FSL_BULK_SIG still active?

Hi, everyone Pls... Is this still an active spamassassin test? header __FSL_HAS_LIST_UNSUB exists:List-Unsubscribe meta FSL_BULK_SIG ((DCC_CHECK || RAZOR2_CHECK || PYZOR_CHECK) && !__FSL_HAS_LIST_UNSUB) describe FSL_BULK_SIG Bulk signature with no Unsubscribe Had some o

Lots of money, score of 0??

Guys, Do you usually tune up Lots of money rule? Strange, our spamassassin/EFA scores 0 and false negative. Imho it should score at least something, few people would write Million dollars in an email, why not add up score? LOTS_OF_MONEY 0.00 See https://pastebin.com/dY6iFeYL Thanks! Rob

razor?

Hi, everyone Just wondering, whats your thoughts on Razor? Havent analysed big amount of emails yet, but Ive had a few cases where it causes very strange false positives that make no sense. and adds a lot of points... RAZOR2_CF_RANGE_51_100 0.36, RAZOR2_CF_RANGE_E8_51_100 2.43, RAZOR2_CHECK 1.7

catching a dot in the number of a rule

Hi, masters! I know [1-9]{1,5} spreadsheets catches somnething like 23244 spreadsheets What about 23.244 spreadhseets? How to make the rule consider a dot in the number? Thank you! Rob

Re: Ends with string

URI. uri __TEST_URLS /\b(\.vn|\.pl|\.my|\.lu|\.vn|\.ar)\b/i I believe this does it, correct? uri __TEST_URLS /\b(\.vn$|\.pl$|\.my$|\.lu$|\.vn$|\.ar$)\b/i Thanks. Rob 2017-09-08 14:03 GMT-03:00 Kevin A. McGrail : > On 9/8/2017 12:24 PM, Robert Boyl wrote: > >> Hello, everyone! >

Ends with string

Hello, everyone! Is there a way to create a Spamassassin rule that checks for a certain URL suffix such as .ru but makes sure it has to be at the end of the URI? Ends with string. Thanks! Rob

block attachments via plugin

Hi, guys Recently I saw this. http://jrs-s.net/2013/06/14/block-common-trojans-in-spamassassin/ My idea was to create a rule in the way mentioned in this site, such as, for example, certain attachment file type (such as HTML or ZIP) and a certain subject, score the message. The rule works. But

Re: Possible ignore CRLF?

cewarp can catch even with the CR LF. If I remove the CR LF my qmail catches it (SA). http://pastebin.com/gyeDcA3H Thanks Rob 2016-08-26 10:50 GMT-03:00 Axb : > On 08/26/2016 03:46 PM, Robert Boyl wrote: > >> Hi, everyone! >> >> Just curious if anyone has had this issu

Possible ignore CRLF?

Hi, everyone! Just curious if anyone has had this issue before. We have a customer SA rule that catches certain text "se voce nao deseja mais receber..." We have an icewarp mail server where our rule hits just fine, DESPITE a CRLF after word "SE". See imagem showing that CRLF http://screenpress

detect if html attachment without plugin

Hi, everyone Quick question. We have a Spamassassin installation where the mail servers implementation doesnt permit any SA plugins, so I cant use Plugin::MIMEHeader or the such. To be able to detect that an email has an HTML attachment, such as this message: http://pastebin.com/raw/TieFEiZi I t

scan an HTML file, possible?

Hi, everyone I have a very nice regex a friend passed me that catches those emails that have an HTML attached with a redirect html command to some malefic website. He has some tool in Exim that scans text in attachments. But I wanted to use a spamassassin rule. Is there some plugin/way in Spamas

eval:check_uridnsbl to check subdomains

Hi, everyone We are trying to query subdomains of a DNSBL in body of message, but learned that the default plugin we use, used by URIBL, caps off subdomains. This is the rule we based ourselves on... it works fine, except for subdomains... it considers the domain part... urirhssub URIBL_GR

Re: understanding HELO_DYNAMIC_IPADDR

this? Thanks 2016-05-01 11:06 GMT-03:00 RW : > On Sun, 1 May 2016 10:20:09 -0300 > Robert Boyl wrote: > > > Hi, everyone > > > > Ive seen some discussion in Spamassassin's bugzilla about this > > HELO_DYNAMIC_IPADDR rule, some unanswered over years. > &g

Very low score for spam from b2blistappenders.com

Hi, everyone Pls, do you get a good spam score on this? For us, no hits for spamassassin, etc. I checked in test sites such as http://spamcheck.postmarkapp.com/ and also very low score. Strange, as it does seem to have spammy words, etc... no? See: http://pastebin.com/EJH1eddN Thanks! Robert

Regex in case of spaces

Hi, everyone! Sorry, lame with regex. How can I make a rule to catch: Need to buy a product ? And also catch "need to buy a product?" Note the extra spacing. Tried this, didnt work: describe TEST123test body TEST123/\bNeed to buy products *\?\b/i scoreTEST123 0.0 If

Abused accounts

Hi, everyone Please check http://pastebin.com/GUBqpyZ8 Interesting how some spams that abuse some legit account such as this one are hard to detect, how Spamassassin scores almost nothing although there are spammy works, etc. System caught DCC_CHECK 1.10. Some other systems such as isnotspam.com