Re: Stock/image-only spam still getting through

2006-07-18 Thread Loren Wilton
I've attached the one that just got through. spamassassin -t reports the following for it: 0.8 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= entry 2.9 HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP) 1.3 RCVD_NUMERIC_HELO

RE: Stock/image-only spam still getting through

2006-07-18 Thread Bowie Bailey
Loren Wilton wrote: I've attached the one that just got through. spamassassin -t reports the following for it: 0.8 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= entry 2.9 HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname

Re: Stock/image-only spam still getting through

2006-07-18 Thread Andy Jezierski
Owen Mehegan [EMAIL PROTECTED] wrote on 07/17/2006 05:20:44 PM: I've been inundated with maddening image-only stock spam lately. I've just today sat down to try and tweak my rules up to weed this out. I added sare_stocks and sare_obfu, updated my version of rules du jour for good measure,

Stock/image-only spam still getting through

2006-07-17 Thread Owen Mehegan
First, the prerequisites: SpamAssassin version 3.1.1, running on Perl version 5.8.4 Debian Linux, 2.6.10 kernel Using spamd I've been inundated with maddening image-only stock spam lately. I've just today sat down to try and tweak my rules up to weed this out. I added sare_stocks and

Re: Stock/image-only spam still getting through

2006-07-17 Thread Theo Van Dinter
On Mon, Jul 17, 2006 at 06:20:44PM -0400, Owen Mehegan wrote: The highest scores are for the HELO? We've got to be able to do better than that... what am I missing? sa-update? with just local rules: [19640] dbg: check: is spam? score=16.082 required=5 [19640] dbg: check:

Re: Image only spam

2006-07-14 Thread Steven Stern
Jack Gostl wrote: - Original Message - *From:* Steven Stern mailto:[EMAIL PROTECTED] *Cc:* Spamass mailto:users@spamassassin.apache.org *Sent:* Thursday, July 13, 2006 6:52 PM *Subject:* Re: Image only spam Jack Gostl wrote: - Original Message - From: Steven Stern

Re: Image only spam

2006-07-14 Thread Jack Gostl
Converting to 3.1 is beginning to look better and better. Thanks - Original Message - From: Steven Stern [EMAIL PROTECTED] To: Spamass users@spamassassin.apache.org Sent: Friday, July 14, 2006 8:11 AM Subject: Re: Image only spam Jack Gostl wrote: - Original Message

Re: Image only spam

2006-07-13 Thread Jack Gostl
- Original Message - From: Steven Stern [EMAIL PROTECTED] To: Spamass users@spamassassin.apache.org Sent: Wednesday, July 12, 2006 4:31 PM Subject: Re: Image only spam Jack Gostl wrote: Thanks for the response. Take it slow with me, spamassassin has been running so well for so

Re: Image only spam

2006-07-13 Thread Dimitri Yioulos
On Thursday July 13 2006 9:28 am, Jack Gostl wrote: - Original Message - From: Steven Stern [EMAIL PROTECTED] To: Spamass users@spamassassin.apache.org Sent: Wednesday, July 12, 2006 4:31 PM Subject: Re: Image only spam Jack Gostl wrote: Thanks for the response. Take it slow

Re: Image only spam

2006-07-13 Thread Steven Stern
Jack Gostl wrote: - Original Message - From: Steven Stern [EMAIL PROTECTED] To: Spamass users@spamassassin.apache.org Sent: Wednesday, July 12, 2006 4:31 PM Subject: Re: Image only spam Jack Gostl wrote: Thanks for the response. Take it slow with me, spamassassin has been

Image only spam

2006-07-12 Thread Jack Gostl
I'm running SpamAssassin version 3.0.3 running on Perl version 5.8.2 under AIX 5.3. Starting a few months ago, I have been absolutely inundated with image only spam. I've gone from catching 99% of the spam with almost no false positives to less than 85%. I asked about this awhile ago

Re: Image only spam

2006-07-12 Thread JamesDR
Jack Gostl wrote: I'm running SpamAssassin version 3.0.3 running on Perl version 5.8.2 under AIX 5.3. Starting a few months ago, I have been absolutely inundated with image only spam. I've gone from catching 99% of the spam with almost no false positives to less than 85%. I asked about

Re: Image only spam

2006-07-12 Thread Steven Stern
Jack Gostl wrote: I'm running SpamAssassin version 3.0.3 running on Perl version 5.8.2 under AIX 5.3. Starting a few months ago, I have been absolutely inundated with image only spam. I've gone from catching 99% of the spam with almost no false positives to less than 85%. I asked about

Re: Image only spam

2006-07-12 Thread Jack Gostl
Stern [EMAIL PROTECTED] To: Spamass users@spamassassin.apache.org Sent: Wednesday, July 12, 2006 9:13 AM Subject: Re: Image only spam Jack Gostl wrote: I'm running SpamAssassin version 3.0.3 running on Perl version 5.8.2 under AIX 5.3. Starting a few months ago, I have been absolutely

Re: Image only spam

2006-07-12 Thread Loren Wilton
I'm running SpamAssassin version 3.0.3 running on Perl version 5.8.2 under AIX 5.3. Starting a few months ago, I have been absolutely inundated with image only spam. I've gone from catching 99% of the spam with almost no Have you tried any of the SARE rules? A number of them will help

RE: Image only spam

2006-07-12 Thread Joe Zitnik
After you stop and restart SA, correct? On 7/12/2006 at 10:48 AM, Bowie Bailey [EMAIL PROTECTED] wrote: Jack Gostl wrote: Thanks for the response. Take it slow with me, spamassassin has been running so well for so long that I haven't had to fiddle with it in ages and I don't remember the

Re: Image only spam

2006-07-12 Thread Markus Edholm
I'm going to take this slow if I screw it up and a full load of spam hits this place I'll have to leave town. (1) I currently have no local.cf. I assume the default location is /etc/mail/spamassassin. (2) I assume that I just add the string: TRUSTED_RULESETS=SARE_GENLSUBJ0 SARE_OBFU

Re: Image only spam

2006-07-12 Thread Dimitri Yioulos
On Wednesday July 12 2006 1:48 pm, Loren Wilton wrote: (1) I currently have no local.cf. I assume the default location is /etc/mail/spamassassin. This seems rather amazing. This is the normal place that the standard SA options live. Grep around for *.cf files and see where they live. You

Re: Image only spam

2006-07-12 Thread Jack Gostl
- Original Message - From: Loren Wilton [EMAIL PROTECTED] To: users@spamassassin.apache.org Sent: Wednesday, July 12, 2006 1:48 PM Subject: Re: Image only spam (1) I currently have no local.cf. I assume the default location is /etc/mail/spamassassin. This seems rather amazing

Re: Image only spam

2006-07-12 Thread Logan Shaw
On Wed, 12 Jul 2006, Loren Wilton wrote: NO! That string is part of the configuration file for RulesDuJour, ir RDJ is it is commonly referenced. I'm not sure you need the RulesDuJour to catch this image-only spam. I'm regularly getting such messages (composed of just a big block of GIFs

Re: Image only spam

2006-07-12 Thread Dimitri Yioulos
On Wednesday July 12 2006 2:36 pm, Jack Gostl wrote: - Original Message - From: Loren Wilton [EMAIL PROTECTED] To: users@spamassassin.apache.org Sent: Wednesday, July 12, 2006 1:48 PM Subject: Re: Image only spam (1) I currently have no local.cf. I assume the default location

Re: Image only spam

2006-07-12 Thread Steven Stern
- From: Steven Stern [EMAIL PROTECTED] To: Spamass users@spamassassin.apache.org Sent: Wednesday, July 12, 2006 9:13 AM Subject: Re: Image only spam Jack Gostl wrote: I'm running SpamAssassin version 3.0.3 running on Perl version 5.8.2 under AIX 5.3. Starting a few months ago, I have

Re: Image only spam

2006-07-12 Thread Jack Gostl
- Original Message - From: Steven Stern To: Spamass Sent: Wednesday, July 12, 2006 4:31 PM Subject: Re: Image only spam Jack Gostl wrote: Thanks for the response. Take it slow with me, spamassassin has been running so well for so long that I haven't had to fiddle with it in ages