This is what I block:
(bid|book|click|club|cricket|date|democrat|directory|download|faith|help|link|ninja|party|press|pro|racing|reviews?|rocks|science|site|social|space|top|uno|webcam|website|work|win|xyz)
I will add some from what you have posting, thanks.
Sergio
On Wed, Apr 27, 2016 at 5:39
> stopped all the emails that comes with the exe file attached to the email,
> but there was a lot of them that didn't come with the EXE file and for that
> is why I am creating this rule.
>
> Best Regards,
>
> Sergio Cabrera
>
Outlook Express 5.00.2919.6600
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600
***
Thanks a lot for your kind answers.
Best Regards,
Sergio Cabrera
On Sat, Nov 19, 2011 at 8:18 AM, RW wrote:
> On Sat, 19 Nov 2011 05:42:43 -0600
> Sergio wrote:
>
>
DHLTOTAL11
One more option that I will like to add, for this rule to check is for
attachments, where do I look for the attachment file, it is in the body?
Once again, thank you.
Sergio
On Sat, Nov 19, 2011 at 10:45 AM, Sergio wrote:
> RW,
> Now I understand why it gave a 1 point when I
||
(__ENV_FROM_UPS && __FROM_DHL)
scoreVIRUS_DHLTOTAL11
Once again, thank you for helping me.
Best Regards,
Sergio Cabrera
On Sat, Nov 19, 2011 at 1:27 PM, John Hardin wrote:
> On Sat, 19 Nov 2011, Sergio wrote:
>
> this is one header of the emails that I received:
&g
Received =~ /envelope-from [^ @]+@ups\.com/i
header __FROM_UPSFrom =~ /\bups\.com/i
meta DHL_UPS_MISMATCH (__ENV_FROM_DHL && __FROM_UPS) ||
(__ENV_FROM_UPS && __FROM_DHL)
describe DHL_UPS_MISMATCH Correo con virus DHL-USA o UPS
scoreDHL_UPS_MISMATCH 11
Regards,
Serg
C rules file, none of my other rules work.
Regards,
Sergio
On Mon, Nov 21, 2011 at 10:55 AM, Bowie Bailey wrote:
> On 11/21/2011 11:35 AM, John Hardin wrote:
> > On Mon, 21 Nov 2011, Bowie Bailey wrote:
> >
> >> On 11/20/2011 10:02 PM, Sergio wrote:
> >>&
That was the error, the @ has to be escaped \@, now it is working.
Thank you all for your help on this rule.
Regards,
Sergio
On Mon, Nov 21, 2011 at 1:16 PM, Bowie Bailey wrote:
> On 11/21/2011 1:30 PM, Sergio wrote:
> > Unfortunately, it seems that MCP doesn't
, but for
now it is what I was looking for.
Regards,
Sergio
2011/11/21 Karsten Bräckelmann
> On Mon, 2011-11-21 at 14:46 -0600, Sergio wrote:
> > I block a lot of spam searching for strings on the subject, but
> > sometimes the subject in the header comes in EVAL, like th
t catches the "i" and the space and just in case
the spamer tries to use "publi ci dad" it will be catched as well. In my
RegEx editor it passes the test.
About the word "publicidad" In my server not much people uses that word and
that is why I can block it.
Sergio
Thank you Benny,
I will use this command next time.
Sergio
By the way your links are very accurate, that are the spammers that sent
the email, with my new rule they are
On Tue, Nov 22, 2011 at 3:42 AM, Benny Pedersen wrote:
> On Mon, 21 Nov 2011 22:32:42 +0100, Karsten Bräckelmann wr
> Thank you Kevin!
>
> @ RW,
> you are right I use MailScanner and all my rules are created under the
> MCP, it works really great and all the rules that I create are there, so I
> don't mess with Spam Assassin rules.
>
> Best Regards,
>
> Sergio
>
>
>
\.com|surelycomplainsecretary\.info|teuksull\.info|theharborccc\.org|themiamibeachheat\.com|thoroughlydevelopment\.info|tivolicn\.com|whaukferth\.com|barrchickenjoint\.info)/i
describe CHARLY_RULE1Charly Spammers
scoreCHARLY_RULE111
Regards,
Sergio
Thank you Martin,
I will give it a try to your pormanteu, appreciated for sharing it.
Regards,
Sergio
On Fri, Nov 25, 2011 at 12:13 PM, Martin Gregorie wrote:
> On Fri, 2011-11-25 at 11:49 -0600, Sergio wrote:
> > I have the following rule where I wrote all the HELO spammers that SA
&
Thanks a lot for your inputs.
Sergio
e and CPU cycles when all you want to check
is Received:
>
>try with:
>header BLAH Received =~/\blayeredvpnzervices\.com\b
I have changed all my ALL for Received, thank you for pointing this out.
Regards,
Sergio
R %A *N #S S. E. X{UA`L P&0/R N_
What it will be the best way to catch any type of garbled word?
Sergio
On Sun, Nov 27, 2011 at 7:53 AM, Kevin A. McGrail wrote:
> On 11/27/2011 8:26 AM, Martin Gregorie wrote:
>
>>
>> Change the meta to this:
>>
>> meta PO
On Sun, Nov 27, 2011 at 9:40 AM, Kevin A. McGrail wrote:
> On 11/27/2011 10:24 AM, Sergio wrote:
>
>>
>> I want to thank you KAM for the share of his rules, I have learned a lot
>> looking on them and thanks to that I have modified the rules that I had to
>> ma
Regards,
Sergio
not to check in "ALL" headers, I have
redefined my first rules and now I have seen a better approach on what I am
doing, still need a lot more input from experts, :)
Regards,
Sergio
On Tue, Nov 29, 2011 at 2:21 PM, Adam Katz wrote:
> Summary for the impatient:
> Do not write
Hi all,
is there a way to check the size of a subject on a rule?
Thanks in advance.
Sergio
Sorry, I always reply to the list, this time it flips on me.
Thanks!
So, this way I can have a check on the large of the subject as a sub rule
and then check for the content, appreciated.
Regards,
Sergio
On Thu, Dec 1, 2011 at 4:33 PM, John Hardin wrote:
> On Thu, 1 Dec 2011, Sergio wr
Working great! lol
On Thu, Dec 1, 2011 at 5:10 PM, Benny Pedersen wrote:
> On Thu, 1 Dec 2011 16:59:33 -0600, Sergio wrote:
>
>> Sorry, I always reply to the list, this time it flips on me.
>>
>
> try reply now, just testing :-)
>
?
*netset: cannot include 0:0:0:0:0:0:0:1/128 as it has already been included
netset: cannot include 0:0:0:0:0:0:0:1/128 as it has already been included*
Thanks in advance.
Sergio
(Public apologies to Karste, wrote him instead of the list, mmm... I need
to remember to write to the list and not just do a Reply.)
What is the best way to dissable DNSWL manually?
(in case I don't want to wait until tomorrow)
Regards,
Sergio
Thank you Kam.
Regards,
Sergio
On Mon, Dec 12, 2011 at 7:37 PM, Kevin A. McGrail wrote:
> On 12/12/2011 8:35 PM, Sergio wrote:
>
>> (in case I don't want to wait until tomorrow)
>> What is the best way to dissable DNSWL manually?
>>
>
> Add this to your lo
o more than 100 emails in a
CC or BCC with attachments no large of 5MB, could be blocked. Is it
possible?
Best Regards,
Sergio Cabrera
Thank you, Kevin.
I have EXIM in my box, does the command will be the same for EXIM?
Best Regards,
Sergio
On Mon, Mar 26, 2012 at 10:27 AM, Kevin A. McGrail wrote:
> On 3/26/2012 12:22 PM, Sergio wrote:
>
>> Is there a way to have a rule that could count how many "@"
belongs to that server.
Thank you in advance.
Best Regards,
Sergio Cabrera
authenticated domain.
Could this be done?
Best Regards,
Sergio
On Wed, Aug 15, 2012 at 11:12 PM, David B Funk wrote:
> On Wed, 15 Aug 2012, Sergio wrote:
>
> Hello all,
>> wondering if there could be a rule where the email that is delivered from
>> the server could be checked the
Thank you, KAM.
I will take a look at those URLs, appreciated.
John, that is what I am looking to do and that is why I thought that SA
could have a rule for this. I will read the info that KAM sent.
Best Regards,
Sergio
On Thu, Aug 16, 2012 at 2:22 PM, John Hardin wrote:
> On Thu, 16
Hi all,
I tried this rule to stop emails with an empty subject, but it didn't work:
header SUBJECT_EMPTY SUBJECT =~ /^$/i
describe SUBJECT_EMPTY EMPTY SUBJECT
scoreSUBJECT_EMPTY 11
Any hint on what is wrong?
Best Regards to all,
Sergio
Received =~ /\\=.*.(com|net|org|biz)\@/i
score BLACKLIST_REGEX5
Or if you have a better way on doing this, your advice is appreciated.
Best Regards,
Sergio
It seems that my rule using "Received" instead of "From" did the trick, the
rule is working now.
Thanks!
Regards,
Sergio
On Tue, Jul 8, 2014 at 10:43 PM, Sergio wrote:
> Hi all,
> long time not bother you with my doubts, sorry if this has been posted
> before
ule? This is a new type of rule for me :)
Once again, thanks for your inputs.
Sergio
On Wed, Jul 9, 2014 at 7:19 AM, Kevin A. McGrail wrote:
> On 7/9/2014 9:08 AM, RW wrote:
>
>> VERP and similar schemes work on the envelope, so checking the From
>> header should relatively
Hi,
where is the best place to download the lastest KAM rules?
Thanks in advance.
Sergio
Thank you, Larry.
-- Forwarded message --
From:
Date: Sun, May 10, 2015 at 2:19 PM
Subject: Re: Where to download the latest KAM rules?
On 2015-05-10 15:11, Sergio wrote:
Hi,
where is the best place to download the lastest KAM rules?
Thanks in advance.
Sergio
http
t; you see fit.
Thanks.
Sorry,but I'm new in spamassassin users.Can you say where I must write
this rules?
Thanks again.
--
Best regards,
Sergio Bortsov(Neonet ISP), mailto:[EMAIL
PROTECTED],[EMAIL PROTECTED]
phones:8(032)2987593;
8(098)4491155.
work the perl
and can't find the reason why it was saing like this.
I'll be thankfull for any help.
Thanks.
--
Best regards,
Sergio Bortsov(Global Ukraine Lan ISP), mailto:[EMAIL
PROTECTED]
phones:8(032)2987593;
8(050)3170470.
Hello spamassasin_list,
I want filter messages with some bad words. How can configure yhe SA
to do that?
Thanks.
--
Best regards,
Sergio Bortsov(Global Ukraine Lan ISP), mailto:[EMAIL
PROTECTED]
phones:8(032)2987593;
8(050)3170470.
Hello Chris,
Wednesday, January 3, 2007, 4:57:02 PM, you wrote:
>
> -Original Message-
> From: sergio [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, January 03, 2007 9:13 AM
> To: spamassasin_list
> Subject: how filter messages by subject
>
>
Hello and good afternoon,
They could help me to solve the problem that we have with razor:
https://www.mail-tester.com/web-13coh&reloaded=3
[cid:image001.png@01D2F024.07D1BB00]
We took 3 weeks trying to solve the problem.
Thank you.
Sergio Villalba Moreno
IT Department
DEKRA Testing
g on Perl version 5.14.2
Comments and suggestions are appreciated. Thanks!
--
Sergio
is a lot of overhead. spamc+spamd is strongly
> recommended for production use.
Thanks a lot for the input, John. I guess I will end up using spamd and
spamc, after all. I'll just wait for the answer to my question, and
then I'll set everything up here.
Regards,
--
Sergio
On Friday, November 08 2013, John Hardin wrote:
> On Fri, 8 Nov 2013, Sergio Durigan Junior wrote:
>
>> #> spamc -c < spam.file
>> 0.0/5.0
>> #> spamc -L spam < spam.file
>> (successful message saying that the spam was learned)
>> #> sp
On Friday, November 08 2013, Amir Caspi wrote:
> On Fri, November 8, 2013 2:39 pm, Sergio Durigan Junior wrote:
>> I don't think sa-learn can help with spamd. Its own manpage mention
>> that, for spamd users, "spamc -L" is the way to go.
>>
>> Hm, re
n, so I don't have any direct
> experience with spamc -L quirks, sorry. That's why I suggested
> sa-learn.
Nice, thank you. I am more inclined to use a per-user database, and
call "spamc -u myuser -L spam". Let's see how that goes.
--
Sergio
On Friday, November 08 2013, Karsten Bräckelmann wrote:
> On Fri, 2013-11-08 at 16:09 -0200, Sergio Durigan Junior wrote:
>> #> spamc -c < spam.file
>> 0.0/5.0
>> #> spamc -L spam < spam.file
>> (successful message saying that the spam was learned
nks for the opinion. I was considering doing that, and your message
was the final word I needed.
Now everything is setup per-user, and I am feeding the Bayes DB with
what I have.
Thanks,
--
Sergio
archives.
Will do. However, I don't have false-positives (ham) to train. As I
said above, I only have about 10 spam messages, which I already used to
train Bayes. Not sure if it is possible/would be good to search for
recent spam archives on the net. I believe not...
--
Sergio
e last 48 hours...). Can you confirm
this?
Thanks a lot, and sorry if I'm asking too much :-).
--
Sergio
On Sunday, November 10 2013, Karsten Bräckelmann wrote:
> On Sun, 2013-11-10 at 01:59 -0200, Sergio Durigan Junior wrote:
>> Nice, thanks both of you for the answers.
>>
>> I am now feeding SA with ham from my INBOX, while I also feed it with
>> false-negatives (intere
tarted using SA a few days ago.
For every spam message that I received, I analyze its headers, verify
that everything is OK with SA, and then feed it to sa-learn.
--
Sergio
On Sunday, November 10 2013, Karsten Bräckelmann wrote:
> On Sun, 2013-11-10 at 03:32 -0200, Sergio Durigan Junior wrote:
>> On Sunday, November 10 2013, Karsten Bräckelmann wrote:
>
>> For all messages that I received since I started using SA (about 20
>> message
amd afterward.
> FWIW, this counts as "modifying SA config", since it updates the stock
> rule-set.
Oh, I did that, yeah. I meant to say that I did not touch in any file
under /etc/spamassassin. So my /etc/spamassassin/local.cf, for example,
is exactly what is shipped with Debian.
Thanks,
--
Sergio
if* there's anything wrong, of course).
First of all, I am using:
- Debian 7.1 (stable)
- SpamAssassin version 3.3.2
running on Perl version 5.14.2
Here is an example of a misclassified spam message:
<http://sergiodj.net/~sergio/sa/spam.txt>
(This spam message was sent to a mail
On Monday, November 11 2013, Karsten Bräckelmann wrote:
> On Mon, 2013-11-11 at 20:26 -0200, Sergio Durigan Junior wrote:
>> Here is an example of a misclassified spam message:
>><http://sergiodj.net/~sergio/sa/spam.txt>
>>
>> (This spam message was sent to a
On Monday, November 11 2013, John Hardin wrote:
> On Mon, 11 Nov 2013, Sergio Durigan Junior wrote:
>
>> Here is an example of a misclassified spam message:
>>
>> <http://sergiodj.net/~sergio/sa/spam.txt>
>
> There's not a lot there for SA to work with.
gt;>>> * < 256000
>>>> | spamc
>
> You might also want to up that size limit to about 512KB. Spams with
> attachments can get larger than that and still be detected.
I'm not receiving such large spams. I will change the size when it
comes to it.
Thanks,
--
Sergio
ason to keep scanning mailing lists. Actually,
it's because of that that I have lots of hams learned :-).
--
Sergio
a-learn to do that.
Therefore, if your local users maintain local Bayes databases, then you
shouldn't need "--allow-tell", unless you are going/planning to allow
the users to also run "spamc -L" to train their databases.
--
Sergio
-allow-tell. This
flag is only useful if you're going to use "spamc -L", AFAIK.
--
Sergio
x27;s IP address; however, SA has a
strict rule for checking the "Received:" header, and I needed to adapt
my modifications to that rule. Anyway, now everything's OK.
Having said that, my SA is still missing lots of spams. For example,
take a look at:
<http://sergiodj.net/~serg
e:
> On Thu, 2013-11-28 at 17:02 -0500, Kris Deugau wrote:
>> Sergio Durigan Junior wrote:
>
>> > UNPARSABLE_RELAY was happening because I modify the headers of
>> > every message sent through my server in order to anonymize the
>> > sender's IP address
51.089718 check[42110]: [ 7] Can't read file
servers.catalogue.lst, looking relatve to
Oct 14 15:07:51.090168 check[42110]: [ 5] Can't read file
/servers.catalogue.lst: No such file or directory
...
debug: running meta tests; score so far=1.27
debug: is spam? score=1.27 required=3.7 tests=DATE_MISSING,NO_REAL_NAME
Sorry about the long mail, but i tell everything that happended. Any
ideas?
Any help is appreciated.
Mario Sergio
ption
that it must be passed in the command line?
Mario Sergio
On Thu, 14 Oct 2004, Matt Kettler wrote:
> At 02:16 PM 10/14/2004, Mario Sergio Candian wrote:
> >i installed the SA 2.64 with qmail, vpopmail, qmail-scanner, etc... I have
> >one question. I have three files in /usr/l
1 of 1 queries
debug: running meta tests; score so far=1.27
debug: is spam? score=1.27 required=3.7 tests=DATE_MISSING,NO_REAL_NAME
is SA read the .cf files in the /usr/local/share/spamassassin first?
Mario Sergio
On Thu, 14 Oct 2004, Matt Kettler wrote:
> At 02:16 PM 10/14/2004, Mario Sergio
Hi guys,
i have other question, how i can to test the SA, sending a spam email?
i need to do that for look if the "required_hits" is default (5.0) or not.
Mario Sergio
/MAMONAS.*ASSASINAS/i
score PROVER_MAMONAS15.0
but doesnt work. :/
How I can do it?
Thanks for all.
Mario Sergio Candian
-
"Dreams as if you'll live forever. Live as if you'll die today" -- James Dean
Oks... I wrong.. sorry... but, I need too to block any emails with subject
SERASA... :/ What I need to do to block it?
Mario Sergio Candian
-
"Dreams as if you'll live forever. Live as if you'll die today" -- James Dean
On Wed, 2 Mar 2005, Matt Kettler wrote:
At 01:46 PM 3/
70 matches
Mail list logo
