rewrite of Subject: in 3.0.1

2004-12-13 Thread Rich
hat indicated I could do this but I thought I'd better ask the pros. Rich

Re: rewrite of Subject: in 3.0.1

2004-12-13 Thread Rich
> "Rich" <[EMAIL PROTECTED]> wrote on 12/13/2004 02:54:23 PM: > >> Is there a way in user_prefs to rewrite the Subject lines to add a > suffix >> like [really spam] if the score exceeds a particular value? The host >> provides SA but doesn't pro

sa-learn and "out of memory" error

2004-12-16 Thread Rich
will give garbage when decoding entities at /usr/local/lib/perl5/site_perl/5.8.6/Mail/SpamAssassin/HTML.pm line 182. then I fed it my mail box of about 1800 ham (~58MB) and got Out of memory! Which is not very promising at all. So why is sa-learn so upset? Rich

AWL confusion

2004-12-19 Thread Rich
negative score (or, at least, a neutral zero) if it's in a WL? Rich

Re: AWL confusion

2004-12-20 Thread Rich
> On Sun, 19 Dec 2004 17:02:06 -0500, Rich <[EMAIL PROTECTED]> wrote: >> So why on earth is a 17-score given to an address in an auto white-list? >> Shouldn't an address get a negative score (or, at least, a neutral zero) >> if it's in a WL? > > You may

salearn parsing error

2004-12-20 Thread Rich
/Mail/SpamAssassin/HTML.pm line 182 Why isn't salearn handling these messages correctly? Rich

low scores?

2004-12-20 Thread Rich
I have recently upgrades from 2.x to 3.0.1 and have been watching the scores for stuff that is real spam. I had a bunch of up-weighted scores in 2.x but I didn't move those over to the new version while I evaluated what the new version was doing. What I don't understand are what seem to be extremel

Re: salearn parsing error

2004-12-20 Thread Rich
> -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Am Montag, 20. Dezember 2004 14:36 schrieb Rich: >> Nobody commented on the first mention of this so I'm repeating it: >> >> I move low-scoring but real spam to a folder and then run salearn on it. >>

Re: salearn parsing error

2005-02-05 Thread Rich
On Mon, 20 Dec 2004 13:47:25 -0500 (EST), Rich <[EMAIL PROTECTED]> wrote: Am Montag, 20. Dezember 2004 14:36 schrieb Rich: Some messages trigger the following error: Parsing of undecoded UTF-8 will give garbage when decoding entities at /usr/local/lib/perl5/site_perl/5.8.

Call for Presentations for ApacheCon 2021 now open

2021-03-08 Thread Rich Bowen
forward to reviewing your contribution to one of the most popular open source software events in the world! Rich, for the ApacheCon Planners -- Rich Bowen, VP Conferences The Apache Software Foundation https://apachecon.com/ @apachecon

ApacheCon is just 3 weeks away!

2021-09-03 Thread Rich Bowen
vability; Search; Tomcat. We will also feature keynotes from Ashley Wolf, Mark Cox, Alison Parker and Michael Weinberg. Details on the schedule, and these keynotes, can be found at https://www.apachecon.com/acah2021/tracks/ We look forward to seeing you at this year’s ApacheCon! – Rich Bowen,

ApacheCon starts tomorrow!

2021-09-20 Thread Rich Bowen
lack And follow us on Twitter - https://twitter.com/apachecon - for tips and announcements during the event. See you tomorrow! -- Rich Bowen, VP Conferences The Apache Software Foundation https://apachecon.com/ @apachecon

Call for Presentations now open, ApacheCon North America 2022

2022-03-30 Thread Rich Bowen
: Community Big Data Search IoT Cloud Fintech Pulsar Tomcat You can submit your session proposals starting today at https://cfp.apachecon.com/ Rich Bowen, on behalf of the ApacheCon Planners apachecon.com @apachecon

Final reminder: ApacheCon North America call for presentations closing soon

2022-05-19 Thread Rich Bowen
your talk proposals in now! Details here: https://apachecon.com/acna2022/cfp.html --Rich, for the ApacheCon Planners

Registration open for Community Over Code North America

2023-08-28 Thread Rich Bowen
, including how to make reservations for discounted hotel rooms in Halifax. Discounted rates will only be available until Sept. 5, so reserve soon! --Rich, for the event planning team

[ANNOUNCE] CFP open for ApacheCon North America 2016

2015-11-25 Thread Rich Bowen
Community growth starts by talking with those interested in your project. ApacheCon North America is coming, are you? We are delighted to announce that the Call For Presentations (CFP) is now open for ApacheCon North America. You can submit your proposed sessions at http://events.linuxfoundation.o

ApacheCon Seville CFP closes September 9th

2016-08-30 Thread Rich Bowen
speakers. So make sure your abstracts clearly explain what you'll be talking about. For further updated about ApacheCon, follow us on Twitter, @ApacheCon, or drop by our IRC channel, #apachecon on the Freenode IRC network. -- Rich Bowen WWW: http://apachecon.com/ Twitter: @ApacheCon

ApacheCon is now less than a month away!

2016-10-19 Thread Rich Bowen
r at @apachecon * Join us on IRC, at #apachecon on the Freenode IRC network * Join the apachecon-discuss mailing list by sending email to apachecon-discuss-subscr...@apache.org * Or contact me directly at rbo...@apache.org with questions, comments, or to volunteer to help See you in Sev

"Complex regular subexpression recursion limit exceeded" error from sa-learn

2016-11-23 Thread Rich Wales
ividual e-mails that generate this diagnostic, but I've looked at them and can't see anything obviously strange. Any thoughts? -- *Rich Wales* ri...@richw.org

Re: "Complex regular subexpression recursion limit exceeded" error from sa-learn

2016-11-23 Thread Rich Wales
> /OK, I can repro on trunk: . . . It's that very long block of QP > blanks right at the end. . . . Please open a bug and attach that > spample as a repro test case./ Done. (https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7374) -- *Rich Wales* ri...@richw.org

Re: "Complex regular subexpression recursion limit exceeded" error from sa-learn

2016-11-23 Thread Rich Wales
On 11/23/16 21:13, Benny Pedersen wrote: > and output to this ticket of "spamassassin --lint -D 2>&1 >/tmp.txt" > so all installed plugins versions are known, in case its already fixed Done. Rich Wales ri...@richw.org

Re: "Complex regular subexpression recursion limit exceeded" error from sa-learn

2016-11-24 Thread Rich Wales
> try disabling any local rules to see if it helps. . . . > it's apparently about rules, not about mail content. I temporarily removed my local.cf file, but I still got the warning. Rich Wales ri...@richw.org

Save the date: ApacheCon Miami, May 15-19, 2017

2016-11-30 Thread Rich Bowen
today at http://apachecon.com/ and submit your talks. ApacheCon Miami is going to be our best ApacheCon yet, and you, and your project, can’t afford to miss it. -- Rich Bowen - rbo...@apache.org VP, Conferences http://apachecon.com @apachecon

ApacheCon CFP closing soon (11 February)

2017-01-18 Thread Rich Bowen
pachecon on the Freenode IRC network. Or contact me - rbo...@apache.org - with any questions or concerns. Thanks! Rich Bowen, VP Conferences, Apache Software Foundation -- (You've received this email because you're on a dev@ or users@ mailing list of an Apache Software Foundation projec

FINAL REMINDER: CFP for ApacheCon closes February 11th

2017-02-08 Thread Rich Bowen
Thanks, and we look forward to seeing you in Miami! -- Rich Bowen VP Conferences, Apache Software Foundation rbo...@apache.org Twitter: @apachecon (You are receiving this email because you are subscribed to a dev@ or users@ list of some Apache Software Foundation project. If you do not wish to

Last chance: ApacheCon is just three weeks away

2017-04-26 Thread Rich Bowen
ing list: https://lists.apache.org/list.html?apachecon-disc...@apache.org * Podcasts and speaker interviews: http://feathercast.apache.org/ * IRC: #apachecon on the https://freenode.net/ We look forward to seeing you in Miami! -- Rich Bowen - VP Conferences, The Apache Software Foundation http:

Found clue for detecting lots of ".us" spam

2017-07-26 Thread Rich Wales
onsensus on this sort of thing? Thanks for any feedback. Rich Wales ri...@richw.org

Spamhaus PBL and ZEN blocklists

2011-05-08 Thread Rich Wales
alled Zen" is in error -- the ZEN list combines SBL, XBL, and PBL.) Comments on this? Am I missing something here? Rich Wales Palo Alto, CA ri...@richw.org

Fake amavisd-new header lines in recent spam

2014-11-09 Thread Rich Wales
ith a smaller group of developers, so as not to give too many ideas to the black hats? :-) Rich Wales ri...@richw.org

Re: Fake amavisd-new header lines in recent spam

2014-11-09 Thread Rich Wales
4, or 17196. Here is a sample rule which will detect the extraneous semicolon. header BOGUS_RCVD_AMAVIS Received =~ /\(amavisd-new,\s+port\s+\d+\).+;\s*for\b/ -- *Rich Wales* Palo Alto, CA ri...@richw.org

Re: Fake amavisd-new header lines in recent spam

2014-11-10 Thread Rich Wales
> /do we have your permission to add this rule to SA's masscheck / > autopromoting ?/ Yes, by all means, go ahead. -- *Rich Wales* ri...@richw.org

Save the date: ApacheCon North America, September 24-27 in Montréal

2018-02-20 Thread Rich Bowen
@ApacheCon on Twitter to be the first to hear announcements about keynotes, the schedule, evening events, and everything you can expect to see at the event. See you in Montréal! Sincerely, Rich Bowen, V.P. Events, on behalf of the entire ApacheCon team [1] http://www.apachecon.com/acna18 [2

Spam from addresses where full name mirrors left-hand side of address

2018-04-01 Thread Rich Wales
chnically possible* to create a Spamassassin rule which would match this sort of "From:" line? And assuming it can be done, is it *worthwhile* to do it?  I do realize some perfectly legitimate "From:" lines conform to this same pattern, and the only way to really tell the difference may be via AI or a real human brain. -- *Rich Wales* ri...@richw.org

ApacheCon North America 2018 schedule is now live.

2018-05-01 Thread Rich Bowen
if your company wants to sponsor this event, get in touch at h...@apachecon.com for opportunities that are still available. See you in Montreal! Rich Bowen VP Conferences, The Apache Software Foundation h...@apachecon.com @ApacheCon [1] http://cloudstackcollab.org/ [2] http

Register now for ApacheCon and save $250

2018-07-09 Thread Rich Bowen
. Register today at http://apachecon.com/acna18 and we’ll see you in Montreal! -- Rich Bowen VP, Conferences, The Apache Software Foundation h...@apachecon.com @ApacheCon

Speakers needed for Apache DC Roadshow

2018-09-11 Thread Rich Bowen
areer advice. Please take a look at: http://www.apachecon.com/usroadshow18/ (Note: You are receiving this message because you are subscribed to one or more mailing lists at The Apache Software Foundation.) Rich, for the ApacheCon Planners -- rbo...@apache.org http://apachecon.com @ApacheCon

4 Apache Events in 2019: DC Roadshow soon; next up Chicago, Las Vegas, and Berlin!

2019-03-06 Thread Rich Bowen
on at https://apachecon.com/aceu19/ . Sponsorship opportunities are available for all events, with details listed on each event’s site at http://apachecon.com/. We look forward to seeing you! Rich, for the ApacheCon Planners @apachecon

Re: recent update to __STYLE_GIBBERISH_1 leads to 100% CPU usage

2019-05-30 Thread Rich Wales
ht, and this seemed to suffice. Since I'm using amavisd-new, I also killed off (had to use "kill -9") all of the amavisd-new child processes (which were spinning at 100% and didn't go away when I stopped the service). After doing this and restarting amavisd-new, my mail queue emptied in no time. Rich Wales ri...@richw.org

ApacheCon North America 2019 Schedule Now Live!

2019-06-12 Thread Rich Bowen
also be running ApacheCon Europe in Berlin in October. Details of that event are at https://aceu19.apachecon.com/ Follow us on Twitter - @ApacheCon - for all the latest updates. See you in Las Vegas! Rich Bowen, VP Conferences, The ASF rbo...@apache.org http://apachecon.com/

Call for presentations for ApacheCon North America 2020 now open

2020-01-21 Thread Rich Bowen
/Other The CFP will close Friday, May 1, 2020 8:00 AM (America/New_York time). Submit early, submit often, at https://apachecon.com/acna2020/cfp Rich, for the ApacheCon Planners

Announcing ApacheCon @Home 2020

2020-06-29 Thread Rich Bowen
. Submit your talks today at https://acna2020.jamhosted.net/ We hope to see you at the event! Rich Bowen, VP Conferences, The Apache Software Foundation

Incoming mail writes on console

2004-09-10 Thread Rich Shepard
lly, not fully). I don't know that this is specifically related to SpamAssassin, but I suspect that it might be. I've searched the Web with google but haven't found anything useful. All help greatly appreciated. TIA, Rich -- Dr. Richard B. Shepard, President Applied Ecosystem S

SQL user config

2004-11-16 Thread Rich West
my whitelist (stored in the database), I see: debug: bayes: Database connection established debug: bayes: found bayes db version 3 debug: bayes: Using userid: 2 debug: Score set 3 chosen. But, it's like it is not using the database at all Any ideas as to where I can begin to look? -Rich

Re: SQL user config

2004-11-16 Thread Rich West
-Q, --setuid-with-sql Enable SQL config (only useful with -x, -x, --nouser-configDisable user config files Then again.. now that I read that.. maybe not so threatening.. :) -Rich Rich West wrote: Now, I know I had this working with SA 3.0 and below on

Re: OT: word frequency analysis

2005-01-17 Thread Rich Puhek
like sed, uniq, and sort can be pretty powerful. --Rich

Re: detecting brute-force spams

2005-02-08 Thread Rich Puhek
list of offenders to double-check and possibly add to a blacklist. My next step will be to migrate the other MX server to postfix. Right now, It accepts mail for non-existent users, passes them to the mailhub, the hub generates a bounce, and the bounce either sits on the sendmail MX server, or gets rejected by the postfix server. --Rich

bayes database merge?

2005-03-30 Thread Rich Winkel
his, but it's better than nothing... Thanks, Rich

globbing in user_prefs whitelist not working

2005-04-19 Thread Rich Winkel
Hi, I'm using SA 2.63 on freebsd 4.10. It seems that whitelist_from [EMAIL PROTECTED] in user_prefs isn't working, I have to fully specify the userid. Does anyone have any ideas? Thanks! Rich

Re: globbing in user_prefs whitelist not working

2005-04-19 Thread Rich Winkel
I should mention that the address in question is the user's own address; he's cc:ing mail to himself. I have to fully specify his address. According to Rich Winkel: > Hi, I'm using SA 2.63 on freebsd 4.10. It seems that > whitelist_from [EMAIL PROTECTED] > in user_prefs

suggestions on optimizing SA check

2005-04-20 Thread Rich Chiuppi
Bind 9.3.1 locally also tried remote DNS server. My email is backing up very slowly and I can't get it to process faster. Any help would be wonderful. I'm stuck. -- Best regards, Rich mailto:[EMAIL PROTECTED]

Re[2]: suggestions on optimizing SA check

2005-04-21 Thread Rich Chiuppi
sults when I get them. I have notice boat loads of DNS traffic from lookups - this may be the thief of my efficiency. again- thank you. Rich Wednesday, April 20, 2005, 8:59:28 PM, you wrote: > On Wed, Apr 20, 2005 at 02:08:24PM -0400, Rich Chiuppi wrote: >> I have noticed a 1-3 second

Re: How to exlcude spamassassin check for some users?

2005-05-23 Thread Rich Puhek
ed. Been working well for several years. A description and the script can be found at: http://users.2z.net/rpuhek/scripts_public/misc/skip_sa.txt --Rich

Re: Score an entire cf file

2005-06-02 Thread Rich Puhek
quot;somefile.cf" is the rule file. Replace my sample score of 5.00 with your desired score, and local.cf with your actual local.cf file location. (actually, for your case, a temp file might be in order, then paste back into your file). --Rich

SA config questions.

2007-09-25 Thread Gomes, Rich
uid=99,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=46005,mid=<[EMAIL PROTECTED]>,autolearn=no 2 - How do I get SA to use a "global" ruleset since this will just be a gateway and will have no local users on it? Thanks in advance! Rich

Spammer sending from [EMAIL PROTECTED]

2007-12-07 Thread Rich Dygert
ock [EMAIL PROTECTED] You can verify that the address is invalid first if you wish. Is there a better way to handle something like this? -- Rich Dygert CompuServe classic Email SA

Re: Spammer sending from [EMAIL PROTECTED]

2007-12-07 Thread Rich Dygert
McDonald, Dan wrote: On Fri, 2007-12-07 at 11:15 -0500, Rich Dygert wrote: Folks I am the postmaster for @compuserve.com and @csi.com (the "i" is important, @cs.com is someone else). A couple months ago my email traffic doubled (from 1 million a day to 2 million a day).

Identifying Source of False Positives

2009-06-01 Thread Rich Shepard
so if I missed the information please point me to the appropriate location. Rich

Re: Identifying Source of False Positives

2009-06-01 Thread Rich Shepard
is correlates with a distribution and SpamAssassin upgrade, so it must be something different in SA that's triggering this response now. Suggestions on how to proceed greatly appreciated. Thanks, Rich

Re: [sa] Re: Identifying Source of False Positives

2009-06-01 Thread Rich Shepard
27;h' where you meant to use an 'H', thereby feeding *only* the header to spamassassin? ## Call SpamAssassin :0fw: spamassassin.lock * < 256000 | spamassassin This is how it's been for years. Rich

Re: Identifying Source of False Positives

2009-06-01 Thread Rich Shepard
/var/log/maillog And this is from ~/procmail/recipes.rc: ## Call SpamAssassin :0fw: spamassassin.lock * < 256000 | spamassassin Thanks, Rich

Re: [sa] Re: Identifying Source of False Positives

2009-06-01 Thread Rich Shepard
< 256000 | spamassassin The first recipe has been commented out for a while now, so the call to SA is at the top of the list. Next guess: Has this log summary grown in size past some limit that would cause the whole body to be 'truncated'? No. The log summary report (with headers) is < 26,000 bytes. Rich

Re: Identifying Source of False Positives

2009-06-01 Thread Rich Shepard
s saved message and look for anything unusual in the debug output. There is always a blank line between headers and body. I tried running 'spamassassin -D' on the saved message and nothing happened. Should it take more than a few seconds to complete and return a debug report? Thanks, Rich

Re: Identifying Source of False Positives

2009-06-01 Thread Rich Shepard
t value for years without a problem. I'll keep teaching SA that the log reports are ham and see if that makes a difference. As I wrote earlier, this is all within the past quarter year, and it's been a PITA since it's taken time and attention away from my business. Thanks, Rich

Re: Identifying Source of False Positives

2009-06-01 Thread Rich Shepard
Y,__ENV_AND_HDR_FROM_MATCH,__FB_NUM_PERCNT,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_MSGID,__HAS_RCVD,__HAS_SUBJECT,__KAM_MED2,__KAM_NUMBER2,__KAM_TIME4,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NAKED_TO,__NONEMPTY_BODY,__SANE_MSGID,__TOCC_EXISTS,__hk_obfdomreq2 It suddenly jumps from 1.2 to 3.91 after looking for images. I don't know where to fix that. I think that I need to update SPF, too, because that's compiled against an earlier perl version. Rich

RE: Barracuda Blacklist

2009-06-02 Thread rich...@buzzhost.co.uk
Does Drako know you are posting here Bob? It's a bit naughty. He had everyone sign a form saying they would not post to places like this? You really should know better. We all know that Barraucda are behind emailreg. We know that emailreg is 'cash for spamming'. We know that support have been to

Re: [sa] Re: Identifying Source of False Positives

2009-06-02 Thread Rich Shepard
ODY, while none of them had empty bodies. Those from the google group mail list might have had a html-formatted part, but the log reports are plain ASCII text. What might possibly be triggering this false rule? Rich

Re: Identifying Source of False Positives

2009-06-02 Thread Rich Shepard
me) explanation. Rich

RE: Barracuda Blacklist

2009-06-02 Thread rich...@buzzhost.co.uk
self across as caring and sharing. It's bullshit and anyone can smell it. > I am also learning to count Jann among my friends, and I'm sure he would > *appropriately* acknowledge your greeting. > > If your participation is at all typical of this community, that

Re: Identifying Source of False Positives

2009-06-03 Thread Rich Shepard
ssassin Where do I insert a call to formail and what is the appropriate format? Thanks, Rich -- Richard B. Shepard, Ph.D. | IntegrityCredibility Applied Ecosystem Services, Inc.|Innovation <http://www.appl-ecosys.com> Voice: 503-667-4517 Fax: 503-667-8863

Re: Identifying Source of False Positives

2009-06-04 Thread Rich Shepard
pearing in the spam hold mailbox, I'll relax. Thank you all for the very helpful suggestions. I'll update the status over the next days. Rich -- Richard B. Shepard, Ph.D. | IntegrityCredibility Applied Ecosystem Services, Inc.|Innovat

Re: Identifying Source of False Positives -- RESOLVED

2009-06-05 Thread Rich Shepard
On Tue, 2 Jun 2009, Rich Shepard wrote: I started doing this today. Each of the false positive messages was exported from alpine to a file, and I ran sa-learn on that file telling it the text is ham. Today the mail and logwatch summary reports appeared in my inbox and there were no false

Re: Identifying Source of False Positives -- RESOLVED

2009-06-05 Thread Rich Shepard
EMPTY_BODY m'^[^\n]+\n\s*$' describe EMPTY_BODY Message has subject but no body score EMPTY_BODY 2.5 It apparently used to work, but isn't with the new SA to which I upgraded a few months ago. Thanks, Rich -- Richard B. Shepard, Ph.D. | Integrity

Re: New slew of spams

2009-06-05 Thread rich...@buzzhost.co.uk
On Fri, 2009-06-05 at 18:58 +0100, Jeremy Morton wrote: > Hi, > > I've suddenly started getting a new slew of spams that are making their > way through my SpamAssassin filter. Here's an example of one: > > http://pastebin.com/m586e296c > > As you can see they tend to hit a couple of blacklists

Re: [SA] Identifying Source of False Positives -- RESOLVED

2009-06-05 Thread Rich Shepard
On Fri, 5 Jun 2009, Adam Katz wrote: Since that regex matches nothing, I assume you meant it to be m'^[^\n]+\n\s*$'s or m'^[^\n]+\n\s*$'ms Adam, I didn't write this. It apparently came with the local.cf file a few years ago. Rich -- Richard B. Shepard, Ph.D.

Re: New slew of spams

2009-06-05 Thread rich...@buzzhost.co.uk
On Fri, 2009-06-05 at 20:33 +0200, Raymond Dijkxhoorn wrote: > Hi! > > >> http://pastebin.com/m586e296c > >> > >> As you can see they tend to hit a couple of blacklists, but don't get a > >> high enough score to be marked as spam. What do your SpamAssassin > >> analyses give of this e-mail, and a

Next Rule Causing False Positives: BOTNET

2009-06-06 Thread Rich Shepard
ist of all such senders? Is there a better way to tune this rule so it's not triggered so frequently? Rich -- Richard B. Shepard, Ph.D. | IntegrityCredibility Applied Ecosystem Services, Inc.|Innovation <http://www.appl-ecosys.com> Vo

Re: Next Rule Causing False Positives: BOTNET

2009-06-06 Thread Rich Shepard
It must have been the Slackware build/installation script that included it because adding such a plug-in would not have occurred to me. Regardless, I will decrease the score by 80%. Thanks, Rich -- Richard B. Shepard, Ph.D. | IntegrityCredibility Applie

Re: Next Rule Causing False Positives: BOTNET

2009-06-06 Thread Rich Shepard
much spam and malware out there. I'm lowering the score on that rule. Thanks, Rich -- Richard B. Shepard, Ph.D. | IntegrityCredibility Applied Ecosystem Services, Inc.|Innovation <http://www.appl-ecosys.com> Voice: 503-667-4517 Fax: 503-667-8863

Re: Next Rule Causing False Positives: BOTNET

2009-06-08 Thread Rich Shepard
with the SPAMBOT score lowered to 2.0, and scores of 0.4 for the individual components. Now that my mail has settled back to normal I'll again thank everyone and leave the list. Rich -- Richard B. Shepard, Ph.D. | IntegrityCredibility Applied Ecosystem Ser

Re: new spam image with random body message

2009-06-17 Thread rich...@buzzhost.co.uk
On Wed, 2009-06-17 at 13:33 +0200, Paweł Tęcza wrote: > Ibrahim Harrani pisze: > > Hi, > > > > another header from another image spams. > > All images contain god, bad and a url with numbers. > > The spamers are cunning... It seems that they have stopped sending spams > with X-Mailer: header cont

RE: new spam image with random body message

2009-06-17 Thread rich...@buzzhost.co.uk
Make Her Beeg For More And More" is > what i got > > -----Original Message- > From: rich...@buzzhost.co.uk [mailto:rich...@buzzhost.co.uk] > Sent: Wednesday, 17 June 2009 9:43 PM > To: Paweł Tęcza > Cc: users@spamassassin.apache.org > Subject: Re: new spam image wit

Re: new spam image with random body message

2009-06-17 Thread rich...@buzzhost.co.uk
On Wed, 2009-06-17 at 15:02 +0200, Matus UHLAR - fantomas wrote: > On 17.06.09 13:48, rich...@buzzhost.co.uk wrote: > > But there are certain words you would never expect to see in the > > subjects of legitimate mail none the less unless you often get mail with > > words

Re: new spam image with random body message

2009-06-17 Thread rich...@buzzhost.co.uk
On Wed, 2009-06-17 at 18:02 +0300, Ibrahim Harrani wrote: > http://pastebin.com/m6a027715 See if you can spot the keys; 1. Received: from unknown #if you don't know who you are goodbye. 2 (HELO .user.x) #mail servers don't tend to HELO/EHLO with 'user' 'dsl' 'ppp' as a rule. 3.(62.57.252.7

Re: more mainsleeze spam

2009-06-19 Thread rich...@buzzhost.co.uk
On Thu, 2009-06-18 at 14:04 -0400, Michael Scheidell wrote: > main sleaze, as in spam from larger, established, 'legit' companies. I > am seeing a 20% increase in spam that doesn't trigger any of the zombie, > forged, gappy or dialup list rules. Neither are they triggering SARES > or SOUGHT ru

Re: anything usefull to do with a joe-jobed domain?

2009-06-19 Thread rich...@buzzhost.co.uk
On Fri, 2009-06-19 at 13:32 +0200, Arvid Picciani wrote: > Hi, > I'm currently convincing my boss to throw away a domain that receives so > much backscatter, its useless to try filtering the legitimate mail. > Could i do anything useful with it? > Spamtrap won't work since 99.99% of mails are ba

Re: A difficult one to weed out?

2009-06-21 Thread rich...@buzzhost.co.uk
On Sun, 2009-06-21 at 13:35 +0200, Benny Pedersen wrote: > On Sun, June 21, 2009 13:23, Jeremy Morton wrote: > > My SpamAssassin apparently isn't checking this blocklist; how do I get > > it to? > > cbl is part of zen.spamhaus.org, but some ips is not in sync that fast, so > check cbl in mta level

Custom Rule Sets

2009-06-21 Thread rich...@buzzhost.co.uk
Good morning, Looking at the docs I see a 'don't add your customer rules here' warning in reference to the default /usr/share/spamassassin dir. Instead it lists a couple of options including local.cf Is it possible to ask local.cf to include external files/dir for custom rules at all? Thanks

Re: Custom Rule Sets

2009-06-21 Thread rich...@buzzhost.co.uk
On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote: > rich...@buzzhost.co.uk wrote: > > Good morning, > > > > Looking at the docs I see a 'don't add your customer rules here' warning > > in reference to the default /usr/share/spamassassin dir. Instead

Re: Custom Rule Sets

2009-06-22 Thread rich...@buzzhost.co.uk
On Mon, 2009-06-22 at 00:57 -0600, LuKreme wrote: > On Jun 21, 2009, at 23:48, "rich...@buzzhost.co.uk" > wrote: > > > On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote: > >> rich...@buzzhost.co.uk wrote: > >>> Good morning, > >>>

SORBS bites the dust

2009-06-22 Thread rich...@buzzhost.co.uk
Noted this over at NANAE; QUOTE: All, Please feel free to forward this message to any other location/mailing list. It comes with great sadness that I have to announce the imminent closure of SORBS. The University of Queensland have decided not to honor their agreement with myself and SORBS

Re: Custom Rule Sets

2009-06-22 Thread rich...@buzzhost.co.uk
On Mon, 2009-06-22 at 07:30 -0400, Matt Kettler wrote: > rich...@buzzhost.co.uk wrote: > > On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote: > > > >> rich...@buzzhost.co.uk wrote: > >> > >>> Good morning, > >>> > >>

Re: Custom Rule Sets

2009-06-22 Thread rich...@buzzhost.co.uk
On Mon, 2009-06-22 at 07:53 -0400, Matt Kettler wrote: > rich...@buzzhost.co.uk wrote: > > On Mon, 2009-06-22 at 07:30 -0400, Matt Kettler wrote: > > > >> rich...@buzzhost.co.uk wrote: > >> > >>> On Mon, 2009-06-22 at 00:26 -0400, Matt Ket

Re: SORBS bites the dust

2009-06-22 Thread rich...@buzzhost.co.uk
On Mon, 2009-06-22 at 19:40 +0200, Arvid Picciani wrote: > rich...@buzzhost.co.uk wrote: > > It comes with great sadness that I have to announce the imminent > > closure > > of SORBS. The University of Queensland have decided not to honor their > > agreement with mys

RE: SORBS bites the dust

2009-06-23 Thread rich...@buzzhost.co.uk
On Tue, 2009-06-23 at 09:29 -0400, Jeff Moss wrote: > WHAT? Sorbs and Spamhaus are polar opposites. Spamhaus is a great > organization while SORBS is a POS that helped give all blacklists a > bad name. > I don't know if SpamAssassin has ever used it. > I respect any block list for targeting t

Re: SORBS bites the dust

2009-06-23 Thread rich...@buzzhost.co.uk
On Tue, 2009-06-23 at 22:17 +0200, Arvid Picciani wrote: > >> It does make you wonder why they never seem to end up on any of the > >> spamhaus lists. Perhaps they are brilliant list washers ? > >> > > > > Same here - I see lots of these and they don't score on many lists. > > It might be an unedu

Re: SA on Windows XP + POP to desktop client?

2009-06-23 Thread rich...@buzzhost.co.uk
On Tue, 2009-06-23 at 22:50 +0200, Yet Another Ninja wrote: > On 6/23/2009 10:37 PM, Lee wrote: > > > > Hello SpamAssassin fans, > > > > Having read and tried various things on the SA site and elsewhere, even > > including some technically dead stuff in the Web Archive, I'm wondering > > if any

Re: SORBS bites the dust

2009-06-23 Thread rich...@buzzhost.co.uk
On Wed, 2009-06-24 at 00:07 +0200, mouss wrote: > Res a écrit : > > On Tue, 23 Jun 2009, mouss wrote: > > > >> payment were only needed for spam, not for "dul" > > > > not really :) despite what their site said/says.. its kind of a > > detterent i think sunno we never paid > > > > This is w

Re: SORBS bites the dust

2009-06-24 Thread rich...@buzzhost.co.uk
On Wed, 2009-06-24 at 19:00 +0200, Per Jessen wrote: > Benny Pedersen wrote: > 2) I didn't include free email providers in my list of "large and > serious hosting providers" - I was thinking more of organisations such > as 1and1, hetzner, rackspace etc. etc. My special award goes to 1and1. I get

Re: SORBS bites the dust

2009-06-24 Thread rich...@buzzhost.co.uk
On Thu, 2009-06-25 at 09:16 +1000, Res wrote: > On Wed, 24 Jun 2009, rich...@buzzhost.co.uk wrote: > > >> This is wrong. if you have evidence, show it. if not, stop spreading > >> rumours. I have delisted an IP in the past, and I have been watching > >> people try

Re: SORBS bites the dust

2009-06-25 Thread rich...@buzzhost.co.uk
On Thu, 2009-06-25 at 17:41 +1000, Res wrote: > if you jump on a bandwagon without first hand experience, thats *exactly* > what you are, if you had experienced it first hand of course you become an > authority on the subject in your your case, and your opinion matters as > factual, but you by y

  1   2   3   4   >