Re: HABEAS_ACCREDITED WHY BY DEFAULT?

2009-12-04 Thread Chr. von Stuckrad
On Fri, 04 Dec 2009, rich...@buzzhost.co.uk wrote: > Point 4 - > All that is largely irrelevant to this list, but my point of interest is > why a commercial white list appears in Spamassassin with the default > scores set the way they are? It's perfectly reasonable to ask. It could > be expanded t

Re: Problems sending Abuse mails to Twitter

2009-11-27 Thread Chr. von Stuckrad
On Thu, 26 Nov 2009, Ralph Bornefeld-Ettmann wrote: > I could find your IP (82.113.106.21) on these lists : > ... ... ... > > IP of your server (62.231.42.10) I found on these lists : > > blocked.secnap.net127.0.0.2 > countries.nerd.dk 127.0.0.1 > ips.backscatterer.org 127.0.0.2 B

Re: The www[variations]continue....

2009-07-16 Thread Chr. von Stuckrad
On Thu, 16 Jul 2009, Benny Pedersen wrote: > On Thu, July 16, 2009 12:47, rich...@buzzhost.co.uk wrote: > > Don't you just love them :-) Well, I seem to remember the nearly same scenario a long while ago. Somebody went through nearly the same 'contorions' to always avoid the last 'matching' which

Re: Am I fscking up my bayes db?

2009-07-09 Thread Chr. von Stuckrad
On Thu, 09 Jul 2009, Martin Gregorie wrote: > Here's a simple bash shell script fragment that does the job and does it > fairly fast: > > > for f in data/*.txt ... > gawk ' ... > done > ==

Re: Bombarded by German political spam

2005-05-15 Thread Chr. von Stuckrad
On Sun, May 15, 2005 at 10:59:12AM -0500, Steven Stern wrote: > I received about 500 on the webmaster account. > > Now we know what "sober" was all about. I see *no* connection to any Virus or Trojan! I got about 200 of them into a few accounts and seemingly I'm receiving more every few minutes.

Re: New(?) 'writing direction switch'(?) obfuscation technique

2005-04-22 Thread Chr. von Stuckrad
Hi! I lately received two Barkley-Bank-Phishs, but could not really read them with my ASCII mailreader. The first line of the mail is in my ASCII Browser: D#8238;rae#8236; Ba#8238;lcr#8236;ays Memb#8238;re#8236;, All 'mozillas' show Dera Balcrays Membre, BUT even though MIME-encoding was of

Re: how to filter on invalid local users

2005-04-21 Thread Chr. von Stuckrad
On Thu, Apr 21, 2005 at 03:37:02PM -0500, Michael Parker wrote: > 1) Don't accept mail for invalid users. Well, I often tought about not accepting Mail *FROM* locally-illegal-Users. The 'To' is done by the MTA, but the 'From' would be nice also. It would drop all the spams faking random local User

Re: Spammers Target Secondary MX hosts?

2005-03-18 Thread Chr. von Stuckrad
On Fri, Mar 18, 2005 at 10:24:25AM -0800, Kelson wrote: ... > 5. We generate DSNs that go to third parties or nonexistant hosts, >contributing to backscatter and cluttering up our outbound queue. ... Even worse, the result of bounces sent by _our_ MTA was being Spamcop-RBLed for hitting spamtra

Re: Time for my monthly beating again...

2005-02-16 Thread Chr. von Stuckrad
On Wed, Feb 16, 2005 at 08:26:43AM -0500, Joe Flowers wrote: > For us, SA *seems* to score SPAM messages with lower and lower hit > scores as time goes by, and the users get more and more glassy-eyed over > it's ("my" if you prefer) effectiveness as time goes by too. OH, interesting, I think I h

Broken Ratware-Setup? May be useful for Rules?

2005-02-10 Thread Chr. von Stuckrad
Hi! I attach a 'funny' Mail I got bounced from one of our Users, because it looks like 'broken/misconfigured Ratware'. Maybe somebody can update Rules for such things/structures? The most interesting point seems to be, that the Tool creates three 'Received-Headers' to fool 'first-hop' IP/Domain c

Re: Odd hanging on mail servers

2005-01-20 Thread Chr. von Stuckrad
On Thu, Jan 20, 2005 at 02:37:12PM -0500, Matt wrote: > Ok that works great if you KNOW the domain.. but what do you do when > this happens once every 3 or 4 days to random domains? Oops! No idea, had something like this by network glitches, which made random DNS-Servers unavailable. But we cou

Re: Odd hanging on mail servers

2005-01-20 Thread Chr. von Stuckrad
On Thu, Jan 20, 2005 at 01:47:12PM -0500, Matt wrote: > Ahh ha! Got it.. it seems to be domains that either the name servers > are not responding.. or the domain doesn't exist yet.. for instance: > > debug: DNS MX records found: 0 > > Is there anyway to get around this? It seems to hang and do t

Re: Off to a rocky start with amavix+spamd

2005-01-20 Thread Chr. von Stuckrad
On Thu, Jan 20, 2005 at 12:33:11PM -0500, Haines Brown wrote: > My spamassassin 3.0.2 can be directed to tag a test message as spam > (debian testing), but amavisd-new is not automatically sending ... > I know spamd is running. In /etc/default/spamassassin I have ENABLED = > 1, and in amavisd.conf,

Do spammers send *german* 'pure bayes poison' just 'now'?

2004-12-10 Thread Chr. von Stuckrad
Hi! I'm just curious whether a very strange spam is send to 'many' users. Today many addresses here were hit by absolutely *useless* messages, which *look* like real spam, as long as you look at the subject, which ist the often recurring theme of 'telephone-cd with reverse search enabled'. But l

German-Spammer-OOPS :-)) [Original-Software zum Schleuderpreis]

2004-11-18 Thread Chr. von Stuckrad
I got the following spam today, it might be someting for rules to check for broken ratware, but it might also produce false positives in 'computer talk' :-) The text is completely irrelevant, but the spammers address/url/contact ist missing due to database failure:-)) Yours Stucki - Forward

Re: Blank line inserted before Message-ID header makes headers appear in body

2004-11-12 Thread Chr. von Stuckrad
On Thu, Nov 11, 2004 at 02:07:05PM -0800, Kelson wrote: > A SpamAssassin ruleset can't make any changes to the message AFAIK, so > it doesn't matter which rules you have installed. > > If SA is adding the newline, it's either due to a configuration option > (check your local.cf) or due to a bug.

Re:

2004-11-02 Thread Chr. von Stuckrad
On Tue, Nov 02, 2004 at 08:42:34AM -0500, Matt Kettler wrote: ... > >X-Spam-Status: SpamAssassin Failed ... > >What can give this error? ON 29th of October "Alexandr Orlov <[EMAIL PROTECTED]>" also wrote a Question to the list, containig the same Header. He said "I have a linux box with Communig

Re: Memory usage question

2004-09-17 Thread Chr. von Stuckrad
On Fri, Sep 17, 2004 at 10:42:20AM -0400, Matt Kettler wrote: > Since your box has 256mb of physical ram, I'd limit it to maximum of > 256mb/15mb = 17 spamd's at the highest. I'd really suggest using something > much lower like 10 unless you add some ram. Even this seems to be dangerous (sometim

Re: Phishing obfuscated url detection

2004-09-15 Thread Chr. von Stuckrad
On Wed, Sep 15, 2004 at 02:17:15AM -0700, Jeff Chan wrote: > On Wednesday, September 15, 2004, 1:38:30 AM, Julian Field wrote: > > ... Is it possible to detect where > > bar > > and foo and bar are unrelated domains? > > That could be a good idea for a rule. It would be nice if it > could be dete