Re: Lots of 419/scam and investment spams getting through suddenly

2009-06-19 Thread omehegan
Chip M. wrote: > > Owen, particularly with 419/scam spams, it's VERY helpful if you > tell us more about your ham ecology. > > It would also be helpful if you told us about your FP pipeline. > For example: Do you have a corpus? Can you easily analyze > individual SA hits on ham, over an exten

Re: Lots of 419/scam and investment spams getting through suddenly

2009-06-19 Thread omehegan
John Hardin wrote: > > That's not what I asked - are you _training_ as that user? That's often > the problem when bayes isn't behaving the way you expect. > > sa-update won't bring 3.2.1 up to 3.2.5; you're not getting the up-to-date > rules, which may catch those. > > That said, I'm gettin

Re: Lots of 419/scam and investment spams getting through suddenly

2009-06-17 Thread omehegan
John Hardin wrote: > > On Wed, 17 Jun 2009, omehegan wrote: > >>>>> http://www.nerdnetworks.org/spam/spam1 >>>>> http://www.nerdnetworks.org/spam/spam2 >>>>> http://www.nerdnetworks.org/spam/spam3 >>>>> http://www.ner

Re: Lots of 419/scam and investment spams getting through suddenly

2009-06-17 Thread omehegan
omehegan wrote: > > > > John Hardin wrote: >> >> On Wed, 17 Jun 2009, omehegan wrote: >> >>> Lately a lot of 419 and investment spams have been getting through with >>> very low SA scores. >>> >>> http://www.nerdnetworks.

Re: Lots of 419/scam and investment spams getting through suddenly

2009-06-17 Thread omehegan
John Hardin wrote: > > On Wed, 17 Jun 2009, omehegan wrote: > >> Lately a lot of 419 and investment spams have been getting through with >> very low SA scores. >> >> http://www.nerdnetworks.org/spam/spam1 >> http://www.nerdnetworks.org/spam/spam2 &g

Lots of 419/scam and investment spams getting through suddenly

2009-06-17 Thread omehegan
I'm running SpamAssassin 3.2.1 on Linux, with spamd integrated with Postfix. I use SPF, greylisting, and bayes. Lately a lot of 419 and investment spams have been getting through with very low SA scores. Can anyone take a look at these and see if there's another ruleset I should use to trap them?

Hotmail and Gmail spam getting through

2008-06-16 Thread omehegan
It looks like Hotmail and Gmail's captcha has been broken. I'm getting spam using their domains as return addresses, and the messages pass SPF. I assume there are other people getting these. I've attached two - the second one doesn't even seem to be advertising anything. Can anyone suggest a way t

Re: Bayes suddenly scoring everything at 0

2007-07-06 Thread omehegan
Any other thoughts on this? I got another 5-6 spams this morning that were scored 0 by Bayes. It's dragging down the hits from other rules! omehegan wrote: > > I'm running SA 3.2.1 with Postfix, routing mail to it through spamd/spamc. > I have a site-wide Bayesian database

Re: Bayes suddenly scoring everything at 0

2007-07-05 Thread omehegan
I should note that autolearn is turned on, and is apparently learning about half of my legit messages as ham, so that's cool. Furthermore, the spams that are getting through are showing as autolearn=no, so that's good as well. Seems less likely, then, that a stale database of ham messages is causi

Bayes suddenly scoring everything at 0

2007-07-05 Thread omehegan
I'm running SA 3.2.1 with Postfix, routing mail to it through spamd/spamc. I have a site-wide Bayesian database that I trained some time ago with a few hundred hams, and then since then I've trained spam into it anytime I received a false negative. With the recent influx of PDF and stock spam, I'v