Re: The www[variations]continue....

2009-07-20 Thread Mike Wallace
Benny, Thanks for noticing my spf error. I used the wizard to fix it. Mike

Re: The www[variations]continue....

2009-07-20 Thread Benny Pedersen
On Sun, July 19, 2009 20:11, Mike Wallace wrote: > It was Dan's rule, so I switched to your rule and it was caught. > Sorry, first time posting on this list. thats okay, no one is imho perfekt here on this maillist :) i just sav that you have error in your spf record http://old.openspf.org/wiza

RE: The www[variations]continue....

2009-07-19 Thread McDonald, Dan
From: McDonald, Dan [mailto:dan.mcdon...@austinenergy.com] >From: John Hardin [mailto:jhar...@impsec.org] >>On Sun, 19 Jul 2009, Mike Wallace wrote: >> >>> I got one today that wasn't caught by your rule >> >>Whose, mine or Dan's? >> >>> it had 22232 for the domain name inside of www and net and us

RE: The www[variations]continue....

2009-07-19 Thread McDonald, Dan
From: John Hardin [mailto:jhar...@impsec.org] >On Sun, 19 Jul 2009, Mike Wallace wrote: > >> I got one today that wasn't caught by your rule > >Whose, mine or Dan's? > >> it had 22232 for the domain name inside of www and net and used bracket >> dot bracket for the separator. I just got a couple

Re: The www[variations]continue....

2009-07-19 Thread Mike Wallace
It was Dan's rule, so I switched to your rule and it was caught. Sorry, first time posting on this list. Mike

Re: The www[variations]continue....

2009-07-19 Thread John Hardin
On Sun, 19 Jul 2009, Mike Wallace wrote: I got one today that wasn't caught by your rule Whose, mine or Dan's? it had 22232 for the domain name inside of www and net and used bracket dot bracket for the separator. My URI_OBFU_WWW rule (from the SA sandbox) should have caught that. Dan's i

Re: The www[variations]continue....

2009-07-19 Thread Mike Wallace
I got one today that wasn't caught by your rule it had 22232 for the domain name inside of www and net and used bracket dot bracket for the separator. Mike On Jul 16, 2009, at 6:23 PM, McDonald, Dan wrote: On Fri, 2009-07-17 at 00:04 +0200, Michelle Konzack wrote: Good Evening, Am 2009-

Re: The www[variations]continue....

2009-07-17 Thread Benny Pedersen
On Fri, July 17, 2009 11:14, Justin Mason wrote: >> I have scored it with 10.00 because the stupid AWL which scores  in  30% >> of all cases with -5.00. score AWL 10 ? perldoc Mail::SpamAssassin::Plugin::AWL see factor > sounds like you should turn off the AWL? it works for me :) -- xpoint

Re: The www[variations]continue....

2009-07-17 Thread Justin Mason
On Fri, Jul 17, 2009 at 09:45, Michelle Konzack wrote: > Am 2009-07-17 09:46:28, schrieb Ben: >> Dan, >> >> Thanks for the rules. >> >> I am using "AE_MED42" from a previous thread, is this "AE_MED44" meant >> to replace this or work in addition to it? >> >> Also just curious, why the low score?  W

Re: The www[variations]continue....

2009-07-17 Thread Michelle Konzack
Am 2009-07-17 09:46:28, schrieb Ben: > Dan, > > Thanks for the rules. > > I am using "AE_MED42" from a previous thread, is this "AE_MED44" meant > to replace this or work in addition to it? > > Also just curious, why the low score? With the default required hits of > 5.0 and this in my setup

Re: The www[variations]continue....

2009-07-16 Thread Ben
McDonald, Dan wrote: Have you tried my rule? I've caught 401 of them since I updated it this morning. It's also got a little surprise for the next logical variant... body__MED_OB /\bw{2,3}(?:[[:punct:][:space:]]{1,5}|[[:space:][:punct:]]{1,3}dot[[:space:][:punct:]]{1,3})[[:alpha:]]

Re: The www[variations]continue....

2009-07-16 Thread Michelle Konzack
Am 2009-07-16 17:23:41, schrieb McDonald, Dan: > Have you tried my rule? Installed for some minutes... will see how many it catch. > I've caught 401 of them since I updated it this > morning. It's also got a little surprise for the next logical > variant... > > body __MED_OB > /\bw{2

Re: {Spam?} RE: The www[variations]continue....

2009-07-16 Thread John Hardin
On Fri, 17 Jul 2009, Ibrahim Harrani wrote: Hi, Is this rule available via updates.spamassassin.org sa-update channel? http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf Not at present. Stuff in the sandbox is still undergoing testing and evaluation.

Re: The www[variations]continue....

2009-07-16 Thread McDonald, Dan
On Fri, 2009-07-17 at 00:04 +0200, Michelle Konzack wrote: > Good Evening, > > Am 2009-07-16 23:42:44, schrieb Karsten Bräckelmann: > > On Fri, 2009-07-17 at 00:37 +0300, Ibrahim Harrani wrote: > > > Is this rule available via updates.spamassassin.org sa-update channel? > > > > Nope. It's living

Re: The www[variations]continue....

2009-07-16 Thread Karsten Bräckelmann
On Fri, 2009-07-17 at 01:02 +0300, Ibrahim Harrani wrote: > How can I get them into my spamassassin rules automatically svn > or manually? Click the link. Then use the "download" link, preferably for HEAD. Copy-n-paste the rule in some *.cf file of your choice in your *site* specific configura

Re: The www[variations]continue....

2009-07-16 Thread Michelle Konzack
Am 2009-07-16 11:47:16, schrieb rich...@buzzhost.co.uk: > Don't you just love them :-) > > Love Making Tipps -- Tips for Better And Greater > sex.www[dot]nu26[dot]com The only thing I love is the use of my "Makarow"... charged for spamers! Thanks, Greetings and nice Day/Evening Michelle Konz

Re: The www[variations]continue....

2009-07-16 Thread Michelle Konzack
Good Evening, Am 2009-07-16 23:42:44, schrieb Karsten Bräckelmann: > On Fri, 2009-07-17 at 00:37 +0300, Ibrahim Harrani wrote: > > Is this rule available via updates.spamassassin.org sa-update channel? > > Nope. It's living in a sandbox. > > > > http://svn.apache.org/viewvc/spamassassin/trunk/r

Re: The www[variations]continue....

2009-07-16 Thread Ibrahim Harrani
Hi, How can I get them into my spamassassin rules automatically or manually? Thanks 2009/7/17 Karsten Bräckelmann : > On Fri, 2009-07-17 at 00:37 +0300, Ibrahim Harrani wrote: >> Is this rule available via updates.spamassassin.org sa-update channel? > > Nope.  It's living in a sandbox. > >> > h

Re: The www[variations]continue....

2009-07-16 Thread Karsten Bräckelmann
On Fri, 2009-07-17 at 00:37 +0300, Ibrahim Harrani wrote: > Is this rule available via updates.spamassassin.org sa-update channel? Nope. It's living in a sandbox. > > http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf -- char *t="\10pse\0r\0dtu...@ghno\x4

Re: {Spam?} RE: The www[variations]continue....

2009-07-16 Thread Ibrahim Harrani
Hi, Is this rule available via updates.spamassassin.org sa-update channel? Thansk On Thu, Jul 16, 2009 at 4:08 PM, Randal, Phil wrote: > John Hardin wrote: >> On Thu, 2009-07-16 at 11:47 +0100, rich...@buzzhost.co.uk wrote: >>> Don't you just love them :-) >>> >>> Love Making Tipps -- Tips for B

Re: {Spam?} RE: The www[variations]continue....

2009-07-16 Thread McDonald, Dan
On Thu, 2009-07-16 at 09:11 -0400, Dan Schaefer wrote: > > The rules should also proactively cover (dot) and {dot} as well as [dot] and , and {dot>, and /dot/, and ... That's why I like using [[:punct:]], which includes ! ' # S % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ { | } ~ I've simplifi

Re: {Spam?} RE: The www[variations]continue....

2009-07-16 Thread John Hardin
On Thu, 2009-07-16 at 14:08 +0100, Randal, Phil wrote: > John Hardin wrote: > > On Thu, 2009-07-16 at 11:47 +0100, rich...@buzzhost.co.uk wrote: > >> Don't you just love them :-) > >> > >> Love Making Tipps -- Tips for Better And Greater > >> sex.www[dot]nu26[dot]com > > > > http://svn.apache.org

Re: {Spam?} RE: The www[variations]continue....

2009-07-16 Thread Dan Schaefer
The rules should also proactively cover (dot) and {dot} as well as [dot] I agree. -- Dan Schaefer Web Developer/Systems Analyst Performance Administration Corp.

{Spam?} RE: The www[variations]continue....

2009-07-16 Thread Randal, Phil
John Hardin wrote: > On Thu, 2009-07-16 at 11:47 +0100, rich...@buzzhost.co.uk wrote: >> Don't you just love them :-) >> >> Love Making Tipps -- Tips for Better And Greater >> sex.www[dot]nu26[dot]com > > http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/ 20_uri_obfu_ws.cf

Re: The www[variations]continue....

2009-07-16 Thread John Hardin
On Thu, 2009-07-16 at 11:47 +0100, rich...@buzzhost.co.uk wrote: > Don't you just love them :-) > > Love Making Tipps -- Tips for Better And Greater > sex.www[dot]nu26[dot]com http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf -- John Hardin KA7OHZ

Re: The www[variations]continue....

2009-07-16 Thread rich...@buzzhost.co.uk
On Thu, 2009-07-16 at 13:43 +0200, Chr. von Stuckrad wrote: [snip] > (Of course every good spammer will read the spamassassin list ;-) I don't think they care that much. Once you've got the mail server to accept it, ending up in a junk folder is still a successful delivery. If you are running it s

Re: The www[variations]continue....

2009-07-16 Thread Chr. von Stuckrad
On Thu, 16 Jul 2009, Benny Pedersen wrote: > On Thu, July 16, 2009 12:47, rich...@buzzhost.co.uk wrote: > > Don't you just love them :-) Well, I seem to remember the nearly same scenario a long while ago. Somebody went through nearly the same 'contorions' to always avoid the last 'matching' which

Re: The www[variations]continue....

2009-07-16 Thread Benny Pedersen
On Thu, July 16, 2009 12:47, rich...@buzzhost.co.uk wrote: > Don't you just love them :-) > > Love Making Tipps -- Tips for Better And Greater > sex.www[dot]nu26[dot]com lets start block tld with score 100, and on known uri score -100 -- xpoint