Re: Mail::SpamAssassin::Plugin::Phishing PhishStats[.]info domain expired

2024-06-23 Thread Larry Nedry via users
On 7/21/23 9:10 AM, Giovanni Bechis wrote: Hi, phishstats[.]info domain has recently moved to a parking domain, if you are using Mail::SpamAssassin::Plugin::Phishing plugin with data downloaded from PhishStats[.]info it would be better to comment "phishing_phishstats_feed" configuration line.

T_SCC_BODY_TEXT_LINE

2022-04-03 Thread Larry Nedry
Greetings, What is the purpose of the rule named T_SCC_BODY_TEXT_LINE? On my servers, it hits nearly every spam and ham email. Regards, Larry

Re: recent update to __STYLE_GIBBERISH_1 leads to 100% CPU usage

2019-05-30 Thread Larry Nedry
On 5/29/19 7:32 AM, Karsten Bräckelmann wrote: That's a non-scoring sub-rule, setting its score to 0 has no effect. Redefining the rule to disable it is the way to go: meta __STYLE_GIBBERISH_1 0 FWIW, I've added this to local.cf, recompiled, and restarted spamd but am still seeing CPUs

Re: Spam with tons of lines with garbage characters, preceded by

2017-12-29 Thread Larry Nedry
On 7/20/17 2:31 AM, Henrik K wrote: On Thu, Jul 20, 2017 at 01:02:07AM -0500, David B Funk wrote: On Thu, 20 Jul 2017, Andrzej A. Filip wrote: By default messages bigger than 500KB are not sent to spamd for processing/scanning => the tactics you describe frequently "turns off" spam filtering.

Re: Hostkarma white list

2009-09-29 Thread Larry Nedry
Oops! Sorry, I didn't intend to send my previous message to the list. Nedry On 9/29/09 at 12:51 PM -0500 Larry Nedry wrote: On 9/29/09 at 7:41 AM -0700 Marc Perkel wrote: For those of you getting spam from IPs/Hostnames on my hostkarma white list, if you could email me a list of false hits (IP

Re: Stats (was: The EmailBL test zone period has been extended to July 1st.)

2009-05-23 Thread Larry Nedry
On 5/22/09 at 9:28 PM +0200 Karsten Bräckelmann wrote: An interesting observation is, that the hitrate (in percent) in spam scoring 15 is an order of magnitude higher than with high-scoring [1] spam. This is rare to find... My EMAILBL_TEST_LEM hitrate leans heavily toward the other end of the

Re: sa-compile

2009-04-16 Thread Larry Nedry
On 4/16/09 at 7:44 AM -0400 Michael Scheidell wrote: Larry: what version of re2c are you using? re2c 0.13.5

Re: sa-compile

2009-04-15 Thread Larry Nedry
On 4/15/09 at 10:30 AM -0400 Rick Macdougall wrote: Normal sa-update sa-compile takes about 2 minutes here. If I add JM's saught rules it takes over 30 minutes. Here's another data point. With JM's sought and sought-fraud rules the compile takes less than 7 minutes on a server running an Intel

Re: Updating SpamAssassin

2009-02-10 Thread Larry Nedry
On 2/10/09 at 8:38 PM +0100 Karsten Bräckelmann wrote: I don't see a problem to do this. Really wonder why that machine dos not have Internet access, though. Not to be snarky either, but I'd be interested in the answer to John's question, too. ;) I can't speak for Daniel but I have an offline

Re: Bayesian per domain filtering

2009-01-18 Thread Larry Nedry
On 1/18/09 at 3:46 PM -0500 Munroe Sollog wrote: I am sure this has been asked before, however, I cannot find any clear documentation nor archives addressing this question. I would like to store a per domain bayesdb, preferably in a database. Is there documentation on doing this? Yes, it is

Re: DKIM sigs started failing.

2008-09-04 Thread Larry Nedry
On 9/4/08 at 9:10 AM -0400 Michael Scheidell wrote: Anyone else missing the DKIM_VERIFIED rule on legit email? Out of the last 249,000 emails, DKIM_VERIFIED has only hit 18 times. DKIM_SIGNED on the other hand has hit about 58,000 times. Nedry

Re: FreeMail plugin

2008-08-26 Thread Larry Nedry
On 3/21/08 at 4:59 PM +0200 Henrik K wrote: Hehe, yeah it should be ok. Let me know if you spot any false FPs with REPLYTO.. I recently installed the FreeMail 1.10 SA plugin and am getting a ridiculous number of FPs. I haven't installed Regexp::Assemble but that shouldn't make any difference in

Re: Fwd: Attn: webmail Subscriber

2008-08-15 Thread Larry Nedry
On 8/15/08 at 8:07 AM -0700 John Hardin wrote: Is there any reason the base rules should _not_ contain a whitelist_from_spf or whitelist_from_rcvd for the list? Would you really want to auto-train your bayes with mail from this list? Nedry

Re: iXhash plugin and lists - feedback wanted

2008-08-04 Thread Larry Nedry
On 8/4/08 at 8:42 PM -0500 Chris wrote: Hi Dirk, I've been using it on my home system probably ever since you made it available. Below are hit stats from yesterday: Total: 279 Ham: 122 Spam: 157 iXhash.cf: Rule Name Score Ham Spam %of Ham %of Spam

Re: Memory Leak?

2008-07-27 Thread Larry Nedry
On 7/27/08 at 8:28 AM -0700 jdow wrote: These are important results. They show that you have a plenty fast enough machine for 100,000 emails per day, although given the fact that daytime is pretty bad compared to night time you'd probably see significant slowdowns in throughput during the day as

Re: Short circuit priority doesnt seem to work

2008-06-26 Thread Larry Nedry
On 6/26/08 at 7:05 PM +0200 Benny Pedersen wrote: make priority positive not negative, default all have 0 to start with, and 10 would be tested before 0 :-) And again on 6/26/08 at 10:06 PM +0200 Benny Pedersen wrote: On Thu, June 26, 2008 21:17, Michael Parker wrote: Negative numbers come

Re: whitelist_auth problem

2008-06-12 Thread Larry Nedry
On 6/7/08 at 3:19 PM -0500 Larry Nedry wrote: Hi All, A few days ago whitelist_auth and whitelist_from_dkim stopped working. Everything else seems to be working well. I haven't made any changes to the server recently so I find this puzzling. neither of these rules work: whitelist_from_dkim

Re: whitelist_auth problem

2008-06-10 Thread Larry Nedry
On 6/7/08 at 3:19 PM Larry Nedry wrote: Hi All, A few days ago whitelist_auth and whitelist_from_dkim stopped working. Everything else seems to be working well. I haven't made any changes to the server recently so I find this puzzling. neither of these rules work: whitelist_from_dkim

Re: whitelist_auth problem

2008-06-08 Thread Larry Nedry
On 6/8/08 at 10:41 AM +0200 Matus UHLAR wrote: didn't you upgrade any packages? No, I haven't made any changes to the server in recent weeks. Didn't example.com stop publishing domainkeys records? No, none of the domains that I have whitelisted have stopped publishing DomainKeys, SPF or DKIM

whitelist_auth problem

2008-06-07 Thread Larry Nedry
Hi All, A few days ago whitelist_auth and whitelist_from_dkim stopped working. Everything else seems to be working well. I haven't made any changes to the server recently so I find this puzzling. neither of these rules work: whitelist_from_dkim[EMAIL PROTECTED] whitelist_auth

MySQL and Size Of bayes_expiry_max_db_size

2008-05-27 Thread Larry Nedry
Greetings, This weekend I created a MySQL db to store my bayes tokens. It seems to be working well but I'm a little puzzled by the default size of bayes_expiry_max_db_size. I understand that the default size is 150,000 which seems very low as it took only one day to reach 100,000 tokens. Was

Re: MySQL and Size Of bayes_expiry_max_db_size

2008-05-27 Thread Larry Nedry
On 5/27/08 at 4:33 PM -0500 Michael Parker wrote: You should adjust it for whatever works best for your user base and the resources you have available on your database. Of course. But how would I figure out what works best? How can I tell if it is working poorly or very well? I'm looking for a

Re: Godaddy.com blacklisted (and deserves to be)

2008-03-20 Thread Larry Nedry
On 3/20/08 at 7:36 AM -0400 Michael Scheidell wrote: So, godaddy, you use SpamAssassin? I found out the hard way that Godaddy doe use SpamAssassin to scan customers' outgoing mail. Up until late last year I was renting a dedicated server from them. Suddenly one day most of the mail sent by my

Re: test my auto-generated ruleset

2008-02-11 Thread Larry Nedry
I've been using Justin Mason's auto-generated rule set since mid October and am fairly happy with it. Up until Jan 11, false positives averaged about 10% of the hits and I can live with that. I noticed a surprising change on Jan 11, 2008. Before that day many of the hits were on low scoring (

Re: mass-check wiki page needs updating..

2008-01-31 Thread Larry Nedry
On 1/31/08 at 10:38 AM + Justin Mason wrote: Is anyone using mass-check without previously having SVN set up? Yes, I am. I don't know what's involved in using SVN but I did look at the SVN tree via the web and at first and second look, it wasn't obvious how to use the web to easily download

Re: mass-check wiki page needs updating..

2008-01-30 Thread Larry Nedry
On 1/30/08 at 12:12 PM -0500 Theo Van Dinter wrote: So the masses directory was cut, since the only time you'd use that stuff is when developing SA or rules, and at that point you can just grab the SVN tree since you're probably going to want to use it for the latest code/rules anyway. I imagine

Re: Help with SA / Procmail regex [OT]

2008-01-30 Thread Larry Nedry
On 1/30/08 at 3:20 PM + Arthur Dent wrote: I am so pleased with this rule that I decided to give my poor old SA a well-deserved rest from this rubbish and take these spams out at Procmail time. Keep in mind that there are a lot of mobile phones out there that have email addresses that begin

Re: MP3 Spam

2007-10-20 Thread Larry Nedry
On 10/19/07 at 10:55 AM +0100 Justin Mason wrote: I think you need 3.2.x for the MIMEHeader plugin. Nope, the Storm MP3 rules work just fine with SA 3.1.8. Nedry

Re: test my auto-generated ruleset

2007-10-16 Thread Larry Nedry
On 8/13/07 at 4:01 PM +0100 Justin Mason wrote: I've been working on a new way to auto-generate body rules recently... Are these rules restricted to Spamassassin 3.2 or newer? The following is what I get when I dig 8.1.3.sought.rules.yerp.org. Notice the NXDOMAIN. Thanks for the great work!

Re: Need help finding an old rule making page.

2007-04-06 Thread Larry Nedry
On 4/6/07 Josh Graham wrote: Last year there was this page I had bookmarked that was basically a php form where you enter criteria and it would output Spamassassin rules for you. SpamAssassin Configuration Generator http://www.yrex.com/spam/spamconfig.php HTH, Nedry

Re: Mass-Check Hangs

2007-04-04 Thread Larry Nedry
On 4/4/07 at 10:40 AM +0100 Justin Mason wrote: Could you try adding --restart=1000? In 3.1.18 mass-check will hang at the point where it should restart. Also, could you try with the rc1 of SpamAssassin 3.2.0, or SVN trunk? I think Theo fixed bugs in this code. Thanks, I downloaded the lastest

Mass-Check Hangs

2007-04-03 Thread Larry Nedry
Hi All, I'm trying to use mass-check to test the accuracy of a plugin that I'm developing. If I run mass-check without the -j option (single process) it takes a few hours for it to finish a corpus of about 60,000 emails. If I use the --net option it could a day or two to complete. Of course if

Re: Joe jobbed - Daaaagh!

2007-02-06 Thread Larry Nedry
On 2/6/07 at 12:31 PM + Steve [Spamassassin] wrote: I'm being Joe-Jobbed by some spamming kit that seems to be used fairly widely... or, at least, from a wide range of hosts. Snipped Are there any existing plug-ins for Spamassassin which address this kind of problem? VBounce

Re: sa-learn explained

2006-12-29 Thread Larry Nedry
On 12/29/06 at 12:09 PM -0500 Vernon Webb wrote: Yes, ORDB-RBL SBL+XBL FWIW, relays.ordb.org no longer exists: http://ordb.org/news/?id=38 Nedry

Re: VBounce with SA 3.0.4

2006-12-29 Thread Larry Nedry
Hello again, On 12/28/06 at 10:51 AM -0600 Larry Nedry wrote: I am administering a linux box that has the Plesk 8.1 control panel installed. SpamAssassin 3.0.4 comes with the Plesk package and it doesn't look like it would be easy to upgrade to the latest version of SA. I want to install

Re: RBLs (was: sa-learn explained)

2006-12-29 Thread Larry Nedry
On 12/29/06 at 2:50 PM -0500 Vernon Webb wrote: What are you using? Currently I am using only zen.spamhaus.org. The rest of the RBLs that I have tried have had too many false positives to be useful for my requirements. Which RBLs do the rest of you folks feel comfortable using? Nedry

VBounce with SA 3.0.4

2006-12-28 Thread Larry Nedry
Hello All, I am administering a linux box that has the Plesk 8.1 control panel installed. SpamAssassin 3.0.4 comes with the Plesk package and it doesn't look like it would be easy to upgrade to the latest version of SA. I want to install VBounce which requires Mail::SpamAssassin::Logger. It