esterday 2/2/22 (gasp!) . . . I've noticed an up tick in
missed
>> SPAM from .co domain. Though obvious SPAM
>> weight loss, phish, "personals", they are scoring rather low.
>
> spammer use spamassassin self to make there spam pass spamassassin
>
>> Adde
On 2022-02-03 16:50, joea- lists wrote:
SA version 3.4.5
old version, stable is 3.4.6 now
Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed
SPAM from .co domain. Though obvious SPAM
weight loss, phish, "personals", they are scoring rather low.
spammer u
>> On Thu, 2022‑02‑03 at 10:50 ‑0500, joea‑ lists wrote:
SA version 3.4.5
>>>
>>> Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in
missed
>>> SPAM from .co domain. Though obvious SPAM
>>> weight loss, phish, "personals"
> On Thu, 2022-02-03 at 10:50 -0500, joea- lists wrote:
>> SA version 3.4.5
>>
>> Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed
>> SPAM from .co domain. Though obvious SPAM
>> weight loss, phish, "personals", they are scori
On Thu, 2022-02-03 at 10:50 -0500, joea- lists wrote:
> SA version 3.4.5
>
> Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed
> SPAM from .co domain. Though obvious SPAM
> weight loss, phish, "personals", they are scoring rather low.
>
SA version 3.4.5
Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed SPAM
from .co domain. Though obvious SPAM
weight loss, phish, "personals", they are scoring rather low.
Added a custom rule for that domain, which should deal with it, but wondering
i
On Tue, 30 May 2017, Robert Kudyba wrote:
I note that message hit BAYES_00. If content like that is getting a
"strong ham" Bayes score, you should review your training processes and
Bayes corpora - you *do* keep copies of messages you train Bayes with,
right? :)
Yes just re-synced.
Did you d
> For the past few days lots of missed spam has been getting through, running
>>> SA 3.4.1 on Fedora 25 with sendmail. I see that they are being tagged with
>>> URIBL_RHS_DOB, i.e., domains registered in the last five days. Since we
>>> are not running our own DN
>From: John Hardin
>On Mon, 29 May 2017, Robert Kudyba wrote:
>> For the past few days lots of missed spam has been getting through, running
>> SA 3.4.1 on Fedora 25 with sendmail. I see that they are being tagged with
>> URIBL_RHS_DOB, i.e., domains registered in t
On Mon, 29 May 2017, Robert Kudyba wrote:
For the past few days lots of missed spam has been getting through, running
SA 3.4.1 on Fedora 25 with sendmail. I see that they are being tagged with
URIBL_RHS_DOB, i.e., domains registered in the last five days. Since we
are not running our own DNS
For the past few days lots of missed spam has been getting through, running
SA 3.4.1 on Fedora 25 with sendmail. I see that they are being tagged with
URIBL_RHS_DOB, i.e., domains registered in the last five days. Since we
are not running our own DNS server (yet--need permission from our CISO
On Fri, 11 Mar 2016, Robert Chalmers wrote:
Found a copy here …
http://www.impsec.org/~jhardin/antispam/sa-stats.pl
Note that I also host a version that works with gzipped log files, if you
have compression enabled in your log rotator.
But that's not the latest. I don't know where the v1.03
;> I would like to know how to get these stats too.
>>
>> From: Robert Chalmers [mailto:rob...@chalmers.com.au]
>> Sent: Tuesday, March 08, 2016 5:25 AM
>> To: users@spamassassin.apache.org
>> Subject: Re: Missed spam, suggestions?
>>
>> Can I ask, how a
( 0%) 0 ( 0%)
>>> 2016-03-11 17 0 ( 0%) 0 ( 0%)
>>> 2016-03-11 18 0 ( 0%) 0 ( 0%)
>>> 2016-03-11 19 0 ( 0%) 0 ( 0%)
>>> 2016-03-11 20 0 ( 0%) 0 ( 0%)
>>&
0%) 0 ( 0%)
>> 2016-03-11 20 0 ( 0%) 0 ( 0%)
>> 2016-03-11 21 0 ( 0%) 0 ( 0%)
>> 2016-03-11 22 0 ( 0%) 0 ( 0%)
>> 2016-03-11 23 0 ( 0%) 0 ( 0%)
>> Done. Report generate
0 ( 0%) 0 ( 0%)
>> 2016-03-11 20 0 ( 0%) 0 ( 0%)
>> 2016-03-11 21 0 ( 0%) 0 ( 0%)
>> 2016-03-11 22 0 ( 0%) 0 ( 0%)
>> 2016-03-11 23 0 ( 0%) 0 ( 0%)
>> Done. Report
how to get these stats too.
From: Robert Chalmers [mailto:rob...@chalmers.com.au]
Sent: Tuesday, March 08, 2016 5:25 AM
To: users@spamassassin.apache.org
Subject: Re: Missed spam, suggestions?
Can I ask, how are you getting these stats please?
Thanks
On 8 Mar 2016, at 05:11, David B Funk
w
u]
> Sent: Tuesday, March 08, 2016 5:25 AM
> To: users@spamassassin.apache.org
> Subject: Re: Missed spam, suggestions?
>
> Can I ask, how are you getting these stats please?
>
> Thanks
> On 8 Mar 2016, at 05:11, David B Funk <mailto:dbf...@engineering.uiowa.edu
rote:
>
> I would like to know how to get these stats too.
>
> From: Robert Chalmers [mailto:rob...@chalmers.com.au]
> Sent: Tuesday, March 08, 2016 5:25 AM
> To: users@spamassassin.apache.org
> Subject: Re: Missed spam, suggestions?
>
> Can I ask, how are you gettin
ers [mailto:rob...@chalmers.com.au]
> Sent: Tuesday, March 08, 2016 5:25 AM
> To: users@spamassassin.apache.org
> Subject: Re: Missed spam, suggestions?
>
> Can I ask, how are you getting these stats please?
>
> Thanks
> On 8 Mar 2016, at 05:11, David B Funk <mailto:dbf...@engi
to know how to get these stats too.
From: Robert Chalmers [mailto:rob...@chalmers.com.au]
Sent: Tuesday, March 08, 2016 5:25 AM
To: users@spamassassin.apache.org
Subject: Re: Missed spam, suggestions?
Can I ask, how are you getting these stats please?
Thanks
On 8 Mar 2016, at 05:11
I would like to know how to get these stats too.
From: Robert Chalmers [mailto:rob...@chalmers.com.au]
Sent: Tuesday, March 08, 2016 5:25 AM
To: users@spamassassin.apache.org
Subject: Re: Missed spam, suggestions?
Can I ask, how are you getting these stats please?
Thanks
On 8 Mar 2016, at 05:11
On Tue, 8 Mar 2016, Matus UHLAR - fantomas wrote:
On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas
wrote:
how can these two stats be different?
On 08.03.16 10:19, @lbutlr wrote:
Because one is for SPAM and one is for HAM.
On Mar 8, 2016, at 10:41 AM, Matus UHLAR - fantomas
wrote:
Wh
On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote:
how can these two stats be different?
On 08.03.16 10:19, @lbutlr wrote:
Because one is for SPAM and one is for HAM.
On Mar 8, 2016, at 10:41 AM, Matus UHLAR - fantomas wrote:
Why did you remove the important part?
On 08.03.16 11
On Tue, 8 Mar 2016, Matus UHLAR - fantomas wrote:
On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas
wrote:
> how can these two stats be different?
On 08.03.16 10:19, @lbutlr wrote:
Because one is for SPAM and one is for HAM.
TOP SPAM RULES FIRED
RANK RULE NAME COUNT %OF
> On Mar 8, 2016, at 10:41 AM, Matus UHLAR - fantomas wrote:
>
>> On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote:
>>> how can these two stats be different?
>
> On 08.03.16 10:19, @lbutlr wrote:
>> Because one is for SPAM and one is for HAM.
>
> Why did you remove the important part?
On 8. mar. 2016 18.42.03 Matus UHLAR - fantomas wrote:
Why did the same rule hit 38.98% of all mail and 50.51% of all mail?
grep foo ./hamfolder
grep bar ./spamfolder
Why should both folders need same counts of mails ?
On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote:
how can these two stats be different?
On 08.03.16 10:19, @lbutlr wrote:
Because one is for SPAM and one is for HAM.
Why did you remove the important part?
TOP SPAM RULES FIRED
RANKRULE NAME COUNT %OFRULES
On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote:
> how can these two stats be different?
Because one is for SPAM and one is for HAM.
--
No man is free who is not master of himself
On 07.03.16 23:39, Charles Sprickman wrote:
TOP SPAM RULES FIRED
RANKRULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM
2 HTML_MESSAGE12714 8.18 38.98 87.85 90.80
TOP HAM RULES FIRED
RANKRULE NAME COUNT %O
Can I ask, how are you getting these stats please?
Thanks
> On 8 Mar 2016, at 05:11, David B Funk wrote:
>
> On Mon, 7 Mar 2016, Charles Sprickman wrote:
>
>> I’ve been running with some daily training for a little over a week and I’m
>> seeing less spam in my inbox. I’ve seen a few things sl
On Mon, 7 Mar 2016, Charles Sprickman wrote:
I’ve been running with some daily training for a little over a week and I’m
seeing less spam in my inbox. I’ve seen a few things slip through because
bayes tipped them below the default score, these were two phishing emails.
Here’s some rule stats
> On Feb 29, 2016, at 3:18 PM, Reindl Harald wrote:
>
> Am 29.02.2016 um 21:05 schrieb Charles Sprickman:
>>> On Feb 29, 2016, at 4:23 AM, Reindl Harald wrote:
>>>
>>> Am 29.02.2016 um 06:24 schrieb Charles Sprickman:
I’ve not had much luck with Bayes - when I had it enabled recently on a
On Mon, 29 Feb 2016, Charles Sprickman wrote:
My concern with disabling autolearn is that then I’m the only one
training. My spam probably looks like everyone else’s, but my ham is
very different, lots list traffic and such.
You can still have your users provide misses for training, you'd ju
Am 29.02.2016 um 21:05 schrieb Charles Sprickman:
On Feb 29, 2016, at 4:23 AM, Reindl Harald wrote:
Am 29.02.2016 um 06:24 schrieb Charles Sprickman:
I’ve not had much luck with Bayes - when I had it enabled recently on a
per-user basis it was just hitting the master DB server too hard with
> On Feb 29, 2016, at 4:23 AM, Reindl Harald wrote:
>
>
>
> Am 29.02.2016 um 06:24 schrieb Charles Sprickman:
>> I’ve not had much luck with Bayes - when I had it enabled recently on a
>> per-user basis it was just hitting the master DB server too hard with udpates
>
> just make a sitewide b
Am 29.02.2016 um 06:24 schrieb Charles Sprickman:
I’ve not had much luck with Bayes - when I had it enabled recently on a
per-user basis it was just hitting the master DB server too hard with udpates
just make a sitewide bayes
(https://wiki.apache.org/spamassassin/SiteWideBayesSetup) withou
ges, SUV sales and Lawyer Finders.
>
> What I just did was go through a collection of missed spam and re-ran
> it through spamassassin. All of it jumped from originally scoring
> around 2-3 to a minimum of 6.5 with most hitting around 12. The
> biggest difference I see is that DNS
collection of missed spam and re-ran it
through spamassassin. All of it jumped from originally scoring around 2-3 to a
minimum of 6.5 with most hitting around 12. The biggest difference I see is
that DNSBL and URIBL services had started hitting. When originally received,
these emails all originated
On Thu, 5 Apr 2012, Jason Haar wrote:
Is this the format being referred to? These are consistently getting
through SA for us too
http://pastebin.com/VHkfnTtm
No, it's not.
On 01/04/12 10:05, John Hardin wrote:
On Sat, 31 Mar 2012, joea wrote:
On 3/31/2012 at 8:22 AM, Michael Scheidell
On 04-04-2012 11:26, Jason Haar wrote:
Is this the format being referred to? These are consistently getting
through SA for us too
http://pastebin.com/VHkfnTtm
Jason
On 01/04/12 10:05, John Hardin wrote:
On Sat, 31 Mar 2012, joea wrote:
On 3/31/2012 at 8:22 AM, Michael Scheidell
wrote:
Is this the format being referred to? These are consistently getting
through SA for us too
http://pastebin.com/VHkfnTtm
Jason
On 01/04/12 10:05, John Hardin wrote:
> On Sat, 31 Mar 2012, joea wrote:
>
> On 3/31/2012 at 8:22 AM, Michael Scheidell
>
>> wrote:
>>
>>> if you need help, you
>>> On 3/31/2012 at 6:27 PM, RW wrote:
> On Sat, 31 Mar 2012 12:17:52 -0400
> joea wrote:
>
>
>> Beyond that, where can I find the difference, in a SPAM learning
>> sense, between "sa-learn --spam filename" and "spamassassin -r <
>> filename"?
>>
>> If I do the sa-learn on the same file, after
On Sat, 31 Mar 2012 12:17:52 -0400
joea wrote:
> Beyond that, where can I find the difference, in a SPAM learning
> sense, between "sa-learn --spam filename" and "spamassassin -r <
> filename"?
>
> If I do the sa-learn on the same file, after doing spamassassin, it
> tells me 0 tokens. If I then
On Sat, 31 Mar 2012, joea wrote:
On 3/31/2012 at 8:22 AM, Michael Scheidell
wrote:
if you need help, you need enough full information.
Or, you make the pastebin 'private', and send the link offlist to
someone who has volunteered to help. . . . .
If there are more volunteers, beyond the p
31.3.2012 19:17, joea kirjoitti:
> Beyond that, where can I find the difference, in a SPAM learning sense,
> between "sa-learn --spam filename" and "spamassassin -r < filename"?
>
> If I do the sa-learn on the same file, after doing spamassassin, it tells me
> 0 tokens.
> If I then do "sa-learn -
Post what you feel. The ML will help if they can. You can replace IPs and
domains etc.
--
Jeremy McSpadden
On Mar 31, 2012, at 11:19 AM, "joea" wrote:
On 3/31/2012 at 8:22 AM, Michael Scheidell
> wrote:
>> On 3/31/12 8:04 AM, joea wrote:
>>> starting below my local and MP details? Ho
>>> On 3/31/2012 at 8:22 AM, Michael Scheidell
wrote:
> On 3/31/12 8:04 AM, joea wrote:
>> starting below my local and MP details? Hopefully, the latter, as the
> former leaves me feeling a bit exposed.
>>
> we already know everything you think you want to hide.
Well, let's hope not . . .
>
On 3/31/12 8:04 AM, joea wrote:
starting below my local and MP details? Hopefully, the latter, as the former
leaves me feeling a bit exposed.
we already know everything you think you want to hide.
if you need help, you need enough full information.
Or, you make the pastebin 'private', and s
. . .
> That's very little information to go on.
Sorry. We learn as we go.
> Posting samples (with _all_ headers intact) on a pastebin or on a personal
> website so we can see them might yield some advice or new rules. Please
> don't send samples to the list, just the URLs where the samples
On Fri, 30 Mar 2012, joea wrote:
Having some difficulty grasping why some SPAM is getting thru yet some
similar is marked.
They have different source email address and subject, yet identical
"layout" 3 http links, 3 graphics items and like that.
"Layout" generally isn't relevant.
The link
Having some difficulty grasping why some SPAM is getting thru yet some similar
is marked.
They have different source email address and subject, yet identical "layout" 3
http links, 3 graphics items and like that.
When I save the message source (Mime.822 file) and do sa-learn --spam file it
From: "Loren Wilton" <[EMAIL PROTECTED]>
I turned off Bayes tests temporarily and it had little effect.
This seems a bit odd. That bayes_00 should have been good for about -3
points. Backing out Bayes should have raised the scores on this stuff by
around 3 points, which with only a little bi
* Leigh Sharpe wrote (29/06/06 03:03):
This was my first suspicion. I turned off Bayes tests temporarily and
it had little effect. I'm seriously considering resetting the bayes
and starting again
I can recommend that. I had a situation a while ago where the bayes
database got mysteriously cor
> I turned off Bayes tests temporarily and it had little effect.
This seems a bit odd. That bayes_00 should have been good for about -3
points. Backing out Bayes should have raised the scores on this stuff by
around 3 points, which with only a little bit of help should be tipping them
into spam.
:08
PM
Subject: Lots of missed spam
Hi
All,
After 6 months or
more of perfect operation, I have had heaps of spam has been missed over the
last few weeks. Running SA with -D option shows nothing obvious in the
logs.
A small selection of misses
is posted here:
http
On Wed, Jun 28, 2006 at 06:55:07PM -0700, jdow wrote:
> >1) all of this spam is hitting BAYES_00.. you really should check your
> >bayes training and correct it.
>
> THAT is a bad thing. Getting down to BAYES_00 for spam takes some
> doing. At the very least a whole lot of spam got trained as ham.
On Thu, 29 Jun 2006, Leigh Sharpe wrote:
> I'm seriously considering resetting the bayes and starting again,
> but this time I'll be making sure that it only gets fed by people
> who are actually competent enough to put their spam in the spam
> folder and ham in the ham folder, not the other way a
PROTECTED]
Sent: Thursday, June 29, 2006 11:57 AM
To: users@spamassassin.apache.org
Subject: Re: Lots of missed spam
Leigh you have a large boatload of spam trained as ham. Make sure your
users realize that GOOD messages train as ham and BAD messages train as
spam. It appears at least one perso
Leigh you have a large boatload of spam trained as ham. Make sure your
users realize that GOOD messages train as ham and BAD messages train as
spam. It appears at least one person has been feeding them both to the
ham training.
{^_^}
- Original Message -
From: "Leigh Sharpe" <[EMAIL PROT
From: "Matt Kettler" <[EMAIL PROTECTED]>
Leigh Sharpe wrote:
Hi All,
After 6 months or more of perfect operation, I have had heaps of spam
has been missed over the last few weeks. Running SA with -D option
shows nothing obvious in the logs.
A small selection of misses is posted here:
http://www
ECTED]
web www.pacificwireless.com.au
-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED]
Sent: Thursday, June 29, 2006 10:55 AM
To: Leigh Sharpe
Cc: users
Subject: Re: Lots of missed spam
Leigh Sharpe wrote:
> Hi All,
> After 6 months or more of perfect operation, I have had heaps of spam
&
Leigh Sharpe wrote:
> Hi All,
> After 6 months or more of perfect operation, I have had heaps of spam
> has been missed over the last few weeks. Running SA with -D option
> shows nothing obvious in the logs.
> A small selection of misses is posted here:
> http://www.pacificwireless.com.au/spam/
>
Hi
All,
After 6 months or
more of perfect operation, I have had heaps of spam has been missed over the
last few weeks. Running SA with -D option shows nothing obvious in the
logs.
A small selection of misses is posted
here:
http://www.pacificwireless.com.au/spam/
Anybody got any
ideas wh
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Am Freitag, 21. Januar 2005 14:30 schrieb John Fleming:
> Since upgrading v2.64 to 3.0.2, I have a much higher false negative rate.
> I posted one a couple of days ago that involved a "trusted" issue. I just
> got a medication-spam this morning that
> Is a lot of reconfiguration usually necessary when upgrading 2.64 to 3.0?
I
> thought I understood that 3.0 incorporated several of the rulesets that
were
> previously separate, and besides, I haven't removed any old rulesets yet
> anyway.
Some is necessary. Shouldn't be a huge amount.
You nee
Since upgrading v2.64 to 3.0.2, I have a much higher false negative rate. I
posted one a couple of days ago that involved a "trusted" issue. I just got
a medication-spam this morning that ONLY triggered bayes_99, although it
mentioned sexual health, anxiety and others I would've thought would've
On Friday 26 November 2004 10:28 am, Jerry Bell wrote:
> This spam went through with a score of 0. I'm using 3.01 with most of the
> sare rulesets. Any ideas on how to catch these?
>
Just as a me too. I've been battling these for the last month or so with SA
3.0.1 with varied results. I run wit
Jerry Bell wrote:
When I run it manually, this is what I get:
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on db.stelesys.com
X-Spam-Status: No, score=0.1 required=5.0 tests=AWL,BAYES_00 autolearn=ham
version=3.0.1
X-Spam-Level:
What's this best way to get it out of the AWL and b
When I run it manually, this is what I get:
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on db.stelesys.com
X-Spam-Status: No, score=0.1 required=5.0 tests=AWL,BAYES_00 autolearn=ham
version=3.0.1
X-Spam-Level:
What's this best way to get it out of the AWL and bayes?
Thanks for
Jerry Bell wrote:
I wonder if my bayes db has been poisoned to the point of thinking this is
ham? In the logs, it autolearned this one as ham, so I suspect that may
be the case.
You say it scored 0 points..does this mean it triggered no rules or the
+ - rules totaled up to 0? Regardless of bayes
I wonder if my bayes db has been poisoned to the point of thinking this is
ham? In the logs, it autolearned this one as ham, so I suspect that may
be the case.
> Jerry Bell wrote:
>> I'm using SA through exim/exiscan, and I've got it set up to only report
>> if it is spam. Guess I should change t
Jerry Bell wrote:
I'm using SA through exim/exiscan, and I've got it set up to only report
if it is spam. Guess I should change that.
The SA logs showing it getting a score of 0. SA is working really well
for me the other 99% of the time.
Jerry
Jerry Bell wrote:
This spam went through with a scor
I'm using SA through exim/exiscan, and I've got it set up to only report
if it is spam. Guess I should change that.
The SA logs showing it getting a score of 0. SA is working really well
for me the other 99% of the time.
Jerry
> Jerry Bell wrote:
>> This spam went through with a score of 0. I'
Jerry Bell wrote:
This spam went through with a score of 0. I'm using 3.01 with most of the
sare rulesets. Any ideas on how to catch these?
Thanks,
Jerry
http://www.syslog.org
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED],
[EMAIL PROTECTED]
Delivery-date: Thu, 25 Nov 2004 1
This spam went through with a score of 0. I'm using 3.01 with most of the
sare rulesets. Any ideas on how to catch these?
Thanks,
Jerry
http://www.syslog.org
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED],
[EMAIL PROTECTED]
Delivery-date: Thu, 25 Nov 2004 14:53:39 -0500
R
76 matches
Mail list logo
