i wonder then how can i use both to definitively not receive spam
coz, i'm an administrator ( lots of computers on my network), and spamassassin is too slow...
bogofilter seems to be the godd solution, but i'd like itt to learn automatically what spam is...
that why SA can teach him... but
On Tue, 2006-03-21 at 09:41 -0500, Matt Kettler wrote:
Yousef Raffah wrote:
This might be a general question but it is quite new to me, why do I see
the message has two different spam scores?
Because it looks like was scanned by two different copies of spamassassin.
One copy has been
Hi Emmanuel,
I have a custom rule which works nicely for me to catch those spams that use
this HTML trick. I'll send it to you offline as I've heard it's not wise to
post rules to the list (coz the spammers then see them) :)
Happy to send it to anyone else who asks too...
Cheers,
Jeremy
Krispisen a écrit :
i wonder then how can i use both to definitively not receive spam
coz, i'm an administrator ( lots of computers on my network), and
spamassassin is too slow...
bogofilter seems to be the godd solution, but i'd like itt to learn
automatically what spam is...
that why
Michael
Scores well on my system..
X-Spam-Status: Yes, score=10.9 required=5.0
tests=BAYES_50,BODY_FOREIGN_CURR,
DCC_CHECK,EXTRA_MPART_TYPE,FB_CONST_9,FM_MULTI_ODD2,FM_NO_STYLE,
HTML_MESSAGE,TW_CV,TW_GJ,TW_LR,TW_MQ,TW_RX,TW_WR,TW_XC autolearn=no
version=3.1.0
--
Martin
Emmanuel Lesouef a écrit :
Hi all,
I get several spam that are HTML but they are not detected.
In fact, they use the span mark out such as in this example :
This one is also not detected :
n V c a n I p i o u e m $ n 105 30 lp j p y i g l j l k s
c C g i j a c I i i r s $9 n 9 10 1j
Was this one only in plain text, or did it include an HTML part as well? Can
you give us the full body unaltered? Could be that it's using some other
type of fancy HTML to make the text look like that.
Cheers,
Jeremy
Emmanuel Lesouef [EMAIL PROTECTED] wrote in message
news:[EMAIL PROTECTED]
Hi!I recently installed Mailscanner and spamassassin on debian. I haven't configured it to use multi.surbl.org lists, but when i send a test mail with a testlink, i can see that it's catched as spam, just like it should:
MailScanner-SpamCheck: spam, SpamAssassin (score=9.303, required 5,
Mail sent to a Japanese user is being wrongly marked as spam, intermittently.
It seems that this is related to the fact that it is in double byte
characters. Does anyone know of a way to fix this?
Many thanks.
--
View this message in context:
The trick is really simple: read every second part of the text. The
other parts are moved away using span tag. Nice html. :)
By the way, the html looks like this in the mail:
DIVFONT face=Arial size=2Hi,/FONT/DIV
DIVFONT face=Arial size=2/FONTnbsp;/DIV
DIVFONT face=Arial size=2Do you want to
On Tuesday 21 March 2006 11:19 pm, Matt Kettler wrote:
Chris wrote:
I had a FN awhile ago that I ran through spamassassin -t and it gave
the same score as the original:
score=4.3 required=5.0 tests=BAYES_99,HTML_MESSAGE,
SARE_HTML_TITLE_LWORD,SARE_UNSUB18
Then I ran it
Does anybody know the instructions for training SA with the contents of
the Thunderbird Junk folder ?
My web host, where SA is tunning, suggests I do this in order to reduce
the amount of spam I get, and I can login to my web host, transfer files
from my local machine to my web host, and run
Edward Diener wrote:
Does anybody know the instructions for training SA with the contents of
the Thunderbird Junk folder ?
My web host, where SA is tunning, suggests I do this in order to reduce
the amount of spam I get, and I can login to my web host, transfer files
from my local machine to
JamesDR wrote:
Edward Diener wrote:
Does anybody know the instructions for training SA with the contents
of the Thunderbird Junk folder ?
Upload them as single messages to your ISP account. If you have a
special folder in TB (Thunderbird) for the messages you want to train on
you can find
I started using the rulesDuJour for a couple of weeks and decided to set it
up on a cron job. For unknown reasons, I was never successful at setting it
on a cron. So I went back to manual but now that doesn't work as well. I
fear that when I was testing it on the cron, I went over some limit and
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
There are lists that use various servers for their distributions.
These servers can be described using wild cards as for instance
*.somelist.org
I tried to use such wild cards in local.cf as in
whitelist_from_rcvd [EMAIL PROTECTED]
-Original Message-
From: Jim Smith [mailto:[EMAIL PROTECTED]
Sent: Wednesday, March 22, 2006 07:35
To: users@spamassassin.apache.org
Subject: Have I been banned from rulesdujour?
I started using the rulesDuJour for a couple of weeks and
decided to set it up on a cron job. For
The wildcard isn't needed, and I doubt it's allowed either. See the info and
examples at
http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.html#whitelist_and_blacklist_options
Specifically, the string at the end of whitelist_from_rcvd which refers to
the reverse DNS of
Jim Smith wrote:
I started using the rulesDuJour for a couple of weeks and decided to
set it up on a cron job. For unknown reasons, I was never successful
at setting it on a cron. So I went back to manual but now that
doesn't work as well. I fear that when I was testing it on the cron,
I went
I would suggest that you do as the error says and check your CRON.
What do you get from 'crontab -l'?
Nothing very telling:
#0 0 * * * /usr/local/urchin/urchin -q
0 6 * * * /bin/sh /home/find_quar
0 2 * * * /usr/local/etc/mail/spamassassin/RulesDuJour/rules_du_jour
Jim Smith wrote:
I would suggest that you do as the error says and check your CRON.
What do you get from 'crontab -l'?
Nothing very telling:
0 2 * * * /usr/local/etc/mail/spamassassin/RulesDuJour/rules_du_jour
Once a day shouldn't cause a problem. Try contacting whoever is in
Martin Lyberg wrote:
Hi!
I recently installed Mailscanner and spamassassin on debian. I haven't
configured it to use multi.surbl.org http://multi.surbl.org lists,
but when i send a test mail with a testlink, i can see that it's
catched as spam, just like it should:
MailScanner-SpamCheck:
Chris wrote:
http://wiki.apache.org/spamassassin/AwlWrongWay
Thanks Matt, I knew that it wasn't a 'real' whitelist, just didn't realize
an address would get added by running it through spamassassin more than
once.
It's an averager.. In order to track averages every address gets
well... my user community isquite lazy.That's why i created 2 accounts. spambox hambox.when an user checks his webmail, he can click on a button which send the mail as spam in the spambox, or send it as ham in the hambox.
Therefore, i have a new corpus each day, composed with spam ham
I installed spamassassin not long ago on our server, and it worked great!
Then sometime in the last couple of weeks it appears to have just
stopped working. No incoming e-mails are being tagged with spamassassin
headers anymore.
I restarted sendmail (eh, I know that wouldn't really do
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Craig Morrison wrote:
JamesDR wrote:
Edward Diener wrote:
Does anybody know the instructions for training SA with the
contents of the Thunderbird Junk folder ?
Upload them as single messages to your ISP account. If you have a
special folder in
System: SA 3.1.0 (called from MailScanner, called from sendmail.
The ISP mmail.co.uk (part of the O2 mobile phone (cellphone under
trans-Atlantic translation!) company here in the UK) generates a peculiar
Date: format. So when it arrives here, our SA is tagging it as spam.
Part of the headers:
This one is also not detected :
n V c a n I p i o u e m $ n 105 30 lp j p y i g l j l k s
c C g i j a c I i i r s $9 n 9 10 1j o p r i a l s l a s
d V d i y a e g k r a a $6 h 9 10 U9 a p y i g l m l v s
n V c a n I p i o u e m $ n 105 30 lp j p y i g l j l k s
c C g i j a c I i
I created 2 accounts. spambox hambox.when
an user checks his webmail, he can click on a button which send the
mail as spam in the spambox, or send it as ham in the hambox.
Therefore, i have a new corpus each day, composed with spam ham messages...I think ur solution was great.First, Bogofilter
David Lee wrote:
System: SA 3.1.0 (called from MailScanner, called from sendmail.
The ISP mmail.co.uk (part of the O2 mobile phone (cellphone under
trans-Atlantic translation!) company here in the UK) generates a peculiar
Date: format. So when it arrives here, our SA is tagging it as spam.
Part
David Lee wrote:
Date: Wed, 22 Mar 06 12:00:00 GMT Standard Time
[snip.]
The main addressable issue here seems to be the INVALID_DATE. The
Date: supplied by Mmail does not have a simple timezone (e.g. expect
GMT), but rather GMT Standard Time. (Correct?)
This seems to me to be a clear
For what it's worth, Vodafone's as bad (stuff changed to protect the
innocent):
From: [EMAIL PROTECTED] [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Date: Nov 9, 2005 4:53 PM
Subject: You have received a new message
RFC2822 is unequivocal about the day month year
Seen other companies email systems not follow standards as well (I think
MS-EXCH can be easily broken). I've seen stuff arrive in a Eudora MUA and
get filed at the 'top' well out of the way of recent messages and the user
then swears blind they never got the email.till they scroll to the
Randal, Phil wrote:
For what it's worth, Vodafone's as bad (stuff changed to protect the
innocent):
From: [EMAIL PROTECTED] [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Date: Nov 9, 2005 4:53 PM
Subject: You have received a new message
RFC2822 is unequivocal about
- Original Message -
From: Liam-PrintingAutomation [EMAIL PROTECTED]
To: users@spamassassin.apache.org
Sent: Wednesday, March 22, 2006 07:36
Subject: SA just stopped working
I installed spamassassin not long ago on our server, and it worked great!
Then sometime in the last couple of
On Wed, Mar 22, 2006 at 09:12:14AM -0800, Mike Jackson wrote:
cat msg_to_test.txt | spamassassin -D --lint 21 | more
Then look at the output to see if there's anything wrong.
Just to note, there's no point in sending a message to spamassassin
if you're doing --lint (it generates its own
-Original Message-
From: Loren Wilton [mailto:[EMAIL PROTECTED]
Sent: Wednesday, March 22, 2006 8:29 AM
To: users@spamassassin.apache.org
Subject: Re: HTML spam not detected
This one is also not detected :
n V c a n I p i o u e m $ n 105 30 lp j p y i g l j l k s
c C g i j a c
Matt Kettler wrote:
Real numbers from last week:
Total messages scanned by SA:
19268
Number of messages matching SPF_FAIL:
89
Number of messages matching SPF_SOFTFAIL
493
Number of messages matching SPF_NEUTRAL
200
Number of messages matching SPF_PASS
6064
These
Hello Jean-Paul,
Here's the rules I use, I've had these rules for a few weeks but I
just noticed today the use of extra spaces between each letter, so
here's an updated set of rules. This might be easier converted to a
replace_tags ruleset but it works fine like it is.
body FB_CIALIS_LEO2
Matthew.van.Eerde wrote:
pass: 467
none: 3297
softfail: 139
fail: 106
error: 2
Oops, forgot neutral
none: 3357
pass: 486
neutral: 91
softfail: 140
fail: 110
error: 2
--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software
with isp's blocking port 25 and requireing you to use thier mail server
how are business going to enable spf of thier domain when thier
employees could be sending mail from hundreds of different mail
servers??On 3/22/06, [EMAIL PROTECTED] [EMAIL PROTECTED]
wrote:Matthew.van.Eerde wrote: pass: 467
On 3/21/06, Andrew Donkin [EMAIL PROTECTED] wrote:
Jason, if you haven't moved to innodb already, try SHOW PROCESSLIST
in mysql. Do you have many threads locked on SELECT FROM
bayes_token and INSERT INTO bayes_token?
Yep, that's it completely.
I had about 100 threads locked, so I am
Bazooka Joe wrote:
with isp's blocking port 25 and requireing you to use thier mail
server how are business going to enable spf of thier domain when
thier employees could be sending mail from hundreds of different mail
servers??
No-one's holding a gun to their head. If they don't want to
Want to install/compile 3.1.1 the first time. I tried on two different
linux systems and get
make: Nothing to be done for `Makefile.PL'.
make Makefile.PL for 3.1.0 is still okay.
I assume I'm missing something obvious? Nothing about different configure
instructions in the wiki or INSTALL notes.
Kai Schaetzl wrote:
Want to install/compile 3.1.1 the first time. I tried on two different
linux systems and get
make: Nothing to be done for `Makefile.PL'.
make Makefile.PL for 3.1.0 is still okay.
I assume I'm missing something obvious? Nothing about different configure
instructions in the
Theo Van Dinter wrote:
On Wed, Mar 22, 2006 at 09:12:14AM -0800, Mike Jackson wrote:
cat msg_to_test.txt | spamassassin -D --lint 21 | more
Then look at the output to see if there's anything wrong.
Just to note, there's no point in sending a message to spamassassin
if you're doing
Hi!
I have Kmail on Suse10 along with Spamassassin.
I have a few accounts setup as POP3.
For one account, I want to be able to receive email just for the email
addresses I specify, everything else to be spam.
The other accounts don't have to be affected by this rule.
How do I set Spamassassin
Yes, there seems to be a bug.
See today's entry for bug 3815:
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=3815
[EMAIL PROTECTED] wrote:
Matt Kettler wrote:
Notice my FAIL percentage is much higher. This is probably because my domain
publishes a -all record, and the most-frequently-spoofed domain for mail I
receive is my own.
I publish as soft-fail.
That said, SA doesn't receive that much email
Krispisen a écrit :
well... my user community isquite lazy.
That's why i created 2 accounts. spambox hambox.
when an user checks his webmail, he can click on a button which send the
mail as spam in the spambox, or send it as ham in the hambox.
The problem here (and I have no
Jean-Paul Natola wrote:
Hi all
After upgrading to 3.1.1
I'm getting a bunch of
[36993] warn: config: SpamAssassin failed to parse line,
SARE_RMML_Stock27_.166 is not valid for score, skipping:
score_SARE_RMML_Stock27_.166
Is there something , or should I say, what step did I
Kai Schaetzl wrote:
Want to install/compile 3.1.1 the first time. I tried on two different
linux systems and get
make: Nothing to be done for `Makefile.PL'.
make Makefile.PL for 3.1.0 is still okay.
I assume I'm missing something obvious? Nothing about different
configure
On Wed, Mar 22, 2006 at 02:56:22PM -0500, Matt Kettler wrote:
score SARE_RMML_Stock27 .166
actually it should be score SARE_RMML_Stock27 0.166. not having a
leading 0 is invalid.
--
Randomly Generated Tagline:
Is there a space between the wall and paint? - Bob Lazarus
pgp2A4wCXStMA.pgp
Hello Spamassassin,
I'm back with new doubts hehehe. I've been reading a lot of articles and
e-mails from the list about SPF and Domain Keys but I don't know how to
use they in SpamAssassin. I'm using SpamAssassin 3.1.0 and I already
installed the Perl Module Mail::SPF::QUERY. There's a new
Jeferson Pessoa Santana wrote:
I'm back with new doubts hehehe. I've been reading a lot of articles
and e-mails from the list about SPF and Domain Keys but I don't know
how to use they in SpamAssassin. I'm using SpamAssassin 3.1.0 and I
already installed the Perl Module Mail::SPF::QUERY.
[EMAIL PROTECTED] wrote:
Jeferson Pessoa Santana wrote:
I'm back with new doubts hehehe. I've been reading a lot of articles
and e-mails from the list about SPF and Domain Keys but I don't know
how to use they in SpamAssassin. I'm using SpamAssassin 3.1.0 and I
already
Jean-Paul Natola wrote:
Hi all
After upgrading to 3.1.1
I'm getting a bunch of
[36993] warn: config: SpamAssassin failed to parse line,
SARE_RMML_Stock27_.166 is not valid for score, skipping:
score_SARE_RMML_Stock27_.166
Is there something , or should I say, what step did I miss?
indeed, if users send spam or ham in the wrong mailbox... i'm screwed, and the wordlist.db's gonna be corrupted.But i really cant filter user per user... i have to try another solution.yeah, a scheduled task woulb be easier. i think a good solution would be :
users can send ham and spam in a
JamesDR wrote on Wed, 22 Mar 2006 13:35:17 -0500:
perl Makefile.PL
Ah, well, braindead. I could have looked a thousand times on my own
writing and wouldn't have noticed the error. I simply did it too often in
the past. Thanks!
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive
Greetings:
This spam has been getting through our Spam Assassin rules set.
What rule can we use to catch this spam?
Return-Path:
[EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 4122 invoked by uid 399); 22 Mar 2006 23:12:50
-
Delivered-To: [EMAIL PROTECTED]
Received:
Jeferson Pessoa Santana wrote:
Hello Spamassassin,
I'm back with new doubts hehehe. I've been reading a lot of articles and
e-mails from the list about SPF and Domain Keys but I don't know how to
use they in SpamAssassin. I'm using SpamAssassin 3.1.0 and I already
installed the Perl Module
Since more and more of such mails with fairly well done random bayes evading
(aka poisoning) text parts are coming in, I wonder how to write a rule to
catch *.gif attachments. Any suggestions?
cheers,
wolfgang
On Thu, Mar 23, 2006 at 12:51:59AM +0100, wolfgang wrote:
Since more and more of such mails with fairly well done random bayes
evading
(aka poisoning) text parts are coming in, I wonder how to write a rule to
catch *.gif attachments. Any suggestions?
It depends what you mean by catch *.gif
In an older episode (Thursday, 23. March 2006 00:57), Theo Van Dinter wrote:
It depends what you mean by catch *.gif attachments. There are already
rules which look for some of these graphics, and it's easy to use the
MIMEHeader plugin to look at MIME part headers.
I am so far not familiar
On Thu, Mar 23, 2006 at 01:09:44AM +0100, wolfgang wrote:
I am so far not familiar with using that plugin (in a patched 3.0.4 by the
way).
You should upgrade. ;)
You can try using the plugin from 3.1:
mouss wrote:
Chris Purves a écrit :
[snip]
What spamc calls EnvelopeFrom is the top header of the message:
Return-path:
[EMAIL PROTECTED]
I am guessing that exim calls spamc before it adds this header so that
spamc has less information to work with than when running the tests.
I'm sorry for
Greetings Theo Van Dinter
Thank you for the rule.
Based on the email to the list with what is actual spam, do you have
any suggestions for:
1. Scoring
2. Any meta combinations to reduce false positives?
I tested using a score of 3 (because sometimes the real spam
OS-X 10.4.5
SA 3.1.1
I've got some problem with spamd loading that have got me puzzled.
What I would like to do is uninstall SA and start fresh.
Some of the post that I've read may indicate that there modules that
were not installed properly.
Richard
The advantage of a bad memory is
Oh, let's mix up this top/bottom miscegenation with a topper this time
(We're human. It behooves us to prove it and adapt to the other guy's
peculiarities or necessities.)
Rant out of the way here is a simple observation:
===8--
c:\man strftime
'man' is not recognized as an internal or
From: Liam-PrintingAutomation [EMAIL PROTECTED]
I installed spamassassin not long ago on our server, and it worked great!
Then sometime in the last couple of weeks it appears to have just
stopped working. No incoming e-mails are being tagged with spamassassin
headers anymore.
I restarted
It's part of the ISO C standard runtime libraries.
-Philip
jdow wrote:
Oh, let's mix up this top/bottom miscegenation with a topper this time
(We're human. It behooves us to prove it and adapt to the other guy's
peculiarities or necessities.)
Rant out of the way here is a simple
Ah, but man strftime does not universally apply. For people with their
heads buried deeply enough up the Windows mire they've probably never heard
of either the RFCs, man, or strftime. That's sad. It's life in the world
with Microsoft in it.
{^_-}
- Original Message -
From: Philip
OK here goes, my first post to this list. I have an issue with Spamassassin not
reading / using the white list.
The setup is a standalone PC running Guinevere to filter spam and viruses for a
GroupWise system. The OS is Win2k fully service packed. Perl is ActivePerl
5.8.8.816. Spamassassin is
On Thu, Mar 23, 2006 at 12:04:29AM -0600, Kenneth Olsen wrote:
The local.cf is set to add *SPAM ** to the subject line. No changes
to the subject line.
Next I'm thing the white list and / or black list entries are incorrect and
the system is not reading past a point. Get the virgin
urirhssub SAFF_EXAMPLE rbl.example.com. A 127.0.0.8
urihssub expects just 8, not 127.0.0.8
Sorry for the delay in responding. Your description, while it seems
to match the current code, doesn't match the documentation:
subtest is the sub-test to run against the returned data.
Craig Morrison craigsa at 2cah.com writes:
JamesDR wrote:
Edward Diener wrote:
Does anybody know the instructions for training SA with the contents
of the Thunderbird Junk folder ?
Upload them as single messages to your ISP account. If you have a
special folder in TB (Thunderbird)
jdow wrote:
c:\man strftime
'man' is not recognized as an internal or external command,
operable program or batch file.
Heh. Actually, on my machine:
C:\man strftime
This command is not supported by the help utility. Try strftime /?.
... of course, I should probably note
C:\custom-pathls
77 matches
Mail list logo
