On Mon, 28 Sep 2009, McDonald, Dan wrote:
On Sat, 2009-09-26 at 09:25 -0700, John Hardin wrote:
On Sat, 26 Sep 2009, Karsten Brckelmann wrote:
On Fri, 2009-09-25 at 11:37 -0700, John Hardin wrote:
Another note which I've seen here before: Drop the [.,] for the host
part of a uri rule. It's no
On Sat, 2009-09-26 at 09:25 -0700, John Hardin wrote:
> On Sat, 26 Sep 2009, Karsten Brckelmann wrote:
>
> > On Fri, 2009-09-25 at 11:37 -0700, John Hardin wrote:
> > Another note which I've seen here before: Drop the [.,] for the host
> > part of a uri rule. It's not a URI if it contains a comma,
On Sat, 26 Sep 2009, Karsten Br?ckelmann wrote:
On Fri, 2009-09-25 at 11:37 -0700, John Hardin wrote:
Try this:
uri URI_GOOG_READER m;^https?://(?:www\.)?google[\.,]com/reader/;i
Another note which I've seen here before: Drop the [.,] for the host
part of a uri rule. It's not a URI if it c
On Fri, 2009-09-25 at 11:37 -0700, John Hardin wrote:
> On Fri, 25 Sep 2009, Guillaume Gelle wrote:
>
> > Don't know what you mean by (?:) and backtracking tho, I'll double check
> > the wiki page about syntax ;)
The (?:foo|bar) is a non-capturing, pure alternation, indicated by
the ?: after the
On Fri, 25 Sep 2009, Guillaume Gelle wrote:
Don't know what you mean by (?:) and backtracking tho, I'll double check
the wiki page about syntax ;)
Try this:
uri URI_GOOG_READER m;^https?://(?:www\.)?google[\.,]com/reader/;i
On Fri, 2009-09-25 at 09:30 +0200, Guillaume Gelle wrote:
now, I'
ntax ;)
Thanks,
Guillaume
> Subject: Re: porn portal spammers v2
> Date: Fri, 25 Sep 2009 06:22:03 -0500
> From: dan.mcdon...@austinenergy.com
> To: users@spamassassin.apache.org
>
> On Fri, 2009-09-25 at 09:30 +0200, Guillaume Gelle wrote:
> > Dear all,
> >
>
On Fri, 2009-09-25 at 09:30 +0200, Guillaume Gelle wrote:
> Dear all,
>
> As usual, spammers improved and instead of receiving profiles|groups|
> personnal.yahoo.com links, now, I'm being hit with
> www.google.com/reader links.
> (ie : href=3D"http://www.google.com/reader/item/tag:google.com,2005
Dear all,
As usual, spammers improved and instead of receiving
profiles|groups|personnal.yahoo.com links, now, I'm being hit with
www.google.com/reader links.
(ie : http://www.google.com/reader/item/tag:google.com,2005:reader/ite=m/69a282969886af5e";>Haste
to come)
I took the firts rule submi
On tir 01 sep 2009 16:55:06 CEST, R-Elists wrote
at what stage are you dealing with SPF here?
http://www.openspf.org/Software
mta? or mta and SA?
postfix stage
can you give example config so we can see some clarity on what you
are doing in regards to them?
pypolicyd-spf have commented e
> if spf_pass yes :-)
>
> reject neotral and softfail for hotmail.com reduce it nicely
> here without reject valid mail from hotmail, oh yes there is
> still spam sent from hotmail that gets pass, but then its
> surely more easy to complain it was not me
>
benny,
at what stage are you dea
On tir 01 sep 2009 01:10:06 CEST, LuKreme wrote
I used to score mail from hotmail at 3.0... might be time to do
that again.
if spf_pass yes :-)
reject neotral and softfail for hotmail.com reduce it nicely here
without reject valid mail from hotmail, oh yes there is still spam
sent from ho
On 31-Aug-2009, at 07:11, Mynabbler wrote:
Comment by the hotmail abuse desk on a previous attempt to close the
gate
upstream: we are not responsable for the content on yahoo groups and
our
users communicating about it. Pfff. k-thank-you-bye-bye. :( At the
moment
the source is primarily hotm
the source being either hotmail or some poor sod giving his
credentials to a spammer.
--
View this message in context:
http://www.nabble.com/Porn-portal-spammers-tp25203019p25223292.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
On 29-Aug-2009, at 07:41, Mynabbler wrote:
I am getting rather tired from messages spamming porn-portals. They
typically
originate from hotmail.com,
Er, do they really originate from hotmail servers, or are they simply
spoofing a hotmail return address? Are you using zen?
--
A: You're wr
Hi,
> I am getting rather tired from messages spamming porn-portals. They typically
> originate from hotmail.com, and advertise a porn-portal based on
> google.com/groups, google.com/reader, groups.yahoo.com, pipes.yahoo.com,
> spaces.live.com, docs.google.com, sites.google.com and livejournal.com
] HELO blu0-omc3-s14.blu0.hotmail.com to hits: 10.168,
names: FREEMAIL_FROM,PORTAL_ABUSE,HTML_MESSAGE
Subject: Seeixy brunette fu-icks and suuicks on camera
--
View this message in context:
http://www.nabble.com/Porn-portal-spammers-tp25203019p25205909.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
On Sat, 2009-08-29 at 10:15 -0700, an anonymous Nabble user wrote:
> Karsten Bräckelmann wrote:
> > tflags __COMMA multiple
> > meta __COMMA_4 __COMMA >= 4
>
> Works wonders. I chose three, and was almost inclined to score on just this
> rule, if it wasn't for people discussing Dave Dee, Dozy, B
On Sat, 29 Aug 2009, Mynabbler wrote:
Karsten Bräckelmann-2 wrote:
header __COMMA Subject =~ /,/
tflags __COMMA multiple
meta __COMMA_4 __COMMA >= 4
Works wonders. I chose three, and was almost inclined to score on just this
rule, if it wasn't for people discussing Dave Dee, Dozy, Beaky,
On Sat, 29 Aug 2009, Karsten Br?ckelmann wrote:
On Sat, 2009-08-29 at 06:41 -0700, an anonymous Nabble user wrote:
The combo 'Portal link found' and subject could still be used, provided
I have a rule that is able to count the number of comma's in a subject.
Is there a way to do such a thing?
On Sat, 29 Aug 2009 10:15:56 -0700 (PDT)
Mynabbler wrote:
>
>
> Karsten Bräckelmann-2 wrote:
> >
> > header __COMMA Subject =~ /,/
> > tflags __COMMA multiple
> > meta __COMMA_4 __COMMA >= 4
> >
>
> Works wonders. I chose three, and was almost inclined to score on
> just this rule, if it
.0.0.0 to 255.255.255.255...
--
View this message in context:
http://www.nabble.com/Porn-portal-spammers-tp25203019p25204657.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
On Sat, 2009-08-29 at 06:41 -0700, an anonymous Nabble user wrote:
> The combo 'Portal link found' and subject could still be used, provided I
> have a rule that is able to count the number of comma's in a subject. Is
> there a way to do such a thing?
header __COMMA Subject =~ /,/
tflags __COMMA
On Sat 29 Aug 2009 03:41:00 PM CEST, Mynabbler wrote
http://pastebin.com/m5c18ffdd
The combo 'Portal link found' and subject could still be used, provided I
have a rule that is able to count the number of comma's in a subject. Is
there a way to do such a thing?
http://rfc-ignorant.org/tools/l
there a way to do such a thing?
--
View this message in context:
http://www.nabble.com/Porn-portal-spammers-tp25203019p25203019.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
24 matches
Mail list logo
