Re: JMF_W & URIBL_BLACK

2009-11-10 Thread Alex
Hi, > You know how it is unsafe to use unsubscribe on many spam because that you > are a live address? Of course. If you read again, I'm talking about sites like eWeek.com, where someone has intentionally subscribed, but can't figure out how to unsubscribe, so they think if they just treat it as

Re: JMF_W & URIBL_BLACK

2009-11-10 Thread Warren Togami
On 11/10/2009 10:59 PM, Alex wrote: This just becomes increasingly important when management drops an email in the "Put Spam Here" folder for training that clearly isn't spam, but something they've subscribed to, like a newsletter. For the email that even I question sometimes, I'd like to be abl

Re: JMF_W & URIBL_BLACK

2009-11-10 Thread Alex
Hi, >> for both JMF_W >> (HOSTKARMA_W) and URIBL_BLACK in the same message. > > I'm not involved in the management of either of these, but I have some > analysis which I think is accurate: Rob, thanks, I think you've hit the nail on the head on all counts. That's what the spam race is all about -

Google doc link spam

2009-11-10 Thread fchan
Hi, I'm getting alot of this new Google document link spam recently. Below is an example: Return-Path: Delivered-To: fc...@molsci.org Received: (qmail 11025 invoked by uid 501); 10 Nov 2009 16:55:53 -0800 Received: from 87.217.186.215 by s1.molsci.org (envelope-from , uid 509) with qmail-scan

Re: Regex Question

2009-11-10 Thread John Hardin
On Tue, 10 Nov 2009, rahlqu...@gmail.com wrote: Thanks! Your earlier Regex is in place and doing quite well. Pleased to be of service. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732

Re: Regex Question

2009-11-10 Thread rahlquist
On Tue, Nov 10, 2009 at 3:57 PM, John Hardin wrote: > On Tue, 10 Nov 2009, Ralf Hildebrandt wrote: > > On Tue, 2009-11-10 at 14:32 +0100, Ralf Hildebrandt wrote: >>> * rahlqu...@gmail.com : > Ok regex is not my strong suit by any means. Trying to get a match for > email address

Re: Regex Question

2009-11-10 Thread Bill Landry
Ralf Hildebrandt wrote: > * Benny Pedersen : >> On tir 10 nov 2009 15:26:43 CET, "rich...@buzzhost.co.uk" wrote >>> Please keep this in your mind in future before trotting out that tired >>> old gas. >> imho Ralf have never being banned in maillist here, if you dont like >> his answers just unsubsc

RE: Regex Question

2009-11-10 Thread R-Elists
some centos people are having a pub party and the "kings and queens" in london it might be over already based upon time difference from usa maybe all of you could go there and drink beer and duke it out or something constructive ;-> - rh

Re: Regex Question

2009-11-10 Thread Ralf Hildebrandt
* John Hardin : > In that case, depending on the MTA logging, perhaps he could still > disable catchall and then troll the logs to see which invalid > addresses were attempted. Or block tke mail to any recipient starting with "|" In postfix that could be done with check_recipient_access regexp:/

Re: Regex Question

2009-11-10 Thread John Hardin
On Tue, 10 Nov 2009, Ralf Hildebrandt wrote: On Tue, 2009-11-10 at 14:32 +0100, Ralf Hildebrandt wrote: * rahlqu...@gmail.com : Ok regex is not my strong suit by any means. Trying to get a match for email addresses that start with a pipe character ( about 15% of my spam is this ). That's no

Re: Regex Question

2009-11-10 Thread Ralf Hildebrandt
* Matus UHLAR - fantomas : > Ralf's question was in no way offensive. He is just trying to solve the > problem by way that is most efficient for most of e-mail users and admins. What the OP intends to do ("Who's selling away my addresses?") can be done in the MTA entirely. A colleague at tu-bs.de

Re: Regex Question

2009-11-10 Thread Ralf Hildebrandt
* Benny Pedersen : > On tir 10 nov 2009 15:26:43 CET, "rich...@buzzhost.co.uk" wrote > >Please keep this in your mind in future before trotting out that tired > >old gas. > > imho Ralf have never being banned in maillist here, if you dont like > his answers just unsubscribe Good point, but richar

Re: Regex Question

2009-11-10 Thread Ralf Hildebrandt
* rich...@buzzhost.co.uk : > On Tue, 2009-11-10 at 14:32 +0100, Ralf Hildebrandt wrote: > > * rahlqu...@gmail.com : > > > Ok regex is not my strong suit by any means. Trying to get a match for > > > email > > > addresses that start with a pipe character ( about 15% of my spam is this > > > ). > >

[Fwd: Re: Getting off the "Cloudmark" formerly "spamnet" blacklist]

2009-11-10 Thread Michael Scheidell
if I reply to the mailing list and not you directly, you should reply to the mailing list. Original Message Subject:Re: Getting off the "Cloudmark" formerly "spamnet" blacklist Date: Tue, 10 Nov 2009 12:25:20 -0800 From: Ted Mittelstaedt Organization: Interne

Re: Regex Question

2009-11-10 Thread jdow
From: Sent: Tuesday, 2009/November/10 09:14 On Tue, 2009-11-10 at 11:45 -0500, Alex wrote: >> imho Ralf have never being banned in maillist here, if you dont like >> his answers just unsubscribe >> > Trotting out useless, pointless, tardy, curt, terse replies benefit > nobody at all and makes

Re: Regex Question

2009-11-10 Thread jdow
From: Sent: Tuesday, 2009/November/10 08:27 On Tue, 2009-11-10 at 16:50 +0100, Benny Pedersen wrote: On tir 10 nov 2009 15:26:43 CET, "rich...@buzzhost.co.uk" wrote > Please keep this in your mind in future before trotting out that tired > old gas. imho Ralf have never being banned in mailli

Re: JMF_W & URIBL_BLACK

2009-11-10 Thread Rob McEwen
Alex wrote: > for both JMF_W > (HOSTKARMA_W) and URIBL_BLACK in the same message. I'm not involved in the management of either of these, but I have some analysis which I think is accurate: (1) Marc Perkel's domain whitelist is auto-generated. This has many advantages... but one disadvantage is th

Re: Regex Question

2009-11-10 Thread John Hardin
On Tue, 10 Nov 2009, rich...@buzzhost.co.uk wrote: Rather than let this drift into a hijacked free-for-all perhaps one of the guru's of REGEX here would actually like to answer the OP's question. If you hadn't gotten distracted by your multiple nemeses you would have noticed I've done so. :)

Re: Regex Question

2009-11-10 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-10 at 11:45 -0500, Alex wrote: > >> imho Ralf have never being banned in maillist here, if you dont like > >> his answers just unsubscribe > >> > > Trotting out useless, pointless, tardy, curt, terse replies benefit > > nobody at all and makes the poster look arrogant especially whe

Re: Regex Question

2009-11-10 Thread Matus UHLAR - fantomas
> On Tue, 2009-11-10 at 14:32 +0100, Ralf Hildebrandt wrote: > > * rahlqu...@gmail.com : > > > Ok regex is not my strong suit by any means. Trying to get a match for > > > email > > > addresses that start with a pipe character ( about 15% of my spam is this > > > ). > > > > That's not needed. Wh

Re: Regex Question

2009-11-10 Thread rahlquist
On Tue, Nov 10, 2009 at 11:49 AM, John Hardin wrote: > On Tue, 10 Nov 2009, rahlqu...@gmail.com wrote: > > On Tue, Nov 10, 2009 at 9:09 AM, John Hardin wrote: >> >> * rahlqu...@gmail.com : >>> Ok regex is not my strong suit by any means. Trying to get a match > for email addres

Re: Regex Question

2009-11-10 Thread Alex
>> I sometimes welcome the terse replies; it illicit's clarification from the >> OP. > > ITYM "elicits". Heh, yes, thanks. I don't think they're involved in some illicit sex scandal :-) In either case, the apostrophe was wrong, too. Working on getting a new toolchain compiled and working straight

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-10 Thread LuKreme
On 10-Nov-2009, at 08:48, Ted Mittelstaedt wrote: > I would presume, knowing Comcast, and knowing the average ability > of the typical Comcast e-mail user, that the razor-report and > rezor-revoke is being done silently, automatically, behind the > scenes. Perhaps when a user pulls a message out o

Re: Regex Question

2009-11-10 Thread LuKreme
On 10-Nov-2009, at 09:27, rich...@buzzhost.co.uk wrote: > On Tue, 2009-11-10 at 16:50 +0100, Benny Pedersen wrote: >> On tir 10 nov 2009 15:26:43 CET, "rich...@buzzhost.co.uk" wrote >>> Please keep this in your mind in future before trotting out that tired >>> old gas. >> >> imho Ralf have never b

Re: Regex Question

2009-11-10 Thread John Hardin
On Tue, 10 Nov 2009, Alex wrote: imho Ralf have never being banned in maillist here, if you dont like his answers just unsubscribe Trotting out useless, pointless, tardy, curt, terse replies benefit nobody at all and makes the poster look arrogant especially when the answer is mere opinion.

Re: JMF_W & URIBL_BLACK

2009-11-10 Thread Alex
Hi, >> (how can a mail >> server be whitelisted while the message body contains a blacklisted >> URL?) > > Pretty trivially;  if spam with a blacklisted URI is forwarded from an > account handled by a trusted server, the final recipient will see both a > whitelisted/trusted relay and a blacklisted

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-10 Thread Jared Hall
Oh, come now; like calling Comcast is going to get you anywhere. Per: http://www.spamresource.com/2009/10/top-five-tips-for-dealing-with.html I've had success with Comcast. Been good to me. Generic Abuse: http://postmaster.comcast.net/ Personally, I'd fill out Comcast's form at: http://www.comc

Re: Regex Question

2009-11-10 Thread John Hardin
On Tue, 10 Nov 2009, rahlqu...@gmail.com wrote: On Tue, Nov 10, 2009 at 9:09 AM, John Hardin wrote: * rahlqu...@gmail.com : Ok regex is not my strong suit by any means. Trying to get a match for email addresses that start with a pipe character ( about 15% of my spam is this ). Richard,

Re: Regex Question

2009-11-10 Thread Alex
>> imho Ralf have never being banned in maillist here, if you dont like >> his answers just unsubscribe >> > Trotting out useless, pointless, tardy, curt, terse replies benefit > nobody at all and makes the poster look arrogant especially when the > answer is mere opinion. I sometimes welcome the

Re: Regex Question

2009-11-10 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-10 at 16:50 +0100, Benny Pedersen wrote: > On tir 10 nov 2009 15:26:43 CET, "rich...@buzzhost.co.uk" wrote > > Please keep this in your mind in future before trotting out that tired > > old gas. > > imho Ralf have never being banned in maillist here, if you dont like > his answer

Re: JMF_W & URIBL_BLACK

2009-11-10 Thread Kris Deugau
Alex wrote: (how can a mail server be whitelisted while the message body contains a blacklisted URL?) Pretty trivially; if spam with a blacklisted URI is forwarded from an account handled by a trusted server, the final recipient will see both a whitelisted/trusted relay and a blacklisted URI

Re: Regex Question

2009-11-10 Thread Benny Pedersen
On tir 10 nov 2009 15:26:43 CET, "rich...@buzzhost.co.uk" wrote Please keep this in your mind in future before trotting out that tired old gas. imho Ralf have never being banned in maillist here, if you dont like his answers just unsubscribe -- xpoint

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-10 Thread Ted Mittelstaedt
Giampaolo Tomassoni wrote: Daniel J McDonald wrote: ...omissis... How can I? From what I know about razor-revoke, it's the recipients who are using razor and who get messages that razor tags as spam who are the ones that run this. Their recipients who are saying that their messages are being

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-10 Thread Michael Scheidell
Ted Mittelstaedt wrote: How can I? From what I know about razor-revoke, it's the recipients who are using razor and who get messages that razor tags as spam who are the ones that run this. Their recipients who are saying that their messages are being marked spam are comcast e-mail users. We a

RE: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-10 Thread Giampaolo Tomassoni
> Daniel J McDonald wrote: > > ...omissis... > > How can I? From what I know about razor-revoke, it's the recipients > who are using razor and who get messages that razor tags as spam who > are the ones that run this. > > Their recipients who are saying that their messages are being marked > sp

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-10 Thread Ted Mittelstaedt
Daniel J McDonald wrote: On Mon, 2009-11-09 at 16:51 -0800, Ted Mittelstaedt wrote: Hi All, We have a customer who had a compromised mailserver, they fixed the server but are apparently still blacklisted by this company called "CloudMark (www.cloudmark.com) that Comcast uses. In Googl

Re: Regex Question

2009-11-10 Thread rich...@buzzhost.co.uk
On Tue, 2009-11-10 at 14:32 +0100, Ralf Hildebrandt wrote: > * rahlqu...@gmail.com : > > Ok regex is not my strong suit by any means. Trying to get a match for email > > addresses that start with a pipe character ( about 15% of my spam is this ). > > That's not needed. Why are you accepting mail t

Re: Regex Question

2009-11-10 Thread John Hardin
On Tue, 10 Nov 2009, Ralf Hildebrandt wrote: * rahlqu...@gmail.com : Ok regex is not my strong suit by any means. Trying to get a match for email addresses that start with a pipe character ( about 15% of my spam is this ). That's not needed. Why are you accepting mail to NON-EXISTING recipie

Re: Regex Question

2009-11-10 Thread Ralf Hildebrandt
* rahlqu...@gmail.com : > Ok regex is not my strong suit by any means. Trying to get a match for email > addresses that start with a pipe character ( about 15% of my spam is this ). That's not needed. Why are you accepting mail to NON-EXISTING recipients at all? -- Ralf Hildebrandt Geschäftsbe

Regex Question

2009-11-10 Thread rahlquist
Ok regex is not my strong suit by any means. Trying to get a match for email addresses that start with a pipe character ( about 15% of my spam is this ). What I have so far is this; [^a-z0-9]\b[a-z0-9._%+...@[a-z0-9.-]+\.[a-z]{2,4}\b To me that looks right but its not hitting. Any other suggestio

Re: Getting off the "Cloudmark" formerly "spamnet" blacklist

2009-11-10 Thread Daniel J McDonald
On Mon, 2009-11-09 at 16:51 -0800, Ted Mittelstaedt wrote: > Hi All, > >We have a customer who had a compromised mailserver, they fixed the > server but are apparently still blacklisted by this company called > "CloudMark (www.cloudmark.com) that Comcast uses. > >In Googling around I se