On Tue, 3 Nov 2015, Richard Mealing wrote:
From: John Hardin [mailto:jhar...@impsec.org]
So, to generalize the pattern: *your* (the recipient) domain is
(somewhere) in the username part of the From email address?
Hi John - Yup!
From address is - fastnet.co.uk.12056010.bob.jones885@vmta27.to
-Original Message-
From: John Hardin [mailto:jhar...@impsec.org]
Sent: 03 November 2015 17:18
To: users@spamassassin.apache.org
Subject: RE: New rules..
On Tue, 3 Nov 2015, Richard Mealing wrote:
> So I'm looking for something that would block this -
>
> fastnet.
On Tue, 3 Nov 2015, Richard Mealing wrote:
So I'm looking for something that would block this -
fastnet.co.uk.12056010.bob.jones885@vmta27.toprea...
I was thinking of just creating a rule to sort this out with something like -
^fastnet\.co\.uk.\d+..*@
header FROM_IS_FAKE_FASTNET From =~
From: Joe Quinn [mailto:jqu...@pccc.com]
Sent: 02 November 2015 17:13
To: users@spamassassin.apache.org
Subject: Re: New rules..
On 11/2/2015 12:00 PM, Richard Mealing wrote:
Hi there,
Would this be the best list to talk about new rules for spamassassin?
I'm new here..
Thanks,
Rich
On Mon, 2 Nov 2015, Joe Quinn wrote:
On 11/2/2015 12:00 PM, Richard Mealing wrote:
Would this be the best list to talk about new rules for spamassassin?
This would be an excellent place, yes.
Additionally: make sure you take a look at the rules sandboxes in SVN.
There may already be a ru
On 11/2/2015 12:00 PM, Richard Mealing wrote:
Hi there,
Would this be the best list to talk about new rules for spamassassin?
I'm new here..
Thanks,
Rich
This would be an excellent place, yes. The more technical discussion for
things like bugs in eval rules will generally happen in dev@ bu
On 11/2/2015 12:00 PM, Richard Mealing wrote:
Hi there,
Would this be the best list to talk about new rules for spamassassin?
I’m new here..
Thanks,
Rich
Sure though if you are writing rules and want feedback, dev@ might be a
better list!
Well, it's finally working! Thanks again everyone. It was probably a
combination of things, but after I got the rules working it wasn't scanning
the emails because of an LDAP attribute and settings that needed to be put
in for SA to work with Sun Messaging. Again, Thank you.
--
View this messa
On Thu, 2011-03-03 at 09:55 -0800, an anonymous Nabble user wrote:
> > Even worse, you outright ignored my post explaining this. Despite the
> > fact, you actually replied to it. And quoted it in full below.
>
> Quite the opposite, I took your advice - even though it might look to you as
> if I di
On Thu, 2011-03-03 at 09:55 -0800, tr_ust wrote:
> I've already looked at the sun messaging logs
> and there's no indication of SA scanning the emails.
>
On my Linux system spamd logs summaries of each scan to /var/log/maillog
by default. Spamassassin doesn't seem to do this.
Martin
On Thu, 3 Mar 2011, tr_ust wrote:
Also, I seriously doubt you tested your rules "with a real email" as you
said. Notice the NO_RELAYS rule hit for an example. The sample was
either severely damaged, or a very bad copy-n-paste from a source that
just does not resemble a raw mail.
Like I said I
>You are *still* running with network tests disabled. Again, there's
>almost certainly no need for these custom rules and playing whack-a-mole
>with new URIs, if you enable network tests. URIBL and SURBL will do a
>better job at catching them early than you ever could do on your own.
It's not "w
On Thu, 2011-03-03 at 07:59 -0800, an anonymous Nabble user wrote:
> For the first time I finally feel like I'm getting closer to getting this
> thing to work - THANKS EVERYONE FOR ALL THE HELP! I did a test with a real
> email this time that included a blocked uri and the it actually scored it!
C
For the first time I finally feel like I'm getting closer to getting this
thing to work - THANKS EVERYONE FOR ALL THE HELP! I did a test with a real
email this time that included a blocked uri and the it actually scored it!
Content analysis details: (24.7 points, 5.0 required)
pts rule name
On Wed, 2011-03-02 at 13:59 -0800, an anonymous Nabble user wrote:
> Thanks Martin, for your help and time. As you can see, I'm really new to SA.
> I do see that the rules are there from the install and the the DNS module is
> there. However, when I send a test email it doesn't score for the bl
On Wed, 2 Mar 2011, tr_ust wrote:
Thanks Martin, for your help and time. As you can see, I'm really new to SA.
I do see that the rules are there from the install and the the DNS module is
there. However, when I send a test email it doesn't score for the bl uri.
I created a test message that th
Thanks Martin, for your help and time. As you can see, I'm really new to SA.
I do see that the rules are there from the install and the the DNS module is
there. However, when I send a test email it doesn't score for the bl uri.
I created a test message that the only thing it has is 9hz.com, wh
Those rules are already in the default spamassassin install, just make
sure you've got the perl dns modules installed and theyll run
automatically
Martin.
Run "spamassassin -D -lint" and you'll see if u have the perl modules
etc installed
On Wednesday, 2 March 2011, tr_ust wrote:
>
> All you ha
All you had to do is add these lines to a cf file?
urirhssub URIBL_BLACK multi.uribl.com.A 2
bodyURIBL_BLACK eval:check_uridnsbl('URIBL_BLACK')
describeURIBL_BLACK Contains an URL listed in the URIBL blacklist
tflags URIBL_BLACK net
score
I can't comment about the particular URIs mentioned in this
discussion, but we do run some URI rules that are redundant with URIBL
listings.
The reason we do this is because URIBL listings will sometimes
time-out and be removed. So we will list some domain names in our
rules in case they are drop
On Wed, 2011-03-02 at 07:46 -0800, an anonymous Nabble user wrote:
> I'm sorry - there's only one line in the sample of how to write a uri rule.
I strongly suggest to read the SA docs, at the very least some intro
style rule writing guide. Depending solely on a brief third-party usage
example with
On 3/2/2011 11:43 AM, John Hardin wrote:
> On Wed, 2 Mar 2011, Bowie Bailey wrote:
>
>> On 3/2/2011 11:16 AM, Jeff Mincy wrote:
>>> Also, the rules could be combined into a single rule (untested) using
>>> regexp (?:index|nana|ontokoros|tbt|webadmin)
>>>
>>> uri LOCAL_URI_EXAMPLE
>>> /zynetsw.com\/
On 3/2/2011 11:32 AM, Bowie Bailey wrote:
> On 3/2/2011 11:16 AM, Jeff Mincy wrote:
>> Also, the rules could be combined into a single rule (untested) using
>> regexp (?:index|nana|ontokoros|tbt|webadmin)
>>
>> uri LOCAL_URI_EXAMPLE
>> /zynetsw.com\/forms\/use\/(?:index|nana|ontokoros|tbt|webadmin
On Wed, 2 Mar 2011, Bowie Bailey wrote:
On 3/2/2011 11:16 AM, Jeff Mincy wrote:
Also, the rules could be combined into a single rule (untested) using
regexp (?:index|nana|ontokoros|tbt|webadmin)
uri LOCAL_URI_EXAMPLE
/zynetsw.com\/forms\/use\/(?:index|nana|ontokoros|tbt|webadmin)\/form1.html/
On 3/2/2011 11:16 AM, Jeff Mincy wrote:
> Also, the rules could be combined into a single rule (untested) using
> regexp (?:index|nana|ontokoros|tbt|webadmin)
>
> uri LOCAL_URI_EXAMPLE
> /zynetsw.com\/forms\/use\/(?:index|nana|ontokoros|tbt|webadmin)\/form1.html/
Or, if you want to catch any of t
On Wed, 2011-03-02 at 07:46 -0800, tr_ust wrote:
> I'm sorry - there's only one line in the sample of how to write a uri rule.
>
> Are you saying that for each line I need to create a unique
> "LOCAL_URI_EXAMPLE" line? In other words it should look more like this?
>
> uri LOCAL_URI_EXAMPLE /03ys
From: John Hardin
Date: Wed, 2 Mar 2011 07:50:38 -0800 (PST)
On Wed, 2 Mar 2011, tr_ust wrote:
> This is what my rules look like now:
>
> uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/index\/form1.html/
> score LOCAL_URI_EXAMPLE 200
> uri LOCAL_URI_EXAMPLE /zy
On 3/2/11 9:46 AM, "tr_ust" wrote:
>
> I'm sorry - there's only one line in the sample of how to write a uri rule.
>
> Are you saying that for each line I need to create a unique
> "LOCAL_URI_EXAMPLE" line? In other words it should look more like this?
Yes, although score is usually spelled w
On Wed, 2 Mar 2011, tr_ust wrote:
This is what my rules look like now:
uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/index\/form1.html/
score LOCAL_URI_EXAMPLE 200
uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/nana\/form1.html/
score LOCAL_URI_EXAMPLE 100
uri LOCAL_URI_EXAMPLE /zynetsw.com
I'm sorry - there's only one line in the sample of how to write a uri rule.
Are you saying that for each line I need to create a unique
"LOCAL_URI_EXAMPLE" line? In other words it should look more like this?
uri LOCAL_URI_EXAMPLE /03ysl.9hz.com/
core LOCAL_URI_EXAMPLE 20
uri LOCAL_URI_EXAMPLE_
This is what my rules look like now:
uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/index\/form1.html/
score LOCAL_URI_EXAMPLE 200
uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/nana\/form1.html/
score LOCAL_URI_EXAMPLE 100
uri LOCAL_URI_EXAMPLE /zynetsw.com\/forms\/use\/ontokoros\/form1.html/
On 3/1/2011 1:36 PM, Karsten Bräckelmann wrote:
> On Tue, 2011-03-01 at 13:11 -0500, Bowie Bailey wrote:
>> On 3/1/2011 12:39 PM, tr_ust wrote:
>>> Thanks...I could really use the help!
> [...]
>>> uri LOCAL_URI_EXAMPLE /03ysl.9hz.com\//
>>> score LOCAL_URI_EXAMPLE 20
>>> uri LOCAL_URI_EXAMPLE /0
On Tue, 2011-03-01 at 13:11 -0500, Bowie Bailey wrote:
> On 3/1/2011 12:39 PM, tr_ust wrote:
> > Thanks...I could really use the help!
[...]
> > uri LOCAL_URI_EXAMPLE /03ysl.9hz.com\//
> > score LOCAL_URI_EXAMPLE 20
> > uri LOCAL_URI_EXAMPLE /040jk.9hz.com\//
> > score LOCAL_URI_EXAMPLE 20
> > u
On 3/1/2011 12:39 PM, tr_ust wrote:
> Thanks...I could really use the help!
>
> basically - I'm getting the list of phishing links of aper
> (https://aper.svn.sourceforge.net/svnroot/aper/) and creating a rule for it.
>
> Here's a snippet of my rule -
>
> uri LOCAL_URI_EXAMPLE /-la2u.9hz.com\//
Thanks...I could really use the help!
basically - I'm getting the list of phishing links of aper
(https://aper.svn.sourceforge.net/svnroot/aper/) and creating a rule for it.
Here's a snippet of my rule -
uri LOCAL_URI_EXAMPLE /-la2u.9hz.com\//
score LOCAL_URI_EXAMPLE 20
uri LOCAL_URI_EXAMPLE
On Tue, 1 Mar 2011 08:02:23 -0800 (PST), tr_ust
wrote:
> thanks I found the directory and placed the file there...it's not
working
> but at least I'm putting it in the right place.
foo.cf works
foo wont load
make sure you named it something that ends in .cf
00_something.cf loads before 99_ssome
On 3/1/2011 11:02 AM, tr_ust wrote:
> thanks I found the directory and placed the file there...it's not working but
> at least I'm putting it in the right place.
Show us the rule. We can help you debug it.
--
Bowie
thanks I found the directory and placed the file there...it's not working but
at least I'm putting it in the right place.
Bowie Bailey wrote:
>
> On 2/24/2011 5:04 PM, tr_ust wrote:
>> Hi Everyone, sorry I'm a super Newbie on Spamassassin...my stupid
>> question is
>> this:
>>
>> I've created a
On Thu, 2011-02-24 at 14:04 -0800, tr_ust wrote:
> I've created a rule for a blocked URIs - where do I tell spamassassin to use
> that rule? The only thing I see in the documenation is to not put the cf
> file in a certain directory because it will be overwritten during an
> upgrade.
>
Put it i
On 2/24/2011 5:04 PM, tr_ust wrote:
> Hi Everyone, sorry I'm a super Newbie on Spamassassin...my stupid question is
> this:
>
> I've created a rule for a blocked URIs - where do I tell spamassassin to use
> that rule? The only thing I see in the documenation is to not put the cf
> file in a certai
Hi
You create a file.cf with your rules and you place it in spamassassin folder
and restart spamassassin
Regards
Hi Everyone, sorry I'm a super Newbie on Spamassassin...my stupid question is
this:
I've created a rule for a blocked URIs - where do I tell spamassassin to use
that rule? The
> Bill Randle wrote:
>> Does anyone have any rules to squash the recent spate of stock alert
>> spam that I've been seeing? The messages are coming from multiple
>> sources, although some can be traced back to IPs belonging to
>> kornet.net. There are no URLs in the message body. Bayes is probably
Bill Randle wrote:
Does anyone have any rules to squash the recent spate of stock alert
spam that I've been seeing? The messages are coming from multiple
sources, although some can be traced back to IPs belonging to
kornet.net. There are no URLs in the message body. Bayes is probably
the best bet
Hello Matthew,
Tuesday, December 7, 2004, 7:32:22 AM, you wrote:
MN> Hello,
MN> I've recently installed SA 3.0.1, and found some junk was
MN> getting through with scores too low for my liking, especially before the
MN> URLs made it into SURBL. I've put together a few rules to match some
MN> of t
> Getting off topic here, but the all caps is probably a holdover from
> the old SABRE airline reservation system which used a 6-bit codeset
> to reduce the transmission time on their (at the time) slow data links.
Actually it was because the SABRE machines also used a 5-bit code set (and
still la
Matthew Newton wrote:
On Wed, Dec 08, 2004 at 02:22:07PM +0100, Alex Broens wrote:
Matthew Newton wrote:
I've recently installed SA 3.0.1, and found some junk was
getting through with scores too low for my liking, especially before the
URLs made it into SURBL. I've put together a few rules to match
On Wed, 2004-12-08 at 05:22, Alex Broens wrote:
> Matthew Newton wrote:
> > Hello,
> >
> > I've recently installed SA 3.0.1, and found some junk was
> > getting through with scores too low for my liking, especially before the
> > URLs made it into SURBL. I've put together a few rules to match some
On Wed, Dec 08, 2004 at 02:22:07PM +0100, Alex Broens wrote:
> Matthew Newton wrote:
> >
> >I've recently installed SA 3.0.1, and found some junk was
> >getting through with scores too low for my liking, especially before the
> >URLs made it into SURBL. I've put together a few rules to match some
>
Matthew Newton wrote:
Hello,
I've recently installed SA 3.0.1, and found some junk was
getting through with scores too low for my liking, especially before the
URLs made it into SURBL. I've put together a few rules to match some
of these that you might find interesting.
They are:
Finally, a string
At 06:43 PM 9/13/2004, Thompson´s Mail wrote:
Do You know where I can download a new rules for SpamAssassin ? I
would like a simple URL, where I can use a wget command, or some like this.
For the primary ruleset, the only practical means up update is full-version
upgrade. It's not possible or
50 matches
Mail list logo
