[Help] bodyre in hashbl

2021-05-17 Thread Marco
e', '([\p{L}\p{M}\d\Sàèìòù]+[\ \t]+[\p{L}\p{M}\d\Sàèìòù]+)', '^127\.0\.0\.2') So I have to add the accented character literally. I can't understand why. Are there any limitation in Hashbl plugin with UTF8? Maybe I have misunderstood something. Thank you very much for every hint. Kind Regards Marco

Re: [Help] bodyre in hashbl

2021-05-18 Thread Marco
Il 17/05/2021 18:12, Henrik K ha scritto: On Mon, May 17, 2021 at 03:02:57PM +0200, Marco wrote: So I have to add the accented character literally. I can't understand why. Are there any limitation in Hashbl plugin with UTF8? Maybe I have misunderstood something. SA doesn't support

Re: [Help] bodyre in hashbl

2021-05-19 Thread Marco
rds Marco

URI_NO_WWW_INFO_CGI info

2015-12-29 Thread marco
.biz domains in these rules and not the others domains (.com etc...)? Thanks Marco

uceprotect issue

2016-11-02 Thread Marco
't know how to contact uceprotect, their contact form is unavailable. It seems the problem starts on 30 october. Did you have noticed too something about? I think if you use uceprotect it's better to test the answer in 127.x.x.x address class... Best Regards Marco

sa-update fails with “no mirrors available”

2013-09-23 Thread Marco
Is this a known issue? How to fix it? SpamAssassin version 3.3.2 running on Perl version 5.18.1 Marco

Re: sa-update fails with “no mirrors available”

2013-09-23 Thread Marco
n Sid. I'll file a bug report tomorrow. What's supposed to be in that file (then I can add it manually as a workaround)? Marco Sep 23 19:52:36.528 [5668] dbg: logger: adding facilities: all Sep 23 19:52:36.529 [5668] dbg: logger: logging level is DBG Sep 23 19:52:36.529 [5668] dbg: generic

Re: sa-update fails with “no mirrors available”

2013-09-23 Thread Marco
1 Thanks for the quick help. Marco

Strange URIBL_SBL false positive?

2013-10-17 Thread Marco
Contains an URL listed in the SBL blocklist [URIs: errebian.it] ...but errebian.it IPs are not in SBL..! Could you help me to understand? Thank you very much!! Marco

Re: Strange URIBL_SBL false positive?

2013-10-17 Thread Marco
the unreal score this person is using "7.0 URIBL_SBL" means he's screaming for trouble definitely NOT an FP I though SBL could be safe for MTA blocking configurations. If the plugin works as explained I'll restore the score to the default. Many thanks Marco

Awl on Redis

2015-04-17 Thread marco
Hi to all, a saw that from spamassassin 3.4 Bayes can be stored on a Redis database. Is it possible also for Awl (auto_whitelist) ? Or maybe in the future ? thanks Marco

Re: SPAM/Phish and Ham E-mail Dataset

2011-01-12 Thread Marco Ribeiro
http://untroubled.org/spam/ --> for spam, updated daily. --Marco Túlio *Sola Scriptura, Sola Fide, Sola Gratia, Solus Christus, Soli Deo Glória* On Wed, Jan 12, 2011 at 8:23 PM, mouss wrote: > Le 12/01/2011 23:02, Mahmoud Khonji a écrit : > > I would highly appreciate if anyon

Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC

2011-04-05 Thread Marco Beishuizen
-STABLE and sendmail. Thanks, Marco -- The best things in life are for a fee.

Re: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC

2011-04-05 Thread Marco Beishuizen
mpile the rules or remove the plugin that looks for compiled rules. How do I compile the rules? I'm using the ports btw. Marco -- A day without orange juice is like a day without orange juice.

Re: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC

2011-04-05 Thread Marco Beishuizen
On Tue, 5 Apr 2011, Michael Scheidell wrote: just 'sa-compile' make sure it completes. do a 'spamassassin --lint' to make sure you don't have any rules that won't compile. also, AFTER you compile the rules, you have to restart spamd. I already ran sa-compile twice, and didn't get any error

Re: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC

2011-04-05 Thread Marco Beishuizen
On Tue, 5 Apr 2011, Michael Scheidell wrote: did you reload spamd, restart spamd? when you recompile the rules, you need to tell spamd to reload. did this used to work before you upgraded to perl 5.12? Yes I recompiled and restarted spamd. I think I have this error for a long time, also with

Re: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC

2011-04-05 Thread Marco Beishuizen
On Tue, 5 Apr 2011, Michael Scheidell wrote: did you reload spamd, restart spamd? when you recompile the rules, you need to tell spamd to reload. did this used to work before you upgraded to perl 5.12? When spamd restarts I also get: ... Stopping spamd. Waiting for PIDS: 9064. Starting spamd.

Re: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC

2011-04-06 Thread Marco Beishuizen
restart spamd.  your errors will go away. I deinstalled sa completely and reinstalled it, including the deletion of all sa directories. Now it seems to work fine. I'll keep an eye on it if it stays ok. Thanks for the help. Regards Marco -- Avert misunderstanding by calm, poise, and balance.

Re: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC

2011-04-06 Thread Marco Beishuizen
On Wed, 6 Apr 2011, Benny Pedersen wrote: disable this v320.pre:loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody and restart spamd.  your errors will go away. you did not listen, but try: spamassassin 2>&1 -D --lint | less any unwanted plugins failing ?, or do you like to use more plugin

warn: Use of uninitialized value $opt{"syslog-socket"} in lc at /usr/local/bin/spamd line 444

2011-05-08 Thread Marco Beishuizen
n get rid of it. Thanks and regards, Marco PS: running SA on FreeBSD 8.2-STABLE -- He who writes with no misspelled words has prevented a first suspicion on the limits of his scholarship or, in the social world, of his general education and culture. -- Julia Norton McCorkle

Re: warn: Use of uninitialized value $opt{"syslog-socket"} in lc at /usr/local/bin/spamd line 444

2011-05-08 Thread Marco Beishuizen
On Sun, 8 May 2011, the wise Michael Scheidell wrote: missing the syslog conf setting? I don't have anything spamd related in syslog.conf. the official freebsd port? what port version? newest? Yes, it's the latest portversion (4.8.0) -- Who to himself is law no law doth need, offends no l

Re: Confused about Mail::SPF::Query

2014-01-01 Thread Marco Volkert
You can check the SPF entries for your (or other) domain here: http://mxtoolbox.com/SuperTool.aspx?action=spf%3ayour-domain.com&run=networktools Am 31.12.2013 19:39, schrieb Blason R: It seems you did not publish TXT record for your domain hence gmail mail servers are unable to identify the

SA 3.3, Debian and *BL...

2015-03-04 Thread Marco Gaiarin
L usage? How can i fix it? Thanks. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia''http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiar

Re: SA 3.3, Debian and *BL...

2015-03-04 Thread Marco Gaiarin
oh. Seems to me i've missed something... probably 'dns_available test: 172.0.0.1' mean that i've to use '172.0.0.1' as a resolving test, not a resolver... Ouch... i'm a stupid. Sorry to all. ;( -- dott. Marco Gaiarin GNUPG

Re: Awl on Redis

2015-04-22 Thread Marco Felettigh
Ok Thanks for the answer :) Marco On Fri, 17 Apr 2015 07:58:15 -0400 "Kevin A. McGrail" wrote: > On 4/17/2015 6:46 AM, ma...@nucleus.it wrote: > > Hi to all, > > a saw that from spamassassin 3.4 Bayes can be stored on a Redis > > database. > > > >

CVE-2018-11805 fix and sa-exim

2019-12-18 Thread Marco Gaiarin
> 10, 'connectiphdr' => 'X-SA-Exim-Connect-IP', 'envfromhdr' => 'X-SA-Exim-Mail-From', 'rcpttohdr' => 'X-SA-Exim-Rcpt-To', 'greylistnullfrom' => 1, 'greylistfourthbyte'

Re: CVE-2018-11805 fix and sa-exim

2019-12-19 Thread Marco Gaiarin
Riprendo quanto scritto nel suo messaggio del 18/12/2019... > I've reported this to atleast Debian and Ubuntu along with a proper fix. Many thanks!!! -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'&#

How to handle bounces

2004-09-09 Thread Marco Supino
re used etc, which i think is something better being kept secret, if spam is to be handled better. Anyone has any idea how to "strip" the headers on outgoing emails, remove the replaced body of spamassassin, and restore the message to its original state ? Thanks. Marco.

Re: How to handle bounces

2004-09-09 Thread Marco Supino
know. Marco. Kelson wrote: Kevin Peuhkurinen wrote: If you are that concerned about what information is revealed in out of office autoreplies, you should not be allowing OoO autoreplies externally anyway. They pose a far greater security risk in terms of leaking information that can be used in

SQL one Site-Wide

2004-09-12 Thread Marco Supino
To: Addr to search in the database ? or any other idea i can use to allow users to config their own settings. Thanks. Marco.

Re: spamassassin-users on MARC

2004-09-15 Thread Marco Maske
ndering. >=== Al You can get the SA-users list on GMANE and apache, too. Here's a list of all SA-list and where them archived: http://wiki.apache.org/spamassassin/MailingLists -- Ciao Marco, registered GNU/Linux-User 313353

Re: REMINDER: Adding new JP list to multi.surbl.org on 9/27/04 [Scanned]

2004-09-29 Thread Marco Maske
s already default in SA 3.1 and higher, and will scored by the masstest every Update. -- Ciao Marco, registered GNU/Linux-User 313353 Keine Macht George W.Bush und seiner Junta zur Ausbeutung, Unterdrückung, Weltmacht & 'BigBrother-watching'; kauft keine U$-Waren!

Re: (off topic) PGP/GPG

2004-09-29 Thread Marco Maske
available). I'm interestet. This is first time that I exchange keys and I want sign my RPM's for others. If you need something to verify me you can look at http://www.denic.de/en/whois/index.jsp for marcomaske.de boldsuck.de to see that I'm Marco Maske Steinweg 18 53121

print runtime config

2004-10-03 Thread Marco Supino
, and how i can print them on the screen (in debug mode) ? Thanks. Marco.

Bayes - Oracle

2004-10-09 Thread Marco Supino
Hi, I am tring to make the AWL and Bayes work with SQL , on a Oracle 8.1.7 database, AWL works fine, but i have some problems with the bayes interface, make test gives out this errors : t/bayessql..ok 16/44# Failed test 17 in t/bayessql.t at line 133 t/bayessql..

Re: Ham rule problem

2004-10-15 Thread Marco Maske
e and it should work. Not necessary, but useful for Ham rules: tflags HAS_XX nice noautolearn -- Ciao Marco, registered GNU/Linux-User 313353 Keine Macht George W.Bush und seiner Junta zur Ausbeutung, Unterdrückung, Weltmacht & 'BigBrother-watching'; kauft keine U$-Waren!

Re: Whitelisting

2004-10-18 Thread Marco Maske
e. In other words, if the host that connected to your MX had an IP address that mapped to 'sendinghost.spamassassin.org', you should specify "sendinghost.spamassassin.org" or just "spamassassin.org" here. -- Ciao Marco, registered GNU/Linux-User 313353

Re: Duplicate Subject Headers

2004-10-19 Thread Marco Supino
This happends with the spamass-milter, and its a known bug, no fix yet, are you using this milter ? Marco. Gustafson, Tim wrote: Hello I'm getting a lot of messages that are actually marked as SPAM, but "appear" to not have the subject header rewritten. Further investigation rev

Re: Duplicate Subject Headers

2004-10-19 Thread Marco Supino
No, I asked several times, but never got an answer. Marco. Gustafson, Tim wrote: Yes, I'm using spamass-milter. :\ Any ideas on when there might be a fix? Tim Tim Gustafson MEI Technology Consulting, Inc [EMAIL PROTECTED] (516) 379-0001 Office (516) 480-1870 Mobile/Emergencies (516) 908-418

Re: Whitelisting

2004-10-19 Thread Marco Maske
s normally are: # a union of domains specified in: $mydestination, $virtual_alias_domains, # $virtual_mailbox_domains, and $relay_domains. # @local_domains_acl = ( ".$mydomain" ); # $mydomain and its subdomains -- Ciao Marco, registered GNU/Linux-User 313353

Per-recipient on system-wide

2004-10-21 Thread Marco Supino
on the relay), so each recipient can specify options for himself (throught SQL). Other MTA's can also be considered, if this functionality is availble, Thanks. Marco.

Empty messages

2005-01-05 Thread Marco Supino
there any rule that can take of this ? This is the sa header : X-Spam-Status: No, hits=3.4 required=5.0 tests=MISSING_HEADERS, MISSING_SUBJECT,RCVD_IN_BL_SPAMCOP_NET,SPF_FAIL Maybe a rule that if MISSING_HEADERS & MISSING_SUBJECTS a score will be much higher , is this good ? Marco.

spamd - limiting processes

2005-05-11 Thread Marco Herrn
livered because of this. Now my question is, what to do to limit concurrent spamd processes? And is it correct behaviour that the spamd processes give up, when the DB isn't accessible at some time? If they had tried it again, all mails could have been delivered. Regards Marco

Re: spamd - limiting processes

2005-05-12 Thread Marco Herrn
> At 05:51 AM 5/11/2005, Marco Herrn wrote: >>It seems that the --max-children option doesn't do as one expects, since >>spamd now uses a preforking. And it seems that the processes are not >>limited at all. > > Are you sure? Are there more than 5 spamd's in ps

Re: German Spam followup

2005-05-17 Thread Marco Maske
vers, ... And don't forget the bayes. There must be some *trustet* people from *every* country, who can choice ham and spam for sa-learn. -- Ciao Marco, registered GNU/Linux-User 313353

Re: whitelist_from vs blacklist_from

2005-05-17 Thread Marco Maske
k in your docs for amavisd.conf-sample. That is the traditional style, chatty configuration file with many easy explained good examples. -- Ciao Marco, registered GNU/Linux-User 313353

Listening on local interface

2005-06-20 Thread Marco Herrn
*:* 10608/spamd child udp 368 0 *:34604 *:* 10608/spamd child What does that mean? All udp connections listen on the whole internet. Is this a bug? Have I configured spamd incorrectly? Any hints are appreciated. Regards Marco

Re: Listening on local interface

2005-06-21 Thread Marco Herrn
Hi, Matt Kettler <[EMAIL PROTECTED]> wrote: > Marco Herrn wrote: > > What does that mean? All udp connections listen on the whole internet. Is > > this a bug? Have I configured spamd incorrectly? > > > > What plugins are you using? Any chance you've got a

Re: Listening on local interface

2005-06-21 Thread Marco Herrn
On Mon, 20 Jun 2005 14:00:16 -0400 Theo Van Dinter <[EMAIL PROTECTED]> wrote: > On Mon, Jun 20, 2005 at 06:17:25PM +0200, Marco Herrn wrote: > > udp 368 0 *:34602 *:* > >10608/spamd child > >

SFP question

2006-09-05 Thread Marco Michelino
Hi list, I have a question about SPF support. On my server, SPF_HELO_* tests work properly while SPF_* checks are never performed; why this? How does spamassassin decide to perform one test or the other? In 25_spf.cf I see: tflags SPF_PASS net nice userconf but I cant'understand

SQL preferences - multiword preferences

2005-06-24 Thread Marco Herrn
subject? I stored this as one string in the column 'preference' and the value (SPAM) in the column 'value', but it is ignored. How do I have to give such preferences? Regards Marco

Logging the Sendmail queue id in the SpamAssassin logs?

2006-01-13 Thread Marco Teeuwen
his is not very practical. Any help? Thanks, Marco Teeuwen

Bypass SA Was: DO NOT Filter this list!!!

2006-02-16 Thread Marco Maske
#x27;i, qr'^.. $'i, ), Don't use SENDER SOFT-WHITELISTING in amavisd because thats the same as in SA. It's only affect the score but don't bypass SA. Maybe someone helps this. On SuSE Linux amavisd-new can setup with Postfix in YAST. Ciao Marco.

Re: I catch all this spam, but just for curiosity...

2006-02-26 Thread Marco Maske
. The rules can be: AND "&&", OR "||" # NAND, NOR (negotation) is set so: !__MY_FIRST_RULE meta EXAMPLE_RULE ( __MY_FIRST_RULE && __MY_SECOND_RULE && __MY_THIRD_RULE) describe EXAMPLE_RULE How to write a meta rule score EXAMPLE_RULE 5 -- Ciao Marco, registered GNU/Linux-User 313353

Re: Can someone check my local.cf

2006-03-31 Thread Marco Maske
Benjamin Adams wrote: > I just updated from 3.1.0 to 3.1.1 > I'm going to use the same local.cf ... > # OK languages > ok_languages en fr de ok_languages is realised by Plugin since 3.1.0 see Upgrade File and this List Ciao Marco. -- Sie brauchen einen Computer nicht

Re: How to whitelist mail lists?

2007-03-06 Thread Marco Maske
Feb. 06 search the archive: http://wiki.apache.org/spamassassin/MailingLists Subject Re: Bypass SA Was: DO NOT Filter this list!!! Ciao Marco!

Re: Freshdesk (again)

2020-08-18 Thread Pedro David Marco
If they only have some IPs addresses instead of millions of them, for sure they would care!! Pedro. >On Monday, August 17, 2020, 08:52:24 PM GMT+2, @lbutlr wrote: >On 17 Aug 2020, at 11:25, Philip Prindeville > wrote: > I’ve been calling out phishing from the same (IP

spamd childs keep working with previous configuration after reload or restart...

2020-09-14 Thread Pedro David Marco
Hi everybody! Sometimes sending HUP signal to the parent spamd daemon, or even restarting it,  do not cause a reload in all spam childs. normally (99% of times) all childs work with current config as expected but 1% of the times...some childs work with current config and some childs keep wor

Re: Check HELO

2020-09-14 Thread Pedro David Marco
>On Monday, September 14, 2020, 05:23:13 PM GMT+2, John Hardin wrote: >I don't check for FCrDNS explicitly, but I do reject non-FQDN HELO strings  >(e.g. no dots present) from the Internet. That catches a surprising > percentage of garbage up front. +1 -Pedreter

Re: blacklisting the likes of sendgrid, mailgun, mailchimp etc.

2020-09-17 Thread Pedro David Marco
>On Thursday, September 17, 2020, 12:44:52 PM GMT+2, Marc Roos wrote: >For what it is worth. I was always under the impression that most of >hose >companies that are using these networks known for 'harassing' >here just ignorant. I used to do business with the 'idiots' of >ucows/open

Re: Announcement of the passing of Jari Fredriksson

2020-09-22 Thread Pedro David Marco
:-( sad news, Kevin... thanks for letting us know... Rest in peace, Jari...   -Pedreter On Monday, September 21, 2020, 06:13:11 PM GMT+2, Kevin A. McGrail wrote: Definitely.  For those who have inquired, that was supposed to read "I am sorry to announce that Jari Fredriksson di

sa-compile time in SA 3.4.4

2020-10-02 Thread Pedro David Marco
Hi everybody... i have noticed a huge difference in compiling time between SA 3.4.2 and 3.4.4    (3.4.4 is much much faster)but i have not seen anything in the "what_is_new docs" about it... make it sense?? Thanks... ---Pedreter

Parsing Sendgrid links

2020-10-19 Thread Pedro David Marco
Does anyone know how to parse Sendgrid redirection links like this: https://u15178038.ct.sendgrid.net/ls/click?upn=UgxaS24gNWvLFnxuRn0rD7yEB8283lpOzJbYCl-2BDIEoXpgCZWC85CVCSMWWLv7d8PUrbpDyLJSfJKqQvzZXNfw-3D-3Djkdm_XsGA-2Fgkm2IVk-2FlYw8ReyfPf5dkRMjAf-2BMJiZBo-2B42nZP1FD9PWIpHZFF9vj7mZg836sNXYVioj8zp

Re: Apache SpamAssassin and Spammers 1st Amendment Rights

2020-11-21 Thread Pedro David Marco
Your freedom ends where my rights start.

Understanding firebasestorage URLs...

2020-12-14 Thread Pedro David Marco
Hi ! i am trying to understand firebase URLs.. like this: https://firebasestorage.googleapis.com/v0/b/hust-28d4c.appspot.com/o/olgen%2Findex2ton.html?alt=media&token=35970e26-0fe8-44ad-ae93-d38929669e81#i...@susmuelas.com (handle carefully: real phishing)  is there any doc/info about it? fields me

Emotet today..

2021-01-13 Thread Pedro David Marco
Hi all... sorry for the semi off-topic... Today Emotet is being sent in an encrypted zip with the password embedded into an anti-ocr image.. watch out! -Pedrete

Re: HEADS UP: SPAMCOP MIA

2021-01-31 Thread Pedro David Marco
spamcop seems back.. but... we need to be 100% sure that people behind it who should be - Pedreter On Sunday, January 31, 2021, 08:11:30 PM GMT+1, Axb wrote: On 1/31/21 8:04 PM, Bill Cole wrote: > On 31 Jan 2021, at 6:58, Axb wrote: > >> Happy Sunday !!! >> >> Cisco forgot to

Re: QR-decoding

2021-02-02 Thread Pedro David Marco
I already did that ... it collects URLs, Email boxes and  BTC wallets from QR (despite the full image is a QR code or the image 'contains' a QR) and injects them back into SA If there is interest in the community, maybe i can make it a standalone plugin and send it to Kevin for consideration..

Re: URLs hidden in Morse code

2021-02-12 Thread Pedro David Marco
On Thursday, February 11, 2021, 09:49:35 PM GMT+1, Bill Cole wrote: >Web-based MUAs (SquirrelMail, Horde, GMail, Outlook Web Access, etc.)  >brought back some support for JavaScript in mail, but as I understand >some of them do some defanging of scripts and the advancement of browser

Random results with AskDns

2021-03-01 Thread Pedro David Marco
Hi all, When there are several hundreds of lookups, Askdns / Async abort many of them randomly even when 100% of queries got an answer.I use local dns cache but every run of SA produces different number of aborted remaining lookups.  If you dig manually from command line any aborted query, answer

Re: Random results with AskDns

2021-03-02 Thread Pedro David Marco
answer and die on timeout.This not only affects final SA result, but performance. Correct Kernel UD tunning solves the problem! ---Pedreter. On Monday, March 1, 2021, 06:06:24 PM GMT+1, Pedro David Marco wrote: >Hi all,>When there are several hundreds of lookups, Askdns /

Re: Random results with AskDns

2021-03-02 Thread Pedro David Marco
Tried both and with/without cache... Pedreter... On Tuesday, March 2, 2021, 04:46:08 PM GMT+1, Matus UHLAR - fantomas wrote: On 02.03.21 15:26, Pedro David Marco wrote: >Just in case someone has this issue...   >Short version: >In heavy load environments, SA prod

Re: Random results with AskDns

2021-03-02 Thread Pedro David Marco
. On Tuesday, March 2, 2021, 04:44:35 PM GMT+1, Benny Pedersen wrote: >On 2021-03-02 16:26, Pedro David Marco wrote:> Correct Kernel UD tunning >solves the problem!>in verbose this is ?

Re: adobe cloud malicious link

2021-06-09 Thread Pedro David Marco
Even worse, Adobe make injects several redirections and never offer the PDF so nothing to scan even if you follow the links Let's keep thinking on it... Pedro. On Saturday, June 5, 2021, 12:48:00 AM GMT+2, Alex wrote: >Hi, >I received what appears to be a legitimate email from what

Re: Office phish

2021-07-05 Thread Pedro David Marco
>On Thursday, July 1, 2021, 05:03:50 PM GMT+2, RW wrote: > What legitimate email uses javascript? Pretty common! many people copy and paste from webs.. and of course these are important mails! :-( Pedreter

Re: Office phish

2021-07-06 Thread Pedro David Marco
On Monday, July 5, 2021, 11:45:42 PM GMT+2, RW wrote: >I'm not sure what you are referring to there. If you copy and paste a >web page into an HTML email, are you not just copying the formatting? Agree RW, but...  copy and paste from web source to MUA works! --Pedreter.

Re: Email Phishing and Zloader: Such a Disappointment

2021-07-12 Thread Pedro David Marco
>On Monday, July 12, 2021, 04:01:03 AM GMT+2, Kevin A. McGrail wrote: >If you can get me a spample, I'm sure I can tell you but in general we >block macros so that's all that's needed.  Likely the OLEVBMacro plugin >and KAM ruleset is blocking all of these already if you have the plugin

Identifying Amazon hosts...

2021-07-28 Thread Pedro David Marco
Hi! i have spam with this header: Received: from a48-115.smtp-out.amazonses.com (HELO a48-115.smtp-out.amazonses.com) (54.240.48.115) Is there any way, based on its fqdn, to know whether an Amazon smtp host is public or dedicated? Thanks! Pedreter.

Re: Identifying Amazon hosts...

2021-07-28 Thread Pedro David Marco
Hi Antony, please accept my apologizes and excuse my lack of accuracy on asking. i have knowledge near zero on Amazon, AWS, SES, etc.. My believe is that there are public amazon smtp servers that can be used by their customers (SES) and servers you have for your own... Again, please everybody, b

Re: spam from gmail.com

2021-11-09 Thread Pedro David Marco
The same with Microsoft365... A couple of weeks ago tons of M365 IP ranges got into their own RBLs...  good job!!!  Pedreter. >On Tuesday, November 9, 2021, 01:09:39 PM GMT+1, Peter wrote: > >This has been going on for a long time, Google is now one of my top spam >scources - I black

Emotet seems to be back...

2021-11-16 Thread Pedro David Marco
heads  up!!! Sorry for the semi off-topic...  but just in case this may help... Encripted zip files witth dangerous ofuscated macros inside calling our beloved powershell... Pedro

Semi off-topic: Problems with SpamRats

2022-01-14 Thread Pedro David Marco
Sorry for the semi-off-topic...  is there anybody in the list from SpamRats or with any contact in SpamRats, please? I am having issues with them and seems impossible to contact them... Thanks and sorry for bothering! ---Pete.

[no subject]

2022-04-28 Thread Pedro David Marco
Good question...  probably an interesting new feature for SA: dividing and deal with attached emails (and nested emails that look like a chat) in a one by one basis... Pete. >On Tuesday, April 26, 2022, 02:36:25 PM GMT+2, Matus UHLAR - fantomas wrote: >Hello, >is it possible to match me

Re: Spamhaus spurious positives - how does SpamAssassin check Spamhaus?

2022-05-09 Thread Pedro David Marco
To me it looks like a a DNS cache times issue... Paul, what resolver are you using? is your server under heavy load when this happens? if it is Linux, run    netstat -suna    and check for any errors in the Udp area. In FreeBSD  netstat -sa Pedro. On Saturday, May 7, 2022, 06:36:43 PM GM

pay attention if you use unrar

2022-06-29 Thread Pedro David Marco
sorry for the semi off-topic but worths so share... important unrar bug... https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/ Regards, Pedro.

Re: shit from serverion

2022-06-29 Thread Pedro David Marco
On our side it is a huge list as well... does Serverion send anything clean? Pedro. On Wednesday, June 29, 2022, 04:02:05 PM GMT+2, Matus UHLAR - fantomas wrote: On 29.06.22 13:14, Marc wrote: >Today I decided to spend some time getting all the ip's[1] (these are all > /24 thus you ha

Re: shit from serverion

2022-06-30 Thread Pedro David Marco
>On Thursday, June 30, 2022, 09:12:59 AM GMT+2, Benoit Panizzon wrote: >>All my attempts to reach out to ab...@serverion.com or any other >contacts found on their website remained unreplied. When a company does that  they deserve to be sent to /dev/null --Pedro.

Local mode with some URI checks. Possible??

2016-09-02 Thread Pedro David Marco
Hi!  I am using "Local tests only" mode of SA to prevent any network checks, but there is one URIBL i would like to use (as an exception).. is it possible to do this??? I have added this rule lo local.cf:  urirhssub     URIBL_BLACK  multi.uribl.com.        A   2  body            URIBL_BLACK  e

Re: Local mode with some URI checks. Possible??

2016-09-03 Thread Pedro David Marco
only mode. From: Axb To: users@spamassassin.apache.org Sent: Saturday, September 3, 2016 11:06 AM Subject: Re: Local mode with some URI checks. Possible?? On 09/03/2016 08:45 AM, Pedro David Marco wrote: > Hi! > > I am using "Local tests only" mode of SA to prevent a

Re: Local mode with some URI checks. Possible??

2016-09-04 Thread Pedro David Marco
@spamassassin.apache.org Sent: Saturday, September 3, 2016 1:57 PM Subject: Re: Local mode with some URI checks. Possible?? On 03.09.16 09:32, Pedro David Marco wrote: >Thans Axb, I already did it, but i could not found any reasonable way to >disable all networks checks but one...(not to go one by one,

Re: Local mode with some URI checks. Possible??

2016-09-04 Thread Pedro David Marco
ache.org" Sent: Sunday, September 4, 2016 9:52 PM Subject: Re: Local mode with some URI checks. Possible?? On 3 Sep 2016, at 5:32, Pedro David Marco wrote: > there is a Flag to indicate when a rule is net related or not, so my > understanding was thatas my rule did not have that flag,

Re: Local mode with some URI checks. Possible??

2016-09-04 Thread Pedro David Marco
  multi.uribl.com.        A  2 body        MY_URIBL_BLACK    eval:check_uridnsbl('MY_URIBL_BLACK') describe    MY_URIBL_BLACK    Contains an URL listed in the URIBL blacklist tflags      MY_URIBL_BLACK    net score      MY_URIBL_BLACK    3.0 Syntax is well documented. On 09/05/2016 06:59

Re: RCVD_IN_SORBS_SPAM and google IPs

2016-09-10 Thread Pedro David Marco
i receive tons of Ransonware from Google and MS Office365 IPs..   ---PedroD From: Bowie Bailey To: users@spamassassin.apache.org Sent: Friday, September 9, 2016 3:35 PM Subject: Re: RCVD_IN_SORBS_SPAM and google IPs On 9/9/2016 9:24 AM, li...@rhsoft.net wrote: > > > Am 09.09.2016

trusted_networks question...

2016-09-10 Thread Pedro David Marco
Hi there... i have this in my local.cf: trusted_networks    88.2.890.3 when i run SA in debug mode i see this: [17721] dbg: received-header: relay 88.2.890.3 trusted? no internal? no msa? no there is no error or warns anywhere... is this normal? Thanks! ---PedroD

Re: trusted_networks question...

2016-09-10 Thread Pedro David Marco
ormal? ---PedroD From: Martin To: users@spamassassin.apache.org Sent: Saturday, September 10, 2016 10:56 AM Subject: RE: trusted_networks question... From: Pedro David Marco [mailto:pedrod_ma...@yahoo.com] Sent: Saturday, September 10, 2016 9:51

Plugin development help needed...

2016-09-10 Thread Pedro David Marco
Hi there... i am not an expert OO developer so i am somehow flying blind in here and need your help please Basically i want to write my own plugin and i have some repeated calculations in each and every plugin method that i would like to reduce to just one, but i am not sure on how to do it... M

Re: Plugin development help needed...

2016-09-10 Thread Pedro David Marco
. From: Martin Gregorie To: users@spamassassin.apache.org Sent: Saturday, September 10, 2016 3:33 PM Subject: Re: Plugin development help needed... On Sat, 2016-09-10 at 13:09 +, Pedro David Marco wrote: > Hi there... > i am not an expert OO developer so i am somehow flying bl

Dealing with huge URLs and timeouts (possible evasion technique?)

2016-09-25 Thread Pedro David Marco
Hi, When  SA 3.4.1 analyzes emails with large random URIs... like this: http://track.parceiroshl.com.br/sessionredir/5745f9d44d45e448d1c7997b/aHR0cHM6Ly9yZWRpci5sb21hZGVlLmNvbS9sLzQ5NDY0ZDM2NDc2YTYzNmYzODZmNGY2YjQ1NTA2ZjU1NzA0ODY5NzAzMjY3NGU3MTc1NzI1MTRkNmQ1NTJmNTk3MzM3Mzg2Yjc3NjM3NDY5NDg0YjMxNzA0N

PYZOR_CHECK always have zero score, why?

2016-10-18 Thread Pedro David Marco
Hi! It seems PYZOR_CHECK rule is not being used in my SA Just installed SA and Pyzor in a Debian and executed  "pyzor discover."In Debian pyzor is enabled by default so nothing to add in local.cf. Command "pyzor check < emailfile.eml" works ok. .. now i try to test SA in debug mode like thi

Re: PYZOR_CHECK always have zero score, why?

2016-10-18 Thread Pedro David Marco
ent: Wednesday, October 19, 2016 6:04 AM Subject: Re: PYZOR_CHECK always have zero score, why? On 18 Oct 2016, at 23:22, Pedro David Marco wrote: > So Pyzor seems to be OK!... the problem is somehow related to > PYZOR_CHECK rule but why???  Some config file is being loaded that sets the

  1   2   3   4   >