RE: this receive line only in spam

2005-07-18 Thread Menno van Bennekom
I would gladly block that 38.113.3.xx address in postfix like I blocked those other 2000 ip-segments but.. they are not the actual sender. They relay it to spambots I think: Received: from 127ppp11.telegraph.spb.ru (127ppp11.telegraph.spb.ru [213.158.11.127]) by *** (Postfix) with ESMTP id

Re: SA Headers not on Ham

2005-07-18 Thread Loren Wilton
Is the mail being filtered correctly, and you are seeing SA headers on spam, but not on ham? Or do you also have reason to believe that the mail isn't being filtered correctly? Some glue agents do their own version of SA headers, and may not feel the need to install headers on ham. Qmail may be

No general anti-spam rules in special configures

2005-07-18 Thread Thomas Booms
Hi all, I have a special problem with my qmail configure. In this case no tagging works, but the header lines appear normally so far I saw in the mail source. I have qmail installed from the site lifewithqmail.org. In my /var/qmail/users/assign file I have mixed entries like =domain.tld-pos

Re: HELP: Looking for mac mail server software

2005-07-18 Thread Patrick Sneyers
Postfix comes free with any OSX 10.3 or higher. In 10.2 you get Sendmail. http://www.messagepartners.com/products/mpp_free_edition.html Interfaces SA and Clamav with Postfix and others on OS X. Been using it for 2 months now, with CommuniGate Pro as Mail server. Good product. I wrote a how-

Removing entries from the "auto-whitelist"?

2005-07-18 Thread Dr Robert Young
I have some entries in the auto-whitelist that are "bogus" and give strong negative scores. How would one remove them w/out doing a "clean" or re-creating the auto-whitelist from scratch?

Re: Removing entries from the "auto-whitelist"?

2005-07-18 Thread Ed Kasky
On Mon, 18 Jul 2005, Dr Robert Young wrote: I have some entries in the auto-whitelist that are "bogus" and give strong negative scores. How would one remove them w/out doing a "clean" or re-creating the auto-whitelist from scratch? man spamassassin --remove-addr-from-whitelist=addr Remove

Spammer style messages ?

2005-07-18 Thread Brian Ipsen
Hi, Recently I've noticed at lot of spammer emails in html format containg entries like: perfume The text/word in the SPAN tags is random Has anyone implemented a rule to assign a high score for messages, which matches this pattern (with the "display: none" style) ?? Regards, /Brian

Spam Phone number

2005-07-18 Thread Martin.Carnegie
Title: Spam Phone number Hi All, I have been receiving lots of spam with something like the following.  Would it be possible to get this phone number added to Evil Numbers? The phone number always seems to be the same, but the extension is always changing. Microsoft Mail Internet Headers

Re: Spammer style messages ?

2005-07-18 Thread John Wilcock
Brian Ipsen wrote: Recently I've noticed at lot of spammer emails in html format containg entries like: perfume The text/word in the SPAN tags is random Has anyone implemented a rule to assign a high score for messages, which matches this pattern (with the "display: none" style) ?? I u

Re: HOWTO build milter-spamc on Mac/X "Tiger"

2005-07-18 Thread Andy Jezierski
Dr Robert Young <[EMAIL PROTECTED]> wrote on 07/17/2005 01:23:37 PM: > Just as an update to those who have an interest, > > gcc 4.0 and higher will cause problems with milter-spamc release   > 0.25. The configure script puts in params that changed between gcc   > 3.x and 4.x (specifically the -f

Re: Spammer style messages ?

2005-07-18 Thread Theo Van Dinter
On Mon, Jul 18, 2005 at 04:54:12PM +0200, John Wilcock wrote: > full local_DISPLAY_NONE /\bdisplay\s?:\s?none\b/i > describe local_DISPLAY_NONE Style with "display: none" CSS attribute > score local_DISPLAY_NONE 2.0 Ewww! At least do rawbody. Here's a rule of thumb: if you think you

Re: SA Headers not on Ham

2005-07-18 Thread Mosenior Moses
On Mon, 18 Jul 2005 14:25:38 -0400 Matt Kettler <[EMAIL PROTECTED]> wrote: > Loren Wilton wrote: > > Is the mail being filtered correctly, and you are seeing SA headers on spam, > > but not on ham? Or do you also have reason to believe that the mail isn't > > being filtered correctly? > > > > So

Re: whitelisting mistaken SORBS DUL listing locally? (fwd)

2005-07-18 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - --- Forwarded Message > Date:Sun, 17 Jul 2005 13:59:55 +0200 > From:[asf sysadmins] > Subject: Re: whitelisting mistaken SORBS DUL listing locally? > > --On July 14, 2005 12:36:23 PM -0700 Justin Mason <[EMAIL PROTECTED]> wrote: > > I

Re: Spammer style messages ?

2005-07-18 Thread Matt Kettler
John Wilcock wrote: Brian Ipsen wrote: Recently I've noticed at lot of spammer emails in html format containg entries like: perfume The text/word in the SPAN tags is random Has anyone implemented a rule to assign a high score for messages, which matches this pattern (with the "displa

Re: I am NOT a spammer

2005-07-18 Thread Matt Kettler
David Brodbeck wrote: Don Levey wrote: 1) Segregate dynamic IPs into one netblock, static IPs into another. I think as we get closer and closer to running out of IPv4 addresses, this is going to get less and less common. A lot of places can no longer afford to have IPs sitting around unused

Re: Fedora changed SpamAssassin default level to 7?

2005-07-18 Thread Steven W. Orr
On Monday, Jul 11th 2005 at 16:28 -0700, quoth Justin Mason: =>fyi, if you're using Fedora Core -- =>http://blog.dave.org.uk/archives/000715.html => =>totally unconfirmed, but worth noting in case that really is the =>case. => =>--j. => I'm running FC4 here and I thought I'd look. In my /usr/li

Re: SA Headers not on Ham

2005-07-18 Thread Matt Kettler
Loren Wilton wrote: Is the mail being filtered correctly, and you are seeing SA headers on spam, but not on ham? Or do you also have reason to believe that the mail isn't being filtered correctly? Some glue agents do their own version of SA headers, and may not feel the need to install headers

False positives "received from localhost"

2005-07-18 Thread up
I've had a couple of these since upgrading to 3.0.4. Headers with NO IP address in it, just this: Received: from localhost by (our server) I assume that if it's not a bug on my end, some users and/or servers are sending out from 127.0.0.1, which in turn sets off: RCVD_IN_BL_SPAMCOP_NET,RCVD_IN

[Spamassassin Wiki] Trivial Update of "FrontPage" by MooBer (fwd)

2005-07-18 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 anyone know what this nabble.com site is? it appears to be a mailing list archive of the users list, but I've never heard of it. (the edit is already reverted -- the wiki front page is not the appropriate place for this.) - --j. - --- Forwarded

Re: update on floating dividing score between spam and ham messages

2005-07-18 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 btw, I was just rereading this -- an interesting approach you might want to experiment with, is having *two* boundaries. ie: negative scores positive scores <|---|---

Re: Removing entries from the "auto-whitelist"?

2005-07-18 Thread Steven Dickenson
On Jul 18, 2005, at 9:08 AM, Dr Robert Young wrote: I have some entries in the auto-whitelist that are "bogus" and give strong negative scores. How would one remove them w/out doing a "clean" or re-creating the auto-whitelist from scratch? You've already asked this question and we've alread

Re[2]: Rule Advice

2005-07-18 Thread Robert Menschel
Hello dennis, Friday, July 15, 2005, 10:08:56 PM, you wrote: dsc> Ah, here is the From header: dsc> From: 360° Skin Care <[EMAIL PROTECTED]> dsc> Not 6 digits, but maybe the degree symbol is contributing. I'll advise not dsc> to start the username with 360°. Actually, that header is > From: =?is

Re: update on floating dividing score between spam and ham messages

2005-07-18 Thread Joe Flowers
Justin, Do you have suggestions on how I should come up with the two boundary lines and what do I do with the "unsure" messages? I'm all ears. Joe Justin Mason wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 btw, I was just rereading this -- an interesting approach you might want t