Is spam volume really down

2008-11-18 Thread ram
Is this news true ( spams down by 75% ) http://www.securecomputing.net.au/News/128340% 2cspam-volumes-drop-75-percent-in-a-day.aspx On my servers I havent seen any big change Thanks Ram

Re: OT: Google alerts FP's

2008-11-18 Thread Matus UHLAR - fantomas
On 17.11.08 18:15, Mark Martinec wrote: I have been using USER_IN_SPF_WHITELIST to whitelist mails from google alerts It had been working fine , but last 2-3 days I see that these mails dont get an SPF-pass. Seems guys at google are using some other servers whitelist_from_dkim [EMAIL

Re: Is spam volume really down

2008-11-18 Thread McDonald, Dan
On Tue, 2008-11-18 at 15:08 +0530, ram wrote: Is this news true ( spams down by 75% ) http://www.securecomputing.net.au/News/128340% 2cspam-volumes-drop-75-percent-in-a-day.aspx On my servers I havent seen any big change If you were inflicted by that particular botnet, you would have

Re: Is spam volume really down

2008-11-18 Thread John Rudd
Difference in Spam getting through Spamhaus-Zen and ClamAV signatures (which include ClamAV, SaneSecurity, MBL, and one other)? No, delivered spam is about the same # of messages as before. Difference in number of messages getting bounced by Spamhaus-Zen and ClamAV? Down about about 40-50%.

Re: Is spam volume really down

2008-11-18 Thread Steve Freegard
ram wrote: Is this news true ( spams down by 75% ) http://www.securecomputing.net.au/News/128340%2cspam-volumes-drop-75-percent-in-a-day.aspx On my servers I havent seen any big change I've seen a drop on a number of servers that I manage. The best illustration I've found is from Spamcop;

Re: Funds / Award release scams poor scoring

2008-11-18 Thread Micah Anderson
mouss [EMAIL PROTECTED] writes: Henrik K wrote: On Mon, Nov 10, 2008 at 08:49:00AM +0100, mouss wrote: Henrik K wrote: On Mon, Nov 10, 2008 at 12:25:42PM +0530, ram wrote: The number of DNSWL_LOW and DNSWL_MED misfires have gone up especially in last two days. Even Marc's JMF_W misfires.

Distributing the processing load

2008-11-18 Thread Micah Anderson
Our poor spamassassin machine is not able to keep up with the mail load. We are constantly getting prefork: server reached --max-children setting, consider raising it errors, and our max-children are already set at the max that this machine can handle (50). Since we are using spamc/spamd I

Re: Distributing the processing load

2008-11-18 Thread Rick Macdougall
Micah Anderson wrote: Our poor spamassassin machine is not able to keep up with the mail load. We are constantly getting prefork: server reached --max-children setting, consider raising it errors, and our max-children are already set at the max that this machine can handle (50). Since we are

Re: Help with bayes

2008-11-18 Thread Troy Settle
Kai Schaetzl wrote: Troy Settle wrote on Mon, 17 Nov 2008 13:33:10 -0500: I'm having a major problem with the bayes system. I cleared the bayes database and let it start re-learning. Once it kicked in, I again started getting false hits with BAYES_00=-2.599 on a great many spam/uce

Re: hostkarma junkemailfilter

2008-11-18 Thread Marc Perkel
Henrik K wrote: On Sun, Nov 16, 2008 at 03:29:07PM -0500, Micah Anderson wrote: Over at another post about Phishing[0], Brent suggested setting up hostkarma.junkemailfilter to my RBL list, which I have done... However it seems to hit a lot of spams giving them a -5 scoring. I've either got

Re: Help with bayes

2008-11-18 Thread Karsten Bräckelmann
On Tue, 2008-11-18 at 15:19 -0500, Troy Settle wrote: Kai Schaetzl wrote: Troy Settle wrote on Mon, 17 Nov 2008 13:33:10 -0500: I'm having a major problem with the bayes system. I cleared the bayes database and let it start re-learning. Once it kicked in, I again started getting

Re: Help with bayes

2008-11-18 Thread Jeff Mincy
From: Troy Settle [EMAIL PROTECTED] Date: Tue, 18 Nov 2008 15:19:56 -0500 Kai Schaetzl wrote: Troy Settle wrote on Mon, 17 Nov 2008 13:33:10 -0500: I'm having a major problem with the bayes system. I cleared the bayes database and let it start re-learning. Once it

Re: hostkarma junkemailfilter

2008-11-18 Thread Henrik K
On Tue, Nov 18, 2008 at 12:34:36PM -0800, Marc Perkel wrote: If we had a 30% FP rate we would be out of business. I think that's an exaggeration. What do you call 294 hams out of 836 JMF hits then? Don't take it personally, even barracuda has similar ratio. I can't add many points with it

Re: Help with bayes

2008-11-18 Thread Kai Schaetzl
Troy Settle wrote on Tue, 18 Nov 2008 15:19:56 -0500: From incoming mail. well, but how? By auto-learning? In that case you are just multiplying your problem. It seems a lot of spam gets miscategorized as ham. Auto-learning that spam as ham means enforcing this miscategorization and that's

Re: hostkarma junkemailfilter

2008-11-18 Thread Henrik K
On Tue, Nov 18, 2008 at 11:16:27PM +0200, Henrik K wrote: On Tue, Nov 18, 2008 at 12:34:36PM -0800, Marc Perkel wrote: If we had a 30% FP rate we would be out of business. I think that's an exaggeration. What do you call 294 hams out of 836 JMF hits then? To be fair, I do have zen etc

Re: Is spam volume really down

2008-11-18 Thread fchan
Yes I see a drop in total messages and spam and I see similar results from http://www.spamcop.net/spamgraph.shtml?spammonth. Since they knocked off McColo, my unfortunate neighbors in the San Francisco Bay Area, my mail server has more disk space since I have been quarantining certain spam

Re: Help with bayes

2008-11-18 Thread James Wilkinson
Kai Schaetzl wrote: well, but how? By auto-learning? In that case you are just multiplying your problem. It seems a lot of spam gets miscategorized as ham. Auto-learning that spam as ham means enforcing this miscategorization and that's what you see as a result. When SpamAssassin decides

Re: Help with bayes

2008-11-18 Thread Kai Schaetzl
James Wilkinson wrote on Tue, 18 Nov 2008 21:56:34 +: well, but how? By auto-learning? In that case you are just multiplying your problem. It seems a lot of spam gets miscategorized as ham. Auto-learning that spam as ham means enforcing this miscategorization and that's what you

Re: hostkarma junkemailfilter

2008-11-18 Thread Benny Pedersen
On Tue, November 18, 2008 22:16, Henrik K wrote: The problem is catching smallish local ISP type relays. If such users send lots of ham inside Finland and only the occasional spam/virus leak to some US honeypot, it's no surprise your list can't be foolproof. I guess I have to build my own

Re: Distributing the processing load

2008-11-18 Thread Matt Kettler
Micah Anderson wrote: Our poor spamassassin machine is not able to keep up with the mail load. We are constantly getting prefork: server reached --max-children setting, consider raising it errors, and our max-children are already set at the max that this machine can handle (50). Since we

RE: rules

2008-11-18 Thread RobertH
as I note in the comments on the blog post -- it seems likely that the people having problems are using a bad version of re2c. --j. by bad version, do you mean one that doesnt compile or finish compiling properly, or one that compiles (completes compilation) yet does bad stuff