Subject: Re: SPAM-LOW: Re: Hiring for Spam Assassin Troubleshooting
From:jdow [EMAIL PROTECTED]
Date:Sun, 4 Jun 2006 17:43:46 -0700
To: users@spamassassin.apache.org
From: Evan Platt [EMAIL PROTECTED]
X-Mailer: IncrediMail (5002253) is not a real e-mail client. You'll
find yourself
Just a quick note that the 70_sare_html*.cf rules files have been
updated.
Information at http://www.rulesemporium.com/rules.htm#html
Bob Menschel
Just a quick note that 70_sare_html0.cf has been updated. A few
obsolete rules (no longer hit any ham) have been removed, and one rule
added.
It'll take a little while longer for me to update the rest of the
70_sare_html*.cf files, and therefore 70_sare_html.cf ... if you don't
want to wait for
Hello Phil,
Sunday, May 28, 2006, 11:20:05 AM, you wrote:
PS Hi there,
PS So I searched (a lot) for solutions. I only found this one in the SA rules :
PS SARE_TOCC_BCC_MANY
PS in the 70_SARE_header0.cf file.
PS By default, the score is set to 0...
PS Then I looked at the SARE file.
PS There is
Just a quick note that 70_sare_specific.cf has been updated.
Only a couple of minor new rules; mostly score changes.
Information about specific.cf available at
http://www.rulesemporium.com/rules.htm#specific
Bob Menschel
Just a quick note that SARE's header*.cf family of rules files have
been updated.
See http://www.rulesemporium.com/rules.htm#header for information
about this rules set. (Version information will be updated on that
page within the hour.)
Bob Menschel
Hello Matt,
Wednesday, May 17, 2006, 4:04:39 PM, you wrote:
MK Some of the shorter results are:
MK body SARE_OBFU_BACK_NUM m'(?!BACK)\bb\d?a\d?c\d?k\b'i
MK body SARE_OBFU_SAVE_NUM m'(?!save)\bs\d?a\d?v\d?e\b'i
MK body SARE_OBFU_SAVINGS_NUM
Hello James,
Wednesday, May 17, 2006, 6:09:51 AM, you wrote:
JEP I had the same probllem with sa 3.04
JEP Anyhow, i solved it by changing the trusted ruleset entry
JEP SARE_HEADER_0 to SARE_HEADER_X31 as advised on rulesemporium.com,
JEP and all works fine now.
Either you misread the web
Hello Kelson,
Monday, March 13, 2006, 11:30:07 AM, you wrote:
K Robert Menschel wrote:
I'm not familiar enough with the newsletters below to know ...
whitelist_from_rcvd [EMAIL PROTECTED]
...
K I can confirm this one as both legit and a frequent false positive (in
K part because of the 7
Hello John,
Monday, March 13, 2006, 2:53:33 PM, you wrote:
JD I am trying to train spamassassin using spam and ham I've collected. My
JD problem is the sa-learn script is using too many resources on the server
JD (my spam folder had ~1000 messages).
JD Is there a way I can run sa-learn on my
I'm not familiar enough with the newsletters below to know whether
they should be whitelisted. Can anyone confirm that these newsletters
(which apparently do get flagged as spam, at least from time to time)
should be whitelisted? Does anyone have any objections to
whitelisting them?
Bob
Just a quick note that SARE's whitelist has been updated.
For information, http://www.rulesemporium.com/rules.htm#whitelist
Bob Menschel
Hello Chris,
Wednesday, March 8, 2006, 2:37:47 AM, you wrote:
CP The attached newsletter is triggering the following rules:
CP X-Spam-Report:
CP * 0.6 SARE_BAYES_5x7 BODY: Bayes poison 5x7
CP * 0.8 SARE_BAYES_7x7 BODY: Bayes poison 7x7
CP * 0.6 SARE_BAYES_6x7 BODY: Bayes poison
Hello John,
Tuesday, March 7, 2006, 10:35:37 AM, you wrote:
SJ Yes, I do do most of these things... SARE, URIBLs, bayes, AWL. No, it
SJ doesn't require much attention. However, it's time to upgrade and THAT is
SJ what is going to take a bunch of my time. We need new hardware (the thing is
SJ
Hello Phil,
Tuesday, March 7, 2006, 5:30:16 AM, you wrote:
RP My experience of the SARE Stock rules to date hasn't been
RP good. They score way too low to kick stuff into the high score
RP region even with the help of Bayes.
RP
RP What's probably needed is two sets of rules or scores for the
Hello Brian,
Sunday, February 5, 2006, 4:52:00 AM, you wrote:
BSM If I use spamassassin -D --lint then it reveals that I'm at 3.0.2
BSM I have posted the x-spam-status from 15 messages at
BSM http://www.meehanontheweb.com/xspamstatus.txt
BSM (the software_spam_rule, which looks for 'software'
Hello Chris,
Saturday, January 28, 2006, 7:02:27 AM, you wrote:
C Guess you could call it that. The last ruleset update I received via rdj
C was 28 Dec which was SARE OEM, does that pretty much match what most of you
C have seen?
Don't use RDJ, but within SARE, oem was last updated Jan 10.
Hello Peter,
Wednesday, January 11, 2006, 7:31:39 PM, you wrote:
P Looks like I had two problems simultaneously. The update issue was not
P causing the error it seems. The real problem I'm encountering appears to
P concern a particular SARE rule. I am running amavisd-new with SA and this
P is
Hello William,
Tuesday, January 10, 2006, 11:37:35 AM, you wrote:
But the 4 letters that matter with Bayes are:
YMMV
WS Isn't that an OTCBB Ticker symbol? I heard they're about to go
WS through the _roof_!!
Your Milage May Vary, Inc. I hear they're cornering the market on
Hello Robert,
Thursday, December 29, 2005, 4:56:49 PM, you wrote:
RK X-Spam-Checker-Version: SpamAssassin 3.0.4
RK OS Linux Red Hat (I think)
RK Is there a way to get SpamAssassin to send all suspected spam to a
RK specific email address? I do not want to download any spam but I would
RK like
Just a quick note that the SARE family of Subject Header rules files
have been updated. Basic documentation at
http://www.rulesemporium.com/rules.htm#genlsubj
Bob Menschel
Hello Chris,
Friday, December 23, 2005, 3:04:29 AM, you wrote:
CL I'm getting false positives for SARE_URI_EQUALS, which scores 5 and is
CL therefore skewing the scoring of some mail quite badly. ...
CL Does anyone have any suggestions, apart from simply reducing the
CL score for
Hello Chris,
In addition,
Monday, December 19, 2005, 3:20:50 PM, you wrote:
C Kai Schaetzl wrote:
Chris wrote on Mon, 19 Dec 2005 09:37:05 -0600 (CST):
What would cause SA (sa-spamd) to core (perl) when there are rules in
mail/spamassassin (recently downloaded from rulesemporium)?
If
Hello Bowie,
Tuesday, December 20, 2005, 7:22:39 AM, you wrote:
BB Brian S. Meehan mailto:[EMAIL PROTECTED] wrote:
Somewhere I got a rule for emails with only Re: in the subject line.
However, I received a valid email and it had a valid subject line with
stuff in it but it got marked as
Hello Jonathan,
Thursday, December 15, 2005, 11:12:23 AM, you wrote:
Have you tried the 70_sare_specific.cf filter? I am not sure it will catch
that specific problem but it catches spam with geocities and tripod url's for
me.
JN Yeah, I'm using that list. It's been great, but the *.br one
Hello JP,
Thursday, December 15, 2005, 8:37:10 PM, you wrote:
JK I am getting a lot of wrist watch spam with links to web pages which
JK have
JK malodorous scripts embedded in them
JK a typical spam looks like this:
Tests added to 70_sare_specific.cf in the last month should help catch
Hello Steven,
Thursday, December 1, 2005, 6:57:45 PM, you wrote:
SS In order to keep our mail flowing to AOL members, I've signed up through
SS the AOL postmaster service to receive TOS reports. Basically, whenever
SS someone reports mail from our domains as spam, AOL forwards it to me.
SS
Hello User,
Thursday, December 1, 2005, 4:26:43 PM, you wrote:
UfSML SARE_FRAUD was suggested but would this be a duplication when
UfSML we are running clamd virus scanner on all the mail?
I don't think so. The fraud rules file is aimed at phishing emails.
If clamd catches your phishing
Wednesday, November 30, 2005, 11:59:23 AM, Matt wrote:
MK I'm not well versed in picking the minimalist set for a low-resource
site, but
MK I can at least tell you what I know you should avoid.
MK In general, the bigger the .cf file, the more resource intensive it will
likely
MK be. Admittedly
Hello Anders,
Tuesday, November 22, 2005, 1:17:25 PM, you wrote:
AN Is there any effective rule set for blocking off all these chronometer
AN and wrist watch spams?
AN Preferably one that I can add into my rules_du_jour..
The current 70_sare_specific.cf should catch them. If you have one that
Hello Paul,
Saturday, November 19, 2005, 11:11:40 PM, you wrote:
PB Hi,
PB I want to know if there is a Java interface into
PB SpamAssassin? I have a requirement to flag some
PB text as spam or not, but I am not using email. My data is
PB similar to email (from, title, body) but
PB it is not
Hello Elton,
Friday, November 18, 2005, 8:00:07 AM, you wrote:
ERC I`m getting some spams with Return-Path: ([EMAIL PROTECTED]).
Return-Path: [EMAIL PROTECTED]
Return-Path: [EMAIL PROTECTED]
ERC Then I did this rule.
ERC header EL_NOBODY_RP Return-Path =~ /[EMAIL PROTECTED]/i
ERC describe
Just a quick note that 70_sare_specific.cf has been updated. Many of
the geocities spam and table-built spam should now be flagged.
Documentation and link at
http://www.rulesemporium.com/rules.htm#specific
Scores may need adjusting. And with this announcement, we expect the
spammers will begin
Hello Steven,
Wednesday, November 16, 2005, 1:47:24 PM, you wrote:
SL I guess if this is the case I need to lower
SL the score for that rule as my kill value is a 3.5, ...
SpamAssassin scores are optimized for a this is spam threshold of 5.
Anyone who changes their threshold significantly away
Hello mouss,
Saturday, November 5, 2005, 1:04:34 AM, mouss wrote:
m Steve Heggood a écrit :
Has anyone developed a rule for the current onslaught of wristwatch spam?
Thanks in advance,
-steve-
m 70_sare_specific.cf contains many ones.
And if you get wristwatch spam not caught by
Hello Martin,
Wednesday, November 2, 2005, 12:57:22 AM, you wrote:
MH Anyone any idea what rule has the following in it that would cause the RDJ
MH lint to fail..
MH Lint output: [90183] warn: config: invalid regexp for rule KEZAAM:
MH /SecuryTeam Order: missing or invalid delimiters [90183]
Hello The,
Sunday, October 23, 2005, 5:54:05 AM, you wrote:
TD I am using rules du Jour and now I am getting
TD ...
The basic local.cf errors have already been answered.
TD [2136] warn: config: warning: score set for non-existent rule
FUZZY_GUARANTEE
TD ...
The FUZZY_xxx rules are new with SA
Hello Ryan,
Friday, October 21, 2005, 1:22:38 PM, you wrote:
RM This thread is ancient I know, but I am still using the rule posted below
but
RM had to make an update to it (in case anyone else also uses this rule).
RM I changed __X_AUTH_WARN_3 to read:
RM header__X_AUTH_WARN_3
Hello Thomas,
Thursday, October 20, 2005, 11:01:13 AM, you wrote:
TD At one point I had a specific user in our white list, but
TD I've since taken them out, but messages are still coming in with
TD the header info, not spam... white listed.
TD I have auto white list and auto learn turned off.
TD
Hello M.Lewis,
Saturday, October 15, 2005, 10:40:29 PM, you wrote:
ML Is there a best practices recommendation for how often to run sa-learn ?
IMO, best (least system impact, least problematic) is to run sa-learn
for each individual message as it's identified.
However, that's probably not
Hello M.Lewis,
Sunday, October 16, 2005, 4:13:24 PM, you wrote:
ML Thanks Bob. Very interesting.
ML After you do the sa-learn for both the spam and ham, do you then delete
ML those files in order to keep them small ?
We concatenate those files to comprehensive user flagged as spam and
user
Thursday, October 13, 2005, 4:28:07 PM, jdow wrote:
j I'd also suggest being proactive with Robert and feeding him precanned
j and carefully configured white list entries. If you develop a relatively
j secure handshake with Robert it should work out nicely for those setups
j that use the SARE
Hello Brian,
Thursday, October 13, 2005, 1:30:21 PM, you wrote:
BE I am looking into some options for a friend who wants
BE to reduce the amount of spam they receive. ...
Check into email hosting at http://www.ctyme.com/hosting/index.htm
Might require changing her email addresses, but once
Hello ADMIN_miki,
Wednesday, October 12, 2005, 5:20:48 AM, you wrote:
A rewrite_header Subject #_SPAM_#
have you tried --lint on this? I'm thinking that the first # in
that header might be seen as beginning a comment, giving you an empty
spam prefix.
Bob Menschel
Hello Bjorn, others
Monday, October 10, 2005, 2:24:11 AM, you wrote:
BJ Loren Wilton wrote:
There is a recent bug report that one of the SARE rules will cause extreme
processor use on a particular spam that has the entire message on a single
line. This looks like it may be another example of
Hello John,
Friday, October 7, 2005, 5:26:58 PM, you wrote:
JA 2 Was it a simple enough rule to be hand written as a
JAuser rule, and if so, does any one know that it was?
From SA 3.0.4:
body STOCK_PICK/STOCK PICK/i
describe STOCK_PICK Offers a picked
Hello jdow,
Thursday, October 6, 2005, 12:35:15 AM, you wrote:
j From: Robert Menschel [EMAIL PROTECTED]
SARE's URI rules files and HTML rules files have been updated. ...
Both sets include the migration of rules incorporated into 3.1.0 into
new 70_sare_*_x31.cf files. If you are still
SARE's URI rules files and HTML rules files have been updated.
URI rules files were updated early this morning. They had a --lint
error in them at first, but that has been corrected. The HTML files
have been updated this evening (and may not be available for download
for another 40-60 minutes).
Hello John,
Monday, October 3, 2005, 1:11:23 PM, you wrote:
JH Only clue I have is that if I run sa-learn, it takes minutes to respond at
JH all, and in the output appears Parsing of undecoded UTF-8 will give
JH garbage when decoding entities at
JH [...]/Mail/SpamAssassin/HTML.pm line
JH 182 -
Hello Ralph,
Sunday, October 2, 2005, 5:37:59 AM, you wrote:
RS first I want to thank you for keeping up all the good work and
RS updating the rule files. Unfortunately, some of the PGP signatures
RS don't seem to match their rule files (i.e. 70_sare_genlsubj.cf.sig,
RS 70_sare_header.cf.sig),
Just quick notice that the SARE OBFU rules (70_sare_obfu*.cf) have
been updated.
Of note: One rule which has been incorporated into SpamAssassin 3.1.0
has been moved to the new 70_sare_obfu_x31.cf file. Systems that are
remaining on 3.0.x or earlier should obtain this file. No need for
RDJ on
SARE's General Subject rules files and the Whitelist rules files have
been updated.
Included in the General Subject rules files are rules which will help
detect the recent flood of pharmaceutical spam.
Thanks to Daryl C. W. O'Shea, we've also enhanced the whitelist rules
files to include SPF
Hello Thijs,
Saturday, September 24, 2005, 12:00:14 AM, you wrote:
TKE To lint spamassassin from the command line has no other effect than through
TKE RulesDuJour. The same list of errors/warnings shows up as mentioned below.
TKE Since I use a standard (clean) installation with only Tripwire in
Hello Steve,
Saturday, September 24, 2005, 4:35:41 PM, you wrote:
S I've recently had my domain targeted by a variety of offensive spammers
S pushing legally dubious stuff who have chosen my domain as the sent-from
S and/or reply to address in forged email.
S My simple question (which I admit
Just a quick note that SARE's specific rules file has been updated.
This will begin to help catch the recent wave of obfuscating drug
spam.
More rules file updates to follow.
Documentation concerning specific.cf at
http://www.rulesemporium.com/rules.htm#specific
Bob Menschel
Hello robert,
Tuesday, September 20, 2005, 12:08:57 PM, you wrote:
rdc Using Spamassassin 3.1 on Fedora Core 2 running qmail. Spamassassin rules
rdc are running through a MySQL database.
rdc The problem is Im seeing an increase of spam getting through, mainly
rdc pharmecutical. I am using rules
Hello Nick,
Monday, September 19, 2005, 8:52:05 AM, you wrote:
NG Hi,
NG Recently a lot of messages have started getting past spamassassin as
NG ham. They are all the same format and disguise the words by using
NG floating divs:
Final scoring mass-check is running. SARE Rule set should be
Hello James,
Saturday, September 17, 2005, 6:33:43 PM, you wrote:
JL Re[any single digit or number ie a-z or 0-9] email is discarded
JL Re[more then one digit or letter] email is allowed through
JL As I see it, this rule matches perfectly. The chance that someone will
JL send or receive a
Hello Burton,
Friday, September 16, 2005, 6:22:54 PM, you wrote:
BW I'm a fairly new user of SpamAssassin, running Debian's 3.0.4-2.
BW If I get a piece of spam that, for some reason or another, gets a BAYES_00
BW score and nothing else, it will score negative points and is auto-learned
BW as
Hello Ronald,
Friday, September 16, 2005, 4:46:38 AM, you wrote:
RIN Using the following as a rule set, spam with the above subject line
RIN is still getting through -
RIN # Check for bad RE[ tag
RIN header BAD_RE_TAG Subject =~ /\bRe\[\b/i
RIN score BAD_RE_TAG 6.0
RIN What am I doing wrong ?
Hello Brian,
Wednesday, September 14, 2005, 5:31:34 AM, you wrote:
BI Hi,
BI The number of messages like below has increased. Unfortunately, they are
BI not reported to SpamCop fast enough for SURBL to handle them Has anyone
BI created some sort of filter to identify this type of messages
Hello Ilan,
Tuesday, September 6, 2005, 12:07:24 AM, you wrote:
IA I keep getting these kind of pharm. spam where a list of
IA drugs and their prices is arranged in an html table. ...
IA Obviously, the OBFU rule set is not that sophisticated.
Could have fooled me, since none of that spam
Hello Rob,
Wednesday, August 31, 2005, 12:04:03 PM, you wrote:
RMPS SEE:
RMPS http://pvsys.com/busted01.txt
RMPS This was sent to an e-mail address for a client of mine's
RMPS former employee. ...
RMPS A few days ago, this box recieved what appears to be an
RMPS option confirmation. This
Hello Adrian,
Wednesday, August 31, 2005, 4:10:29 PM, you wrote:
AM debug: PATH included '/root/bin', which doesn't exist, dropping.
Were you running as user = root? $HOME/bin is normally included in
the SA $PATH, if it exists. If it doesn't exist, no harm done.
AM debug: diag: module not
Hello John,
Friday, August 26, 2005, 6:25:14 AM, you wrote:
JH Hello,
JH We have had a complaint from a user that some of his Japanese mail
JH (being received by us) is always marked by SA as spam. As a University
JH it is natural for us to receive foreign mail messages.
Understood.
JH
Hello wolfgang,
Saturday, August 27, 2005, 3:50:20 AM, you wrote:
w we received a Duden newsletter (duden is *the* spelling
w rules/grammar/dictionary publisher in germany) with the header:
Wolfgang,
If you can send me the full email, with headers, so I can compose a
whitelist_from_rcvd rule
Hello Burton,
Monday, August 22, 2005, 1:29:48 PM, you wrote:
BW Once a piece of spam has been shown to sa-learn as spam, is there any real
BW use in the user keeping it around? I know that sa-learn will skip over it
BW if shown it again, so I'm thinking no (unless you lose your bayes db and
BW
Hello Paul,
Monday, August 15, 2005, 1:45:53 AM, you wrote:
PJS DNS is working fine. We've been running SA for 6 months no problem,
PJS it's only when we added the extra 10 rule sets it got bogged down. I've
PJS just been removing them one by one at the moment and have got the timing
PJS back
Hello Brian,
Monday, August 15, 2005, 1:46:09 AM, you wrote:
BM As subject, I use a fair number of Rules Emporium rules, is there any
BM information about on which of those rules have made it into the 3.1.0 rule
set?
As Loren suggested, my mass-check to identify any overlaps between
current
Hello Jack,
Tuesday, August 9, 2005, 6:15:22 AM, you wrote:
JG I am trying to pass CNN breaking news alerts through the filters. My
JG user_prefs contains:
JG whitelist_from [EMAIL PROTECTED]
JG and even
JG whitelist_from [EMAIL PROTECTED]
JG The problem is that they are sending mail
Hello Greg,
Tuesday, August 9, 2005, 9:38:03 PM, you wrote:
GA But if you do manage multiple users accounts, you have to provide industry
GA standard anti-spam protection without blocking on your own definition of
GA spam. Now if you are only talking your own email box, you can define every
GA
Just a quick note that the SARE header and whitelist rules files have
been updated.
Documentation at http://www.rulesemporium.com/rules.htm
Bob Menschel
Hello Muhammad,
Saturday, August 6, 2005, 4:45:14 AM, you wrote:
MFB I am newbie in spamassassin. I want to block the email
MFB basedon custom rules like for matching Viagra, Penis Enlarment
MFB etc.Can any body help me in its deployment? As I tried with the
MFB following settingbut it did not
Hello Dhanny,
Sunday, July 31, 2005, 12:08:51 AM, you wrote:
DK Hi,
DKI installed qmail (only for smtp proxy) + spamassassin (userpref,
DK bayes, awl store in mySQL). I use spamd and spamc to scan every email,
DK but how can spamc scan email with personal configuration after scan
DK with
Hello hamann,
Sunday, July 31, 2005, 1:01:45 AM, you wrote:
H for some reason the spam sample at
H http://wolfgang.remsnet.de/medspam.txt is only classified by html
H rules, and by various dns tests, but the common drugs and human
H body part rules missed it. Anyone would have an idea why this
Hello Herb,
Sunday, July 31, 2005, 4:00:58 PM, you wrote:
HM 60_whitelist.cf
HM 70_sare_adult.cf
HM 70_sare_bayes_poison_nxm.cf
HM 70_sare_evilnum0.cf
HM 70_sare_evilnum1.cf
HM 70_sare_genlsubj.cf
HM 70_sare_genlsubj0.cf
HM 70_sare_genlsubj1.cf
HM 70_sare_genlsubj2.cf
HM 70_sare_genlsubj3.cf
Hello Frank,
Thursday, July 28, 2005, 2:09:52 PM, you wrote:
FMC it's getting more complicated. we didn't find any bayes
FMC files at all. now I'm seeing some entries in the log saying
FMC autolearn=no and others saying =unavailable. they almost
FMC alternate although perhaps the difference is
Hello Magnus,
Thursday, July 28, 2005, 12:06:20 AM, you wrote:
MH Is there a way to say to SA that if this custom rule of mine triggers,
MH then the mail *is* spam and you have to autolearn it as such., except
MH looking for MY_CUSTOM_RULE in X-Spam-Status afterwards and feeding the
MH mail to
Hello jdow,
Tuesday, July 26, 2005, 3:03:23 PM, you wrote:
j whitelist_from_rcvd [EMAIL PROTECTED] fidelity2.m0.net
j Fidelity Investment's Newsletters
Got it. Thanks. Will validate, and then publish shortly.
Bob Menschel
Hello Frank,
Wednesday, July 27, 2005, 3:02:23 PM, you wrote:
FMC I posted a message the other day asking why my spamd might
FMC backlog periodically and someone asked me if I could see from the
FMC log what was happening. It started again today and I see
FMC something. the last entry in the
Hello Andy,
Wednesday, July 27, 2005, 7:13:01 AM, you wrote:
AJ Didn't know there was a SARE whitelist.
Discussed on this list a few months back, while experimenting with it
on my own system. Then announced it here when published, but otherwise
it's been quiet. Worth mentioning from time to
Hello Frank,
Wednesday, July 27, 2005, 8:34:02 PM, you wrote:
The Bayes system will occasionally determine that it needs to expire
old entries, to keep the database files within reasonable size, and
that expiration can take a long while.
FMC is there a file I can check to see if it has
Hello Mark,
Thursday, July 21, 2005, 9:49:04 AM, you wrote:
MW ... The issue is how I get procmail to put SPAM mail in
MW $HOME/mail/spam for each of the users.
Can't help with that question, since I know nothing about procmail,
but...
Why not use POP? I see two options:
1) Don't reroute the
Hello Eddy,
Wednesday, July 20, 2005, 5:30:19 AM, you wrote:
EB Hi!
EB I'm receiving spams with the following subject line
EB Subject: TRAMAD0OL, MER1DllA, \/ALUUM, XANA, L0RAAZEPAM,
EB AMBllEN, ALPRAZZ0LAM, \/llGRA, CAALlS,
EB LEVlTRRA
EB Spamassassin does not give points to this spam.
EB
Hello dennis,
Friday, July 15, 2005, 10:08:56 PM, you wrote:
dsc Ah, here is the From header:
dsc From: 360° Skin Care [EMAIL PROTECTED]
dsc Not 6 digits, but maybe the degree symbol is contributing. I'll advise not
dsc to start the username with 360°.
Actually, that header is
From:
Just a quick note that
http://www.rulesemporium.com/rules/70_sare_obfu1.cf has been updated
to avoid a performance problem reported this week.
Bob Menschel
Hello dennis,
Friday, July 15, 2005, 10:08:56 PM, you wrote:
dsc On Jul 15, 2005, at 3:19 PM, Loren Wilton wrote:
dsc If that username starts with six digits, it hits that rule, as shown
dsc in Loren's example.
dsc Ah, here is the From header:
dsc From: 360° Skin Care [EMAIL PROTECTED]
dsc Not
Hello Matt, Dr. Young,
Friday, July 15, 2005, 10:40:03 AM, you wrote:
MK Dr Robert Young wrote:
font size=0./font
font size=1{whatever}/font
MK Those should both trip HTML_FONT_SIZE_TINY.
MK Unfortunately, that's a low scoring rule due to some FPs and limited number
of
MK spam hits in
Hello Dr. Young,
Wednesday, July 13, 2005, 3:37:18 PM, you wrote:
DRY If this is set in local.cf
DRY whitelist_from_rcvd@gold.com gold.com
DRY trusted_networks gold.com ( via the IP address }
DRY and the incoming email header looks like (xxx added by me)
DRY Received: ...
DRY From:
Hello dennis,
Thursday, July 14, 2005, 2:34:42 AM, you wrote:
dsc Been using SA for quite a while and agree it's working great.
dsc Is FROM_STARTS_WITH_NUMS appropriately spammy if it's a legal way to
dsc name a domain?
Yes.
header FROM_STARTS_WITH_NUMS From:addr =~ /^\d{6,}\S+\@/i
The
Hello Dr,
Wednesday, July 13, 2005, 7:00:04 PM, you wrote:
DRY How often should one clean the whitelist ?
IMO: When the AWL rule misbehaves repeatedly and significantly (I
assume you're talking about the AWL database/rule).
And it's probably best, if AWL is working in general, but there's a
Hello Technical,
Thursday, July 14, 2005, 3:15:19 AM, you wrote:
TD Hi
TD We are running Qmail Scanner 1.25 + Spamassassin 3.04 + Clamd 1.86.1 on
TD our dual 1.4Ghz P3 Linux mail server. We've been experiencing some
TD problems with the server taking a long time to scan messages (In most
TD
Hello dennis,
Thursday, July 14, 2005, 9:03:46 AM, you wrote:
dsc On Jul 14, 2005, at 5:52 AM, Robert Menschel wrote:
header FROM_STARTS_WITH_NUMS From:addr =~ /^\d{6,}\S+\@/i
The email address used in the From header begins with 6 (or more)
digits. it's not hitting on 360SkinCare.com
Hello Herb,
Thursday, July 14, 2005, 12:12:26 AM, you wrote:
Never place new scores or rules into the
/usr/share/spamassassin directory. They WILL get deleted or
replaced when you update.
HM Really? I didn't know that (obviously) although I have updated
HM several (minor) versions of
Hello Martin,
Tuesday, July 12, 2005, 1:50:18 PM, you wrote:
MCac I have a FP that hit on SARE_SPEC_FROM_WOMR and the
MCac description is Email from address points to WOMR. I tried to
MCac find more information but the only thing I can find is a radio
MCac station in Cape Cod. With a score of
Hello Mun,
Tuesday, July 12, 2005, 3:36:10 AM, you wrote:
One possibility: If you're doing sa-learn as one user, and qmail is
invoking spamd to run as a different user, you may be training one
Bayes database and spamd may be using a different database that isn't
trained.
MF I'm having some
Hello Chavdar,
Monday, July 11, 2005, 3:40:14 AM, you wrote:
CV Hi List,
CV Our mailserver server serves about 100 users. Our config:
CV Sendmail+Procmail+SpamAssassin.
CV The question is:
CV If I got it right, we should run sa-learn for each user in order to benefit
CV from bayes. We intend
Hello Bart,
Tuesday, July 5, 2005, 2:24:39 AM, you wrote:
BV Hellow!
BV I'm receiving mail with XANA, L0RAAZEPAM, \/ALUUM, \/llGRA, CAALlS,
BV LEVlTRRA, MER1DllA, ALPRAZZ0LAM, TRAMAD0OL, AMBllEN repeated wife as
BV subject, and while it gives several scores, none of them has anything to
BV do
Hello Lorenzo,
Tuesday, July 5, 2005, 5:22:04 AM, you wrote:
LL Hello,
LL I receive some emails form a newsletter that is not spam.
LL These emails go through SpamAssasin and they get this score:
LL Content analysis details: (2.0 points, 2.0 required)
LL I configured SpamAssasin with a 2.0
Hello Mun,
Saturday, July 2, 2005, 2:59:44 PM, you wrote:
MF I'm using SpamAssassin 3.0.1 on a qmail system, and invoking it
MF using qmail-scanner.
MF 1. Send a test mail to my account, and explicitly run
MF sa-learn on the mail to identify it as spam. This is repeated for
MF abt 15 times.
1 - 100 of 291 matches
Mail list logo
