RE: Spam from compromised web mails

2009-12-16 Thread R-Elists
> > When running site wide, how do you get ham to train bayes? I > can manage spam by spam reporting and such, but getting ham > without breaching the privacy of our users is my problem. > > raj > Raj, one potential option is to setup bayes autolearn thresholds with proper scores for your

Re: Spam from compromised web mails

2009-12-16 Thread Thomas Harold
On 12/16/2009 9:42 AM, Rajkumar S wrote: On Wed, Dec 16, 2009 at 1:07 PM, Yet Another Ninja wrote: I don't do any "manual" training, ever. SA's butler, "autolearn", does it for me. bayes_auto_learn 1 In this case if a new spam comes and it does not score on any other rules, Would't this be

Re: Spam from compromised web mails

2009-12-16 Thread Rajkumar S
On Wed, Dec 16, 2009 at 1:07 PM, Yet Another Ninja wrote: > I don't do any "manual" training, ever. SA's butler, "autolearn", does it > for me. > > bayes_auto_learn  1 In this case if a new spam comes and it does not score on any other rules, Would't this be classified as a ham? Also I need bayes

Re: Spam from compromised web mails

2009-12-16 Thread Thomas Harold
On 12/15/2009 12:49 PM, LuKreme wrote: On 15-Dec-2009, at 09:12, RW wrote: On Tue, 15 Dec 2009 09:44:50 -0500 I'm exactly the opposite, hardly any of the lists I subscribe to do that, and I find it annoying when it's done. Every list mail comes with a List-Id header so you can filter, tag or wh

Re: Sieve mailing list rules (was Spam from compromised web mails)

2009-12-16 Thread Thomas Harold
On 12/15/2009 9:54 AM, Benny Pedersen wrote: On tir 15 dec 2009 15:44:50 CET, Jeff Koch wrote in has a tag. A tag of two characters would allow users to quickly identify the email as coming from the SA mailing list and decide whether the email is worth opening. in the header: List-Id: in s

Re: Spam from compromised web mails

2009-12-15 Thread Yet Another Ninja
On 12/16/2009 8:24 AM, Rajkumar S wrote: On Tue, Dec 15, 2009 at 9:07 PM, Yet Another Ninja wrote: even using site wide, autolearning will help your detection a LOT. Don't underestimate it... When running site wide, how do you get ham to train bayes? I can manage spam by spam reporting and su

Re: Spam from compromised web mails

2009-12-15 Thread Rajkumar S
On Tue, Dec 15, 2009 at 9:07 PM, Yet Another Ninja wrote: > even using site wide, autolearning will help your detection a LOT. > Don't underestimate it... When running site wide, how do you get ham to train bayes? I can manage spam by spam reporting and such, but getting ham without breaching the

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread LuKreme
On Dec 15, 2009, at 11:55, Jeff Koch wrote: Instead of trying to make points why not read the whole thread? As I said in a prior response - not everyone has management control over the mailserver they use to get SA list mail. You do not need 'management control' over a mailserver to filter

Re: Spam from compromised web mails

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, LuKreme wrote: As you may have noticed, I've got my procmail set to insert one (as seen above). But this has the unfortunate side-effect of messing with threading in some threaded mail clients and archives :( I just see "Subject: Re: Re: Spam from…" Changing the subject

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Jeff Koch
Instead of trying to make points why not read the whole thread? As I said in a prior response - not everyone has management control over the mailserver they use to get SA list mail. At 01:01 PM 12/15/2009, Toni Mueller wrote: On Tue, 15.12.2009 at 12:52:44 -0500, Jeff Koch wrote: > Of c

Re: [sa] Spam from compromised web mails

2009-12-15 Thread Kai Schaetzl
Charles Gregory wrote on Tue, 15 Dec 2009 12:12:41 -0500 (EST): > I imagine this same thinking applies to any number of people using a > 'basic' mail client and not bothering to 'sort' mail into alternate > delivery folders which they must then 'remember' to read. If you don't sort away hig

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Chris Owen
On Dec 15, 2009, at 12:02 PM, Jeff Koch wrote: > As I said not everyone controls the mailserver they get their list mail from. Then why are they on a mailing list for people who run mail servers? Chris - Chris Owen

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 18:52:44 CET, Jeff Koch wrote Of course an iPhone can see IMAP folders. But what's going to sort mail into folders when I'm traveling for a week and the office PC is turned off? never tryed a google email at gmail ? well sieve is the answer, not the clients problem you ha

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Jeff Koch
As I said not everyone controls the mailserver they get their list mail from. At 12:55 PM 12/15/2009, LuKreme wrote: On 15-Dec-2009, at 10:52, Jeff Koch wrote: > At 12:41 PM 12/15/2009, Benny Pedersen wrote: >> open your eyes and see more, both the above smartphones above can >> handle imap ju

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Toni Mueller
On Tue, 15.12.2009 at 12:52:44 -0500, Jeff Koch wrote: > Of course an iPhone can see IMAP folders. But what's going to sort mail > into folders when I'm traveling for a week and the office PC is turned > off? The server on which the imap server runs? Kind regards, --Toni++

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Mikael Syska
Hi, You use the mailserver - http://en.wikipedia.org/wiki/Sieve_%28mail_filtering_language%29 And all are happy and can do what they want ... add the tag to the subject ... remove it. Personal pref can be made ... mvh On Tue, Dec 15, 2009 at 6:52 PM, Jeff Koch wrote: > > Of course an iPhone c

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread LuKreme
On 15-Dec-2009, at 10:52, Jeff Koch wrote: > At 12:41 PM 12/15/2009, Benny Pedersen wrote: >> open your eyes and see more, both the above smartphones above can >> handle imap just fine, but i just test it from nokia e51, should i >> prove it ? > Of course an iPhone can see IMAP folders. But what's

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread LuKreme
On 15-Dec-2009, at 10:22, Jeff Koch wrote: > At 11:12 AM 12/15/2009, RW wrote: >> I'd find it annoying to look at a list where every single message >> starts with "[sa-user]". > How could a two character tag like SA be annoying? You must never use a > blackberry or iPhone to check your email eit

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Jeff Koch
Of course an iPhone can see IMAP folders. But what's going to sort mail into folders when I'm traveling for a week and the office PC is turned off? At 12:41 PM 12/15/2009, Benny Pedersen wrote: On tir 15 dec 2009 18:22:00 CET, Jeff Koch wrote How could a two character tag like SA be annoy

Re: Spam from compromised web mails

2009-12-15 Thread LuKreme
On 15-Dec-2009, at 09:44, Charles Gregory wrote: > On Tue, 15 Dec 2009, Jeff Koch wrote: >> I have to say that it is extremely annoying that this mailing list does not >> put a tag identifying itself in the subject line. Every other mailing list >> of a similar technical nature that I participate

Re: Spam from compromised web mails

2009-12-15 Thread LuKreme
On 15-Dec-2009, at 09:12, RW wrote: > On Tue, 15 Dec 2009 09:44:50 -0500 > Jeff Koch wrote: > >> >> I have to say that it is extremely annoying that this mailing list >> does not put a tag identifying itself in the subject line. Every >> other mailing list of a similar technical nature that I pa

Re: SA Tag - Spam from compromised web mails

2009-12-15 Thread Mikael Syska
Hi, On Tue, Dec 15, 2009 at 6:31 PM, Jeff Koch wrote: > > Why be forced into using one mail client? Hey, it's almost 2010 - people > use multiple devices to check email - smartphones, PDA's, mail to voice, > webmail, internet cafes. The days of using only one client are long past. > You can still

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 18:22:00 CET, Jeff Koch wrote How could a two character tag like SA be annoying? You must never use a blackberry or iPhone to check your email either. open your eyes and see more, both the above smartphones above can handle imap just fine, but i just test it from nokia e5

SA Tag - Spam from compromised web mails

2009-12-15 Thread Jeff Koch
Why be forced into using one mail client? Hey, it's almost 2010 - people use multiple devices to check email - smartphones, PDA's, mail to voice, webmail, internet cafes. The days of using only one client are long past. You can still use IMAP on a main PC to keep your email sorted - but why no

SA Tag Spam from compromised web mails

2009-12-15 Thread Jeff Koch
How could a two character tag like SA be annoying? You must never use a blackberry or iPhone to check your email either. At 11:12 AM 12/15/2009, RW wrote: On Tue, 15 Dec 2009 09:44:50 -0500 Jeff Koch wrote: > > I have to say that it is extremely annoying that this mailing list > does not p

Re: [sa] Re: Spam from compromised web mails

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Toni Mueller wrote: As you may have noticed, I've got my procmail set to insert one (as seen above). But this has the unfortunate side-effect of messing with threading in some threaded mail clients and archives :( I don't know the abilities of Alpine, but if you use proc

Re: Spam from compromised web mails

2009-12-15 Thread Toni Mueller
Hi, On Tue, 15.12.2009 at 11:44:49 -0500, Charles Gregory wrote: > On Tue, 15 Dec 2009, Jeff Koch wrote: >> I have to say that it is extremely annoying that this mailing list does >> not put a tag identifying itself in the subject line. Every other >> mailing list of a similar technical natur

Re: Site-wide Bayes (was: Spam from compromised web mails)

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Matt Garretson wrote: Heartily agreed. Site-wide bayes here (single database for 2000+ users) catches 40% of the spam here. But what is the FP rate? Is it safe for an ISP with a widely varied user base to use site-wide Bayes? - Charles

Re: [sa] Re: Spam from compromised web mails

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Jeff Koch wrote: I have to say that it is extremely annoying that this mailing list does not put a tag identifying itself in the subject line. Every other mailing list of a similar technical nature that I participate in has a tag. A tag of two characters would allow users t

Re: Spam from compromised web mails

2009-12-15 Thread RW
On Tue, 15 Dec 2009 09:44:50 -0500 Jeff Koch wrote: > > I have to say that it is extremely annoying that this mailing list > does not put a tag identifying itself in the subject line. Every > other mailing list of a similar technical nature that I participate > in has a tag. I'm exactly the op

Re: Spam from compromised web mails

2009-12-15 Thread Kai Schaetzl
Yet Another Ninja wrote on Tue, 15 Dec 2009 16:37:35 +0100: > even using site wide, autolearning will help your detection a LOT. Definitely. Been using site-wide for all my servers for years. No problems. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://

Re: Spam from compromised web mails

2009-12-15 Thread Matt Garretson
On 12/15/2009 10:37 AM, Yet Another Ninja wrote: > even using site wide, autolearning will help your detection a LOT. > Don't underestimate it... Heartily agreed. Site-wide bayes here (single database for 2000+ users) catches 40% of the spam here. It could certainly catch more, but the first

Re: Spam from compromised web mails

2009-12-15 Thread Yet Another Ninja
On 12/15/2009 4:07 PM, Rajkumar S wrote: On Tue, Dec 15, 2009 at 8:29 PM, Matt Garretson wrote: Do you use Bayes? Bogofilter (another bayesian filter) catches those here. The one you posted scored 0.94 here and would have been dropped. I am not using bayes as of now, SA is site wide and so

Re: Spam from compromised web mails

2009-12-15 Thread LuKreme
On 15-Dec-2009, at 04:39, Rajkumar S wrote: > On Tue, Dec 15, 2009 at 3:51 PM, Mike Cardwell > wrote: >> That particular email was sent from a host in Nigeria connecting to a host >> in Brazil. The Nigerian host is listed on Barracuda, the SBL and the XBL. > > Is there a way to write a rule to ta

Re: Spam from compromised web mails

2009-12-15 Thread Rajkumar S
On Tue, Dec 15, 2009 at 8:29 PM, Matt Garretson wrote: > Do you use Bayes?  Bogofilter (another bayesian filter) catches > those here.  The one you posted scored 0.94 here and would have > been dropped. I am not using bayes as of now, SA is site wide and so proper training is a problem. raj

Re: Spam from compromised web mails

2009-12-15 Thread Matt Garretson
On 12/15/2009 9:31 AM, The Doctor wrote: > On Tue, Dec 15, 2009 at 12:55:00PM +0530, Rajkumar S wrote: >> Occasionally I receive mail from compromised web mails asking user >> name and password from my users. The source IPs are usually clean (as >> they are legitimate mail servers) and do not catch

Re: Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 15:44:50 CET, Jeff Koch wrote in has a tag. A tag of two characters would allow users to quickly identify the email as coming from the SA mailing list and decide whether the email is worth opening. in the header: List-Id: in sieve filter: # spamassassin if anyo

Re: Spam from compromised web mails

2009-12-15 Thread Jeff Koch
I have to say that it is extremely annoying that this mailing list does not put a tag identifying itself in the subject line. Every other mailing list of a similar technical nature that I participate in has a tag. A tag of two characters would allow users to quickly identify the email as comin

Re: Spam from compromised web mails

2009-12-15 Thread The Doctor
On Tue, Dec 15, 2009 at 12:55:00PM +0530, Rajkumar S wrote: > Hi, > > Occasionally I receive mail from compromised web mails asking user > name and password from my users. The source IPs are usually clean (as > they are legitimate mail servers) and do not catch any ip based rules. > Usually one or

Re: Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 08:25:00 CET, Rajkumar S wrote I have pasted one such (slightly edited) mail at http://pastebin.ca/1715399 http://sa.hege.li/ to me it looks like a gmail user trying to get more users sending there login and passwords then what ever it really is ? -- xpoint http://www.u

Re: Spam from compromised web mails

2009-12-15 Thread Rajkumar S
On Tue, Dec 15, 2009 at 3:51 PM, Mike Cardwell wrote: > That particular email was sent from a host in Nigeria connecting to a host > in Brazil. The Nigerian host is listed on Barracuda, the SBL and the XBL. Is there a way to write a rule to tag mails which are hitting web mails via proxy? Receiv

Re: Spam from compromised web mails

2009-12-15 Thread Mike Cardwell
On 15/12/2009 07:25, Rajkumar S wrote: Occasionally I receive mail from compromised web mails asking user name and password from my users. The source IPs are usually clean (as they are legitimate mail servers) and do not catch any ip based rules. Usually one or two mail accounts are used to pump

Spam from compromised web mails

2009-12-14 Thread Rajkumar S
Hi, Occasionally I receive mail from compromised web mails asking user name and password from my users. The source IPs are usually clean (as they are legitimate mail servers) and do not catch any ip based rules. Usually one or two mail accounts are used to pump mails via web mail after authenticat