Re: DNS Perl Help? [ot]

Mark Perkel wrote: If I have a string, what's that fastest way to count the number of periods in the string? in perl, I would probably split the string at the periods @parts = split /\./, $string; and then just use the number of splits $#parts Wolfgang Hamann

Re: Bye for good FuzzyOCR

Spamassassin List schrieb: Spamassassin List schrieb: i just uninstalled FuzzyOCR from my system as it seems like its become out of fashion to send those spam images that FuzzyOCR can read and I noticed that I dont even need it to get the remaining imagespam above a score of 10. Thanks alot

Re: DNS Perl Help? [ot]

On Sun, Jul 22, 2007 at 07:15:50AM -, [EMAIL PROTECTED] wrote: > Mark Perkel wrote: > If I have a string, what's that fastest way to count the number of > periods in the string? > > in perl, I would probably split the string at the periods > > @parts = split /\./, $string; > and then just us

Re: Spam Du Jour ? *.XLS

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chr. v. Stuckrad schrieb: > On Sun, 22 Jul 2007, Robert Schetterer wrote: > >>> investors news-76212.xls, et all >>> >>> no real challenge >>> >> jep , got 3 xls spams today > > well, here too, > > but I think soon we'll get the whole mix ... > a co

Re: Bye for good FuzzyOCR

I'm not recieving much of it anymore anyways. FWIW, about 20% of the spam I got today had either a GIF or PNG image attached to it. Most advertizing viagra in clear text with no obfuscation, a few advertizing stocks. FuzzyOCR still does quite well here. Loren

RE: DKIM vs DomainKeys plugins

Ok, seems to work now, not sure why it wasn't. Thanks all. -- Michael Scheidell, CTO SECNAP Network Security Corporation Keep up to date with latest information on IT security: Real time security alerts: http://www.secnap.com/news

Any mailbox-challenge plugin?

Hi everybody, anyone knows of a SA plugin to score mails based on challenging the sender e-mail? I don't mean C/R, but instead just attempt an SMTP session in order to see if the source mailbox is known to the sending domain's MX. If it isn't, the plugin applies a score to the e-mail. I know I c

Re: Any mailbox-challenge plugin?

Giampaolo Tomassoni wrote: Hi everybody, anyone knows of a SA plugin to score mails based on challenging the sender e-mail? I don't mean C/R, but instead just attempt an SMTP session in order to see if the source mailbox is known to the sending domain's MX. If it isn't, the plugin applies a sco

R: Any mailbox-challenge plugin?

> -Messaggio originale- > Da: Michele Neylon :: Blacknight [mailto:[EMAIL PROTECTED] > > Giampaolo Tomassoni wrote: > > Hi everybody, > > > > anyone knows of a SA plugin to score mails based on challenging the > sender > > e-mail? > > > > I don't mean C/R, but instead just attempt an SMTP

Re: Any mailbox-challenge plugin?

Giampaolo Tomassoni wrote: Hi everybody, anyone knows of a SA plugin to score mails based on challenging the sender e-mail? I don't mean C/R, but instead just attempt an SMTP session in order to see if the source mailbox is known to the sending domain's MX. If it isn't, the plugin applies a sco

Re: DNS Perl Help? [ot]

Theo Van Dinter wrote: On Sun, Jul 22, 2007 at 07:15:50AM -, [EMAIL PROTECTED] wrote: Mark Perkel wrote: If I have a string, what's that fastest way to count the number of periods in the string? in perl, I would probably split the string at the periods @parts = split /\./, $string;

R: Any mailbox-challenge plugin?

> -Messaggio originale- > Da: John Rudd [mailto:[EMAIL PROTECTED] > > Giampaolo Tomassoni wrote: > > Hi everybody, > > > > anyone knows of a SA plugin to score mails based on challenging the > sender > > e-mail? > > > > I don't mean C/R, but instead just attempt an SMTP session in order >

Re: Spam Du Jour ? *.XLS --> packed into zip now

On Sun, 22 Jul 2007, Robert Schetterer wrote: > http://sanesecurity.co.uk/clamav/ > > catches it now As seen before, they react fast on news on this list :-) Now I got the same 'XLS' *inside* a *.zip file! Stucki -- Christoph von Stuckrad * * |nickname |<[EMAIL PROTECTED]> \ Freie Uni

Re: Bye for good FuzzyOCR

Loren Wilton schrieb: I'm not recieving much of it anymore anyways. FWIW, about 20% of the spam I got today had either a GIF or PNG image attached to it. Most advertizing viagra in clear text with no obfuscation, a few advertizing stocks. FuzzyOCR still does quite well here. Loren

Re: DKIM vs DomainKeys plugins

Michael Scheidell wrote: > Ok, seems to work now, not sure why it wasn't. > > Thanks all. > Not sure why it wasn't either. However, the test message I sent you, and CCed to my verizon address, failed. but a copy sent back to my own yahoo account passed. Looking at the messages, apparently veri

Re: My bash script to upload PDFinfo daily, safely

I have found SaneSecurity definitions to be VERY good - they hit about 60% of my SPAM which is incredible given that they only match exact results (they are not fuzzy). However this high percentage may be beacuse I am based in the UK as is the author of the sanesecurity definitions. Also they tend

Re: Bye for good FuzzyOCR

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Jul 22, 2007, at 9:43 AM, arni wrote: Loren Wilton schrieb: I'm not recieving much of it anymore anyways. FWIW, about 20% of the spam I got today had either a GIF or PNG image attached to it. Most advertizing viagra in clear text with n

Re: Bye for good FuzzyOCR

David Morton wrote the following on 7/22/2007 11:08 AM -0800: > > > On Jul 22, 2007, at 9:43 AM, arni wrote: > > > Loren Wilton schrieb: > >> I'm not recieving much of it anymore anyways. > >> > >> FWIW, about 20% of the spam I got today had either a GIF or PNG > image attached to it. Most adv

Re: Bye for good FuzzyOCR

Bill Landry schrieb: I'm running SA 3.2.1 and FuzzyOCR is running just fine here. Bill ran fine on 3.2.0 for me ...

Everything marked as Spam

We moved servers and tried a different email system (but that is a whole different story). This new server has SA 3.2.1 from source using spamd w/no options passed. We are trying Bongo email system which, i believe uses netmail. Problem is, SA is marking everything as spam. We use sa-update and bot

Re: Everything marked as Spam

At 11:45 22-07-2007, [EMAIL PROTECTED] wrote: We moved servers and tried a different email system (but that is a whole different story). This new server has SA 3.2.1 from source using spamd w/no options passed. We are trying Bongo email system which, i believe uses netmail. Problem is, SA is mark

Re: Bye for good FuzzyOCR

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David Morton wrote: > > > On Jul 22, 2007, at 9:43 AM, arni wrote: > >> Loren Wilton schrieb: >>> I'm not recieving much of it anymore anyways. >>> >>> FWIW, about 20% of the spam I got today had either a GIF or PNG >>> image attached to it. Most

migrating from clamav before mta to SA ClamAV plugin experiences

Would anyone care to share their experiences of migrating from having their pre MTA program handoff to clamav for email virus scanning changed to doing it with the SA ClamAV plugin way ??? The reason I am thinking about migrating and doing it with the SA ClamAV plugin way is that I can just rejec

Re: R: Any mailbox-challenge plugin?

> > Giampaolo Tomassoni wrote: > > > anyone knows of a SA plugin to score mails based on challenging the > > > sender e-mail? > > > > > > I don't mean C/R, but instead just attempt an SMTP session in order to > > > see if the source mailbox is known to the sending domain's MX. If it > > > isn't, th

Re: migrating from clamav before mta to SA ClamAV plugin experiences

On 22.07.07 13:16, Robert - eLists wrote: > Would anyone care to share their experiences of migrating from having their > pre MTA program handoff to clamav for email virus scanning changed to doing > it with the SA ClamAV plugin way ??? > > The reason I am thinking about migrating and doing it wit

RE: migrating from clamav before mta to SA ClamAV plugin experiences

> > which MTA are you using? The clamav plugin should reject the e-mail the > same > way SA plugin does that (with much less CPU time spent) > Uhlar I use qmail-scanner-queue.pl, clamav, spamassassin and qmail I can reject spam over a certain scoring threshold this way, yet I have not figured

Re: Everything marked as Spam

SM wrote: > At 11:45 22-07-2007, [EMAIL PROTECTED] wrote: >> We moved servers and tried a different email system (but that is a whole >> different story). This new server has SA 3.2.1 from source using spamd >> w/no options passed. We are trying Bongo email system which, i believe >> uses netmail.

R: R: Any mailbox-challenge plugin?

> -Messaggio originale- > Da: Matus UHLAR - fantomas [mailto:[EMAIL PROTECTED] > > ...omissis... > > I am really curious how do they behave when there's forged sender and > both > MTA's use this. Either they will cycle forever (so they will never know > if > either address is OK), or they

Re: R: R: Any mailbox-challenge plugin?

Giampaolo Tomassoni wrote: -Messaggio originale- Da: Matus UHLAR - fantomas [mailto:[EMAIL PROTECTED] ...omissis... I am really curious how do they behave when there's forged sender and both MTA's use this. Either they will cycle forever (so they will never know if either address is OK)

Now its zip attachments ^^

This night it seems like we're beeing spammed again by xml documents, but this time neatly packed into a zipfile: I'm really excited whats going to happen next. Maybe psd files embedded in pdf and then rar'ed. And i'd still like to meet the person that goes through all that trouble to read t

Re: Now its zip attachments ^^

Hendrik Helmvoigt wrote: This night it seems like we're beeing spammed again by xml documents, but this time neatly packed into a zipfile: I'm really excited whats going to happen next. Maybe psd files embedded in pdf and then rar'ed. And i'd still like to meet the person that goes through a

Re: Now its zip attachments ^^

On Sun, July 22, 2007 6:47 pm, John Rudd wrote: > For multi-lingual reasons, just allow pain ascii or unicode, and throw > away any messages with any body types other than that. I'd like to ban all those people who write in the tiniest font they can find. Then there's my one brother who always ha

RE: Now its zip attachments ^^

Not sure I agree about banning all attachments, but I would like to ban all email with fonts as BIG as people can find and those which use any kind of background stationary.

Re: New PDF?

WebTent wrote: I have a few PDF's getting through now after doing pretty good, the latest 0.4 pdfinfo + sa 3.1.7 + sare rules + sa-update is not scoring enough on these: Current version is v0.6. And sigs for those were added last Thursday... http://esmtp.webtent.net/mail1.txt

Re: New PDF?

> Current version is v0.6. And sigs for those were added last > Thursday... The web page at still identifies it as 0.4 with a mod date 0f July 16, FYI. The linked file is 0.6, though. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "...Life is no

Fake MX Record

On http://wiki.apache.org/spamassassin/OtherTricks (Fake MX Record) , where do I insert these values: fake0.domain.com 10 realmx.domain.com 20 fake1.domain.com 30 TIA.

Re: Fake MX Record

At 08:17 PM 7/22/2007, Bubuk Gabrok wrote: On http://wiki.apache.org/spamassassin/OtherTricks (Fake MX Record) , where do I insert these values: fake0.domain.com 10 realmx.domain.com 20 fake1.domain.com 30 TIA. In your Zonefile for your DNS. Evan

Re: Fake MX Record

On 7/23/07, Evan Platt <[EMAIL PROTECTED]> wrote: At 08:17 PM 7/22/2007, Bubuk Gabrok wrote: >On http://wiki.apache.org/spamassassin/OtherTricks (Fake MX Record) , >where do I insert these values: >fake0.domain.com 10 >realmx.domain.com 20 >fake1.domain.com 30 > >TIA. In your Zonefile for y

Re: Fake MX Record

At 20:17 22-07-2007, Bubuk Gabrok wrote: On http://wiki.apache.org/spamassassin/OtherTricks (Fake MX Record) , where do I insert these values: Set your DNS records accordingly. The statement that "No good email is lost" is subjective. Regards, -sm

Re: Stuff getting through

>I mean the obvious stuff like "viagra" and such. Usually the spam is caught >but sporadically it does get through. >What is happening. Simply, there are no X-Spam headers on these (and none or some of the "ham" as well). In other words, messages are being delivered before sa is running! Origi