Usually we receive spam having subjects like these examples in order of time :
Subject
FromTo
FedEx Shipment 702193383647 Notification
On 28 Sep 2016, at 1:58, Luciano Rinetti wrote:
When i run the "spamassassin -D --lint" i get the message:
Sep 28 07:45:57.329 [13116] dbg: config: warning: score set for
non-existent rule "rulenames"
where rulenames are:
RCVD_IN_MSPIKE_H4
RCVD_IN_MSPIKE_WL
FREEMAIL_FORGED_FROMDOMAIN
RCVD_IN_M
On 9/28/2016 9:02 AM, Nicola Piazzi wrote:
Usually we receive spam having subjects like these examples in order
of time :
Subject FromTo
FedEx Shipment 702193383647 Notification
j...@company1.com s...@mycompany.it
FedEx S
Bowie, your ia a manual way, it works but is not automated
Automation is a plugin that check similar words in oldest messages (for example
3 of 4 words match)
Then plugin check if sender domain is different and recipient is different
Da: Bowie Bailey [mailto:bowie_bai...@buc.com]
Inviato: merc
I'm still not clear on exactly what you are trying to do, but in order
to test anything against previous messages, you will need a custom SA
plugin and some sort of database to store the information about previous
emails. That is beyond my area of expertise.
If you just need a regex to match
On 09/28/2016 04:21 PM, SA wrote:
I'm getting false positives on this one...
NOTSAME__REPLY_TO From yahoo but reply to yandex
score 1.0
... where reply-to and from are both yahoo.co.uk. There is no sign of
yandex anywhere.
I've looked for this rule but cannot find it. Could someone please a)
I've tried to run "spamassassin -D --lint" several times over the past
few years but never successfully. It always over-spills Terminal and all
attempts to pipe it to file or to more / less fail. Is there ANY way to
get a sensible listing from this command, please? I'm sure there must be.
--
D
I'm getting false positives on this one...
NOTSAME__REPLY_TO From yahoo but reply to yandex
score 1.0
... where reply-to and from are both yahoo.co.uk. There is no sign of
yandex anywhere.
I've looked for this rule but cannot find it. Could someone please a)
tell me where it is and b) fix
On 9/28/2016 10:26 AM, SA wrote:
I've tried to run "spamassassin -D --lint" several times over the past
few years but never successfully. It always over-spills Terminal and
all attempts to pipe it to file or to more / less fail. Is there ANY
way to get a sensible listing from this command, plea
On 09/28/2016 04:26 PM, SA wrote:
I've tried to run "spamassassin -D --lint" several times over the past
few years but never successfully. It always over-spills Terminal and all
attempts to pipe it to file or to more / less fail. Is there ANY way to
get a sensible listing from this command, pleas
On 28/09/16 15:31, Axb wrote:
You are awake that it's not really polite to hijack a thread with
something totally unrelated?
It was relevant. I was trying to compare my system to the OP's.
--
Dave Stiles
Many thanks for that, Bowie.
--
Dave Stiles
> what .cf file includes that rule on your system?
That was the point: I can't find it. I've done a grep for NOTSAME on
usr/share/spamassassin/*.cf but got nothing. Is there another place I
should be looking?
Forgot to mention:
SA version: 3.3.2
Perl version: 5.14.2
--
Dave Stiles
On Wed, 2016-09-28 at 13:29 +, Nicola Piazzi wrote:
> a plugin that check similar words in oldest messages (for example 3 of
> 4 words match)
>
> Then plugin check if sender domain is different and recipient is
> different
> Detection routine
>
>
>
>
Le 28/09/2016 à 16:56, SA a écrit :
what .cf file includes that rule on your system?
That was the point: I can't find it. I've done a grep for NOTSAME on
usr/share/spamassassin/*.cf but got nothing. Is there another place I
should be looking?
/etc/mail/spamassassin is another likely place, bu
Please keep list emails on the list.
I don't think you could do a simple regex match for what you want. As I
said previously, this would require a plugin both to build the custom
regex(s) (or DB query) and to search for the previous emails. You would
want to keep the prior email information i
Obviously i intended to write a plugin that search the db
But I need the regex syntax to search at least 3 words that match of 4 words
given
Nicola Piazzi
CED - Sistemi
COMET s.p.a.
Via Michelino, 105 - 40127 Bologna - Italia
Tel. +39 051.6079.293
Cell. +39 328.21.73.470
Web: www.gruppocomet.it
I don't know of a way to do that with a simple regex. But since you are
writing a plugin, you could do it by parsing the output of a regex search.
1) Create a regex which will match on any combination of 3 of the
words. This will let you pull all of the possible matches from previous
emails.
> If you still can't find it, try doing
> spamassassin --lint -Dconfig
Ok, John, that pointed me in the right direction. Thanks.
It was in whitelist_dkim.cf of all places! I can't recall specifically
adding that rule to the whitelist but then: I have a poor memory for
such things; but the
This is what i need Bowie
The query must be
select from_address, from_domain, to_address, subject from maillog where
subject REGEXP '\b(?:(?:FedEx|Shipment|702193383246|Notification)\b.*?){3}';
But unfortunately mysql give error
ERROR 1139 (42000): Got error 'repetition-operator operand invalid'
I am not familiar with MySQL regular expressions. The regex I provided
uses Perl syntax. It doesn't use lookarounds.
I can think of two things offhand that might be an issue.
1) Maybe it doesn't like the non-capturing groups. (?: )
Try it without the "?:" on the two groups:
\b((FedEx|S
On Wed, 28 Sep 2016, Bowie Bailey wrote:
I don't think you could do a simple regex match for what you want. As I said
previously, this would require a plugin both to build the custom regex(s) (or
DB query) and to search for the previous emails. You would want to keep the
prior email informati
On 28 Sep 2016, at 11:20, Nicola Piazzi wrote:
But I need the regex syntax to search at least 3 words that match of 4
words given
This can be done with a SA meta rule:
header __FOO_IN_SUBJ Subject =~ /foo/i
header __BAR_IN_SUBJ Subject =~ /bar/i
header __BAZ_IN_SUBJ Subject =~ /baz/i
header _
23 matches
Mail list logo