Re: MS-relayed spam

I started forwarding full headers and text to "ab...@outlook.com" and they blocked my IP. -Original Message- From: David Jones via users Sent: Tuesday, January 2, 2024 1:07 PM To: Charles Sprickman Cc: SA Mailing list Subject: Re: MS-relayed spam I would report this to

sa-update

Hello, I didn't get an update since 5 March (1908044). FreeBSD 12.4-RELEASE-p2 spamassassin 4.0.0_2 Mar 17 08:19:41.458 [41854] dbg: channel: metadata version = 1908044, from file /var/db/spamassassin/4.00/updates_spamassassin_org.cf Mar 17 08:19:41.471 [41854] dbg: dns: 0.0.4.updates.spam

Re: Help me waste spammers resources

;d like to share will all of you. On my main spam filtering servers I advertise authenticated login even though I don't actually have any authenticated users. Anyone who tries to authenticate is a spammer. I accept all passwords as good and we accept the email which is then added to my b

Re: Spam not stopped???

he problem. Ken On Wed, 15 Jun 2011, User for SpamAssassin Mail List wrote: Also this is my /etc/default/spamass-milter OPTIONS="-u nobody -i 127.0.0.1,209.102.124.20 -r 9 -M" What strikes me odd is that the message that was stopped the milter had its id set to "spamass-milte

Re: Spam not stopped???

Also this is my /etc/default/spamass-milter OPTIONS="-u nobody -i 127.0.0.1,209.102.124.20 -r 9 -M" What strikes me odd is that the message that was stopped the milter had its id set to "spamass-milter" Jun 15 06:27:31 mail spamd[981]: spamd: connection from localhost [127.0.0.1] at port 42

Re: Spam not stopped???

On Thu, 16 Jun 2011, Lawrence @ Rogers wrote: On 15/06/2011 11:13 PM, User for SpamAssassin Mail List wrote: Lawrence, Thanks for the responce. I know Spam Assassin doesn't stop it we use a spamassassin milter for sendmail to reject it. (We been doing this for years). Anyway he

Re: Spam not stopped???

s. Anyway I'm still looking for a clue why one is blocked and the other is not. Thanks, Ken On Wed, 15 Jun 2011, Lawrence @ Rogers wrote: On 15/06/2011 10:00 PM, User for SpamAssassin Mail List wrote: Hello, I have something I cannot explain. We blacklisted an email address for a

Spam not stopped???

]: p5FF86ld021067: to=, delay=00:00:03, xdelay=00:00:02, mailer=local, pri=31672, dsn=2.0.0, stat=Sent As you can see the use is in the black list but yet the mail was delivered. I checked other email that was over a score of "9" and the mail was rejected, but for some reason or another th

Pyzor Server

Hello, I don't keep constant eye on the mail server logs but did notice that pyzor was not working. I've ping the server that I've been using for years: # pyzor ping 82.94.255.100:24441 TimeoutError: And see it is not working. I did a "pyzor discover" and found a public server and did

RE: removing check for rulenames

>> I did reported to list.dnswl.org but there is no reporting tool for >> SenderScore >> > > Well, there is, but it has been notoriously difficult to find. > Although the rule names have changed with the release of 3.3.0, you > can find reporting information in the SA wiki. > > http://wiki.apa

RE: removing check for rulenames

> -2.0 RCVD_IN_RP_SAFERBL: Sender is in Return Path Safe (trusted >> relay) >> [Return Path SenderScore Safe List (formerly] >> > > Setting the score of any rule to 0 in local.cf, will disable it. > Although many people cho

removing check for rulenames

: Sender is in Return Path Safe (trusted relay) [Return Path SenderScore Safe List (formerly] Thanks with regards

DomainKeys.pm

Hi, After upgrading to 3.3.0. I began to get an error Jan 29 03:12:40.458 [9168] warn: plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/DomainKeys.pm in @INC (@INC contains: lib /usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8

RE: spamassassin-3.3.0 for Fedora/RHEL

> Of course. You have to remove everything from > /var/lib/spamassassin/3.003000 that you do not want to use. As an example, > that is what remains here: Thank you

RE: spamassassin-3.3.0 for Fedora/RHEL

>> So how do I stop using sare or openprotect? > > remove the rules? > remove the channels? > > I suppose you know if you use them or not, do you? Yes I am using it. Since the blog advise to stop using it, thus I am wondering how do I do so? I had remove the sa-update from my crontab. Do I need t

RE: spamassassin-3.3.0 for Fedora/RHEL

> http://wtogami.livejournal.com/33674.html > > If you use spamassassin on Fedora or RHEL5, please see my blog post for > RPM packages and distro-specific notes. * STOP USING SARE or OpenProtect. They died a long time ago. Some of their rules are dangerous or redundant. Many of the bette

RE: exclude domain from server-wide

>> >> I am running a qmail + simscan + spamassassin + clamav on a >> centos 5.3. >> >> Regards >> > there are many ways to do it... > > you could try > > @example.com > > in your > > /var/qmail/control/badmailfrom > > might work... depending on some factors... > > you could smtp reject above a

RE: exclude domain from server-wide

>> How do I exclude a domain from a server-wide envoirment? >> >> > with magic words ? *g > > describe your mail spamassassin server setup ( cause there are > thousend ways which it might be implemented at your side ), then you > might get an answer I am running a qmail + simscan + spamassassi

exclude domain from server-wide

Hi, How do I exclude a domain from a server-wide envoirment? regards

flooded with undetected spam

Hi, My inbox is flooded by some new spams. Any idea how do I block it? http://202.42.86.77/1.eml http://202.42.86.77/2.eml Best regards

Re: spamd and sendmail mailertable

Checking into this more I notice this happens on any forwarded email to another system. Spamassassin refuses to check it. Any Ideas? Thanks, Ken On Fri, 14 Mar 2008, User for SpamAssassin Mail List wrote: > > Hello, > > Were using sendmail and their feature mailertable fo

spamd and sendmail mailertable

Hello, Were using sendmail and their feature mailertable for forwarding certain domains to other mail servers. (using "somedomain.com esmtp:[mail.somedomain.com]") When an email comes in for one of these forwarded domains it will check our greylist, our clamav, but will not do a spamassass

Re: Is http://www.rulesemporium.com?

I have the same problem here: traceroute to www.rulesemporium.com (72.52.4.74), 30 hops max, 38 byte packets 1 roxanne.pcez.com (209.102.124.1) 0.179 ms 0.146 ms 0.143 ms 2 52.ATM5-0.GW9.POR3.ALTER.NET (157.130.180.65) 3.016 ms 3.190 ms 2.917 ms 3 0.so-4-3-0.XT2.POR3.ALTER.NET (152.63

picture spams

Hi, Will ImageInfo be able to detect and catch this picture spam soon? http://dreams.741.com/spam.gif Thanks

[EMAIL PROTECTED] strikes again

The original message was received at Tue, 14 Aug 2007 11:50:13 -0400 from localhost.localdomain [127.0.0.1] - The following addresses had permanent fatal errors - [EMAIL PROTECTED] (reason: 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)) (expanded

Public.pm

Hi List, Does anyone encounter this error and how do you fix it? Use of uninitialized value in string eq at /usr/lib/perl5/vendor_perl/5.8.8/Mail/DomainKeys/Key/Public.pm line 67, line 319. Thanks

Re: A rule for empty body and pdf attachment??

- My guess is that this is not the right "Logger.pm" file. Where do I find the correct file so I can make this work? And is that my only problem??? Thanks, Ken On Thu, 2 Aug 2007, User for SpamAssassin Mail List wrote: > > Hello, > > We are running a Debi

Re: A rule for empty body and pdf attachment??

Hello, We are running a Debian Sarge system here with spamassassin version Version: 3.0.3-2sarge1. I tried to put these plugins (ImageInfo and loadplugin) into my system and got the following errors when I restarted: Aug 2 12:

Re: pyzor problem.

On Mon, 30 Jul 2007, Gary V wrote: > >We noticed pyzor latency/timeouts last week and had to disable it. > > > >User for SpamAssassin Mail List wrote: > > > Hello, > > > > > > I've noticed a big jump in spam here and looking through logs it

pyzor problem.

Hello, I've noticed a big jump in spam here and looking through logs it looks like my system is not getting pyzor to respond. When I do a "spamassassin --lint -D" I show: debug: Pyzor is available: /usr/bin/pyzor debug: Pyzor: got response: 66.250.40.33:24441 TimeoutError: debug: Pyzor: could

error with 3.2.2

Hi, I just updated to 3.2.2. Encountered an error as follows: Jul 30 21:00:33 beyond spamd[20765]: dcc: check failed: failed to read header Jul 30 21:00:36 beyond spamd[20767]: dcc: check failed: util: setuid 0 to 508 failed! at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Util.pm line

Re: How would you provide a 554 rejection notice for spam?

dalchri wrote: I've recently put SpamAssassin in front of my Exchange server as an SMTP proxy. Our previous spam filter would provide a 554 rejection notice for anything that was identified as spam. This meant that any FP would be notified so that email would not get silently ignored. Although

Re: graphic spam

Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not working for me. [26559] dbg: config: read file /etc/mail/spamassassin/imagei

Re: graphic spam

Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not working for me. [26559] dbg: config: read file /etc/mail/spamassassin

Re: Please remove "[EMAIL PROTECTED]" from the list

He is bouncing emails. (See attachment.) Scroom and the camel he rode in on. I am getting the same thing

graphic spam

Hi, Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. regards LC

Routing messages marked as [Spam] to Maildir/.Spam

I apologize if this is a duplicate. I posted the original using Nabble, but there was an error message and not sure if it went through or not. Here goes: I am using Qmail-Scanner 1.25 and Spamassassin 3.1.8 which is the most recent available of the 3.1.x series to Gentoo users. Using qmail, v

Re: Bye for good FuzzyOCR

Spamassassin List schrieb: Spamassassin List schrieb: i just uninstalled FuzzyOCR from my system as it seems like its become out of fashion to send those spam images that FuzzyOCR can read and I noticed that I dont even need it to get the remaining imagespam above a score of 10. Thanks alot

Re: Bye for good FuzzyOCR

Spamassassin List schrieb: Spamassassin List schrieb: i just uninstalled FuzzyOCR from my system as it seems like its become out of fashion to send those spam images that FuzzyOCR can read and I noticed that I dont even need it to get the remaining imagespam above a score of 10. Thanks alot

Re: Bye for good FuzzyOCR

Spamassassin List schrieb: i just uninstalled FuzzyOCR from my system as it seems like its become out of fashion to send those spam images that FuzzyOCR can read and I noticed that I dont even need it to get the remaining imagespam above a score of 10. Thanks alot to the author, the plugin

Re: Bye for good FuzzyOCR

i just uninstalled FuzzyOCR from my system as it seems like its become out of fashion to send those spam images that FuzzyOCR can read and I noticed that I dont even need it to get the remaining imagespam above a score of 10. Thanks alot to the author, the plugin was great when imagespam was o

Re: Logging with Syslog

nt forward? Kris Deugau writes: sa-list wrote: Thanks! Instead of messing with the /etc/sysconfig/spamassassin file, I just commented out those lines. Any reason to keep this configuration, other than wanting more headaches in the future when I try to figure this out again? Well, like I said, /

Re: Logging with Syslog

Thanks! Instead of messing with the /etc/sysconfig/spamassassin file, I just commented out those lines. Any reason to keep this configuration, other than wanting more headaches in the future when I try to figure this out again? Kris Deugau writes: sa-list wrote: I can't seem to g

Logging with Syslog

I can't seem to get SA & Syslog to log messages to a log file other than maillog. I changed the spamassassin start up script to add "-s local5" to the spamd start up options. I modified syslog.conf to add local5 as an entity. I restarted syslog, courier and spamd. I still get logging messages

cannot install it on BSD

Hi guys, I cannot install spamassassin on FreeBSD. Does anyone experienced with this before? any advices will be appreciated. thx

Re: CentOS 5 with FuzzyOCR

Spamassassin List wrote: I am getting some errors when try to spamassassin -t < email.txt Subroutine FuzzyOcr::O_CREAT redefined at /usr/lib/perl5/5.8.8/Exporter.pm line 65. at /usr/lib/perl5/5.8.8/i386-linux-thread-multi/POSIX.pm line 19 Subroutine FuzzyOcr::O_EXCL redefined at /usr/lib/pe

Re: CentOS 5 with FuzzyOCR

Have you installed the programs that FuzzyOcr is calling? rpm -qa ocrad? Yes i have. [EMAIL PROTECTED] Spam]# rpm -qa ocrad ocrad-0.16

CentOS 5 with FuzzyOCR

Hi, I am getting some errors when try to spamassassin -t < email.txt Subroutine FuzzyOcr::O_CREAT redefined at /usr/lib/perl5/5.8.8/Exporter.pm line 65. at /usr/lib/perl5/5.8.8/i386-linux-thread-multi/POSIX.pm line 19 Subroutine FuzzyOcr::O_EXCL redefined at /usr/lib/perl5/5.8.8/Exporter.pm l

domainkey

Hi, spamassassin -D --lint shows that i am having some problem with domainkey [31077] warn: plugin: failed to parse plugin (from @INC): Can't locate Mail/DKIM.pm in @INC (@INC contains: lib /usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/per

Re: spam test

http://hege.li/howto/spam/spamassassin.html Remove everything from Botnet.cf RULES-section and set it up this way: Does the above line mean to remove from the # THE RULES? regards

Re: No RBL checks

On 3/12/07, Spamassassin List <[EMAIL PROTECTED]> wrote: > i think my spamassassin is performing no RBL checks, i disabled that > once, reset that change but it seems that the RBL are still not > working Have you remove -L from the setup of SA? i disbaled it from th

Re: No RBL checks

i think my spamassassin is performing no RBL checks, i disabled that once, reset that change but it seems that the RBL are still not working Have you remove -L from the setup of SA?

Re: FuzzyOCR: pamthreshold

Use patches from here >http://www200.pair.com/mecham/spam/image_spam2.html to solve your problem. thanks. but is the site down? unable to access to it.

Re: Online game spam

On Thu, 8 Feb 2007, Spamassassin List wrote: But the header says:- X-Spam-Status: No, score=2.5 required=5.0 tests=DATE_IN_FUTURE_03_06, HTML_MESSAGE,MIME_HTML_ONLY autolearn=disabled version=3.1.7 I see no network tests (e.g. RCVD_IN_XBL) - do your logs show *any* messages hitting on

Re: Online game spam

On Thu, 8 Feb 2007, Spamassassin List wrote: But the header says:- X-Spam-Status: No, score=2.5 required=5.0 tests=DATE_IN_FUTURE_03_06, HTML_MESSAGE,MIME_HTML_ONLY autolearn=disabled version=3.1.7 I see no network tests (e.g. RCVD_IN_XBL) - do your logs show *any* messages hitting on

Online game spam

Hi, I am getting hit by the online game spam. If i test it using spamassassin -t < email, the result score 24.9. Please see http://202.42.86.68/result.txt But the header says:- X-Spam-Status: No, score=2.5 required=5.0 tests=DATE_IN_FUTURE_03_06, HTML_MESSAGE,MIME_HTML_ONLY autolearn=disabled

FuzzyOCR: pamthreshold

Hi, I am running CentOS 4.4 and have netpbm installed. [EMAIL PROTECTED] textspam]# rpm -q netpbm-devel netpbm-devel-10.25-2.EL4.3 [EMAIL PROTECTED] textspam]# rpm -q netpbm-progs netpbm-progs-10.25-2.EL4.3 [EMAIL PROTECTED] textspam]# rpm -q netpbm-devel netpbm-devel-10.25-2.EL4.3 I still have

Re: Drug Spam

http://www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf I had encountered errors [21895] info: rules: meta test KAM_RPTR_PASSED has undefined dependency '__URIBL_ANY' [21895] info: rules: meta test KAM_REAL has undefined dependency '__KAMREAL1' [21895] info: rules: meta test KAM_REAL

URIBL

Hi List, Anyone having intermittance problem with URIBL? I got a few of the same spam which are having different scores, with and without scoring from blacklist of URIBL. Regards, LC

Re: blarsbl

This is the guy's www site http://www.blars.org/errors/block.html I had some trouble with his list before too. Not many people is using that list, so i guess, not much of damage done anyway.

Re: Default SpamAssassin scores don't make sense

>... >That's where the human tweaking is supposed to happen; if gobs of spam >flag the 80% meter of some test while no ham does, and the 90% meter is >almost never hit by anything, it should have a higher value than the 80% >meter does. If the 90% meter has more ham than spam despite the 80% meter

rules_du_jour

Has anyone come up with a rule that will combat the spam that I have been seeing lately? That is a spam that rambles about much of nothing then has an image or a link at the bottom. I see more and more of these and it seems like the spammers have figured out a way to get this past SA. I include

Re: Scoring PTR's

>... >On 10/23/2006 7:01 PM, John Rudd wrote: >> Eric A. Hall wrote: >>> http://www.ehsco.com/misc/spamassassin/std_compliance.cf might help or >>> work for what you're doing. >>> >>> Make sure to read the disclaimers and warnings >> >> Those helped a lot. There's only three checks I can't do wit

Re: R: R: Scoring PTR's

>... >> RFC 2821 Section 4.1.4 Order of Commands >> ... >>An SMTP server MAY verify that the domain name parameter in the EHLO >>command actually corresponds to the IP address of the client. >>However, the server MUST NOT refuse to accept a message for this >>reason if the veri

RE: R: Scoring PTR's

RFC 2821 Section 4.1.4 Order of Commands ... An SMTP server MAY verify that the domain name parameter in the EHLO command actually corresponds to the IP address of the client. However, the server MUST NOT refuse to accept a message for this reason if the verification fails: the

Re: spam attacks - so and so wrote about a stock

Rob McEwen (PowerView Systems) wrote: In the meantime, it sure would be nice if that new ruleset that Chris bragged about could get on the SARE website ASAP. (Where are you Doc Schneider? I hope we haven't caught you on a busy day. Please hurry.) Rob McEwen PowerView Systems I just got it

Re: senders domain has MX or not?

Which rule will help me in checking if senders domain has MX record or not. E.g I am getting email from [EMAIL PROTECTED], then the rule should check whether domain.com has an MX record or not. I think this should be a question on your mail daemon. Not spamassassin.

Re: Moderator: User needs to be unsubscribed...

>... >To: users@spamassassin.apache.org >From: Evan Platt <[EMAIL PROTECTED]> >Subject: Moderator: User needs to be unsubscribed... >... > >For every post, I'm getting: > >Subject: Autoreply from [EMAIL PROTECTED] (was Re:perl hogging >my memory? ) >Errors-To: <[EMAIL PROTECTED]> >Reply-To: <[EMAI

Re: Tom Van Overbeke is out of the office.

r than his last vacation where the junk went to each poster instead of the list: ... Subject: Tom Van Overbeke is out of the office. From: [EMAIL PROTECTED] To: List Mail User <[EMAIL PROTECTED]> Message-ID: <

stock spams

The stock spams are killing me. I had 70_sare_stocks.cf and its not blocking them. Below is part of the spam and the score. What can i do to beat them? W a t c h o u t! ALLINACE ENTERPRSIE (A ETR) Curernt Pirce: 0.80 Add this g e m to your wat ch list, and w atch it tard closely! Nwes

Adding 'SA scores' to all incoming mails

I'd like SA to make a extra line/section under all my mails where it tells what score the mail got (or maybe even which rules scored on the mail) is there such a setting? it would help me to finetune my SA. tnx

Re: animated GIF spam

While skimming thru my daily rejected spam pile, did a double take when a GIF spam seemed to "blink" at me. Thought it was a sw glitch at first... then realized the sneaky Borg had adapted again. Took a look at the frames in PaintShopPro's AnimationShop, and the first three are all but blank (we

Re: a new kind of spam (with images)

Spamassassin List wrote: Stephane Bentebba wrote: hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has poor text, poor token, or none, and a subject always changing

Re: a new kind of spam (with images)

Stephane Bentebba wrote: hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has poor text, poor token, or none, and a subject always changing the only thing which remain

Re: Improved OCR Plugin with approximate matching

Spamassassin List wrote: decoder wrote: See http://wiki.apache.org/spamassassin/FuzzyOcrPlugin Major changes: Replaced imagemagick with netpbm, support png, invoked giffix for broken gifs, detect image format with magic bytes and not by content-type, added various configuration options. I

Re: Improved OCR Plugin with approximate matching

decoder wrote: See http://wiki.apache.org/spamassassin/FuzzyOcrPlugin Major changes: Replaced imagemagick with netpbm, support png, invoked giffix for broken gifs, detect image format with magic bytes and not by content-type, added various configuration options. I install the above plugin, and

Re: Image spam with inline jpeg image

- Original Message - From: "Gary Funck" <[EMAIL PROTECTED]> To: Sent: Thursday, August 10, 2006 12:04 AM Subject: RE: Image spam with inline jpeg image Menno wrote: Ramprasad wrote: > > But still this mail is getting thru > http://ecm.netcore.co.in/tmp/imagespam.txt > I tested your

Re: ImageInfo plugin for SA

Put the .pm file that is attached in your M::SA::Plugins dir. Add to your init.pre (or v310.pre) the following line. Where is the usual Plugins dir? regards

Re: internal/trusted again, MSA tested for SPF ?

>... >Mark Martinec wrote: > >> As required per docs, the MTA is considered trusted and internal, >> and MSA is declared trusted and NOT internal. >> (both MSA and MTA are on the same IP network) >>... >> >> Is it normal that our own MSA ip address is being submitted for RBL tests? > >It' normal,

Re: [dns-operations] negative caching of throwaway spam domains

I wonder if it is pure coincidence or not - There seems to have been an upswing in the use of 0-day domains today (which don't get caught by DOB - e.g. stedatlan.com-M & olpartmen.com-M in the past hour). But we still have the various BLs, so these are still high scoring spams:-)

pyzor

Hi, Is there a port which I have to open to allow pyzor to run properly? I keep having the below error. [26217] dbg: util: executable for pyzor was found at /usr/bin/pyzor [26217] dbg: pyzor: pyzor is available: /usr/bin/pyzor [26217] dbg: info: entering helper-app run mode [26217] dbg: pyzor:

Re: [Fwd: Re: [dns-operations] negative caching of throwaway spam domains]

>... >Jeff Chan wrote: >> On Thursday, June 22, 2006, 10:35:10 AM, Ken A wrote: >>> Rick Wesson over at Alice's Registry has a dnsrbl listing recently >>> registered domains (see below). I thought this might be of interest to >>> SA users. Anyone used this, or other rbl with similar functions? >>

Re: Block: Google servers still on RBLs?

>... >I know this has been discussed before, but is there a reason google is still >on RBLs? > >Nz-out-0102.google.com >64.233.162.203 listed on bl.spamcop.net 127.0.0.2 > >Chris Santerre >SysAdmin and SARE/URIBL ninja >http://www.uribl.com >http://www.rulesemporium.com >... Gmail 419s, AF

Re: The Future of Email is SQL

>... >Well - I'm a member of the Exim cult - but if something better comes >along I might convert. :) > And you're not even British:) Actually I count Exim in the short list of well done and readily usable/useful MTAs (i.e. works as expected, not "can be

Re: New spam type - sender domain quickly deleted

RVICE.COM 66.45.237.186 Name Server[from dns, dns ip]: DNS.K--SERVICE.COM 64.20.33.4 Domain ABRUXATEATRO.COM not found in registry whois server. But this domain appears to be delegated in dns. This is either an error with registrar whois database or it is possible this domain was recently registe

Re: Gmail spam

>... >Is anyone else getting spam from gmail? The ones I'm getting are very >lengthy but doesn't look like bayes poison. > > >Microsoft Mail Internet Headers Version 2.0 >Received: from mail2.adventureaquarium.com ([10.0.0.205]) by >MAIL-I.adventureaquarium.com with Microsoft SMTPSVC(5.0.2195.6713)

RE: DNS Blacklist Policy Design

>... >Paul, > >I've always thought of you as "chief scientist" among everyone on the spam >assassin list... I've seen you dissect the inner mysterious workings of a >spam like no other... uncovering the spammer's tracks like a superhero FBI >age

Re: DNS Blacklist Policy Design

>... >From: "List Mail User" <[EMAIL PROTECTED]> > >> >... >>>From: "List Mail User" <[EMAIL PROTECTED]> >>> >>>> All of this would use up 6 bits and still leave 17 for any other >>>> purposes you have in

Re: DNS Blacklist Policy Design

>... >From: "List Mail User" <[EMAIL PROTECTED]> > >> All of this would use up 6 bits and still leave 17 for any other >> purposes you have in mind (assuming codes from 127.0.0.2 to 127.0.0.126). > >Uses up 6 of the 7 bits in that range, Paul. Did

Re: DNS Blacklist Policy Design

>... >Here's what I'm trying. I'm using MyDNS but added a few fields. >Basically I'm createing a white list and a black list. The while list >merely prevents an IP from getting on the black list. An IP gets on the >whitelist for 12 hours and on the blackli

Re: Hiring for Spam Assassin Troubleshooting

You have a bunch of problems; You have no PTR record for your MXs except to the dead end of worldfamousgiftbaskets.net - That domain has bogus Whois/registration data (i.e. "Not Given" is invalid). Also that domain has no 'A' or 'MX' records. Your NS records in the TLD zone files don't m

Re: gobs of misses suddenly

>... >My guess is that these came in before any of razor, uribl, etc, got ahold of >them. I just checked them all: > >score=3D43.64 >score=3D16.961 >score=3D24.61 >score=3D13.893 >score=3D10.81 >score=3D34.878 >score=3D39.367 >score=3D23.321 >score=3D41.673 >score=3D47.624 >score=3D36.642 >score=3

Re: gobs of misses suddenly

>... >In the last couple of weeks, I've suddenly started having tons of spam get >by SA. Up until then, things had been working beautifully for a number of >years (with occasional upgrades and tweaks, of course). I'm not sure what >has changed, but something seems broken. I upgraded to 3.1.2, but i

Re: false scoring for DNS_FROM_RFC_ABUSE

>... >From: "Kai Schaetzl" <[EMAIL PROTECTED]> > >> Jamie L. Penman-Smithson wrote on Fri, 26 May 2006 00:52:39 +0100: >> >>> After some research, I came to the conclusion that .de is, indeed, >>> still broken: >>> >>> >> >> And *where exactly* does

Re: false scoring for DNS_FROM_RFC_ABUSE

>... >Jamie L. Penman-Smithson wrote on Fri, 26 May 2006 00:52:39 +0100: > >> After some research, I came to the conclusion that .de is, indeed, >> still broken: >> >> > >And *where exactly* does this RFC say that the whois input and output must >beha

Re: false scoring for DNS_FROM_RFC_ABUSE

>List Mail User wrote on Thu, 25 May 2006 23:02:21 -0700 (PDT): > >> DeNIC does not follow this protocol; > >1. there's nothing which backs your claim, *nothing*. >2. "example" is an example and nothing else. You should know that. There are >also speci

Re: false scoring for DNS_FROM_RFC_ABUSE

solutely right. The RFC doesn't define any syntax. The evidence is totall= >y=20 >bogus. > >=2D-=20 >Magnus Holmgren[EMAIL PROTECTED] > (No Cc of list mail needed, thanks) >... Um... Syntax? RFC3912 Section 3 " 3. Protocol Example

Re: Spamassassin + vpopmail

1st problem - now I got a lot of empty messages after deleting spam (I have compiled vpopmail with this options - 'WITH_SPAMASSASSIN=yes SPAM_THRESHOLD=15 RELAYCLEAR=15 LOGLEVEL=e' on freebsd). Those e-mails are empty with this header (margaret.starnet.cz is my server): I dont think vpopmail

Re: Fast WHOIS lookup

>I'm doing some research using WHOIS to find the owners of domains in the >URI blocklists and finding that many of them have the same owners. I >thing that a database of owners of the URIs that spam links to could be >extremely useful in detecting spam.. I;m seeing that a huge amount of >spam i

Re: AW: WebGUI for Spamassassin?

Christian Reiter wrote: Hi Patrick! is there any WebGUI for training and managing Spamassassin like DSPAM uses one? May Maia Mailguard could help you: http://www.renaissoft.com/maia/ Or MailWatch if you use MailScanner/SA. http://mailwatch.sourceforge.net/ Ken A Any SA/Qmail? regar

  1   2   3   4   5   >