Non scoring 'Bank Deposit' spam

2009-09-12 Thread Clunk Werclick
I was somewhat surprised that this failed to score; http://pastebin.com/m4c75e3ac Log excerpt; Sat Sep 12 05:08:57 2009 [7319] info: spamd: result: . 0 - HTML_MESSAGE,UNPARSEABLE_RELAY scantime=0.3,size=5400,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=55111,mid=<00fada512664885bffba2

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread Jari Fredriksson
> I was somewhat surprised that this failed to score; > > http://pastebin.com/m4c75e3ac > > Log excerpt; > Sat Sep 12 05:08:57 2009 [7319] info: spamd: result: . 0 - > HTML_MESSAGE,UNPARSEABLE_RELAY > scantime=0.3,size=5400,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=55111,mid=<00fad

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread Clunk Werclick
On Sat, 2009-09-12 at 16:05 +0300, Jari Fredriksson wrote: > > I was somewhat surprised that this failed to score; > > > > http://pastebin.com/m4c75e3ac > > > > Log excerpt; > > Sat Sep 12 05:08:57 2009 [7319] info: spamd: result: . 0 - > > HTML_MESSAGE,UNPARSEABLE_RELAY > > scantime=0.3,size=540

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread Jari Fredriksson
> > I don't want the Bayes, but I'm not seeing any rules like > this: > > 4.0 BOTNET Relay might be a spambot or > virusbot > > This is a vanilla Spamassassin - but I'm surprised I'm > not getting any score on these here. What's wrong with the bayes? It works for me. Botnet i

Re: Using a blacklist - configuration-file not working

2009-09-12 Thread Jari Fredriksson
> On Fri 11 Sep 2009 01:47:38 PM CEST, franc wrote > >> Does this mean with amavis spamassassin is NOT used? > > dont confuse the answer:) > > spamassassin is a client > spamd is a daemond > amavisd is a daemond > > finaly: > > amavisd does not use spamassassin or spamd > > clear now ? spama

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread Clunk Werclick
On Sat, 2009-09-12 at 16:15 +0300, Jari Fredriksson wrote: > > > > I don't want the Bayes, but I'm not seeing any rules like > > this: > > > > 4.0 BOTNET Relay might be a spambot or > > virusbot > > > > This is a vanilla Spamassassin - but I'm surprised I'm > > not getting any

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread Jari Fredriksson
> On Sat, 2009-09-12 at 16:15 +0300, Jari Fredriksson wrote: >>> >>> I don't want the Bayes, but I'm not seeing any rules >>> like this: >>> >>> 4.0 BOTNET Relay might be a spambot or >>> virusbot >>> >>> This is a vanilla Spamassassin - but I'm surprised I'm >>> not getting any

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread John Hardin
On Sat, 12 Sep 2009, Clunk Werclick wrote: On Sat, 2009-09-12 at 16:15 +0300, Jari Fredriksson wrote: What's wrong with the bayes? Bayes is going out of fashion. Since when? And according to whom? Bayes is one of the stronger tools available. It's just as easy to make a bad one by bad

Re: JMF whitelist and RAZOR conflict

2009-09-12 Thread John Hardin
On Fri, 11 Sep 2009, MySQL Student wrote: are you recieving forwarded emails from spf domains ? If I understand correctly, no. I have no relationship with any external source and their SPF records. if so add the forward ip to trusted_networks (so spf will be disabled from this hosts) Do

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread Clunk Werclick
On Sat, 2009-09-12 at 08:54 -0700, John Hardin wrote: > On Sat, 12 Sep 2009, Clunk Werclick wrote: > > > On Sat, 2009-09-12 at 16:15 +0300, Jari Fredriksson wrote: > >> > >> What's wrong with the bayes? > > > > Bayes is going out of fashion. > > Since when? And according to whom? Bayes is one of

Re: JMF whitelist and RAZOR conflict

2009-09-12 Thread Henrik K
On Sat, Sep 12, 2009 at 09:02:35AM -0700, John Hardin wrote: > On Fri, 11 Sep 2009, MySQL Student wrote: > >>> are you recieving forwarded emails from spf domains ? >> >> If I understand correctly, no. I have no relationship with any external >> source and their SPF records. >> >>> if so add the f

Re: JMF whitelist and RAZOR conflict

2009-09-12 Thread John Hardin
On Sat, 12 Sep 2009, Henrik K wrote: On Sat, Sep 12, 2009 at 09:02:35AM -0700, John Hardin wrote: On Fri, 11 Sep 2009, MySQL Student wrote: are you recieving forwarded emails from spf domains ? If I understand correctly, no. I have no relationship with any external source and their SPF reco

Re: JMF whitelist and RAZOR conflict

2009-09-12 Thread Benny Pedersen
On lør 12 sep 2009 19:30:09 CEST, Henrik K wrote PS. SPF is checked on internal, not trusted border. Even though they are the same for most people.. some ? and I don't think you can disable SPF checks in any way except fully. if spf test is done in mta stage with prepended header for spf p

Re: JMF whitelist and RAZOR conflict

2009-09-12 Thread Benny Pedersen
On lør 12 sep 2009 20:22:21 CEST, John Hardin wrote Hrm. Changing that might be something to consider, then. change sa to support srs ? or spf trusted_networks ? the later does work in my setup, if one know its not so, please tell me what my error is -- xpoint

Re: JMF whitelist and RAZOR conflict

2009-09-12 Thread John Hardin
On Sat, 12 Sep 2009, Benny Pedersen wrote: On lør 12 sep 2009 20:22:21 CEST, John Hardin wrote Hrm. Changing that might be something to consider, then. change sa to support srs ? or spf trusted_networks ? The latter. Possibly through another list instead of trusted_networks; the semanti

Fraud and Scam on the Rise?

2009-09-12 Thread Karsten Bräckelmann
No investigation regarding the source channels yet, just an observation. Am I the only one who noticed a distinct rise of fraud and scam, typically not triggering Spamhaus ZEN? Getting more and more of them lately. guenther -- happy to manually feed the Sought Fraud rule-set, but

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread RW
On Sat, 12 Sep 2009 17:27:00 +0100 Clunk Werclick wrote: > On Sat, 2009-09-12 at 08:54 -0700, John Hardin wrote: > > On Sat, 12 Sep 2009, Clunk Werclick wrote: > > > > > On Sat, 2009-09-12 at 16:15 +0300, Jari Fredriksson wrote: > > >> > > >> What's wrong with the bayes? > > > > > > Bayes is goi

Re: Fraud and Scam on the Rise?

2009-09-12 Thread John Hardin
On Sun, 13 Sep 2009, Karsten Br?ckelmann wrote: Am I the only one who noticed a distinct rise of fraud and scam, typically not triggering Spamhaus ZEN? Getting more and more of them lately. Some. Not a flood, but a few more than normal. -- John Hardin KA7OHZhttp://www.imp

Re: URL rule creation question

2009-09-12 Thread MySQL Student
>>> \s is the proper way to represent whitespace. >> >> lol, yes, I know that; I was actually trying to match 's' and the >> slash is the start of the pattern match. > > I wasn't referring to the beginning of the RE. Yeah, I realized that just after I sent this, if anyone cares :-) Thanks again,

Re: JMF whitelist and RAZOR conflict

2009-09-12 Thread Benny Pedersen
On lør 12 sep 2009 23:46:44 CEST, John Hardin wrote The latter. Possibly through another list instead of trusted_networks; the semantics are slightly different and overloading the current trusted list with an SPF meaning might be a it will be one more networks list to manage, and keeping tra

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread Benny Pedersen
On lør 12 sep 2009 15:10:41 CEST, Clunk Werclick wrote i ignore your reply-to :) I don't want the Bayes, but I'm not seeing any rules like this: why not ? 4.0 BOTNET Relay might be a spambot or virusbot botnet is not standard sa plugin that might be why you not see the hit

rules question

2009-09-12 Thread Rajesh M
hello all I use qmail toaster with spamassassin -- latest version i sometimes get spam with both the sender id and recipient id as the same. Obviously such emails are originating outside my server. I DO NOT wish to user SPF what i need to do is as follows 1) get the source ip of the email in a

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread Clunk Werclick
On Sun, 2009-09-13 at 01:34 +0100, RW wrote: > On Sat, 12 Sep 2009 17:27:00 +0100 > Clunk Werclick wrote: > > > On Sat, 2009-09-12 at 08:54 -0700, John Hardin wrote: > > > On Sat, 12 Sep 2009, Clunk Werclick wrote: > > > > > > > On Sat, 2009-09-12 at 16:15 +0300, Jari Fredriksson wrote: > > > >>

Re: Non scoring 'Bank Deposit' spam

2009-09-12 Thread Clunk Werclick
On Sun, 2009-09-13 at 06:36 +0200, Benny Pedersen wrote: > On lør 12 sep 2009 15:10:41 CEST, Clunk Werclick wrote > > i ignore your reply-to :) > > > I don't want the Bayes, but I'm not seeing any rules like this: > > why not ? **PLEASE READ THE REST OF THE THREAD TO ANSWER YOU QUESTION** > > >