Spamassassin and mystic generated mails..

It happens once in a while that I get mails with subjects like: Subject: Re[3]: talk thread about his pills and it contains a bunch of random char words, and lots of links to like "Eugene.subsidises.net" where in the Eugene varies inside the mail and sibidises between the mail.. So is it possibl

Bayes Training

Hi, I'm trying to figure out a proper way how to teach spamassassin new spam. I'm using v. 3.04. My Setup consists of Sendmail and Spamassassin (via procmail). Subsequently mail is retrieved by users using POP3. When spam messages and not detected, my users typically forward this spam as an rfc82

Re: Spamassassin and mystic generated mails..

The spamcop uri tests and URIBL are your friends here. They will probably catch those links and mark the thing out of consideration, unless you are one of the unlucky few that get new links in the first few minutes. I haven't figures out why that particular form of obfuscation is showing up in th

Re: Bayes Training

> As you can see the second 'From' is the true spammer, whilst the first > 'From' is my own reporting account. My worry here is that bayes will use my > reporting account as a 'shortcut'. Is there any way of avoiding this (i.e. > can I tell bayes to ignore the first from header but not the second)?

RE: DCC vs Razor2

William Albert wrote: > Dr Robert Young wrote: > >> We have been using Razor2 for some time on SA 3.0.4. I was recently >> reading about DCC. We have never tried it, so I was wondering about >> opinions as to its use. How effective is it? Should it be used with, >> or in place of, Razor? > > Spam

RE: Bayes Training

-Original Message- From: Loren Wilton [mailto:[EMAIL PROTECTED] Sent: 10 August 2005 11:43 To: users@spamassassin.apache.org Subject: Re: Bayes Training > As you can see the second 'From' is the true spammer, whilst the first > 'From' is my own reporting account. My worry here is that bay

SA doesn't use my scores from local.cf

Hi, I have a problem with SpamAssassin. I would appreciate if someone could help me.  My setup is: I’ve upgraded to SpamAssassin version 3.0.3  running on Perl version 5.8.0. I am using in conjunction with spamass-milter - Version 0.3.0 and Sendmail 8.12.11. The OS is RHEL 3.   Spamd runs as no

Re: When is Bulk "Bulk"

Loren Wilton wrote: My $.02 here... Why doesn't he put together a nice presentation package and mail it to them? I think I know the real reason -- it costs money. It could be argued that sending an email costs money, but hardly the cost of putting together a decent presentation on a few sheets of

spamassassin --lint failed, Rules Du Jour

Hello! Just started with Rules Du Jour, and added a couple of rules. When running rulesdujour, I get the followin messages, how do I check what happened and straighten it out? How do I enable debug? Complete log attached as a file. /Andy ***WARNING***: spamassassin --lint failed. Rolling

Statistics for Spamassassin / Spam

Hi there, it would be nice to hear of some statistical tools you are using, to analyze how much spam SA filtered during a period of some time. Any out ther? Maybe some generating nice HTML output or something? kind regards claude

Re: spamassassin --lint failed, Rules Du Jour

Ahh Found out how to get the debug messages, running spamassassin with --lint and debug.. Starting to look through the messages, not found anything yet... including them for your enjoyment.. /Andy / Andrew Markebo <[EMAIL PROTECTED]> wrote: | Hello! | | Just started with Rules Du Jour, and

Re: Spamassassin and mystic generated mails..

>... >It happens once in a while that I get mails with subjects like: > >Subject: Re[3]: talk thread about his pills > >and it contains a bunch of random char words, and lots of links to >like "Eugene.subsidises.net" where in the Eugene varies inside the >mail and sibidises between the mail.. > >So

RE: When is Bulk "Bulk"

From: Greg Allen [mailto:[EMAIL PROTECTED] > > But I must say, some people on the list appear to be giving their own > personal opinion as if they are only referring to their own email inbox, > without regard to users on their system. Maybe they are not really > administrators of multi-user system

RE: AutoWhiteList

Since waiting for a reply concerning my issue, I pulled the src.rpm off the CD. 3.0.1 and installed it, and still the same problemwhy is my auto-whitelist file(s) not showing up? -Original Message- From: Casey King [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 09, 2005 3:15 PM To: us

Re: Bayes Training

Joe Borg wrote: > When spam messages and not detected, my users typically forward this > spam as an rfc822 attachment to a special account > ([EMAIL PROTECTED]). I was then thinking of bouncing the actual > attachment (spam) to another specific account ([EMAIL PROTECTED]), Any reason you don't jus

Re: When is Bulk "Bulk"

On Aug 10, 2005, at 5:02 AM, JamesDR wrote: Loren Wilton wrote: My $.02 here... Why doesn't he put together a nice presentation package and mail it to them? I think I know the real reason -- it costs money. It could be argued that sending an email costs money, but hardly the cost of putting

Re: SA doesn't use my scores from local.cf

ddaasd wrote: > Hi, > I have a problem with SpamAssassin. I would appreciate if someone could > help me. > > My setup is: > > I’ve upgraded to SpamAssassin version 3.0.3 running on Perl version > 5.8.0. I am using in conjunction with spamass-milter - Version 0.3.0 and > Sendmail 8.12.11. The OS

Re: When is Bulk "Bulk"

From: "John Rudd" <[EMAIL PROTECTED]> On Aug 10, 2005, at 5:02 AM, JamesDR wrote: Loren Wilton wrote: My $.02 here... Why doesn't he put together a nice presentation package and mail it to them? I think I know the real reason -- it costs money. It could be argued that sending an email costs

Re: DCC vs Razor2

On Tue, Aug 09, 2005 at 02:04:20PM -0400, Dr Robert Young wrote: > We have been using Razor2 for some time on SA 3.0.4. I was recently > reading about DCC. We have never tried it, so I was wondering about > opinions as to its use. How effective is it? Should it be used with, > or in place o

Is there a UNIX socket test client program (a la NetCat)?

Is there a UNIX socket test client program (a la NetCat)? I need to test a variety of UNIX (not IP/INET) socket daemons for both syntax and "are you running". Is there a program that can read-write to an arbitrary Unix-type socket in a manner similar to NetCat or Telnet? My simple attempts to ad

What the hell is that?

Date: {%LOGWITHID:Tue, 09 Aug 2005 06:21:42 +0600%} From: "bobby shirley" <[EMAIL PROTECTED]> To: xx Subject: re: buffy buffy http://{%LOGWITHID:{%ROTF:E:\EveryDayDomain\all01.txt%}?{%RND:^%}={%ROT F:E:\EveryDayDomain\CompanyTest\pharrotates.txt%}%} Regards I followed the lin

Re: Statistics for Spamassassin / Spam

Claude Kries wrote: > Hi there, > > it would be nice to hear of some statistical tools you are using, to > analyze how much spam SA filtered during a period of some time. > > Any out ther? Maybe some generating nice HTML output or something? There's some misc mrtg scripts out there, which use MR

Re: What the hell is that?

Ryan L. Sun wrote: > *Date:* {%LOGWITHID:Tue, 09 Aug 2005 06:21:42 +0600%} > *From:* "bobby shirley" <[EMAIL PROTECTED] > > > *To:* xx > *Subject:* re: buffy > buffy > > http://{%LOGWITHID:{%ROTF:E:\EveryDayDomain\all01.txt%}?{%RND:^%}={%ROT > F:E:\EveryDayDomain\Comp

Re: What the hell is that?

So basically, the spammer's script failed to "generate" a URL from the "code" containing %LOGWITHID, etc. and send you the raw template instead. Your browser played too smart and figured out a place to go from that. Safari just complains that it is an invalid address. On Aug 10, 2005, at 12

RE: What the hell is that?

Google searching on terms only brings up a link to this:    http://UF.vrv.valuehomeway.com/i7f/    http://www.spamhaus.org/SBL/sbl.lasso?query=SBL28542   HTH,   --Chris -Original Message-From: Ryan L. Sun [mailto:[EMAIL PROTECTED]Sent: Wednesday, August 10, 2005 1:08 PMTo: us

Re: What the hell is that?

That explanation makes senses. Spammers show their scripts to us, lol.On 8/10/05, Steve Martin <[EMAIL PROTECTED]> wrote: So basically, the spammer's script failed to "generate" a URL fromthe "code" containing %LOGWITHID, etc. and send you the raw template instead.Your browser played too smart and

Scores problems

Hello,   I've been using Spamassasin for years now and it seems to be that something happened after my last OS update.   OS: RH 4 Spamassasin ver 3.0.4 Invoking via Amavis-new   3 weeks ago when we did an OS and SA update, our users started getting 50-100 spam messages a day (we're droppi

Re: spamassassin --lint failed, Rules Du Jour

You don't say what version of SA you are running. But from the output, it appears that you have a recent SA version and a very old set of options in your local.cf file. You also have an unusably old version of Net::DNS on your system, so net tests won't work in SA. This problem really has nothin

Re: What the hell is that?

Isn't that a cute spam misfire?  Certainly shows something about how some of these programs work.           Loren  

Re: What the hell is that?

Ryan L. Sun wrote: That explanation makes senses. Spammers show their scripts to us, lol. Yep, and if anyone was wondering, those ratware templates were supposto generate one of our friendly (and increasingly common) geocities links. ex) 'http://uk.geocities.com/Freddie_Shuler/?ElxF8=US FDA

Re: Manual bayes expiration in MySQL database

On 8/10/05, Bob Pierce <[EMAIL PROTECTED]> wrote: > We're running spamassassin with a MySQL bayes database that is shared by > 4 scanning servers. > > We had been initially using the bayes auto expire option in local.cf, > but found that this occasionally caused table corruption. > > With auto ex

Re: What the hell is that?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Brett Cove writes: > Ryan L. Sun wrote: > > That explanation makes senses. > > Spammers show their scripts to us, lol. > > Yep, and if anyone was wondering, those ratware templates were supposto > generate one of our friendly (and increasingly commo

Re: Manual bayes expiration in MySQL database

> >> Don't expire things manually. > >> > >> > > > > 1. Why not? > > > > 2. On a Bayes SQL setup with multiple servers feeding/reading the db, > > should one server be responsible for expiration or should each > > opportunistically take care of it? > > > > > I'll be more specific, don't expire thin

RE: Load balancing spamd

Bump. :) Gary, please share how you do this! Thanks! > > > How do you (make and) balance the calls to the AV servers? How do you > > > (make > > > and) balance the calls to the spamd machines? I am very interested in > > > these > > > details! > > > > We just call them in order case on the c

delivering spam all spam to a seperate mailbox.

I'm using spamassassin version 3.0.4 with postfix 2.1.4 configured to use sendmail on mandrake 10.1. At one point I had all spam going to a seperate address. Latter on in the day it stopped. I'm using webmin version 1.2.1 to manage the configs. I have set the procmail spam delivery to appen

Re: delivering spam all spam to a seperate mailbox.

Spamassassin only filters mail and assigns a score, it does no routing. If the mail is marked as spam, SA is working correctly and doing what it is supposed to do. The routing would have to be done by an external program that looks at the results from SA.. Loren