAYES_00 and AWL so it's autolearning all these bad messages as
ham! Argh!
Th
gt; Sent: Monday, February 27, 2006 11:44 AM
> To: 'Jon D. Slater'; users@spamassassin.apache.org
> Subject: RE: prefs directories with "^M" in the name
>
> Jon,
>
> Typically, it's the difference between UNIX and Windows. If you edited a
> conf file i
seems to be running fine.
When I cd into /usr/share/spamassassin and do an ls, I see:
members.prefs
members.prefs^M (control M, not ^ and M)
If I remove the ^M version, after some period of time, they come back.
What is creating these? And how do I fix it?
Thanks!
Jon
Hej Magnus,
Tack för snabbt svar. Följfråga dock. Vet du ifall "sa-learn --ham
$file" påverkar awl poängsättning?
/jon
Magnus Holmgren said the following on 2006-02-22 12:10:
Jon Essen-Moller skrev:
Shouldn't addresses in the AWL result in points b
learn=ham
version=3.0.1
X-Spam-Report:
* 0.4 AWL AWL: From: address is in the auto white-list
--
Shouldn't addresses in the AWL result in points being subtracted?
Does anyone know what could be wrong?
/jon
. However, I don't know which other MTAs would be
able to do this, or even if this blanket approach would suit you.
Jon
eing a lot of them as well, and now with other URLs than
geocities.
They all have one thing in common - they look like normal forwarded mail
with an URL in it. Not easy to stay ahead of this kind of trash.
--
Jon Kvebaek <[EMAIL PROTECTED]>
Mobil: +47 992 19 829
Unanimiter et constanter Oslo
Quoting Matt Kettler <[EMAIL PROTECTED]>:
> Jon Kvebaek wrote:
> > Hi,
> > we get quite a few messages that have no Received: headers. These
> seem
> > to cause ALL_TRUSTED to fire (with a negative score of course),
> which
> > isn't exactly what I w
Hi,
we get quite a few messages that have no Received: headers. These seem
to cause ALL_TRUSTED to fire (with a negative score of course), which
isn't exactly what I want. Any idea on how I should deal with this
correctly?
--
Jon Kvebaek <[EMAIL PROTECTED]>
Mobil: +47 992 19 829
Un
re Exim to call SA twice.
-Jon
iting for a complaint
from one of our users.
Jon Armitage
) if anyone needs it.
Jon
t received mail that makes spamassassin do this in debug
mode:
debug: received-header: unknown format: from 15.65.160.36 for EQR.44.k..[snip]
try spamassassin -D on one of your and see what it says.
--
Jon Kvebaek <[EMAIL PROTECTED]>
Mobil: +47 992 19 829
Unanimiter et constanter Oslo
Thomas Deliduka wrote:
Ah, Gotcha. So, how can I simply empty out the AWL? I want it reverted to
nothing so I can start fresh.
rm $HOME/.spamassassin/auto-whitelist*
I'm getting a lot of spams slipping thru the net lately. They hit
BAYES_99 and nothing else, usually, because they contain almost no
content other than a URL:
http://uk.geocities.com/Robt_Bright/?M0v=Make.your.day_enjoyable.without
URIDNSBL is apparently skipping that due to it being geocitie
> > Jon Dossey wrote:
> > > I'm sure a lot of us have a similar setup, linux/bsd mx gateways
> > > (running SA) relaying mail to Exchange, and Outlook clients. I'm
just
> > > curious how everyone handles learning?
> > >
> > > It seem
out into a useable format that
sa-learn will understand? Saving messages out of Outlook (for me
anyway) into a txt file removes all the internet headers.
So how else do you handle getting your messages back out of
exchange/outlook, and sa-learn'ed?
.jon
olver. This gives SA a lot of control over queries, but doesn't
take
> > advantage of things like /etc/hosts, and only uses your primary DNS.
>
> ahhh ok
> anyway i can hack it??
> *goes off to read CPAN*...
You'd "hack" SA instead of just installing bind, and letting it just
cache the response?
Talk about wagging the dog ...
.jon
>
Or, if you wanted to watch, just skip the -D (daemonize option). It'll
just sit in the foreground and you can watch it do its thing.
.jon
ange server on the LAN.
Don't forget to re-make the mailertable file:
[EMAIL PROTECTED] mail]# makemap hash mailertable.db < mailertable
Hopefully I understood your problem correctly :)
Thanks,
Jon Dossey
DELTA HEALTH GROUP
Can anyone recommend a good logfile analyzer for Spamassassin?
because I know that some users puts HAM in their ReportSpam folder
Best Regards - Jon
fault setup, running spamd/spamass-milter, SA 3.0.1, RedHat
FC2, and sendmail 8.13.1. I haven't checked in a while (since I updated SA,
the milter, and sendmail), but I have a good feeling most of my processing time
was spent waiting for DNS responses.
Any input into my situation would be appreciated. I'd love to be able to get
down to 2-3 seconds, basically cutting my processing time in half!
.jon
t sort of problem?
Yours faithfully,
Valery
--
Jon Trulsonmailto:[EMAIL PROTECTED]
ID: 1A9A2B09, FP: C23F328A721264E7 B6188192EC733962
PGP keys at http://radscan.com/~jon/PGPKeys.txt
#include
"I am Nomad." -Nomad
they are being trapped...
--
Jon Trulsonmailto:[EMAIL PROTECTED]
ID: 1A9A2B09, FP: C23F328A721264E7 B6188192EC733962
PGP keys at http://radscan.com/~jon/PGPKeys.txt
#include
"I am Nomad." -Nomad
> From: Thomas Cameron [mailto:[EMAIL PROTECTED]
> To: spamassassin-users
> Subject: RE: [SOLVED] Re: Suddenly load average of 15-18???
>
> On Thu, 2005-05-12 at 11:46 -0500, Jon Dossey wrote:
> > > From: Thomas Cameron [mailto:[EMAIL PROTECTED]
> > > Sent
t; problems went away. It's chuffing along happily now.
>
> Memory leak, maybe?
What kind of hardware? Are you scanning zips? I had to just start
blocking zip attachments all together until these virii settle down a
bit.
.jon
) examined).
ham messages:
Learned from 2667 message(s) (3288 message(s) examined).
But nham and nspam is still well under 200 each. What can I do?
Thanks,
Jon
+ -1.096 + 0.703 = 4.607 which is exactly what I got!!!
Gosh it's all working just as it says on the tin 8)
Very sorry for wasting your time.
Cheers
Jon Gerdes
>>> "Loren Wilton" <[EMAIL PROTECTED]> 04/08/05 11:57am >>>
BAYES_40 will slightly l
--
Note that I've scored up RCVD_IN_BL_SPAMCOP_NET to 5.0.
I know that the other local scores work OK becuause I can sent GTUBE in for a
pretty large score
Cheers
Jon Gerdes
*** Disclaimer ***
The information contained in this E-Mail and any subsequent correspondence may
be subj
I made a few custom rules for SA
I did a rawbody test for /jpg/i
Also another rawbody for /gif/i
And then gave these two point values just above the value of spam like I
have mine set at 8 and gave each of these a 30. The emails that I have been
getting in were just a weblink and some text. My
> On Mon, 7 Mar 2005, Jon Dossey wrote:
>
> > > Sounds like a spamass-milter bug... have you checked their site:
> > > http://savannah.nongnu.org/bugs/?group=spamass-milt
> >
> > I don't think it's a milter problem, because the messages are b
> Jon Dossey wrote:
> >> -Original Message-----
> >> Jon Dossey wrote:
> >>>> Still having problems.
> >>>>
> >>>> Redhat FC2, sendmail 8.31.1, spamassassin 3.0.1 (with
> >>>> spamass-milter).
> >>>&
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: Friday, March 04, 2005 5:04 PM
> To: users@spamassassin.apache.org
> Subject: RE: Spamassassin Tagging
>
> Jon Dossey wrote:
> >> Still having problems.
> >>
> &g
ow my self at the mery of the SA mailing list :)
Ok, I changed the required_hits to required_score (even though it
shouldn't matter) and its still not tagging the messages. What am I
missing? Is there any other place this could be defined (or not
defined)?
Thanks,
.jon
r-Version: SpamAssassin 3.0.1 (2004-10-22) on
I throw my self at the mery of the SA mailing list :)
Thanks,
.jon
:51 AM 3/3/2005, Jon McGreevy wrote:
>I am running SA 2.64 and trying to create a rule so that peoples email
>inside the organization will not be marked as spam
>
>I am trying to use the header option and it is not working
>
>Here is what I have so far
>
> From =~ /[
IP won't really work since most people webmail from all over
-Original Message-
From: Martin Hepworth [mailto:[EMAIL PROTECTED]
Sent: Thursday, March 03, 2005 10:09 AM
To: [EMAIL PROTECTED]
Cc: users@spamassassin.apache.org
Subject: Re: Problem with a Rule
Jon
doing it this way
PROTECTED]/I
Alternatively
whitelist_from [EMAIL PROTECTED]
This is generally not considered a good idea tho, because these headers
are very easy to forge. (viruses tend to masquarade as
internal->internal mail)
R
-Original Message-
From: Jon McGreevy [mailto:[EMAIL PROTECTED]
Sent:
all kinds of options like From =~ /[EMAIL PROTECTED]/i
And variations of the above but nothing is working
If I change that to rawbody it works, but the reason I am trying to use the
>From field so that it will not trigger off of the To field. Any help would
be greatly appreciated
Jon McGreevy
configuration is parsed by spamassassin, god only knows how a mistake
like that would end up assigned to some int somewhere.
I'll take it out and see how it goes. Thanks guys.
.jon
> At 11:25 AM 3/2/2005, Jon Dossey wrote:
> >I apologize, I was in a rush. System is redhat fc2, sendmail 8.13.1,
> >spamassassin 3.0.1 and spamass-milter 0.2.0 (updated for SA 3.0,
haven't
> >switched to 0.3.0 yet).
> >
> >Here's (most
being tagged. The
only thing that seemed different about it was that it was flagged as
"Urgent".
Thanks,
.jon
> -Original Message-
> From: Evan Platt [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, March 02, 2005 10:19 AM
> To: [EMAIL PROTECTED]
> Subject: Re: Why w
_CAPS,
X_MSMAIL_PRIORITY_HIGH,X_PRIORITY_HIGH autolearn=no
version=3.0.1
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on
dhgsrv17.deltahealthgroup.com
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 02 Mar 2005 13:54:46.0084 (UTC)
FILETIME=[648D6840:01C51F2F]
Thanks,
.jon
1 - 100 of 142 matches
Mail list logo
