Re: header issues

2011-01-02 Thread Dave Funk
On Sun, 2 Jan 2011, Jack L. Stone wrote: Dave: Ouch! Right you are about the insertions shown at the top of that page. My milter-spamc.cf file only contains the "options" which are managed by a "-option" or "+option". Since you have hacked it, is there any way to turn off the X-Spam-Level in mi

Re: header issues

2011-01-02 Thread Jack L. Stone
At 06:29 PM 1.2.2011 -0600, Dave Funk wrote: >On Sun, 2 Jan 2011, Jack L. Stone wrote: > >> At 04:23 PM 1.2.2011 -0600, Dave Funk wrote: >>> On Sun, 2 Jan 2011, Jack L. Stone wrote: >>> Sorry to have to return to the trough so soon, but still dealing with issues since recent upgrade of SA

Re: header issues

2011-01-02 Thread Dave Funk
On Sun, 2 Jan 2011, Jack L. Stone wrote: At 04:23 PM 1.2.2011 -0600, Dave Funk wrote: On Sun, 2 Jan 2011, Jack L. Stone wrote: Sorry to have to return to the trough so soon, but still dealing with issues since recent upgrade of SA. Downgraded but no help there either, so went back to latest v

Re: header issues

2011-01-02 Thread Jack L. Stone
At 04:23 PM 1.2.2011 -0600, Dave Funk wrote: >On Sun, 2 Jan 2011, Jack L. Stone wrote: > >> Sorry to have to return to the trough so soon, but still dealing with >> issues since recent upgrade of SA. Downgraded but no help there either, so >> went back to latest version. >> >> Am using FBSD-7.x wit

Re: header issues

2011-01-02 Thread Dave Funk
On Sun, 2 Jan 2011, Jack L. Stone wrote: Sorry to have to return to the trough so soon, but still dealing with issues since recent upgrade of SA. Downgraded but no help there either, so went back to latest version. Am using FBSD-7.x with Sendmail and SA-3.3.1_3 Here is the SA headers in an ema

Re: New plugin: DecodeShortURLs

2011-01-02 Thread Raymond Dijkxhoorn
Warren, It appears that under 1% of spam is abusing shortening redirectors.  ~40% of the shortening redirector spam has local-only spamassassin scores below the 5 point threshold.  We'll see next Saturday how it scores with all network rules. Could you please quote the old messages and not p

Re: New plugin: DecodeShortURLs

2011-01-02 Thread Warren Togami Jr.
http://ruleqa.spamassassin.org/20110102-r1054364-n/T_URL_SHORTENER/detail I inserted a giant uri regex into the nightly masscheck in order to get a rough measure the true extent of the URL shortener problem. It appears that under 1% of spam is abusing shortening redirectors. ~40% of the

Re: lots of freemail spam

2011-01-02 Thread Warren Togami Jr.
If I understand that thread correctly, that is for e-mail addresses in body text? I'm suggesting looking only at authenticated UID's in headers from specific providers like Yahoo who are notorious for spam, but their MTA's also send a significant amount of ham so we cannot DNSBL block them. Given

Automatic Rule Combination Generator

2011-01-02 Thread Marc Perkel
Here's a wild idea that might prove a point. Create a set of meta rules which is a combination of every set of two rules. meta COMBO_RULE1_RULE2 (RULE1 && RULE2) describe COMBO_RULE1_RULE2 RULE1 and RULE2 score COMBO_RULE1_RULE2 0.1 Then run stats to see if any of the combos produce interestin

header issues

2011-01-02 Thread Jack L. Stone
Sorry to have to return to the trough so soon, but still dealing with issues since recent upgrade of SA. Downgraded but no help there either, so went back to latest version. Am using FBSD-7.x with Sendmail and SA-3.3.1_3 Here is the SA headers in an email tagged as spam but got through anyway: X-

Re: lots of freemail spam

2011-01-02 Thread Yet Another Ninja
On 2011-01-02 13:59, Warren Togami Jr. wrote: I've been thinking, perhaps we should consider making a "Freemail Realtime BL" that lists not IP addresses, but rather ID's at the Freemail provider. Search the list archives for emailbl 1) I am assuming that ID's you see in headers of mail from Y

Re: lots of freemail spam

2011-01-02 Thread Benny Pedersen
On søn 02 jan 2011 13:59:22 CET, "Warren Togami Jr." wrote I've been thinking, perhaps we should consider making a "Freemail Realtime BL" that lists not IP addresses, but rather ID's at the Freemail provider. emailbl was better coded for this purpose imho freemail as is, is perfect as it is n

Re: lots of freemail spam

2011-01-02 Thread Warren Togami Jr.
I've been thinking, perhaps we should consider making a "Freemail Realtime BL" that lists not IP addresses, but rather ID's at the Freemail provider. 1) I am assuming that ID's you see in headers of mail from Yahoo is always from an authenticated user? 2) Traps and user reports can quickly list a

Re: lots of freemail spam

2011-01-02 Thread Cedric Knight
On 30/12/10 19:15, Lawrence @ Rogers wrote: > Lately, I notice we are getting a fair amount (10-12 per day per client) > of spam coming from freemail users (FREEMAIL_FROM triggers). Usually the > Subject is non-existent or empty, and the message is always just an URL I see a fair amount matching t