Re: SARE fraud ruleset rotted?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 John D. Hardin wrote: > SARE ninjas lurking about: > > I tried to send the following to Matt Yackley via > [EMAIL PROTECTED], but that address bounced. Is Matt (or anyone > else) still maintaining the SARE fraud rulesets? > > Matt: > > I'm getting

Re: Rule for PDF and eCard Spam Needed

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Loren Wilton wrote: > PDFinfo plugin from SARE helps a lot with the pdf mess. Theo has also > published a number of rules that catch them, I believe. You can get > them form one of the standard SA update channels. > > I suppose we ought to publish s

Re: not everyone is happy with SA

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 jdow wrote: > From: "Michael Scheidell" <[EMAIL PROTECTED]> >> -Original Message- >> From: David B Funk [mailto:[EMAIL PROTECTED] >> On Thu, 19 Jul 2007, Dave Pooser wrote: >> their 'PC' interpretation of the error code. Thus Exchange LLusers[1

Re: Question about v3.2.1 and SARE rules..

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Billy Huddleston wrote: > Malformed UTF-8 character (unexpected non-cont > inuation byte 0x00, immediately after start byte 0xd5) in pattern match > (m//) at > /etc/mail/spamassassin/70_sare_obfu1.cf, rule __SARE_OBFU_VISIT1, line > 1, 2> line 64. >

Re: Question about v3.2.1 and SARE rules..

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Billy Huddleston wrote: > I upgraded from 3.1.7 to 3.2.1 and started getting errors from > 70_sare_obfu.cf rules set.. any one got any ideas on this? > > Thanks, Billy > > ** What are the errors? - -- -Doc Penguins: Do it on the ice. 8:44am

Re: "Malformed UTF-8 character" errors>

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Henry Kwan wrote: > > Doc Schneider wrote: >> I just now committed more fixes for 70_sare_obfu.cf, obfu0 and obfu1. >> These should be available within the hour. >> >> Please folks if you have a problem with a rule set f

Re: "Malformed UTF-8 character" errors>

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Loren Wilton wrote: >> (sare_obfu1.cf seems to have been updated though). Do you know if Doc >> plans to >> update sare_obfu.cf soon? > > He's working on it. Said it was a bit of a bear to fix up the regexes > in it. > >Loren > I just now

Re: sa-compile and SARE

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rosenbaum, Larry M. wrote: > > Does this fix the performance problems I was having, or does it just fix > the UTF errors showing in the logs with Perl < 5.8.8 ? You might try it and see if it helps with the performance. Since it does fix the UTF-8 iss

Re: sa-compile and SARE

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Michael Scheidell wrote: >> Please give it an hour or so to become available. And also >> let me know if you're still seeing these issues. >> > > Are they only available via channel? This brought old rule up: > http://www.rulesemporium.com/rules/70_s

Re: sa-compile and SARE

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Koopmann, Jan-Peter wrote: > On Thursday, May 17, 2007 12:44 AM Doc Schneider wrote: > >> No, the 70_sare_stocks.cf was re-scored and a couple rules were >> removed from it and had nothing to do with the UTF-8 issue. I've j

Re: sa-compile and SARE

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daryl C. W. O'Shea wrote: > Koopmann, Jan-Peter wrote: >> Hi, >> >> please excuse me if the archives already answer the question and I >> overlooked it. >> >> I am going to upgrade to 3.2.0 this week but remember reading that >> sa-compile will not

Re: Poor performance with v3.2.0

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rosenbaum, Larry M. wrote: > >> -Original Message- >> From: Doc Schneider [mailto:[EMAIL PROTECTED] >> >> If he is getting the UTF-8 error, this would indeed be odd, since he > is >> using perl-5.8.8 wh

Re: Poor performance with v3.2.0

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Justin Mason wrote: > Rosenbaum, Larry M. writes: >>> From: Loren Wilton [mailto:[EMAIL PROTECTED] >>> Subject: Re: Poor performance with v3.2.0 >>> >>> It would be interesting on some system experiencing this slowdown to >> put >>> 'use bytes' back in

Re: Need help finding an old rule making page.

Josh Graham wrote: > Last year there was this page I had bookmarked that was basically a php > form where you enter criteria and it would output Spamassassin rules for > you. I lost all my bookmarks when a flash drive died, does anyone know > of the page I'm talking about? > > I can't remember ex

Re: Sorting SA Discussion List Messages

Mário Gamito wrote: Don Ireland wrote: Every email list I've ever subscribed to has had something in the subject line (usually in square brackets) to identify 1) that it is a mailing list and 2) what list it is. Maybe, just maybe, you can filter through e-mail adresseses instead of subjects.

Re: Medical tablets spams

David Goldsmith wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Igor Chudov wrote: I also got these errors: Feb 22 21:18:41 manifold spamd[5132]: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_MKSHRT' Feb 22 21:18:41 manifold spamd[5132]: rules: meta test SARE_RD_

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

Jo Rhett wrote: If you want a change to a SARE rule, go talk to the SARE people. I am. They answer questions about the rules on this list, and nowhere else. I guess then the [EMAIL PROTECTED] list isn't where SARE helps with rules... news to me. Since I happen to run that list. -- -

Re: Google Summer of Code 2007 ...

Justin Mason wrote: Theo Van Dinter writes: I'm assuming that there will be a Google Summer of Code 2007 going on, and that the ASF will be involved again. So it's a good time to start thinking about things we'd like to put up as possible projects. We still have a number of items from last yea

Re: sa-update gives error message Insecure dependency in open while running with -T switch

Bob McClure Jr wrote: On Fri, Feb 09, 2007 at 12:02:52PM +1300, Philip Seccombe wrote: This is what happens: Warning: Cannot install File::IO, don't know what it is. Try the command i /File::IO/ That should be IO::FILE. ARG... "Dyslexics of the world untie!" My bad for sure. perl -

Re: sa-update gives error message Insecure dependency in open while running with -T switch

Philip Seccombe wrote: Hi everyone, Tried Googling this but no success Any advise would be greatly appreciated Is it updating or is that error mean it is stopping at the end and not updating? When I run sa-update –D I get the following: [9013] dbg: channel: extracting arch

Re: Spam making it through

Theo Van Dinter wrote: On Mon, Feb 05, 2007 at 02:27:18PM -0600, Doc Schneider wrote: http://hasle.progenyid-com <http://hasle.progenyid-com/> Are you using SA 3.1.7? If so, do an sa-update there is a new rule that should be catching these and all mutations. Three things. First, the s

Re: Spam making it through

Simon Marcil wrote: I'm running SpamAssassin version 3.1.3. Anything I should lookout for/beware of when I upgrade. Thanks Nothing jumps out at me as far as "gotchas" upgrading from 3.1.3 to 3.1.7. Since they're both in the same branch 3.1.x. Course it all depends on what OS you're using too

Re: Spam making it through

Simon Marcil wrote: Anybody have a rule for these ones? http://hasle.progenyid-com Important: Replace "-" with "." in the above link Are you using SA 3.1.7? If so, do an sa-update there is a new rule that should be catching these and all mutations.

Re: SA-gen'd message report headers appear differently (with/without linebreaks) in different mail clients

snowcrash wrote: oops ... that was for FF. this is for TB, Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.2pre) Gecko/20070203 Thunderbird/2.0pre Mnenhy/0.7.4.10005 version 1.5.0.9 (20070104) is what I use. I do build it from source but that shouldn't make any difference. I

Re: SA-gen'd message report headers appear differently (with/without linebreaks) in different mail clients

snowcrash+spamassassin wrote: In T-Bird under preferences->Display under the "Formatting" tab. wrap test to fit window width. I believe it is checked by default. hm. don't have "one of those", http://img401.imageshack.us/img401/8435/tbirdtabuj4.png haven't found it elsewhere either (yet ...)

Re: SA-gen'd message report headers appear differently (with/without linebreaks) in different mail clients

snowcrash+spamassassin wrote: There is nothing SpamAssassin related here. The information in the header is written w/ whitespace folding. Most MUAs leave it alone when showing it to you, Thunderbird apparently unfolds the lines. You may have an option which lets you disable it, but it's 100%

Re: How do I manaually check SPF validity?

Loren Wilton wrote: I know this is doubtless trivial, but I've never done it, and don't know how. I just got a perfectly valid Physics News weekly newsletter from the AIP, and it got SPF_SOFTFAIL for 2.4 points, kicking it into the spam bucket. If this is a config problem on their end I shou

Re: How do I whitelist this?

Steven Stern wrote: I'm having problems whitelisting mail sent through web sites with a from address supplied by the user. Case in point, I send an article from huffingtonpost.com to myself. I used a "whitelist from huffingtonpost.com", but that doesn't reduce the spam score. Should be white

Re: Enhancing Detection of Certain Spam

Rich Shepard wrote: On Wed, 24 Jan 2007, Daryl C. W. O'Shea wrote: Have you actually run sa-update? I just did so. Nothing was returned. I always run sa-update -D to see what is happening. -- -Doc Penguins: Do it on the ice. 10:12pm up 11 days, 7:10, 15 users, load average: 0.9

Re: market buy with image

R Lists06 wrote: I'd use 00_FVGT_File001.cf which is a new file Fred. This combines a lot of his older 88_FVGT* cf files into one. -- -Doc Thanks, if anyone out there running some or a lot of the FRED rules with a lot of success or should we only run certain ones in general Bottom line

Re: market buy with image

R Lists06 wrote: By fred rules, do you mean by Fred Tarasevicius Which specific fred rules are the best by experience? Thanks! I'd use 00_FVGT_File001.cf which is a new file Fred. This combines a lot of his older 88_FVGT* cf files into one. -- -Doc SA/SARE/URIBL/SURBL -- Ninja 11:08

Re: MySQL error?

Theo Van Dinter wrote: On Mon, Jan 15, 2007 at 02:23:23PM -0600, Doc Schneider wrote: I'm seeing this in a server I just upgraded from 3.0.6 to 3.1.7 My thoughts are this is contained in the userpref part of MySQL. Any idea or way to fix this? Jan 15 13:59:56 lists spamd[25290]: c

MySQL error?

I'm seeing this in a server I just upgraded from 3.0.6 to 3.1.7 My thoughts are this is contained in the userpref part of MySQL. Any idea or way to fix this? Jan 15 13:59:56 lists spamd[25290]: config: failed to parse line, skipping: use_terse_report 0 Jan 15 13:59:56 lists spamd[25290]: config

Re: spam attacks - so and so wrote about a stock

Rob McEwen (PowerView Systems) wrote: In the meantime, it sure would be nice if that new ruleset that Chris bragged about could get on the SARE website ASAP. (Where are you Doc Schneider? I hope we haven't caught you on a busy day. Please hurry.) Rob McEwen PowerView Systems I just g

70_sare_stocks.cf

I just committed a fix to the one which had lint errors. #version: 01.00.36 -- -Doc SA/SARE -- Ninja 3:24pm up 20 days, 18:58, 19 users, load average: 1.02, 0.79, 0.74 SARE HQ http://www.rulesemporium.com/

Re: Antidrug.cf, call to cease RDJ updates.

DAve wrote: Rick Macdougall wrote: Matt Kettler wrote: Chris Thielen wrote: Matt, Does antidrug still get updates? If you are going to continue publishing updates to antidrug I will change the URL in RDJ to wherever eventually move it. If, however, there are no additional updates foreseen i

Re: breaking out: thinking abt the 'sa-update *VS* rdj' thread .. .

Bill Landry wrote: - Original Message - From: Andy Jezierski There's a bunch of people in SARE (I don't know the actual number) focused on developing rules. Agreed. That's all they do is rules. Who knows how many ninja's are out there. Well, from what I recall, from when my kid

Re: Stock Spams; aka Pump and Dump

DAve wrote: Howdy, My users are just about tired of the stock spams, we are getting many now that are barely hitting any stock rules at all. The funny thing is they are pretty much a legit email. No obfuscation, no funky headers, no URL. I am nearly ready to just stomp any and all stock mes

Re: Any of you able to block this SPAM?

Trevor wrote: Hi, I've been receiving a number of these emails below. Are any of you getting them and having any luck blocking them? Take a look at http://www.rulesemporium.com/rules/70_sare_stocks.cf That rule set catches most of these quite well. -- -Doc Penguins: Do it on the ice.

Re: standard vs SARE rules

Mike Jackson wrote: SARE RULESETS: 70_sare_adult.cf: 10 70_sare_bayes_poison_nxm.cf: 0 70_sare_html0.cf: 1 70_sare_obfu0.cf: 1 70_sare_oem.cf: 30 70_sare_specific.cf: 5 70_sare_spoof.cf: 14 70_sare_stocks.cf: 69 70_sc_top200.cf: 1 WooHoo! 70_sare_stocks.cf hits my favorite number! Sorry just

Re: Stopping recent stock pumping spam

Tristan Miller wrote: Greetings. In article <[EMAIL PROTECTED]>, Doc Schneider wrote: [1] SARE rulesets: SARE_REDIRECT_POST300 SARE_EVILNUMBERS0 SARE_EVILNUMBERS1 SARE_EVILNUMBERS2 SARE_BAYES_POISON_NXM SARE_HTML SARE_HEADER SARE_SPECIFIC SARE_ADULT SARE_BML SARE_FRAUD SARE_SPOOF SARE_

Re: Stopping recent stock pumping spam

Tristan Miller wrote: Greetings. I'm using SpamAssassin 3.0.4 with local Bayesian filtering, Vipul's Razor, and several daily-updated SARE rulesets [1]. Nonetheless, there's one particular kind of spam lately that always seems to slip through; it consists of a bunch of random words plus a graph

Re: lint errors after upgrade

Jean-Paul Natola wrote: Hi all After upgrading to 3.1.1 I'm getting a bunch of [36993] warn: config: SpamAssassin failed to parse line, "SARE_RMML_Stock27_.166" is not valid for "score", skipping: score_SARE_RMML_Stock27_.166 Is there something , or should I say, what step did I miss?

Re: error after upgraded to 3.11

Spamassassin List wrote: Leading zeros are required for values between (-1,1). Thanks. After examine all the rules, found out that 70_sare_stocks.cf is causing it. It contains lines like:- body SARE_MLB_Stock3 /Last[ _](?:Trade|Price)[ :]/i scoreSARE_MLB_Stock3 .794 body

Updated Pump and Dump rules. 2006-03-07

I just committed version 01.00.12 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It should appear within the hour. This new update includes better all gif stox detection. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja)

Updated Pump and Dump rules. 2006-02-26

Yeah I sent this twice... forgot to add the right date to the subject. D'Oh! I just committed version 01.00.09 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It should appear within the hour. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja)

Updated Pump and Dump rules. 2006-02-23

I just committed version 01.00.09 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It should appear within the hour. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja)

Re: Updated Pump and Dump rules. 2006-02-23

Sandy S wrote: - Original Message - From: "Doc Schneider" <[EMAIL PROTECTED]> To: Sent: Thursday, February 23, 2006 12:06 AM Subject: Updated Pump and Dump rules. 2006-02-23 I just committed version 01.00.08 of this ruleset to: http://rulesemporium.com/rules/70_sa

Re: Updated Pump and Dump rules. 2006-02-23

Gene Heskett wrote: On Thursday 23 February 2006 01:06, Doc Schneider wrote: I just committed version 01.00.08 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It should appear within the hour. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja) I've copied this one from

Updated Pump and Dump rules. 2006-02-23

I just committed version 01.00.08 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It should appear within the hour. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja)

Updated Pump and Dump rules. 2006-02-20

I just committed version 01.00.07 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf This one should now --lint fine with the SA SVN version. Added a 0. to the scores. It should appear within the hour. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja)

Updated Pump and Dump rules. 2006-02-18

I just committed version 01.00.06 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It should appear within the hour. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja)

Updated Pump and Dump rules.

I just committed this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja)

Re: Pump and Dump SARE rules

Chris Santerre wrote: > -Original Message- > From: Doc Schneider [mailto:[EMAIL PROTECTED] > Sent: Friday, January 27, 2006 5:14 PM > To: users@spamassassin.apache.org > Subject: Pump and Dump SARE rules > > > http://rulesemporium.com/rules/70_sare_stock

Re: Pump and Dump SARE rules

Bowie Bailey wrote: Doc Schneider wrote: http://rulesemporium.com/rules/70_sare_stocks.cf Is the latest addition to the SARE rule sets. I don't see this on the SARE rules website. Do you have the masscheck results available anywhere? I will add in the mass-check results in a bit.

Pump and Dump SARE rules

http://rulesemporium.com/rules/70_sare_stocks.cf Is the latest addition to the SARE rule sets. -Doc (SARE Ninja)

Re: lint only one rule file

Christian Eichert wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I whould like to lint a singular rule file e.g. spamassassin --lint /usr/share/spamassassin/10_misc.cf but this is not working and I cannot find the right syntax in the howtos. How to proced? -BEGIN PGP SIGNATURE- V

Re: Problems with AOL's TOS reports

Charles Sprickman wrote: On Fri, 2 Dec 2005, Ralf Hildebrandt wrote: * Kai Schaetzl <[EMAIL PROTECTED]>: In order to keep our mail flowing to AOL members, I've signed up through the AOL postmaster service to receive TOS reports. Basically, whenever someone reports mail from our domains as sp

[Fwd: Re: uol.com.br]

I'm having one of those days. Original Message Subject: Re: uol.com.br Date: Wed, 16 Nov 2005 22:46:13 -0600 From: Doc Schneider <[EMAIL PROTECTED]> To: jdow <[EMAIL PROTECTED]> References: <[EMAIL PROTECTED]> jdow wrote: Does that ISP have ANY redee

Re: Problem with 70_sare_header.cf 01.03.16

Ed Kasky wrote: When running rdj, I get the following: Ruleset for header abuse (sets 0-3) has changed on yoda2. Version line: # Version: 01.03.16 ***WARNING***: spamassassin --lint failed. Lint output: [25934] warn: config: warning: description exists for non-existent rule SARE_HEAD_DATE_LO

Re: aim.com

jdow wrote: What's with the unreadable messages that seem to come from this service. A fellow on the FC4 list is posting messages from his account at aim.com (AOL) that feature a signature and a walking man icon but nothing other than quoted content. (I've just given the entire aim.com host a sco

Re: Adjusting the AWL value

Matt Kettler wrote: Jim Maul wrote: Hey, do you know any commands to remove things from other peoples' ASS? Maybe something like --remove-stick-from ? My boss really needs this! No, usually the only thing you can try on someone else is --remove-head-from-ass. However, this will fail on

Re: (OT, slightly) dealing with AOL spam reports?

Bob McClure Jr wrote: On Wed, May 18, 2005 at 09:16:15AM -0700, Mike Jackson wrote: A couple days ago, I set up AOL's "feedback loop" (though the loop part is a misnomer, since you can't actually respond to the messages) so I could monitor complaints against my employer's servers. Looking through

Re: AWL whaaat

I'd have to turd... er third it! -Doc Gary W. Smith wrote: I second. HSA (Historical Score Averager) might be reasonably accurate, but unless you think about the math, it's purpose isn't clear. (And in my experience, most people don't enjoy thinking about math. ) Got any better suggestions for a n

Re: OT: The highest score?

I've seen one as high as 94.2 and was a really short spam too. Funny how scoing works. 8*) -Doc (SA/SARE/URIBL/SURBL - Stealth Ninja) Roman Serbski wrote: Hi all, What was the highest score you've ever seen? I received a message yesterday that was scored with 51.9(!). =) SA in action: ;-) Sat, 30 A

Re: Spam with no contact info

wolfgang wrote: In an older episode (Saturday 30 April 2005 17:40), Bret Miller wrote: What is it with the current set of spammers who send out nice table-obfuscated drug ads with absolutely no contact information or URL. I'd like to see a sample of those ... regards, wolfgang I'll forward you one