RE: sa-compile error centos 7

I've seen this, caused by a CPAN install which leaves stuff like this in .bashrc: export PERL_LOCAL_LIB_ROOT="$PERL_LOCAL_LIB_ROOT:/root/perl5"; export PERL_MB_OPT="--install_base /root/perl5"; export PERL_MM_OPT="INSTALL_BASE=/root/perl5"; export PERL5LIB="/root/perl5/lib/perl5:$PERL5LIB"; expo

RE: Big problems with senders who use Microsoft Bigfish (a.k.a. FrontBridge)

http://www.spamhaus.org/query/ip/10.10.114.156 10.10.114.156 is not listed in the SBL 10.10.114.156 is not listed in the PBL 10.10.114.156 is not listed in the XBL Cheers, Phil -- Phil Randal Infrastructure Engineer Hoople Ltd | Thorn Office Centre | Hereford HR2 6JT Tel: 01432 260415 | Email:

RE: installing on CentOS 6.4

pyzor and perl-Razor-Agent are in epel. Cheers, Phil -Original Message- From: Jari Fredriksson [mailto:ja...@iki.fi] Sent: 10 May 2013 17:22 To: SpamAssassin Users Subject: OT: installing on CentOS 6.4 I'm installaling latest CentOS, and would like to have SA in that too. But to my di

RE: custom rule help

Try /\:_Stands_in_a_Pristine_West_Coast_Beachside_Security_Village/ Cheers, Phil -- Phil Randal | Infrastructure Engineer NHS Herefordshire & Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260

RE: INVALID_MSGID hitting valid emails

010 13:55 To: users@spamassassin.apache.org Subject: Re: INVALID_MSGID hitting valid emails On 9/22/10 8:05 AM, Randal, Phil wrote: > > Since a rule update on or around September 21^st , we've been getting > lots of hits of INVALID_MSGID. > > Investigation reveals nothing

INVALID_MSGID hitting valid emails

Since a rule update on or around September 21st, we've been getting lots of hits of INVALID_MSGID. Investigation reveals nothing wrong with the Message-ID in the vast majority of cases. Can anyone shed any light on this? Cheers, Phil -- Phil Randal | Networks Engineer NHS Herefo

RE: Upgrading to SpamAssassin 3.3

ed google and it seems that I'm not the first to have this problem but I can't seem to find a solution. Have any of you run into this problem? Thanks -Original Message- From: Randal, Phil [mailto:pran...@herefordshire.gov.uk] Sent: Wednesday, March 17, 2010 11:46 AM To: Kaleb

RE: Upgrading to SpamAssassin 3.3

3.3.0 works fine on CentOS 5.4, but 3.3.1 is due out imminently (in the next week or two), so I'd hold back for that. Read the release notes carefully and ensure that 3.3.x's prerequisites are installed. If you have a test VM you can install on, use it. I tested on a CentOS 5.4 VM on my home PC

RE: SpamAssassin.cache.db problem

You should have tried the MailScanner mailing list. stop MailScanner, rm /var/spool/MailScanner/incoming/SpamAssassin.cache.db, and start MailScanner. More importantly, you need to update spamassassin and MailScanner to more current versions. MailScanner 4.58.9 is over 3 years old, and well out

RE: 90_2tld.cf / / 90_3tld.cf

There's an extraneous linebreak or two in there: # SA > 3.3.0 if (version >= 3.003000) Cheers, Phil -- Phil Randal | Networks Engineer NHS Herefordshire & Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel:

RE: Is spamming legal in the UK ?

Yes and no. The official line is here: http://www.ico.gov.uk/what_we_cover/privacy_and_electronic_communications.aspx Cheers, Phil -- Phil Randal | Networks Engineer NHS Herefordshire & Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Ro

RE: Constant Contact

Tara Natanson wrote: > On Fri, Oct 16, 2009 at 12:49 PM, Adam Katz > wrote: >> Does anybody here know anything about the legitimacy of Constant >> Contact ? > > > Hello, > > I work for Constant Contact. We take reports of spam very seriously. >

{Spam?} RE: The www[variations]continue....

John Hardin wrote: > On Thu, 2009-07-16 at 11:47 +0100, rich...@buzzhost.co.uk wrote: >> Don't you just love them :-) >> >> Love Making Tipps -- Tips for Better And Greater >> sex.www[dot]nu26[dot]com > > http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/ 20_uri_obfu_ws.cf

RE: Short URL provider list?

There's a list of 164 short url services here: http://www.untiny.me/ Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: pran...@herefordsh

RE: constantcontact.com

Aaron Wolfe wrote: > On Fri, Jul 3, 2009 at 5:06 AM, Justin Mason wrote: >> I've heard that they are diligent about terminating abusive clients. >> Are you reporting these spams to them? >> >> --j. >> > > From what I've seen, most of the traffic from them probably doesn't > qualify as spam by t

RE: new spam image with random body message

Anthony Peacock wrote: > Paweł Tęcza wrote: >> Anthony Peacock pisze: >>> Hi, >>> >>> Paweł Tęcza wrote: >> Hi Anthony, Please show us your addition tests, of course :D >>> Unless you are a UK Higher Education organisation you won't be able >>> to use RCVD_IN_JANET_DUL. >> >> Wha

RE: more mainsleeze spam

Cedric Knight wrote: > (b) are from UK-based registered companies and ostensibly directed to > other businesses in the UK. Many are for worthless sales training > webinars - I don't know if they teach more people how to send lots of > spam email. An anonymous benefactor posts a useful monthly li

RE: more mainsleeze spam

We're seeing increasing amounts of that here. I too think that it is sold-on "marketing lists". Some of the spams mention "partner organisations" in their excuse for spamming disclaimer at the bottom of the email. I once had an interesting email discussion with a spammer who'd bought a mailing

RE: New kind of spam

uri DODGY_SPACES_URI /http\:\/\/cid-.{1,20}\.spaces\.live\.com\// Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: pran...@herefordshi

RE: spam count going down?

Bowie Bailey wrote: > Matus UHLAR - fantomas wrote: >> >> I have noticed that... the count of spam processed by SA didn't >> notificably (oh damn is this the right word? it's deep night here) >> change, but number of conections rejected at SMTP level decreased by >> 60-70%. > > Noticeably... :)

RE: Individual SURBL lists to be shut down on public nameservers February 28, 2009. Use multi.

A grep -r -i of your rules directories is the way to go. SA 3.2.5 uses multi. Unless you've put in your own custom rules you should be OK. Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rot

RE: html experts: empty

It hist an awful lot of ham here. Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: pran...@herefordshire.gov.uk Any opinion express

RE: updates.spamassassin.org 2ndaries not updating (was re dsbl)

I've just successfully sa-updated. Thanks guys. Phil -- Phil Randal Networks Engineer Herefordshire Council Hereford, UK -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: 26 September 2008 15:05 To: Ned Slider Cc: [EMAIL PROTECTED]; users@spamassassin.apache.or

RE: Important info for iXhash users

Typo in your example config: bodyCTYME_IXHASH eval:ixhashtest('ctyme.ixhash.net') describeCYTME_IXHASH iXhash found @ ctyme.ixhash.net tflags CYTME_IXHASH net # adjust score as you seem fit score CYTME_IXHASH 0.1 CTYME and CYTME, oops. Phil -- Phil Randal

RE: dsbl.org down for good

Updates are still at version 694708 for 3.2.5. Cheers, Phil -- Phil Randal Networks Engineer Herefordshire Council Hereford, UK -Original Message- From: Daryl C. W. O'Shea [mailto:[EMAIL PROTECTED] Sent: 26 September 2008 02:25 To: users@spamassassin.apache.org Subject: Re: dsbl.org d

RE: Erroneous doubled letters in subject

I should make clear that PR_TD_NOWRAP does hit some ham here, so perhaps it would be better named __PR_TD_NOWRAP. Over the last week here, the figures are mxo: PR_TD_NOWRAP_BAT1094, no fps PR_TD_NOWRAP only324, over 300 ham mx1: PR_TD_NOWRAP_BAT1236, no fps PR_TD_NOWRAP only27

RE: using RHEL / CentOS / Fedora perl?

Andrew Hearn wrote: > Justin Mason wrote: >> have you seen this? >> >> http://blog.vipul.net/2008/08/24/redhat-perl-what-a-tragedy/ >> >> That bug in Red Hat perl will almost definitely slow down >> SpamAssassin, too, I would say. Can anyone verify? >> >> --j. >> > > This fixed it for me on

RE: using RHEL / CentOS / Fedora perl?

Jason Bertoch wrote: > However, Centos 5.2 32-bit and perl 5.8.8 chokes: > > time perl perltest.pl > .. > real0m4.312s > user0m4.272s > sys 0m0.036s As does CentOS 5.2 64-bit and perl 5.8.8: # time perl perltest.pl

RE: e greeting exe link

uri MY_EXECUTABLE_URI /^(?:https?|ftp):\/\/[^\s?]{1,80}\/[^\s?]{1,80}\.(?:exe|scr|dll|pif|vbs| wsh|cmd|bat)$/i describe MY_EXECUTABLE_URILinks to an executable file score MY_EXECUTABLE_URI3.00 Mind the linewrap. Phil -- Phil Randal Networks Engineer Herefordshire Council Heref

RE: more help on whitelist_from_rcvd

efordshire Council Hereford, UK -Original Message- From: Skip [mailto:[EMAIL PROTECTED] Sent: 11 August 2008 17:47 To: Randal, Phil Cc: SpamAssassin Users List Subject: Re: more help on whitelist_from_rcvd Awesome. The DKIM module works for that message, but I can't get it to acce

RE: more help on whitelist_from_rcvd

whitelist_from_dkim might be a better way to go: http://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Plugin_D KIM.html Cheers, Phil -- Phil Randal Networks Engineer Herefordshire Council Hereford, UK -Original Message- From: Skip [mailto:[EMAIL PROTECTED] Sent: 11 August

RE: List of Banks often spoofed in Phishing scams

Joseph Brennan said: > Many banks also send mail from third-party servers. Bank of America sends from > customercenter.com and par3.com. American Express sends from aexp.com (which is > theirs) and cheetahmail.com. Some send from bigfoot. It's only personal bank > account information-- why kee

RE: Lots Of SPAM

I use these rules. Score as you see fit. Mind the linebreaks... body HC_GIRL/\bnice girl that would like to chat.{1,16}Email me at \ .{1,32}\.info.{1,120}\bpic(ture)?s\b/ describe HC_GIRLGirl with pics scam scoreHC_GIRL5 body HC_GIRL2 /I am (?:using|wri

RE: "Nice girl like to chat" spam

body NICE_GIRL_03 /Email me at .{,74} only, because I am writing not from my personal email\./ Would do nicely. No need to be too clever here. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Kris Deugau [mailto:[EMAIL

{Spam?} RE: "Nice girl like to chat" spam

Unfortunately she changes the .info domain as often as she changes her knickers. :-p Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Michael Hutchinson [mailto:[EMAIL PROTECTED] > Sent: 18 February 2008 20:10 > To: users@s

RE: "Nice girl like to chat" spam

This rule should be resistant to FPs: body HC_GIRL/\bnice girl that would like to chat.{1,16}Email me at \ .{1,32}\.info.{1,120}\bpic(ture)?s\b/ describe HC_GIRLGirl with pics scam scoreHC_GIRL5 Mind the linebreak :-) Cheers, Phil -- Phil Randal Network Engineer

RE: Meta rule

try meta WEBTENT_LB LONGWORDS && (BAYES_50 || BAYES_60 || BAYES_80 || BAYES_95 || BAYES_99) Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Robert Fitzpatrick [mailto:[EMAIL PROTECTED] > Sent: 06 February 2008 15:09 > To:

RE: 3.2.3 to 3.2.4

Yes, That should be fine. Don't forget to run sa-update after installing. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Bubuk Gabrok [mailto:[EMAIL PROTECTED] > Sent: 29 January 2008 12:18 > To: users@spamassassin.apach

RE: Mismatched URLs revisited

Unfortunately, people who should know better (e.g. McAfee) do this all the time. There'd have to be a huge whitelist of safe URLs to make this workable. We use MailScanner, which has this sort of phishing detection built in, flagging suspicious links. Cheers, Phil -- Phil Randal Network Eng

RE: Mondo bayes_toks - millions of entries

Matt Kettler wrote: > If you want to increase token lifespan, you'd increase > bayes_expiry_max_db_size so that more tokens are kept at expire time. And what, pray tell, are reasonable values for this and / or a reasonable oldest token age? Just wondering how to optimise the number of Bayes to

RE: bug 5589 patching

I'd wait for SA 3.2.4's release. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: ram [mailto:[EMAIL PROTECTED] > Sent: 14 November 2007 10:39 > To: users@spamassassin.apache.org > Subject: bug 5589 patching > > http://issu

RE: Custom rules working, but not sa-updates

e Rules Dir = /etc/mail/spamassassin > SpamAssassin Local Rules Dir = > SpamAssassin Local State Dir = /var/lib/spamassassin > SpamAssassin Default Rules Dir = > > > > Randal, Phil wrote: > > > > Right, and what does the > > > > MailScanner -

RE: Custom rules working, but not sa-updates

_org/10_mis > c.cf [24215] > dbg: plugin: fixed relative path: > /var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv > ance_fee.cf > [24215] dbg: config: using > "/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_ad > vance_fee.cf" > for included file >

RE: Custom rules working, but not sa-updates

Rob, that could be a MailScanner config problem. You don't say which version of MailScanner, alas. In /etc/MailScanner/MailScanner.conf check the "Spamassassin Local State Dir" line. Mine reads: SpamAssassin Local State Dir = # /var/lib/spamassassin Cheers, Phil -- Phil Randal Network Enginee

RE: sa-update

Yes, That's correct. And the problem is, exactly? Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Obantec Support [mailto:[EMAIL PROTECTED] > Sent: 29 October 2007 17:08 > To: users@spamassassin.apache.org > Subject: sa-u

RE: Help figuring our why SA is taking like 1.5 minutes to filter...

First off, Do an sa-update -D as soon as possible. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK From: Joey [mailto:[EMAIL PROTECTED] Sent: 25 October 2007 14:24 To: users@spamassassin.

RE: Disabling speciffic RBLs

You'll want score __RCVD_IN_ZEN 0.0 score RCVD_IN_SBL 0.0 score RCVD_IN_XBL 0.0 score RCVD_IN_PBL 0.0 score URIBL_SBL 0.0 Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent:

RE: Bit OT but it's about SPAM

Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Bart Schaefer [mailto:[EMAIL PROTECTED] > Sent: 18 October 2007 15:14 > To: users@spamassassin.apache.org > Subject: Re: Bit OT but it's about SPAM >

RE: Bit OT but it's about SPAM

Hyperbole? Well, let's take a look at the figures on my mail relay boxes, for the last 17 days: mx0: total 2,680,671, ham 134,313 (5% of incoming). 92% of incoming rejected at the MTA. Mx0: total 1,868,788, ham 110,510 (5.9% of incoming). 91% of incoming rejected at the MTA. Cheers, Phil

RE: Delays in message processing

Do an sa-update without delay. The rulesets were updated yesterday and the completewhois rules removed. They were causing DNS timeouts. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Roman Serbski [mailto:[EMAIL PROTECTED]

RE: OT - massive newsletter

Kris Deugau wrote: > Ralf Hildebrandt wrote: >> * Randal, Phil <[EMAIL PROTECTED]>: >>> If you don't want to annoy a lot of people your spamming (oops, >>> newsletter sending) software needs to deal with NDRs back from >>> recipient's domains a

RE: OT - massive newsletter

If you don't want to annoy a lot of people your spamming (oops, newsletter sending) software needs to deal with NDRs back from recipient's domains and either put their subscription on hold after a small number of failures or automatically cancel them. There's nothing worse than mailing lists which

RE: spam and virus

Dean, Check out MailScanner - http://www.mailscanner.info Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Dean Clapper [mailto:[EMAIL PROTECTED] > Sent: 14 September 2007 14:39 > To: users@spamassassin.apache.org > Subject

RE: disable spamhaus rbl?

You almost got it right! Try score __RCVD_IN_ZEN 0.0 score RCVD_IN_SBL 0.0 score RCVD_IN_XBL 0.0 score RCVD_IN_PBL 0.0 score URIBL_SBL 0.0 Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Fletcher Mattox [mailto:[EMAIL PROT

RE: what happened after 3.1.8?

The fix is in 3.2.3. Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Jean-Paul Natola [mailto:[EMAIL PROTECTED] > Sent: 13 August 2007 14:49 > Cc: users@spamassassin.apache.org > Subject: RE: what happened after 3.1.8? > > > > --

RE: Error after compiling rules

My guess is that you have copies of the sare rules in both /var/lib/spamassassin/3.002001/ and /etc/mail/spamassassin. Clear them out from the latter. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Bowie Bailey [mailto:[EM

RE: Error after compiling rules

Do you have re2c installed? Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Bowie Bailey [mailto:[EMAIL PROTECTED] > Sent: 07 August 2007 15:16 > To: Spamassassin List (E-mail) > Subject: Error after compiling rules > > Af

RE: ANNOUNCE: Apache SpamAssassin 3.2.2 available

Hmmm, Can't find a mirror carrying it, not even apache.org! Phil -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Justin Mason Sent: 25 July 2007 14:10 To: users@spamassassin.apache.org; [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: ANNOUNCE: Apache SpamA

RE: Setting up a body rule.

A uri rule would make more sense. You're going to match xyzabc.com with that rule, too, so think carefully. Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Diptanjan [mailto:[EMAIL PROTECTED] > Sent: 21 June 2007 13:40 > To: users@

RE: These are getting through SA...

Bill, The problem is that Botnet uses Net::DNS::Resolver's default retry and timeout values, which are way too high. Spamassassin's DnsResolver.pm uses these values: udp_timeout:3 tcp_timeout:3 retrans:0 retry:1 try export RES_OPTIONS="udp_timeout:3 tcp_timeout:3 retrans:0 retry:1"

RE: "make test" dnsbl tests sporadically fail

Possibly related to http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5511 as discussed in the "DNS tests getting aborted" thread? Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK From: Rosenbaum, Larry M.

RE: 3.2.1 install failure

This has been covered on the list already. Try building at as a non-root user. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Chris [mailto:[EMAIL PROTECTED] > Sent: 13 June 2007 15:46 > To: users@spamassassin.apache.org

RE: These are getting through SA...

What happens if Botnet is patched to use Mail::SpamAssassin::DnsResolver instead of Net::DNS::Resolver? I'm musuing about Net::DNS::Resolver's default timeouts and retries... Phil (probably barking up the wrong tree) -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Ori

RE: These are getting through SA...

Bill, I was getting this sort of symptom without using Botnet. It's almost as if something's deadlocking somewhere in SA (until the timeout kicks in). Phil -Original Message- From: Bill Landry [mailto:[EMAIL PROTECTED] Sent: 12 June 2007 22:47 To: users@spamassassin.apache.org Subject:

RE: These are getting through SA...

Well caught, Mark! I'd come to similar conclusions even without digging into the code when I saw DNS-related strangeness when I was testing SA 3.2.0 a few weeks back. I'll second your request that SA process all results it has collected on timeout, instead of discarding them. Cheers, Phil

RE: How to decrease the bayes database size

bayes_seen just grows like topsy. All you need to do is delete it and let SA recreate it. Stop spamd / MailScanner / whatever. check permissions on bayes_seen rm bayes_seen restart do an sa-learn to make sure it still works (if it doesn't, reset permissions on the newly created bayes_seen). C

RE: www.uribl.com

www.rulesemporium.com isn't happy either :-( Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Ken A [mailto:[EMAIL PROTECTED] > Sent: 06 June 2007 18:48 > To: users@spamassassin.apache.org > Subject: Re: www.uribl.com > > R

RE: sa-compile

Check out Justin Mason's talk at MAAWG: http://taint.org/2007/06/05/153724a.html Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: diptanjan [mailto:[EMAIL PROTECTED] > Sent: 07 June 2007 10:27 > To: users@spamassassin.apa

RE: So much spam

We saw an incoming spam increase by 50% yesterday, and are getting similar levels today. A bunch of new spambots? Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Sujit Acharyya-Choudhury [mailto:[EMAIL PROTECTED] > Sent: 2

RE: Disable logging - Whitelist functionality

Justin's already put an example in the wiki: http://wiki.apache.org/spamassassin/ShortcircuitingRuleset Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Duane Hill [mailto:[EMAIL PROTECTED] > Sent: 24 May 2007 11:41 > To:

RE: sa-compile and SARE

Doc Schneider wrote: > > I just now committed fixed rule sets for SARE. > > Please give it an hour or so to become available. And also let me know > if you're still seeing these issues. > > Thanks! Can you tell us which SARE rules were amended? Just so we can do a sanity check. Cheers, Phil

RE: Disabling some DNS tests

ZEN includes CBL, so you've got a duplicate test there. CBL isn't tested in spamassassin (except via XBL). You'll need something like this to stop the spamhaus tests: score __RCVD_IN_ZEN 0.0 score RCVD_IN_SBL 0.0 score RCVD_IN_XBL 0.0 score RCVD_IN_PBL 0.0 score URIBL_SBL 0.0 Cheers, Phil --

RE: notice diff between using 3.1.8 and 3.2.0 ?

Under MailScanner on an old Fedora Core 1 box here 3.2.0 ran at half the speed of 3.1.8. I'm not sure what was causing it. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Luis Hernán Otegui [mailto:[EMAIL PROTECTED] > Sent

RE: Re: Any drawbacks of cron-scheduled bayesian leanring?

Arik Raffael Funke wrote: > Matthias Haegele wrote: >> Arik Raffael Funke schrieb: >>> I.e. what about expiring tags, etc. Sa-learn would routinely >>> re-encounter 5 year-old spam... >> >> Q: Would it be useful (regarding cpu and i/o performance) if only >> learned messages (copied from a maildir

RE: New spam method?

See my reply in the thread "How are cllassified this?" for how to catch these in SA. We're getting thousands of them here. Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Gene Heskett [mailto:[EMAIL PROTECTED] > Sent: 03 April 2007

RE: How are cllassified this?

A large score for ImageShack uris, not a small one, would seem to be in order, otherwise a good proportion end up in people's mailboxes. Unfortunately ImageShack's "report abuse" link on their webpage ( http://reg.imageshack.us/content.php?page=email&q=abuse ) isn't responding, so I guess I'm not

RE: Anyone else seeing a large rise in spam?

Botnets on the rise, apparently. See http://isc.sans.org/diary.html?storyid=2495 Phil -Original Message- From: Nigel Frankcom [mailto:[EMAIL PROTECTED] Sent: 24 March 2007 12:39 To: SpamAssassin Subject: Anyone else seeing a large rise in spam? Hi All, As per the title, I'm seeing a p

RE: NOTICE: SpamAssassin 3.2.0-rc1 PRERELEASE available

Those "(STILL TODO ;)" bits are the things which would convince me to test it. Without them I'm rather in the dark as to what has changed, what needs to be changed in my config, and what areas need careful attention. So when are the betas of the "(STILL TODO ;)"'s coming out? :-) Cheers, Phil

RE: Tool for validating sender address as spam-fighting technique?

You're going to get bounce blowback anyhow, whether you use SAV or not. Using Recipient Address Validation (or any kind of reject at the gateway level without first scanning for spam) would also increase blowback if junk mail is being sent via relays. No Address validation at the gateway - this s

RE: Tool for validating sender address as spam-fighting technique?

smf-sav is one sendmail milter which does this: http://smfs.sourceforge.net/smf-sav.html SAV v1.3.0 - console utility for e-Mail Sender Address Verification (also at http://smfs.sf.net/ ) Cheers, Phil -Original Message- From: Kelly Jones [mailto:[EMAIL PROTECTED] Sent: 10 March 20

RE: NOTICE: SpamAssassin 3.2.0-pre2 PRERELEASE available

127/8 is now always trusted. Remove that "trusted_networks 127/8" line and all should be well. Phil -Original Message- From: Jim Knuth [mailto:[EMAIL PROTECTED] Sent: 07 March 2007 00:12 To: Justin Mason Cc: dev@spamassassin.apache.org; users@spamassassin.apache.org Subject: Re: NOTICE:

RE: FuzzyOcr image spam not getting scored

pam not getting scored > > On Fri, 23 Feb 2007, Randal, Phil wrote: > > > I caught these by adding > > > > corpo > > > > to my FuzzyOCR.words file. > > > > But you should also br running a bunch of SARE rules, and sa-updated > > rulesets

RE: FuzzyOcr image spam not getting scored

I caught these by adding corpo to my FuzzyOCR.words file. But you should also br running a bunch of SARE rules, and sa-updated rulesets. Content analysis details: (21.7 points, 5.0 required) pts rule name description -- -

RE: Another stupid spammer

That made the sa-rule to catch these spams rather trivial to produce :-) Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Ben Wylie [mailto:[EMAIL PROTECTED] > Sent: 22 February 2007 01:59 > To: SpamAssassin Users List > Sub

RE: experience with borderware

Stefan Jakobs [mailto:[EMAIL PROTECTED] said: > What are good and what are bad recipients. Is a client of > borderware a good > recipient and all other bad? And is a bounce with an attached > SPAM-mail also > SPAM? If you ask them at borderware, they 'll answer that you > have to buy > thei

RE: experience with borderware

That borderware page gives lots of clues about your IP: "BSN Data [Email]: Clean: 38% Viruses:0% Spam: 52% Malformed Messages: 1% Suspicious: 9% Good Recipients:12.07% Bad Recipients: 87.93%" "* The ip 141.58.231.9 has sent a high ratio of spam (52 percent). *

RE: milter-sender from SnertSoft.com

You could try smf-sav: http://smfs.sourceforge.net/smf-sav.html Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Matthew Bickerton [mailto:[EMAIL PROTECTED] > Sent: 30 January 2007 11:37 > To: users@spamassassin.apache.or

RE: blacklisting

Try spamassassin --lint (two dashes, not one). Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK _ From: D Ivago [mailto:[EMAIL PROTECTED] Sent: 19 January 2007 09:26 To: users@spamassassin.apache.org Subject: Re: blacklisting *EVERY* time

RE: box trapper filter and wildcard question

I also submit any such "challenge/response" spams I receive at home to spamcop. Eventually someone will get a clue. Phil -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Friday, January 19, 2007 5:06 AM To: dan li Cc: users@spamassassin.apache.org Subject: Re: box t

RE: Percentage of email that is spam after filtering?

Oh, this is a difficult one to measure. As an admin, I cannot judge whether some emails are what I call "subscriber spam" (special offers mailing lists) or unsolicited. Neither has a legitimate place in this organization, so I'm not too bothered, but it does mean that my figures cannot be precise.

RE: RBL checks and -lastexternal

If you're using sendmail, you can blacklist using cn.countries.nerd.dk at the sendmail level, and use See http://blue-labs.org/howto/access_hints.php for tips on how to use sendmail's access file to whitelist senders (and recipients) who might otherwise be blocked by rbls. Connect:your.friend.cn

RE: Greylisting

RFC 1123 (http://www.ietf.org/rfc/rfc1123.txt) 5.3.1.1 Sending Strategy The general model of a sender-SMTP is one or more processes that periodically attempt to transmit outgoing mail. In a typical system, the program that composes a message has some

RE: Not all Stock Spam is bad

With FuzzyOCR 3.4.2 and using ocrad, $ocrad -s5 -i $pfile should catch them, according to a post from "decoder" on the FuzzyOCR list. And it seems to here. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: DAve [mailto:[E

RE: Greylisting

Not to mention that the mail queues are backing up for over half an hour because of all the spam in the first place :-p Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: uxbod [mailto:[EMAIL PROTECTED] > Sent: 21 November 2006 15:13 >

RE: Where to submit SARE rule patches?

Peter H. Lemieux wrote: > Karl Auer wrote: >> On Tue, 2006-11-14 at 09:58 -0500, Peter H. Lemieux wrote: >>> < body __HAS_PENETRATION /\bpenetration\b/i >> >> I think a lot of rules would be better for losing the word >> boundaries. Very few of the worst "four letter words",

RE: Autolearn threshold

It's explained here:   http://wiki.apache.org/spamassassin/AutolearningNotWorking   "Finally, SpamAssassin requires at least 3 points from the header and 3 points from the body, to auto-learn as spam. If either section contributes fewer points, the message will not be auto-learned."   Cheers

RE: do imageinfo and fuzzyocr plugins' results overlap?

the user's mailbox, there's no need for FuzzyOcr to do anything. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of snowcrash+spamassassin &g

RE: do imageinfo and fuzzyocr plugins' results overlap?

I use both here. In FuzzyOcr.cf, set focr_autodisable_score to the threshold you require. That way it only scans images if the SA score so far is under the specified threshold. It's a lot "cheaper" to bump up the score using ImageInfo than to do a couple of OCR scans. Cheers, Phil -- Phil Rand

RE: Well, that didn't take very bloody long

But most of us aren't clever enough with Perl RE's to construct the rule to go with it. So where's the rule to match, folks? Cheers, Phil -Original Message- From: Tony Finch [mailto:[EMAIL PROTECTED] On Behalf Of Tony Finch Sent: Friday, November 10, 2006 9:49 PM To: Steve Lake Cc: user

RE: OT : MailScanner

Yes you can, and many of us MailScanner users do run two or more virus scanners.   You should join the MailScanner user's mailing list, we're are a helpful lot.   Phil   From: Suhas (QualiSpace) [mailto:[EMAIL PROTECTED] Sent: Saturday, November 11, 2006 10:17 AM To: users@sp

  1   2   >