Re: well, isnt that special...

2009-11-25 Thread Per Jessen
rich...@buzzhost.co.uk wrote: > On Wed, 2009-11-25 at 14:04 -0500, Alex wrote: >> > iptables -A FIREWALL -s 127.0.0.0/8 -j DROP >> >> Nah, use REJECT so you get that immediate satisfaction :-) >> >> Alex > > NO NO NO NO NO! > Drop has the effect of tarpitting them :-) Not quite, tarpitting is

[OT] Re: well, isnt that special...

2009-11-25 Thread Alex
Hi, > not relevant to Spamassassin, is it? > > if you have to go way off topic at pleas be considerat and add an OT: tag to > the subject..  > /dev/null > > or try:  http://spam-l.com/mailman/listinfo Yes, very much OT. I was following along with the other iptables comments. Thanks for the point

Re: well, isnt that special...

2009-11-25 Thread Yet Another Ninja
On 11/25/2009 11:29 PM, Alex wrote: iptables -A FIREWALL -s 127.0.0.0/8 -j DROP Very good. That was nearly funny :-) Why don't you add: iptables -A FIREWALL -s 0.0.0.0/0 -j DROP and enjoy the silence :-) Trouble is that you have to be the one that drives to the colo to eventually undo the rul

Re: well, isnt that special...

2009-11-25 Thread Alex
>> iptables -A FIREWALL -s 127.0.0.0/8 -j DROP >> > Very good. That was nearly funny :-) Why don't you add: > iptables -A FIREWALL -s 0.0.0.0/0 -j DROP and enjoy the silence :-) Trouble is that you have to be the one that drives to the colo to eventually undo the rules :-) Speaking of fw rules, h

Re: UCEPROTECT questions

2009-11-25 Thread Michael Scheidell
Alex wrote: Hi, I'm interested in people's opinion of UCEPROTECT. I'm aware of how it works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I wondered if I was doing something wrong. I've set the score to 0.01 for now, while I watch and see how it works here. What's a more reasona

Re: UCEPROTECT questions

2009-11-25 Thread Mariusz Kruk
Alex pisze: I'm interested in people's opinion of UCEPROTECT. I'm aware of how it works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I wondered if I was doing something wrong. Yes, UCEPROTECT seems to be just a big scam. Only thing it seems to care about is the money for 'expr

Re: well, isnt that special...

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 14:04 -0500, Alex wrote: > > iptables -A FIREWALL -s 127.0.0.0/8 -j DROP > > Nah, use REJECT so you get that immediate satisfaction :-) > > Alex NO NO NO NO NO! Drop has the effect of tarpitting them :-) As the Supremes sang; "Set me free why don't you baby? You just k

Re: well, isnt that special...

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 19:20 +0100, Benny Pedersen wrote: > On ons 25 nov 2009 18:55:11 CET, "rich...@buzzhost.co.uk" wrote > > Any more ranges most welcome :-) > > iptables -A FIREWALL -s 127.0.0.0/8 -j DROP > Very good. That was nearly funny :-) Why don't you add: iptables -A FIREWALL -s 0.0.0.0

Re: UCEPROTECT questions

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 13:45 -0500, Alex wrote: > Hi, > > I'm interested in people's opinion of UCEPROTECT. I'm aware of how it > works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I > wondered if I was doing something wrong. > > I've set the score to 0.01 for now, while I watch a

Re: well, isnt that special...

2009-11-25 Thread Tara Natanson
On Wed, Nov 25, 2009 at 1:49 PM, R-Elists wrote: > > > umm side note, i spose to Tara... > > is Constant Contact like the default email marketing system (or one of > them) > for salesforce.com or whatever other large "online" customer management > software??? or do you own them or they own you or

RE: Problems with whitelists and simscan

2009-11-25 Thread Jose Luis Marin Perez
Hi Rick, Thanks for your answer. So for these cases as could do to work whitelists? It can be solution in spamassassin or simscan? Thanks Jose Luis > Date: Wed, 25 Nov 2009 13:23:02 -0500 > From: ri...@ummm-beer.com > To: users@spamassassin.apache.org > Subject: Re: Problems with whitelists

Re: well, isnt that special...

2009-11-25 Thread Alex
> iptables -A FIREWALL -s 127.0.0.0/8 -j DROP Nah, use REJECT so you get that immediate satisfaction :-) Alex

RE: UCEPROTECT questions

2009-11-25 Thread Daniel J McDonald
On Wed, 2009-11-25 at 10:53 -0800, R-Elists wrote: > > > > > I'm interested in people's opinion of UCEPROTECT. I'm aware > > of how it works, but even UCEPROTECT1 seems to catch an awful > > lot of ham, and I wondered if I was doing something wrong. > > > > Alex, > > we use all 3 and adjust

RE: UCEPROTECT questions

2009-11-25 Thread R-Elists
> > I'm interested in people's opinion of UCEPROTECT. I'm aware > of how it works, but even UCEPROTECT1 seems to catch an awful > lot of ham, and I wondered if I was doing something wrong. > > I've set the score to 0.01 for now, while I watch and see how > it works here. What's a more reaso

RE: well, isnt that special...

2009-11-25 Thread R-Elists
> > uri LOCAL_URI_C_CONTACT m{constantcontact\.com\b} > score LOCAL_URI_C_CONTACT 12 > describe LOCAL_URI_C_CONTACT contains link to > constant contact [dot] com > thanks Ned, i do have a coupla companies that use CC for email so i wont totally whack. they

UCEPROTECT questions

2009-11-25 Thread Alex
Hi, I'm interested in people's opinion of UCEPROTECT. I'm aware of how it works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I wondered if I was doing something wrong. I've set the score to 0.01 for now, while I watch and see how it works here. What's a more reasonable score? I d

RE: well, isnt that special...

2009-11-25 Thread R-Elists
thanks Tara, not the hugest biggie... yet since we are only on a few select lists and use this email address, i figured several others on this list were getting it too i did forward both to abuse at your site with headers happy gobble gobble everyone! - rh I've got Compliance on it alre

Re: Problems with whitelists and simscan

2009-11-25 Thread Rick Macdougall
Jose Luis Marin Perez wrote: Dear Sirs I noticed a problem with Spamassassin whitelists and Simscan: Spamassassin is configured to use white lists using mysql (for example) *mysql> select * from userpref; +--++-++ | us

Re: well, isnt that special...

2009-11-25 Thread Benny Pedersen
On ons 25 nov 2009 18:55:11 CET, "rich...@buzzhost.co.uk" wrote Any more ranges most welcome :-) iptables -A FIREWALL -s 127.0.0.0/8 -j DROP -- xpoint

Problems with whitelists and simscan

2009-11-25 Thread Jose Luis Marin Perez
Dear Sirs I noticed a problem with Spamassassin whitelists and Simscan: Spamassassin is configured to use white lists using mysql (for example) mysql> select * from userpref; +--++-++ | username | pr

Re: well, isnt that special...

2009-11-25 Thread rich...@buzzhost.co.uk
On Wed, 2009-11-25 at 17:34 +, Ned Slider wrote: > Aaron Wolfe wrote: > > On Wed, Nov 25, 2009 at 12:04 PM, Ned Slider wrote: > >> R-Elists wrote: > >>> > >>> on a much more important note, can those on the list that have a good > >>> handle > >>> on better filtering spam and/or UCE from Const

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread Michelle Konzack
Am 2009-11-25 00:23:34, schrieb LuKreme: > I get HABEAS mail sent to email addresses that have not been active in > 10 years and have never EVER signed up for anything whatsoever. I get > HABEAS mail sent to new admin@ email addresses on new domains, domains > that have never sent any email at all.

Re: well, isnt that special...

2009-11-25 Thread Ned Slider
Aaron Wolfe wrote: On Wed, Nov 25, 2009 at 12:04 PM, Ned Slider wrote: R-Elists wrote: on a much more important note, can those on the list that have a good handle on better filtering spam and/or UCE from Constant please share your SA info on that please? Here's mine: uri LOCAL

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread Michelle Konzack
Am 2009-11-24 17:23:29, schrieb Jeff Mincy: > I find it a little hard to believe that your spam is so much different from > my spam. On my mail, not one single spam message (out of 228k total) hit > HABEAS for all of 2009. The few messages (480 out of 11k) that hit HABEAS > were all ham, either p

Re: well, isnt that special...

2009-11-25 Thread Aaron Wolfe
On Wed, Nov 25, 2009 at 12:04 PM, Ned Slider wrote: > R-Elists wrote: >> >> just got spammed via constant contact via Aloha Communications Group on >> our >> "email lists" email address from afrit...@aloha-com.ccsend.com >> >> obviously trolling for email addresses >> >> would the Constant Contact

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread Michelle Konzack
Am 2009-11-23 17:08:11, schrieb LuKreme: > On Nov 23, 2009, at 7:39, Matus UHLAR - fantomas > wrote: > > >Yes, why to differ between non-abusing and abusing marketers... > > We've been through this before. On my mail, habeas is a very strong > indicator of spam. It does not appear in legitimate

Custom rule that looks at the charset= in the Content-Type header?

2009-11-25 Thread Thomas Harold
Is it possible to create a custom rule that looks at the charset= string in the Content-Type header? We're getting a lot of Chinese language spam here at the moment (charset="gb2312") and they're only scoring in about a 6.3, but I'd like to push that slightly higher. I'm thinking that the pro

Re: well, isnt that special...

2009-11-25 Thread Ned Slider
R-Elists wrote: just got spammed via constant contact via Aloha Communications Group on our "email lists" email address from afrit...@aloha-com.ccsend.com obviously trolling for email addresses would the Constant Contact employee(s) and advocate on this list please kick some hiney after you ar

Re: well, isnt that special...

2009-11-25 Thread Tara Natanson
On Wed, Nov 25, 2009 at 10:53 AM, R-Elists wrote: > > > just got spammed via constant contact via Aloha Communications Group on our > "email lists" email address from afrit...@aloha-com.ccsend.com > > obviously trolling for email addresses > > would the Constant Contact employee(s) and advocate o

Re: well, isnt that special...

2009-11-25 Thread Chris Owen
On Nov 25, 2009, at 10:12 AM, Michael Scheidell wrote: > R-Elists wrote: >> on a much more important note, can those on the list that have a good handle >> on better filtering spam and/or UCE from Constant please share your SA info >> on that please? >> > header CONSTANTCONTACT List-Unsubscribe

Re: well, isnt that special...

2009-11-25 Thread Michael Scheidell
R-Elists wrote: just got spammed via constant contact via Aloha Communications Group on our "email lists" email address from afrit...@aloha-com.ccsend.com obviously trolling for email addresses would the Constant Contact employee(s) and advocate on this list please kick some hiney after you are

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread Matus UHLAR - fantomas
On 25.11.09 03:23, jdow wrote: > Having a little help might help them maintain a better product. > But (that bitter word), the basic concept is broken. If the spammer > can make more money than it costs to get on the Habeas whitelist > then they will pull the same trick I've seen here in California

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread Matus UHLAR - fantomas
> On Nov 25, 2009, at 3:03, Matus UHLAR - fantomas > wrote: >> I'm not saying that companies registered in habeas do not spam. >> I'm saying that those who do should be reported, which could make >> habeas >> worth using. On 25.11.09 03:16, LuKreme wrote: > Ah, well that's a whole other issue

well, isnt that special...

2009-11-25 Thread R-Elists
just got spammed via constant contact via Aloha Communications Group on our "email lists" email address from afrit...@aloha-com.ccsend.com obviously trolling for email addresses would the Constant Contact employee(s) and advocate on this list please kick some hiney after you are done rolling ar

RE: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread R-Elists
> From: Hajdú Zoltán wrote > > Then whos job? :) Habeas doesnt monitor Your Inbox. > > If You have the time to write here just for 'flaming' against > a ~good concept... > ...Maybe it would be a better idea to spend that time on > supporting them with Your feedback. > > Cheers, Hajdu, we

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread jdow
From: "Per Jessen" Sent: Wednesday, 2009/November/25 03:03 Hajdú Zoltán wrote: LuKreme írta: On Nov 25, 2009, at 3:03, Matus UHLAR - fantomas wrote: I'm not saying that companies registered in habeas do not spam. I'm saying that those who do should be reported, which could make habeas wor

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread LuKreme
On 25-Nov-2009, at 03:57, Hajdú Zoltán wrote: > Then whos job? The people who are making money from the Habeas list, of course. > Habeas doesnt monitor Your Inbox. Nope, they just claim that spammers flooding my inbox should be 'trusted' > If You have the time to write here just for 'flaming' a

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread Hajdú Zoltán
I'm sure they monitor them in various ways, but there could be exceptions (there is no absolutely perfect solution for this problem) - and the blue pill for that is called feedback. Per Jessen írta: Hajdú Zoltán wrote: LuKreme írta: On Nov 25, 2009, at 3:03, Matus UHLAR - fantomas wrote:

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread Per Jessen
Hajdú Zoltán wrote: > LuKreme írta: >> On Nov 25, 2009, at 3:03, Matus UHLAR - fantomas >> wrote: >> >>> I'm not saying that companies registered in habeas do not spam. >>> I'm saying that those who do should be reported, which could make >>> habeas worth using. >> >> Ah, well that's a whole ot

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread Hajdú Zoltán
Then whos job? :) Habeas doesnt monitor Your Inbox. If You have the time to write here just for 'flaming' against a ~good concept... ...Maybe it would be a better idea to spend that time on supporting them with Your feedback. Cheers, LuKreme írta: On Nov 25, 2009, at 3:03, Matus UHLAR - fanto

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread LuKreme
On Nov 25, 2009, at 3:03, Matus UHLAR - fantomas wrote: I'm not saying that companies registered in habeas do not spam. I'm saying that those who do should be reported, which could make habeas worth using. Ah, well that's a whole other issue. Habeas is a commercial enterprise and I don

Re: HABEAS_ACCREDITED SPAMMER

2009-11-25 Thread Matus UHLAR - fantomas
On 25.11.09 07:53, rich...@buzzhost.co.uk wrote: > A good marketing company would *not* require a whitellist, as their mail > would be fully compliant, score low and come from an IP with a good > reputation. If spammers can tick these boxes, a paid for ESP should have > no difficulty *without* the

Re: masscheck & Dumptext.pm line 26.

2009-11-25 Thread Yet Another Ninja
On 11/25/2009 3:56 AM, John Hardin wrote: On Tue, 24 Nov 2009, Justin Mason wrote: that's normal. can be ignored On Tue, Nov 24, 2009 at 21:04, Yet Another Ninja wrote: When running masscheck calling: /home/mc/masscheck/spamassassin/trunk/masses && nice ./mass-check \ --cf='loadplugin