RE: Custom rules regex help

I have created 2 rules because almost everything from zcsend is Spam. Rules are: # zcsend Spam header CGK_ZCSEND_1 All =~ /\@zcsend\.net/ score CGK_ZCSEND_1 2.5 # zcsend Spam header CGK_ZCSEND_2 From =~ /\@zcsend\.net/ score CGK_ZCSEND_2 2.5 and extract from maillog is: /roo

Custom rules regex help

I have created 2 rules because almost everything from zcsend is Spam. Rules are: # zcsend Spam header CGK_ZCSEND_1 All =~ /\@zcsend\.net/ score CGK_ZCSEND_1 2.5 # zcsend Spam header CGK_ZCSEND_2 From =~ /\@zcsend\.net/ score CGK_ZCSEND_2 2.5 and extract from maillog is: /roo

Advice on how to block via a mail domain in maillog

I have a lot of Spam getting into our mail servers where the common thread is cloudapp /root/weeklymail/Thumaillog:Aug 27 11:58:15 plesk3 qmail-scanner-queue.pl: qmail-scanner[12013]: Clear:RC:0(216.170.115.184):SA:0(0.9/4.0): 4.409458 6225 comp...@franking-expert.co.uk u...@domain.com Saving_b

RE: rule for repeated tracking numbers

> -Original Message- > From: Philip Prindeville [mailto:philipp_s...@redfish-solutions.com] > Sent: 07 August 2014 06:01 > To: Paul Stead > Cc: users@spamassassin.apache.org > Subject: Re: rule for repeated tracking numbers > > > On Aug 6, 2014, at 1:23 PM, Paul Stead wrote: > > Uh. the

Similar pattern of emails Comparing Prices

I have had a fair number of VERY similar Spam emails that are all about comparing prices. I have put a number in a pastebin below. They all seem to be originating from Fasthosts in UK which I cannot really blacklist in entirety. Can anyone suggest how to block it with a Spamassassin rule?

RE: Spamassassin Rule Scores

l 2014 at 11:12, emailitis.com wrote: > Can someone tell me how we can find out the Spamassassin rule scores? https://spamassassin.apache.org/tests_3_3_x.html Antony -- I want to build a machine that will be proud of me. - Danny Hillis, creator of The

Spamassassin Rule Scores

Can someone tell me how we can find out the Spamassassin rule scores? Also, in the mailllog, I would like to see spamd show not just the tests, but the scores of each. At present we get just: spamd[7403]: spamd: result: Y 4 - DKIM_SIGNED,HTML_MESSAGE,MIME_HTML_ONLY,T_DKIM_INVALID,T_REMOTE_IMAGE

RE: custom rules header check please

/7/2013 10:40 AM, emailitis.com wrote: I am getting lots of Spam which shows on the maillog as: Nov 7 10:50:39 plesk3 qmail-scanner-queue.pl: qmail-scanner[6974]: Clear:RC:0(217.92.121.114):SA:1(5.9/5.0): 9.209114 16127 fr...@aexp.com <mailto:fr...@aexp.com> Or Nov 7 10:15:36

custom rules header check please

I am getting lots of Spam which shows on the maillog as: Nov 7 10:50:39 plesk3 qmail-scanner-queue.pl: qmail-scanner[6974]: Clear:RC:0(217.92.121.114):SA:1(5.9/5.0): 9.209114 16127 fr...@aexp.com Or Nov 7 10:15:36 plesk3 spamdyke[26254]: ALLOWED from: administrator+984

RE: Image spam

lto:jhar...@impsec.org] > Sent: 02 September 2013 08:01 > To: users@spamassassin.apache.org > Subject: Re: Image spam > > On Mon, 2 Sep 2013, emailitis.com wrote: > > Here's something else to look into: > > > /root/weeklymail/Sunmaillog:Aug 31 11:11:05 plesk3 spamd[11160]: >

Image spam

We are getting a lot of Spam getting through which is a remote image and for some reason is not being picked up by SA. I have put them below with all details, including the SA rules found and message details. For ease, the rules are all pasted below here also. Are there others who have seen

RE: Multiple embedded images rule

We too get a lot of these emails which are largely an image only. T_REMOTE_IMAGE comes up a lot - but it is not listed in http://spamassassin.apache.org/tests_3_3_x.html and the previous email suggests there is no score attached to it. I found somewhere before (cannot find it again) that if we

RE: sa-learn

Benny, Regarding: sa-learn --spam /var/qmail/mailnames/hosted-domain.com/user-1/Maildir/.Spam/cur thank you for the correction and the education.

sa-learn

I'm trying to get SA to do better manual training to make it better. We have autolearn turned on but some Spam gets through with low BAYES values and having clearly been incorrectly learnt in the past. Server-wide, we can only look at the maillog so not sure how, if we find a pattern of ema

RE: New rule for HTML spam, using comments?

"Now I just have to figure out my Bayes problem..." Amir, When you do work that out, please let us know. We get LOTS of Spam getting through and John said that it is the BAYES_00 which is causing the problem. Restarting training seems a bit extreme. We cannot monitor every hosted user, obvious

RE: Single images with random wording & general rules

7 To: users@spamassassin.apache.org Subject: Re: Single images with random wording & general rules On 17.06.13 11:52, emailitis.com wrote: >Autolearn is turned on. I don't think we allow users to train without >review - is there a way I can confirm? We have Plesk 10 and are using >SA throug

RE: Single images with random wording & general rules

Hardin [mailto:jhar...@impsec.org] Sent: 10 June 2013 14:24 To: users@spamassassin.apache.org Subject: Re: Single images with random wording & general rules On Mon, 10 Jun 2013, emailitis.com wrote: > I tried to send the source from one such email but it was rejected > with a Spam score

RE: Single images with random wording & general rules

Hardin [mailto:jhar...@impsec.org] Sent: 10 June 2013 14:24 To: users@spamassassin.apache.org Subject: Re: Single images with random wording & general rules On Mon, 10 Jun 2013, emailitis.com wrote: > I tried to send the source from one such email but it was rejected > with a Spam score

Single images with random wording & general rules

We are getting a lot of Spam which is an image with random words at the bottom. Is there a rule that someone has created which we can include to get rid of this. I tried to send the source from one such email but it was rejected with a Spam score of 13: Remote host said: 552 spam score (13