Negative lookbehind in URIs?

is in SA (maybe a plugin)? -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/| System Admin - UT CompSci =--+--- All syllogisms contain three lines | sha...@shanew.ne

7.ly?

Has anyone seen the 7.ly URL shortening service or had any interaction with them? I don't see any clear way to report abuse, but before a create a URI blacklist, I thought I'd see if maybe they're legitimate. -- Public key #7BBC68D9 at| Shan

RCVD_IN_MSPIKE_H2 score update

looked at ruleqa, but all I see are results for set 0, while DNSBL rules only have scores for set 1 or 3. -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin -

RCVD_IN_SORBS_SPAM and google IPs

now, because it seems to be pushing legit emails close (if not over) the local threshold. -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/| System Admin - UT CompSci =--+-

sa-update (1755260?) leads to dead spamd

d(19) not ready, wait max 300.0 secs Aug 6 06:53:34 wanamaker spamd[17580]: prefork: child 1334: entering state 2 Aug 6 06:53:34 wanamaker spamd[17580]: prefork: new lowest idle kid: none -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/

Unique identifier in debug output

g the code, but I thought I'd ask in case I just missed something. -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/| System Admin - UT CompSci =--+--- All

"Received" headers for rules?

y were Received headers (which explained why it hit). Is there anywhere, other than the code, where I can see what all headers might be checked as part of a "Recevied =~" rule? -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/|

DCC whitelisting

has List-ID as a specific header. I know I could create SA rules that would "counteract" the DCC score, but that seems kludgy (and doesn't help if there are meta rules that trigger off of DCC). -- Public key #7BBC68D9 at| Sh

Scroring and SPF questions

e sender's. Or perhaps I'm missing some smarter way to deal with these situations. -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT CompSci =--+-

DATE_IN_(PAST|FUTURE) false positives

bin.com/GsmzaUSs P.S. I have other example of both FUTURE and PAST that look like false positives to me, but this particular example has the most straightforward Received chain, and I know it's totally legit. -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit

Which milter do you prefer?

ust SpamAssassin stuff, so might be overkill. And I suspect there are a bunch more out there (though a lot of these projects seem to have stalled or died over time). What are your favorite (not spamass-milter) options for plugging spamassassin into a milter? -- Public key #7BBC68D9 at |

Re: OFF TOPIC: A cartoon spam joke.

wrote: OFF TOPIC: I was amazed to see this cartoon, since so many people probably won't get the joke! http://bizarro.com/comics/november-15-2014/ - Mark -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/|

Re: SpamAssassin Not Performing Task

08, and the single response to that matches my two guesses. Finally, have I missed something or is X-Spam-Bar not at all a standard SA header? -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/|

Re: Learing spam/ham with Pine

from my inbox to a "spam" file. I'm not looking for something that's site-wide. This is just for my account. Thanks for any help. --pat-- -- Public key #7BBC68D9 at| Shane Williams http://

Re: scantime=249.2; scantime=175.0; scantime=190.9; scantime=68.9

it stays around 4% for user and 3-4% for system. Link for a ham - http://pastebin.com/k55D79TL spam - http://pastebin.com/28qW2nga Though I hate to do it I've temporally shut down SA, hopefully some of you have a solution. Thanks Chris -- Public key #7BBC68D9 at|

Re: spamass-milter -r doesn't work for me

On Mon, 8 Feb 2010, Andreas Haumer wrote: Hi! Am 08.02.2010 21:47, schrieb Shane Williams: I think you're both misunderstanding what the -b option does, and reading the man page, I can see how it could be more explicit. In any case, the -b option is used to send rejected mail to a spec

Re: spamass-milter -r doesn't work for me

scribed a few days ago on this list (see <http://marc.info/?l=spamassassin-users&m=126537672706931&w=2>) I still don't know how to solve this problem and I haven't got an answer to my mail, though. KR - andreas -- Public key #7BBC68D9 at|

Re: Adding remote-ip/ESMTPID/X-Envelope to logging output?

mailer=local, pri=33624, dsn=2.0.0, stat=Sent Thoughts? -Dan Mahoney -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogi

Re: Unsubscribe

overs "email whose primary purpose is advertising or promoting a commercial product or service", the SA mailing list isn't even address by the law, much less in violation of it. -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/|

Re: faked bouncebacks. what the?

other words, backscatter is a by-product of spamming, while bounced spam is the product itself. -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+---

Re: possible idea for backscatter problem

a valid bounce? In which case, such email could be scored higher, rather than just sent to a bounce folder, which is really what many of us would rather be doing with these messages? -- Public key #7BBC68D9 at| Shane Williams ht

Re: [spamassassin] Re: [spamassassin] Re: How to report 120,000 spams

various actions, including rejection. -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogisms contain three lines | [EMAIL PROTE

Re: spamassassin sendmail virtualusers and mail lists

e that the other's education goals lead to dangers too terrible to contemplate. --- 9 days until Benjamin Franklin's 302nd Birthday -- Public key #7BBC68D9 at| Shane

Re: How would you provide a 554 rejection notice for spam?

proxy? On Exchange? Would you use Sendmail? Postfix? Something else? -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogisms con

Re: migrating from clamav before mta to SA ClamAV plugin experiences

ance - rh -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogisms contain three lines | [EMAIL PROTECTED] Therefore thi

Re: My Newly Expanded DNS Blacklist - Who wants to try it?

the conversation for me. Good luck. -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogisms contain three lines | [EMAIL PROTE

Re: My Newly Expanded DNS Blacklist - Who wants to try it?

On Sun, 17 Jun 2007, Marc Perkel wrote: Shane Williams wrote: Here's the "failed for the last 4 hours" message... - Transcript of session follows - ... while talking to mx.junkemailfilter.com.: <<< 550-REJECTED - 70.112.27.10 is blacklisted at hostk

Re: My Newly Expanded DNS Blacklist - Who wants to try it?

On Sun, 17 Jun 2007, Marc Perkel wrote: Daryl C. W. O'Shea wrote: Shane Williams wrote: > On Sat, 16 Jun 2007, Marc Perkel wrote: > > > Using my new ideas here's my raw blacklist file. It has about 80k IP > > addresses and is updated ever

Re: My Newly Expanded DNS Blacklist - Who wants to try it?

orking you should, for some time, accept mail that it would drop, filter it to a special place, and then visually inspect for ham/spam ratio. I don't see any better method for gathering hard data on it's success rate. -- Public key #7BBC68D9 at|

Re: Innovative Host Blacklisting Idea

On Fri, 15 Jun 2007, Marc Perkel wrote: Shane Williams wrote: Unless you have some other reliable source of statistics regarding how various entities choose MX records, I'd expect blacklisting this way is likely to garner significant false positives. It appears that some spammers hi

Re: Innovative Host Blacklisting Idea

7;d expect blacklisting this way is likely to garner significant false positives. -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogi

Re: [OT] RDJ RulesDuJour Updates dont lint

On Wed, 13 Jun 2007, Raymond Dijkxhoorn wrote: coupon1+coupon2+style1+style2;document.cookie="NSC_DOSP="+add+";path=/";window.location=window.location.href;window.focus(); [18730] warn: config: failed to parse line, skipping:

Re: Spamass-Milter Help

or so Any ideas would be great! -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogisms contain three lines | [

Re: Rules always triggering.

ing Postfix. The sign-up message for this list got those rules triggered. (_Everything_ triggers them.) This is just a guess, but is it possible that OS X's use of carriage returns is making the message look to spamassassin as if it's a single line of text? -- Public key #7BBC68D9 at

Re: How to examine a system and determine the mail delivery agent.

ow the MTA, you can probably check the config files. For example, grep for the string "Mlocal" in /etc/mail/sendmail.cf and if it makes reference to procmail, the MDA is procmail. -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/

Re: DCC worth it?

ow that we used to compile without razor support locally. I think I'll take my own advice and not reply on things that I don't know the in-depth details of. -- Public key #7BBC68D9 at|

Re: Why is there so much hype behind Image spam

On Sun, 16 Jul 2006, John Andersen wrote: On Sunday 16 July 2006 06:35 am, Shane Williams wrote: I never realized SpamAssassin was started back in 1994.  What version number was that?  I'd say it was definitely ahead of its time, since I almost never got email spam until around 1996-1997

Re: Why is there so much hype behind Image spam

d...). In fact, I'm starting to wonder if the whole spam scourge occured because of SpamAssassin. ^_^ -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+

Re: sender-valid SMTP callbacks (Re: Does "tuxorama.com" sound fa miliar to anyone?)

't come up with anything yet) -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogisms contain three lines | [

Re: error during report: Insecure dependency

Razor Agents 2.67, Pyzor 0.4.0 and DCC 1.2.69. Any ideas/comments are most welcome. BR, Matías. -- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+-

Re: Webmail and IP rules

, hits=6.8 required=5.0 tests=BAYES_00=-2.599, HELO_DYNAMIC_DHCP=1.248,HELO_DYNAMIC_HCC=3.741, HELO_DYNAMIC_IPADDR=4.4,NO_REAL_NAME=0.007 autolearn=no version=3.0.1 -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin -

Webmail and IP rules

eader, it should just ignore that header altogether (or ignore it in relation to certain rules). -- Public key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--

Spamcop reporting and insecure dependency

c key #7BBC68D9 at| Shane Williams http://pgp.mit.edu/| System Admin - UT iSchool =--+--- All syllogisms contain three lines | [EMAIL PROTECTED] Therefore this