Re: Mail::SpamAssassin::Plugin::EmailBL??

2017-07-27 Thread hospice admin
Thanks. From: Kevin Golding Sent: 27 July 2017 14:41 To: users@spamassassin.apache.org Subject: Re: Mail::SpamAssassin::Plugin::EmailBL?? On Thu, 27 Jul 2017 08:28:06 +0100, hospice admin wrote: > the above plugin doesn't seem to be distributed

Re: Mail::SpamAssassin::Plugin::EmailBL??

2017-07-27 Thread Kevin Golding
On Thu, 27 Jul 2017 08:28:06 +0100, hospice admin wrote: the above plugin doesn't seem to be distributed with the version of SpamAssassin I'm running: spamassassin --version SpamAssassin version 3.4.0 running on Perl version 5.16.3 Also, I can't find mention of a download location anyw

Mail::SpamAssassin::Plugin::EmailBL??

2017-07-27 Thread hospice admin
Hi, the above plugin doesn't seem to be distributed with the version of SpamAssassin I'm running: spamassassin --version SpamAssassin version 3.4.0 running on Perl version 5.16.3 Also, I can't find mention of a download location anywhere. Am I right in thinking this was an experiment that

Re: emailBL devel ?

2009-11-24 Thread Yet Another Ninja
On 11/24/2009 7:10 PM, Benny Pedersen wrote: On tir 24 nov 2009 19:02:29 CET, Yet Another Ninja wrote seems simpler than adding 1 domains to freemail's config .-) that why i like to change it to be paidmail.pm with lists of paid domains got it now ? :) spammers can get any free domai

Re: emailBL devel ?

2009-11-24 Thread Benny Pedersen
On tir 24 nov 2009 19:02:29 CET, Yet Another Ninja wrote seems simpler than adding 1 domains to freemail's config .-) that why i like to change it to be paidmail.pm with lists of paid domains got it now ? :) spammers can get any free domain and it can continue as a freemail, but whe

Re: emailBL devel ?

2009-11-24 Thread Yet Another Ninja
On 11/24/2009 6:34 PM, Benny Pedersen wrote: On tir 24 nov 2009 18:30:15 CET, Yet Another Ninja wrote Freemail.pm plugin does it pretty well without the overhead and cron'd replication lag... just one problem with freemail it should list all domain as freemail as default, unless there is a cl

Re: emailBL devel ?

2009-11-24 Thread McDonald, Dan
On Tue, 2009-11-24 at 09:22 -0800, R-Elists wrote: > didnt anyone think that the emailBL project was good enough in adding an > extra factor of protection to continue development? I'm using it with a locally sourced set of "bad actors". Unfortunately, I don't believe I

Re: emailBL devel ?

2009-11-24 Thread Benny Pedersen
On tir 24 nov 2009 18:30:15 CET, Yet Another Ninja wrote Freemail.pm plugin does it pretty well without the overhead and cron'd replication lag... just one problem with freemail it should list all domain as freemail as default, unless there is a clear sign of payment to get it otherway aro

Re: emailBL devel ?

2009-11-24 Thread Benny Pedersen
On tir 24 nov 2009 18:22:25 CET, R-Elists wrote didnt anyone think that the emailBL project was good enough in adding an extra factor of protection to continue development? +1 even without more devel on it, what does miss ? so far i have just seen one big problem with it, dns servers

Re: emailBL devel ?

2009-11-24 Thread Yet Another Ninja
On 11/24/2009 6:22 PM, R-Elists wrote: didnt anyone think that the emailBL project was good enough in adding an extra factor of protection to continue development? - rh Freemail.pm plugin does it pretty well without the overhead and cron'd replication lag...

emailBL devel ?

2009-11-24 Thread R-Elists
didnt anyone think that the emailBL project was good enough in adding an extra factor of protection to continue development? - rh

Re: emailbl info update please ?

2009-07-01 Thread Yet Another Ninja
On 7/1/2009 4:41 PM, RobertH wrote: as announced, it has been disabled. i see... if it is determined to be the right thing to do, what is it going to take to get it back online and helping the cause? as with all BLs it takes: - data, lots of it. - some processing iron - mirrors - more mirr

RE: emailbl info update please ?

2009-07-01 Thread RobertH
> > as announced, it has been disabled. > i see... if it is determined to be the right thing to do, what is it going to take to get it back online and helping the cause? - rh

Re: emailbl info update please ?

2009-07-01 Thread Yet Another Ninja
On 7/1/2009 9:36 AM, RobertH wrote: so is emailbl offline since it is now 7/1/09 or has the term status changed? updates please? - rh as announced, it has been disabled.

emailbl info update please ?

2009-07-01 Thread RobertH
so is emailbl offline since it is now 7/1/09 or has the term status changed? updates please? - rh

Re: Reminder: EmailBL test zone will shut down July 1st

2009-06-26 Thread Michael Monnerie
On Dienstag 23 Juni 2009 Justin Mason wrote: > that's ok, we take that into account.  it does pretty well against > zmi's corpus in particular. Yeah, also helped in real live. Quite a few messages were finally tagged as spam because of EMAILBL, with no reported FP. It's a

Re: Reminder: EmailBL test zone will shut down July 1st

2009-06-23 Thread Justin Mason
On Tue, Jun 23, 2009 at 14:32, Henrik K wrote: > On Tue, Jun 23, 2009 at 03:24:03PM +0200, Benny Pedersen wrote: >> >> On Tue, June 23, 2009 10:04, Henrik K wrote: >> >> > Thanks for testing. If you have bad memory, you might as well disable it >> > already. :) >> >> thanks for the code of this plu

Re: Reminder: EmailBL test zone will shut down July 1st

2009-06-23 Thread Henrik K
On Tue, Jun 23, 2009 at 03:24:03PM +0200, Benny Pedersen wrote: > > On Tue, June 23, 2009 10:04, Henrik K wrote: > > > Thanks for testing. If you have bad memory, you might as well disable it > > already. :) > > thanks for the code of this plugin and dns data, to know more what will > happend i

Re: Reminder: EmailBL test zone will shut down July 1st

2009-06-23 Thread Benny Pedersen
On Tue, June 23, 2009 10:04, Henrik K wrote: > Thanks for testing. If you have bad memory, you might as well disable it > already. :) thanks for the code of this plugin and dns data, to know more what will happend i like to ask: will you update this plugin again ? will some results from the tes

Reminder: EmailBL test zone will shut down July 1st

2009-06-23 Thread Henrik K
Referring to: http://sa.hege.li/EmailBL.pm http://sa.hege.li/EmailBL.cf http://sa.hege.li/emailbl_lemfreemail.cf Thanks for testing. If you have bad memory, you might as well disable it already. :) We'll see if it comes back in public. But the idea and plugin is out there, so nothing prevents s

Re: EmailBL future

2009-05-28 Thread Yet Another Ninja
On 5/28/2009 6:40 PM, Marc Perkel wrote: Yet Another Ninja wrote: On 5/28/2009 6:27 PM, Marc Perkel wrote: What do you need to make it survive? It works great for me. I won't be involved at all. It needs data, mirrors, zone, all what a RBL needs. I'll do the mirrors - provide server - I ha

Re: EmailBL future

2009-05-28 Thread Marc Perkel
Yet Another Ninja wrote: On 5/28/2009 6:27 PM, Marc Perkel wrote: What do you need to make it survive? It works great for me. I won't be involved at all. It needs data, mirrors, zone, all what a RBL needs. I'll do the mirrors - provide server - I have data - I don't have what you are using

Re: EmailBL future

2009-05-28 Thread Yet Another Ninja
On 5/28/2009 6:27 PM, Marc Perkel wrote: What do you need to make it survive? It works great for me. I won't be involved at all. It needs data, mirrors, zone, all what a RBL needs. Yet Another Ninja wrote: As you all know, on July 1st the emailbl.me test zone will go dark. I helped Henrik

Re: EmailBL future

2009-05-28 Thread Marc Perkel
What do you need to make it survive? It works great for me. Yet Another Ninja wrote: As you all know, on July 1st the emailbl.me test zone will go dark. I helped Henrik test the plugin and find mirrors for the data which was being fed by feeds dedicated to this test only. Would be nice to se

EmailBL future

2009-05-28 Thread Yet Another Ninja
As you all know, on July 1st the emailbl.me test zone will go dark. I helped Henrik test the plugin and find mirrors for the data which was being fed by feeds dedicated to this test only. Would be nice to see the concept/project/survive. Maybe some of you can come up with something. I have no

Re: EmailBL stats

2009-05-28 Thread Michael Monnerie
On Samstag 23 Mai 2009 Chris wrote: > EmailB Of 71 messages where EMAILBL hit, 3 were still marked ham but really spam (points: 2.0, 3.0, 3.1), no FPs. One message was just pushed over 5.0 by EMAILBL and would have been a FN otherwise. So it helps here. We have a very hard setup and only

Re: Stats (was: The EmailBL test zone period has been extended to July 1st.)

2009-05-26 Thread Justin Mason
btw guys, note that hit-frequencies can also produce rule-overlap reports using the "-o" switch --j. On Tue, May 26, 2009 at 00:57, Mandy wrote: > On Fri, May 22, 2009 at 9:06 PM, Henrik K wrote: >> On Fri, May 22, 2009 at 09:28:55PM +0200, Karsten Bräckelmann wrote: >

Re: Stats (was: The EmailBL test zone period has been extended to July 1st.)

2009-05-25 Thread Mandy
On Fri, May 22, 2009 at 9:06 PM, Henrik K wrote: > On Fri, May 22, 2009 at 09:28:55PM +0200, Karsten Bräckelmann wrote: >> > The EmailBL test zone period has been extended to July 1st. [snip] > Thanks. And this is just a small scale test. If we used more domains, feeds, > a

Re: Stats (was: The EmailBL test zone period has been extended to July 1st.)

2009-05-23 Thread Karsten Bräckelmann
Sorry, quoting self. > > > An interesting observation is, that the hitrate (in percent) in spam > > > scoring < 15 is an order of magnitude higher than with high-scoring [1] > > > spam. This is rare to find... > That's limited to EmailBL hits, so the total o

Re: Stats (was: The EmailBL test zone period has been extended to July 1st.)

2009-05-23 Thread Karsten Bräckelmann
tagged with EMAILBL_TEST_LEM: > > 04.5% scored 00.0 - 05.0 > 03.0% scored 05.0 - 10.0 > 04.5% scored 10.0 - 15.0 > 09.1% scored 15.0 - 20.0 > 78.8% scored 20.0 or higher That's limited to EmailBL hits, so the total of these hits equal 100%. For me that would have been: 19

Re: Stats (was: The EmailBL test zone period has been extended to July 1st.)

2009-05-23 Thread Larry Nedry
On 5/22/09 at 9:28 PM +0200 Karsten Bräckelmann wrote: >An interesting observation is, that the hitrate (in percent) in spam >scoring < 15 is an order of magnitude higher than with high-scoring [1] >spam. This is rare to find... My EMAILBL_TEST_LEM hitrate leans heavily toward the other end of the

Re: Stats (was: The EmailBL test zone period has been extended to July 1st.)

2009-05-23 Thread Chris
On Sat, 2009-05-23 at 07:06 +0300, Henrik K wrote: > Thanks. And this is just a small scale test. If we used more domains, feeds, > and submissions, it could be even nicer. ;-) Keep the reports coming in. It > would be nice to also know how much of spam are generally from freemails, so > FREEMAIL_

Re: EmailBL stats

2009-05-23 Thread Chris
On Sat, 2009-05-23 at 16:43 +0200, Karsten Bräckelmann wrote: > > > > Those are not the total spam for the day but the cumulative spam from > > one day to the next. Though the percentile if figured on the total > > Ah, yees. :) Thanks. I was missing the base before y

Re: EmailBL stats

2009-05-23 Thread Karsten Bräckelmann
m from > one day to the next. Though the percentile if figured on the total Ah, yees. :) Thanks. I was missing the base before you enabled EmailBL. So that draws another picture than the per-month percentage above: 11 hits / 95 spam == 11.6% Out of curiosity, do you run any SMTP time chec

RE: Stats (was: The EmailBL test zone period has been extended toJuly 1st.)

2009-05-23 Thread McDonald, Dan
-Original Message- From: Henrik K [mailto:h...@hege.li] Sent: Fri 22-May-09 23:06 To: users@spamassassin.apache.org Subject: Re: Stats (was: The EmailBL test zone period has been extended toJuly 1st.) >On Fri, May 22, 2009 at 09:28:55PM +0200, Karsten Bräckelmann wrote: >> >

Re: Stats (was: The EmailBL test zone period has been extended to July 1st.)

2009-05-22 Thread Henrik K
On Fri, May 22, 2009 at 09:28:55PM +0200, Karsten Bräckelmann wrote: > > The EmailBL test zone period has been extended to July 1st. > > As promised, here are some results from me, now that I got some half- > decent spam throughput. Not an ISP, not a company. Have been running th

Re: EmailBL stats

2009-05-22 Thread Chris
On Sat, 2009-05-23 at 04:11 +0200, Karsten Bräckelmann wrote: > What about some grep love, and splitting that up in at least less and > greater than a total of score 15? See my post about 6 hours ago, and > considerably more hits in the low-ish scoring spam. > > > > Spam: 192 > > (thats a total

Re: EmailBL stats

2009-05-22 Thread Karsten Bräckelmann
What about some grep love, and splitting that up in at least less and greater than a total of score 15? See my post about 6 hours ago, and considerably more hits in the low-ish scoring spam. > Spam: 192 > (thats a total count since 3 May) > > Totals since last Thursday 14 May > Rule Name

EmailBL stats

2009-05-22 Thread Chris
Ham: 329 Spam: 192 (thats a total count since 3 May) Totals since last Thursday 14 May EmailBL.cf: Rule NameScore Ham Spam %of Ham %of Spam --- EMAILBL_TEST_LEM 0.50 0 11 0.

Stats (was: The EmailBL test zone period has been extended to July 1st.)

2009-05-22 Thread Karsten Bräckelmann
> The EmailBL test zone period has been extended to July 1st. As promised, here are some results from me, now that I got some half- decent spam throughput. Not an ISP, not a company. Have been running the original cf for 5 days, then updated. Since then another 5 days passed. 8.7% hits

Re: The EmailBL test zone period has been extended to July 1st.

2009-05-22 Thread McDonald, Dan
On Fri, 2009-05-22 at 12:07 +0200, Yet Another Ninja wrote: > FYI: > > The EmailBL test zone period has been extended to July 1st. Since it has been extended, I decided to go ahead and fire it up this morning. I'm mainly looking at overlap. It seems to be relatively distinct fr

Re: emailbl production server testing

2009-05-22 Thread Benny Pedersen
On Fri, May 22, 2009 17:37, RobertH wrote: > if there is more i can do to help the dev, please contact me off list for > more personal debug info use dkim, and add to local.cf whitelist_auth undisclosed-recipient[at]yahoo.com changeing at to @ or did yahoo stop using domain keys ? -- http:

Re: The EmailBL test zone period has been extended to July 1st.

2009-05-22 Thread Bowie Bailey
uture run. You can also make pretty foolproof metas from (emailbl && freemail_replyto) etc. So far, the rule has hit on less than 3% of my spam and there were a total of 2 cases where a higher score on this rule would have made a difference. Of course things can always change in the fu

Re: The EmailBL test zone period has been extended to July 1st.

2009-05-22 Thread Henrik K
ou can also make pretty foolproof metas from (emailbl && freemail_replyto) etc.

emailbl production server testing

2009-05-22 Thread RobertH
greetings, we are testing emailbl & scoring it 0.5 for now. i am *hoping* to increase the score since i have seen 3 emails make it through that should have been rejected. yet, when hand checking the results in the logs today i came across this in relationship to an email score properly by S

Re: The EmailBL test zone period has been extended to July 1st.

2009-05-22 Thread Bowie Bailey
Yet Another Ninja wrote: FYI: The EmailBL test zone period has been extended to July 1st. The plugin and rules files can be found at: http://sa.hege.li/ EmailBL.pm & EmailBL.cf & emailbl_lemfreemail.cf Here are some stats for you from a low-volume server: Total emails scanned: 142

The EmailBL test zone period has been extended to July 1st.

2009-05-22 Thread Yet Another Ninja
FYI: The EmailBL test zone period has been extended to July 1st. The plugin and rules files can be found at: http://sa.hege.li/ EmailBL.pm & EmailBL.cf & emailbl_lemfreemail.cf

Re: EmailBL plugin released

2009-05-20 Thread Justin Mason
On Tue, May 19, 2009 at 13:24, Steve Freegard wrote: > Justin Mason wrote: >> http://ruleqa.spamassassin.org/20090516-r775436-n/T_EMAILBL_TEST_LEM/detail > > Would be interesting to see if the 5 ham hits really were ham or whether > they were accidentally misclassified and what the e-mail address

EmailBL Stats

2009-05-20 Thread Chris
Ham: 294 Spam: 163 EmailBL.cf: Rule Name Score Ham Spam %of Ham %of Spam --- EMAILBL_TEST_LEM 0.50 0 10 0.00% 6.13% --

Re: EmailBL hit count

2009-05-19 Thread Michael Monnerie
On Dienstag 19 Mai 2009 Karsten Bräckelmann wrote: > Again, I believe the "your fault" wasn't the intention. But that this > is a test, *needs* testers, and you can do it without *any* impact to > your results. Yes of course. I just meant you can't ask people to use your tests and then blame them

Re: EmailBL plugin released - I like it!

2009-05-19 Thread Jesse Thompson
Yet Another Ninja wrote: from the descriptions you are using, you are speaking about a totally different BL... this is not the one "in googlegroups". ah, my bad. I didn't know that the term 'EmailBL' was used generically. Jesse -- Jesse Thompson Division

Re: EmailBL plugin released - I like it!

2009-05-19 Thread Yet Another Ninja
On 5/19/2009 4:02 PM, Jesse Thompson wrote: Henrik K wrote: First we should test if there actually are such FPs and not speculate. ;) There are FPs by nature. Some of the accounts are legitimate accounts co-opted by spammers to send the phishing attempts to compromise more accounts. Use t

Re: EmailBL hit count

2009-05-19 Thread Karsten Bräckelmann
On Mon, 2009-05-18 at 21:19 -0600, LuKreme wrote: > On 18-May-2009, at 19:02, Michael Monnerie wrote: > > I didn't mean that the final result be a FP, just this one ruleset. > > Shouldn't the goal be to have no FPs and lots of corrects? > > In a word? No. I don't think you understood what that DN

Re: EmailBL plugin released - I like it!

2009-05-19 Thread Jesse Thompson
Henrik K wrote: First we should test if there actually are such FPs and not speculate. ;) There are FPs by nature. Some of the accounts are legitimate accounts co-opted by spammers to send the phishing attempts to compromise more accounts. Use the list with caution, and pay attention to th

Re: EmailBL plugin released

2009-05-19 Thread Steve Freegard
Justin Mason wrote: > http://ruleqa.spamassassin.org/20090516-r775436-n/T_EMAILBL_TEST_LEM/detail Would be interesting to see if the 5 ham hits really were ham or whether they were accidentally misclassified and what the e-mail address was. Cheers, Steve.

Re: EmailBL plugin released

2009-05-19 Thread Justin Mason
ntry for this zone? > > --j. > > On Tue, May 12, 2009 at 11:26, Yet Another Ninja wrote: >> On 5/12/2009 11:20 AM, Henrik K wrote: >>> >>> Hi, >>> >>> EmailBL plugin is now available for testing. Small test zone has been >>> running for

Re: EmailBL hit count

2009-05-18 Thread LuKreme
On 18-May-2009, at 19:02, Michael Monnerie wrote: I didn't mean that the final result be a FP, just this one ruleset. Shouldn't the goal be to have no FPs and lots of corrects? In a word? No. Test are designed to be cumulative. Something that is seen 75% of the time in spam and 25% of the t

Re: EmailBL hit count

2009-05-18 Thread Karsten Bräckelmann
On Tue, 2009-05-19 at 03:02 +0200, Michael Monnerie wrote: > On Sonntag 17 Mai 2009 Yet Another Ninja wrote: > > > That said, I'll implement and test it, and hopefully it's good, > > > with no FPs. > > > > How can score of 0.001 cause a false positive? > > I didn't mean that the final result be a

Re: EmailBL hit count

2009-05-18 Thread Michael Monnerie
stomers in their back. I didn't want to insult anybody, but it should be clear that if a ruleset is to be used it should have an advantage. I installed it on a small server getting about 73.800 connects a day, of which 70.400 are immediately rejected (34.000 because of RBL listing). Final in

Re: EmailBl Stats

2009-05-18 Thread Jason Haar
Well since we're all doing show-and-tell, so far in the past 24 hours 2310 email have triggered the EMAILBL* rules, of which (with the default 0.5 score) 70 were FN i.e. if I increased the score to 2, all those 70 would have been marked as spam (and I checked: they were spam) -- Cheers

Re: EmailBl Stats

2009-05-18 Thread DAve
Karsten Bräckelmann wrote: On Mon, 2009-05-18 at 10:50 -0400, DAve wrote: I will see about the update, for now the last five days stats are as follows. Total mail through SA = 208,498 Total spam messages tagged with EMAILBL = 1471 Total non spam messages tagged with EMAILBL = 128 What

Re: EmailBl Stats

2009-05-18 Thread Karsten Bräckelmann
On Mon, 2009-05-18 at 10:50 -0400, DAve wrote: > I will see about the update, for now the last five days stats are as > follows. > > Total mail through SA = 208,498 > Total spam messages tagged with EMAILBL = 1471 > Total non spam messages tagged with EMAILBL = 128 What exactl

Re: EmailBl Stats

2009-05-18 Thread Steve Freegard
most popular ones). There's been few added, so you might want to download > it daily: > Slightly different set of stats from me as I'm not running it in SA but rejecting at SMTP time. Here's the stats from the last two hours when I enabled the querying of the emailbl: 214-2

Re: EmailBl Stats

2009-05-18 Thread Art Greenberg
I installed the plugin last Tuesday. As of this morning (using the original domain list): Total Messages Processed: 2933 Number identified as spam: 2464 Total number tagged by EMAILBL: 7 Number of FNs tagged by EMAILBL: 2 The two FNs scored a 3. So if EMAILBL had enough weight, SA would have

Re: EmailBl Stats

2009-05-18 Thread DAve
the update, for now the last five days stats are as follows. Total mail through SA = 208,498 Total spam messages tagged with EMAILBL = 1471 Total non spam messages tagged with EMAILBL = 128 FP seen = 0 (fully %80 of our traffic never gets to SA) DAve -- "Posterity, you will know how much

Re: EmailBL hit count

2009-05-17 Thread Bill Landry
LuKreme wrote: > On 17-May-2009, at 06:32, Yet Another Ninja wrote: >> On 5/17/2009 2:09 PM, LuKreme wrote: >>> On 16-May-2009, at 21:25, Bill Landry wrote: >>>> LuKreme wrote: >>>>> grep EMAILBL /var/log/maillog.1 | grep -v "is spam" | wc -

Re: EmailBL hit count

2009-05-17 Thread LuKreme
On 17-May-2009, at 06:32, Yet Another Ninja wrote: On 5/17/2009 2:09 PM, LuKreme wrote: On 16-May-2009, at 21:25, Bill Landry wrote: LuKreme wrote: grep EMAILBL /var/log/maillog.1 | grep -v "is spam" | wc -l ?? How is that going to work if you are telling grep to output everyt

Re: EmailBL hit count

2009-05-17 Thread Yet Another Ninja
On 5/17/2009 3:41 PM, Steve Freegard wrote: Who cares if they have strict blocks on stuff coming in to their network - an EMAILBL listing is all about whether or not spammers/scammers use their service for drop-boxes, spew mail out from their service or use their domain name. Whereas URIBLs

Re: EmailBL hit count

2009-05-17 Thread Steve Freegard
Michael Monnerie wrote: > I generally like the idea. But this project is in the beginners phase, > and a whole lot of people will want to wait until others report it's > benefits. After all, who wishes to put it in production and then maybe > it causes a lot of FPs? Duh: sc

Re: EmailBL hit count

2009-05-17 Thread Yet Another Ninja
I immeditately see that GMX is currently not listed in EMAILBL. It's a big player in the DACH region (Germany, Austria, Switzerland). They have a hard anti spam setup (e.g. not accepting mails from hosts without reverse IP DNS entries, aka PTR Records), so maybe it's not worth to list

Re: EmailBL hit count

2009-05-17 Thread Michael Monnerie
description of where e- mail reports will come from, nobody knows how good the list will be then. That said, I'll implement and test it, and hopefully it's good, with no FPs. I immeditately see that GMX is currently not listed in EMAILBL. It's a big player in the DACH region (

Re: EmailBL hit count

2009-05-17 Thread Yet Another Ninja
On 5/17/2009 2:09 PM, LuKreme wrote: On 16-May-2009, at 21:25, Bill Landry wrote: LuKreme wrote: grep EMAILBL /var/log/maillog.1 | grep -v "is spam" | wc -l ?? How is that going to work if you are telling grep to output everything that does NOT contain "is spam" (-v =

Re: EmailBL hit count

2009-05-17 Thread LuKreme
On 16-May-2009, at 21:25, Bill Landry wrote: LuKreme wrote: grep EMAILBL /var/log/maillog.1 | grep -v "is spam" | wc -l ?? How is that going to work if you are telling grep to output everything that does NOT contain "is spam" (-v = select non-matching lines)? Right.

Re: EmailBL hit count

2009-05-16 Thread Bill Landry
LuKreme wrote: > On 16-May-2009, at 02:43, Yet Another Ninja wrote: >> On 5/13/2009 9:33 AM, Yet Another Ninja wrote: >>> Assuming Henrik may appreciate some stats, even if minimal like below: >>> Yesterday's hits: >>> grep EMAILBL/var/log/maillog

Re: EmailBL hit count

2009-05-16 Thread LuKreme
On 16-May-2009, at 02:43, Yet Another Ninja wrote: On 5/13/2009 9:33 AM, Yet Another Ninja wrote: Assuming Henrik may appreciate some stats, even if minimal like below: Yesterday's hits: grep EMAILBL/var/log/maillog.1 | wc -l 1263 Friday's count: grep 'is spam'

Re: EmailBl Stats

2009-05-16 Thread Henrik K
On Sat, May 16, 2009 at 08:25:58AM -0500, Chris wrote: > Started running the plug-in Thursday and though I don't get much spam a > day I am getting hits: > > Ham: 232 > Spam: 113 > (thats a total count since 3 May) > > EmailBL.cf: > Rule Name Score Ham Spam %of Ham %of

EmailBl Stats

2009-05-16 Thread Chris
Started running the plug-in Thursday and though I don't get much spam a day I am getting hits: Ham: 232 Spam: 113 (thats a total count since 3 May) EmailBL.cf: Rule Name Score Ham Spam %of Ham %of Spam ---

Re: EmailBL hit count

2009-05-16 Thread Yet Another Ninja
On 5/13/2009 9:33 AM, Yet Another Ninja wrote: Assuming Henrik may appreciate some stats, even if minimal like below: Yesterday's hits: grep EMAILBL/var/log/maillog.1 | wc -l 1263 Friday's count: grep 'is spam'/var/log/maillog.1 | wc -l 22397 grep EMAILBL

Re: EmailBL plugin released

2009-05-14 Thread Marc Perkel
s - I can provide you with 6 mirrors Let me know if I can help. Henrik K wrote: Hi, EmailBL plugin is now available for testing. Small test zone has been running for a while, it contains trapped addresses from some of the most popular freemail domains. http://sa.hege.li/EmailBL.pm (see insid

Re: EmailBL plugin released - I like it!

2009-05-13 Thread Charles Gregory
On Wed, 13 May 2009, Henrik K wrote: Still no description of how an address is chosen for inclusion in the RBL blacklist itself. Still wouldn't mind knowing this, unless you fear it would sharing a secret with spammers that they could use to get around this test... First we should test if ther

Re: EmailBL hit count

2009-05-13 Thread DAve
Yet Another Ninja wrote: Assuming Henrik may appreciate some stats, even if minimal like below: Yesterday's hits: grep EMAILBL/var/log/maillog.1 | wc -l 1263 Not so good here, well good, but not so usable on the spam we see. Total messages tagged as spam by SA was 29k, 290 tagg

Note about FreeMail and EmailBL

2009-05-13 Thread Henrik K
It seems I've forgotten how SA loads things.. All the loadplugin clauses should be moved from .cf to .pre files. If any of you are using 90_sare_freemail.cf, it isn't in effect, since cf files are sorted in order of digits, uppercase, lowercase. No problem with files from my site, as I've had th

Re: EmailBL plugin released - I like it!

2009-05-13 Thread Henrik K
On Tue, May 12, 2009 at 05:23:07PM -0400, Charles Gregory wrote: > > Still no description of how an address is chosen for inclusion in > the RBL blacklist itself. Particularly where the (often forged) > "From" header is being used, how does the list avoid FP's? First we should test if there actual

EmailBL hit count

2009-05-13 Thread Yet Another Ninja
Assuming Henrik may appreciate some stats, even if minimal like below: Yesterday's hits: grep EMAILBL/var/log/maillog.1 | wc -l 1263

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Charles Gregory
On Tue, 12 May 2009, Yet Another Ninja wrote: Oh.. you must have skipped the first 52 lines of EmailBL.pm No I can *now* see the two lines that say where the module gathers addresses from. If they were there before, my apologies. But I read that section of the module pretty closely. St

Re: EmailBL plugin released

2009-05-12 Thread Henrik K
On Tue, May 12, 2009 at 04:47:25PM +0200, Wolfgang Zeikat wrote: > Hi > > On 05/12/2009 11:20 AM, Henrik K wrote: >> http://sa.hege.li/EmailBL.pm (see inside for documentation) > > ### About: > # > # This plugin creates rbl style DNS lookups for emails. > > does this plugin handle emails in the se

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Yet Another Ninja
On 5/12/2009 5:45 PM, Charles Gregory wrote: I haven't been following the long thread about this plugin. When I followed the links and examined the code/docs, I found that I really didn't have a sense of WHAT this plugin does. At first I thought it was checking for spam 'reply' e-mail addresses

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Charles Gregory
I haven't been following the long thread about this plugin. When I followed the links and examined the code/docs, I found that I really didn't have a sense of WHAT this plugin does. At first I thought it was checking for spam 'reply' e-mail addresses within the body of an e-mail (the often used

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Yet Another Ninja
elf explained. Mark's idea is very errr... Perkelian? .-) This won't solve your spam problem but it may help. It won't deliver Esspressos, do your laundry or walk the dog, but if all goes well it might... grep EMAILBL/var/log/maillog | wc -l 384. help tag some low scored stuff.

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Charles Gregory
On Tue, 12 May 2009, Marc Perkel wrote: > Here's how you do it in Exim your idea is a has a MASSIVE drawback. It queries the mailbl for EVERY address... That's not the whole code that I'm using. I'm just demonstrating the concept of how you would make it usable from Exim. I have a lot of othe

Re: EmailBL plugin released

2009-05-12 Thread Yet Another Ninja
On 5/12/2009 5:02 PM, Marc Perkel wrote: Do you need more mirrors? I can offer you 4 additional servers. This is all a proof of concept thing and nobody knows what the outcome may be. This zone will disappear in +- 30 days. and unless the mirrors complain that the load is rising a lot, I d

Re: EmailBL plugin released

2009-05-12 Thread Marc Perkel
Do you need more mirrors? I can offer you 4 additional servers. Henrik K wrote: Hi, EmailBL plugin is now available for testing. Small test zone has been running for a while, it contains trapped addresses from some of the most popular freemail domains. http://sa.hege.li/EmailBL.pm (see

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Marc Perkel
Yet Another Ninja wrote: On 5/12/2009 4:32 PM, Marc Perkel wrote: I'm not using your plugin yet but using it from Exim instead and it's working well. Lots of hist. I suppose we'll find out if there's any false positives. Here's how you do it in Exim set acl_c_from_address = ${lc:${address:

Re: EmailBL plugin released

2009-05-12 Thread Justin Mason
I've added it to SVN for testing -- my sandbox for now, but I'll move it to Alex's once his acct is set up ;) is there a test entry for this zone? --j. On Tue, May 12, 2009 at 11:26, Yet Another Ninja wrote: > On 5/12/2009 11:20 AM, Henrik K wrote: >> >> H

Re: EmailBL plugin released

2009-05-12 Thread Wolfgang Zeikat
Hi On 05/12/2009 11:20 AM, Henrik K wrote: http://sa.hege.li/EmailBL.pm (see inside for documentation) ### About: # # This plugin creates rbl style DNS lookups for emails. does this plugin handle emails in the sense of "email addresses"? Or does it make md5hashes of emails in the sense of "

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Yet Another Ninja
On 5/12/2009 4:32 PM, Marc Perkel wrote: I'm not using your plugin yet but using it from Exim instead and it's working well. Lots of hist. I suppose we'll find out if there's any false positives. Here's how you do it in Exim set acl_c_from_address = ${lc:${address:$h_From:}} set acl_c_from_ad

Re: EmailBL plugin released - I like it!

2009-05-12 Thread Marc Perkel
I'm not using your plugin yet but using it from Exim instead and it's working well. Lots of hist. I suppose we'll find out if there's any false positives. Here's how you do it in Exim set acl_c_from_address = ${lc:${address:$h_From:}} set acl_c_from_address_hash = ${md5:$acl_c_from_address} dn

Re: EmailBL plugin released

2009-05-12 Thread Yet Another Ninja
On 5/12/2009 11:20 AM, Henrik K wrote: Hi, EmailBL plugin is now available for testing. Small test zone has been running for a while, it contains trapped addresses from some of the most popular freemail domains. http://sa.hege.li/EmailBL.pm (see inside for documentation) http://sa.hege.li

EmailBL plugin released

2009-05-12 Thread Henrik K
Hi, EmailBL plugin is now available for testing. Small test zone has been running for a while, it contains trapped addresses from some of the most popular freemail domains. http://sa.hege.li/EmailBL.pm (see inside for documentation) http://sa.hege.li/EmailBL.cf (contains the test zone) http

Re: 419 emailBL?

2009-05-04 Thread Henrik K
updating? They can simply be updated with sa-update. It's strange that someone would have to "defend" this. > This wasn't intended as a list to download. I didn't even check the > license. I was simply replying to your "I'm surprised there still hasn'

  1   2   >