>...
>On Sat, 2005-11-12 at 10:56 -0500, Pierre Thomson wrote:
>> A slightly more compact way to treat the final digit:
>>
>> > > bodyPROLO_LEO1 /85\,45|1\,2[12]/
>> > > bodyPROLO_LEO2 /69\,95|3\,3[23]/
>
>New uri showed up today, so the updated ru
On Sun, 2005-11-13 at 01:24 +0100, Raymond Dijkxhoorn wrote:
> Hi!
>
> bodyPROLO_LEO1 /85\,45|1\,2[12]/
> bodyPROLO_LEO2 /69\,95|3\,3[23]/
> >
> > New uri showed up today, so the updated rule I use is now:
> >
> > bodyPROLO_LEO1
Hi!
bodyPROLO_LEO1 /85\,45|1\,2[12]/
bodyPROLO_LEO2 /69\,95|3\,3[23]/
New uri showed up today, so the updated rule I use is now:
bodyPROLO_LEO1 /85\,45|1\,2[12]/
bodyPROLO_LEO2 /69\,95|3\,3[23]/
bodyPROLO_LEO3
On Sat, 2005-11-12 at 10:56 -0500, Pierre Thomson wrote:
> A slightly more compact way to treat the final digit:
>
> > > bodyPROLO_LEO1 /85\,45|1\,2[12]/
> > > bodyPROLO_LEO2 /69\,95|3\,3[23]/
New uri showed up today, so the updated rule I use is
List Mail User wrote:
> They should hit a well trained BAYES
They get some from bayes but not enough, I hand feed every one I get into my
bayes and each new run always comes up with less bayes score.
The past few I received got:
BAYES_60
BAYES_60
BAYES_80
BAYES_95 <- I think this one was a few we
Hi!
bodyPROLO_LEO1 /85\,45|1\,21|1\,22/
bodyPROLO_LEO2 /69\,95|3\,33|3\,32/
No need to have 1\,21 twice in there.
Huh? One is 1,21 (original) the other 1,22 (my addition).
Must be my lack of coffee ;)
Bye,
Raymond.
On Sat, 2005-11-12 at 10:06 +0100, Raymond Dijkxhoorn wrote:
> Hi!
>
> >
> > bodyPROLO_LEO1 /85\,45|1\,21|1\,22/
> > bodyPROLO_LEO2 /69\,95|3\,33|3\,32/
> >
>
> No need to have 1\,21 twice in there.
Huh? One is 1,21 (original) the other 1,22 (my
Hi!
bodyPROLO_LEO1 /85\,45|1\,21|1\,22/
bodyPROLO_LEO2 /69\,95|3\,33|3\,32/
No need to have 1\,21 twice in there.
Bye,
Raymond.
On Wed, 2005-11-09 at 23:47 +0100, Raymond Dijkxhoorn wrote:
> Hi!
>
> >>A slightly earlier one got a much lower score with:
> >>
> >
> > Umm... I don't see any SARE rules in there. The fact is, SARE isn't
> > terribly effective against these 1-column drug spams. The only SARE hit
> > I got
On Wednesday, November 9, 2005, 10:31:30 AM, Pierre Thomson wrote:
> Where are those URIBL_RHS_* tests from? I see no mention of them on either
> SA or URIBL sites.
> Pierre
See:
http://www.uribl.com/usage.shtml
Jeff C.
--
Jeff Chan
mailto:[EMAIL PROTECTED]
http://www.surbl.org/
Hi!
A slightly earlier one got a much lower score with:
Umm... I don't see any SARE rules in there. The fact is, SARE isn't
terribly effective against these 1-column drug spams. The only SARE hit
I got was SARE_SPEC_LEO_LINE03f with a whopping 0.18 points, or
occasionally SARE_SP
>>>...
>> Pierre,
>>
>> I does seem that the digests plus Bayes are the best defense against
>> these. Just a few minutes ago another arrived:
>>
>> Y 15 -
>> BAYES_99,DCC_CHECK,DIGEST_MULTIPLE,HTML_90_100,HTML_MESSAGE,MIME_QP_LONG_LINE,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_BL_S
List Mail User wrote:
>>> ...
>>
>> I'm not really THAT badly off; I run all default 3.1.0 tests plus
>> Bayes and DCC, three RBL's, URIBL/SURBL, some SARE rule sets and a
>> bunch of local rules. I do MTA-level blocking with Spamhaus
>> SBL-XBL, which knocks off at least half the junk before it
>>...
>> do not use SARE tests, just check, read and try to follow what they
>> are doing).
>>
>
>Paul,
>
>I'm not really THAT badly off; I run all default 3.1.0 tests plus Bayes and
>DCC, three RBL's, URIBL/SURBL, some SARE rule sets and a bunch of local rules.
> I do MTA-level blocking with Sp
> -Original Message-
> From: Rosenbaum, Larry M. [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, November 09, 2005 10:45 AM
> To: users@spamassassin.apache.org
> Subject: RE: More spam getting through
>
>
> > From: Loren Wilton [mailto:[EMAIL PROTECTED]
> &g
> From: Loren Wilton [mailto:[EMAIL PROTECTED]
>
> > I'm not sure if Loren's rules made it into any particular
> > ruleset or if Leo "morph"'d too often to bother; Maybe someone
> ...
> Of
> course, the urls are going to end up in SURBL before most of you get
the
> spams, so those will aslo
List Mail User wrote:
>> ...
>> List Mail User wrote:
...
>>> I believe some people using the SARE rules report ~100 points for
>>> them (after half a day or so, they fail every net test, and very
>>> many "small" rules). Also, the typical ones are delivered by
>>> zombies, so often the
>...
>List Mail User wrote:
>>> ...
>>>
>> I believe some people using the SARE rules report ~100 points for them
>> (after half a day or so, they fail every net test, and very many
>> "small" rules). Also, the typical ones are delivered by zombies, so
>> often the DUL tests hit right away, and if
From: Loren Wilton [mailto:[EMAIL PROTECTED]
>
> > If anyone can formulate a regex to catch these letters in any
> > order, while avoiding a repeating sequence like "A A A A A ", it
> > would make this a safer rule.
>
> SARE has quite a number of rules specifically to catch these table
> drug spa
List Mail User wrote:
>> ...
>>
> I believe some people using the SARE rules report ~100 points for them
> (after half a day or so, they fail every net test, and very many
> "small" rules). Also, the typical ones are delivered by zombies, so
> often the DUL tests hit right away, and if you can aff
Thomson [mailto:[EMAIL PROTECTED]
Sent: 08 November, 2005 4:14 PM
To: Bowie Bailey; Spamassassin List (E-mail)
Subject: RE: More spam getting through
Bowie Bailey wrote:
>
> Some of the medication spams are using an obnoxious html table
> structure that makes the contents of eac
> I'm not sure if Loren's rules made it into any particular
> ruleset or if Leo "morph"'d too often to bother; Maybe someone
They were in specific.cf as I recall. Yes, they were in there, and yes, Leo
tended to get around them every few days. A couple of them are still there
and still hit occas
> If anyone can formulate a regex to catch these letters in any order, while
avoiding a
> repeating sequence like "A A A A A ", it would make this a safer rule.
SARE has quite a number of rules specifically to catch these table drug
spams.
Loren
>...
>From: List Mail User [mailto:[EMAIL PROTECTED]
>>
>> >...
>> >I'm running SA 3.1 and I have started to notice more spam come through
>> >recently.
>> >[snip - original table drug spam]
>> >
>> >Has anyone else been having this problem? Any rules to catch medication
>> >names in those types
On Tuesday 08 November 2005 08:57 am, Bowie Bailey wrote:
> I'm running SA 3.1 and I have started to notice more spam come through
> recently.
>
> Some are porn and some are medication. They don't hit much of anything
> beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
>
> Som
From: List Mail User [mailto:[EMAIL PROTECTED]
>
> >...
> >I'm running SA 3.1 and I have started to notice more spam come through
> >recently.
> >
> >Some are porn and some are medication. They don't hit much of anything
> >beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
>
>...
>I'm running SA 3.1 and I have started to notice more spam come through
>recently.
>
>Some are porn and some are medication. They don't hit much of anything
>beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
>
>Some of the medication spams are using an obnoxious html tabl
Pierre Thomson wrote:
> Bowie Bailey wrote:
>>
>> Some of the medication spams are using an obnoxious html table
>> structure that makes the contents of each cell print vertically.
>>
>> For example:
>>
>>
>> a d g
>> b e h
>> c f i
>>
>> <\tr>
>>
>>
>> Th
Bowie Bailey wrote:
>
> Some of the medication spams are using an obnoxious html table
> structure that makes the contents of each cell print vertically.
>
> For example:
>
>
> a d g
> b e h
> c f i
>
> <\tr>
>
>
> This results in:
> a b c
> d e f
> g h i
>
29 matches
Mail list logo
