Re: low scoring spam

On Friday 14 July 2017 at 15:29:38, Charles Amstutz wrote: > Hello, > > I keep having spam come through that hits on almost zero rules, (or very > few) . I get this is definitely possibly, but it's annoying as its > obviously spam. I guess my question is, if what we have in place isn't > hitting

low scoring spam

Hello, I keep having spam come through that hits on almost zero rules, (or very few) . I get this is definitely possibly, but it's annoying as its obviously spam. I guess my question is, if what we have in place isn't hitting on much, then aside from learning it to Bayes, what do we do? Even t

Re: Interesting Low Scoring SPAM with odd script

On Wed, 13 Jan 2010 00:41:00 +0100 Benny Pedersen wrote: > On Tue 12 Jan 2010 07:48:23 AM CET, Christian Brel wrote > > > http://pastebin.com/m66a5a2ae > > X-Virus-Status: Infected (Sanesecurity.Junk.25057.UNOFFICIAL) > Err, yes - I had already *highlighted* that, it was posted because the co

Re: Interesting Low Scoring SPAM with odd script

On Tue, 12 Jan 2010, Jason Bertoch wrote: > > > I'm just interested in the kind of java-script(?) munging that has > > > gone on there and what it is in 'English' for want of a better > > > phrase. > > Nothing was munged, it's just random text. > If so, what's the point to it? By no means

Re: Interesting Low Scoring SPAM with odd script

Jason Bertoch wrote: > By no means a JS coder, and haven't dug deeper to find out, but couldn't > it be pre-compiled JS and not just random text? > Doubtful. I don't believe JavaScript has a bytecode or any other (except in some JavaScript engines internal representation) compiled format. Franc

Re: Interesting Low Scoring SPAM with odd script

On Tue 12 Jan 2010 07:48:23 AM CET, Christian Brel wrote http://pastebin.com/m66a5a2ae X-Virus-Status: Infected (Sanesecurity.Junk.25057.UNOFFICIAL) -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: Interesting Low Scoring SPAM with odd script

I'm just interested in the kind of java-script(?) munging that has gone on there and what it is in 'English' for want of a better phrase. Nothing was munged, it's just random text. If so, what's the point to it? By no means a JS coder, and haven't dug deeper to find out, but couldn't it be p

Re: Interesting Low Scoring SPAM with odd script

John Hardin wrote: > On Tue, 12 Jan 2010, Per Jessen wrote: > >> Christian Brel wrote: >> >>> On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: >>> On 12.01.10 06:48, Christian Brel wrote: > http://pastebin.com/m66a5a2ae > > Anyone seen script like that? >>> >>> I'm jus

Re: Interesting Low Scoring SPAM with odd script

On Tue, 12 Jan 2010 10:56:09 -0800 (PST) John Hardin wrote: > On Tue, 12 Jan 2010, Per Jessen wrote: > > > Christian Brel wrote: > > > >> On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: > >> On 12.01.10 06:48, Christian Brel wrote: > http://pastebin.com/m66a5a2ae > > >

Re: Interesting Low Scoring SPAM with odd script

On Tue, 12 Jan 2010, Per Jessen wrote: Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? I'm just interested in the kind of java-script(?) munging that

Re: [SPAM:9.6] Re: Interesting Low Scoring SPAM with odd script

On Tue, 12 Jan 2010 12:15:41 +0100 Per Jessen wrote: > Christian Brel wrote: > > > On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: > > On 12.01.10 06:48, Christian Brel wrote: > >> > http://pastebin.com/m66a5a2ae > >> > > >> > Anyone seen script like that? > >> > >> IT's the k

Re: Interesting Low Scoring SPAM with odd script

Christian Brel wrote: > On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: > On 12.01.10 06:48, Christian Brel wrote: >> > http://pastebin.com/m66a5a2ae >> > >> > Anyone seen script like that? >> >> IT's the kind of content that should be captured by clamav imho. >> clamav does hav

Re: Interesting Low Scoring SPAM with odd script

On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: > > http://pastebin.com/m66a5a2ae > > > > Anyone seen script like that? > > IT's the kind of content that should be captured by clamav imho. > clamav does have some kind og javascript decopdi

Re: Interesting Low Scoring SPAM with odd script

Matus UHLAR - fantomas wrote: > On 12.01.10 06:48, Christian Brel wrote: >> http://pastebin.com/m66a5a2ae >> >> Anyone seen script like that? > > IT's the kind of content that should be captured by clamav imho. It's plain spam - personally I don't want clamav to deal with spam. > clamav does h

Re: Interesting Low Scoring SPAM with odd script

On 12.01.10 06:48, Christian Brel wrote: > http://pastebin.com/m66a5a2ae > > Anyone seen script like that? IT's the kind of content that should be captured by clamav imho. clamav does have some kind og javascript decopding engine. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantoma

Re: Interesting Low Scoring SPAM with odd script

Christian Brel wrote: > http://pastebin.com/m66a5a2ae > > Anyone seen script like that? Yeah, I saw a couple of those last week. /Per Jessen, Zürich

Re: Dealing with low scoring spam - tighter MTA integration

--On Thursday, March 05, 2009 10:31 PM +0100 Andrzej Adam Filip wrote: I try hard to preach that SA methodology of creating "spam score" based on weighted tests *CAN* be applied at this point too. I would like too apply such test in milter (MIMEDefang) that uses SA anyway in my installation.

Re: Dealing with low scoring spam - tighter MTA integration

James Wilkinson wrote: > Andrzej Adam Filip wrote: >> At "RCPT TO:" stage there are available: >> * connecting client IP address (last mail hop) >> so big part of DNSBL and DNSWL tests *CAN* be used >> * envelope sender for SPF based tests >> * envelope sender and envelope recipient for auto wh

Re: Dealing with low scoring spam - tighter MTA integration

Andrzej Adam Filip wrote: > At "RCPT TO:" stage there are available: > * connecting client IP address (last mail hop) > so big part of DNSBL and DNSWL tests *CAN* be used > * envelope sender for SPF based tests > * envelope sender and envelope recipient for auto white/black listing > (producing

Re: Dealing with low scoring spam - tighter MTA integration

Kenneth Porter wrote: > --On Thursday, March 05, 2009 7:43 AM +0100 Andrzej Adam Filip > wrote: > >> What I would like to see is a option to make spam assassin to produce >> "weighted scores" based on subset of all tests capable to work on subset >> of the "final data" available *before* message

Re: Dealing with low scoring spam - tighter MTA integration

--On Thursday, March 05, 2009 7:43 AM +0100 Andrzej Adam Filip wrote: What I would like to see is a option to make spam assassin to produce "weighted scores" based on subset of all tests capable to work on subset of the "final data" available *before* message headers&body are transfered in SMT

Re: Dealing with low scoring spam - tighter MTA integration

Kenneth Porter wrote: > --On Wednesday, March 04, 2009 4:02 PM +0100 Andrzej Adam Filip > wrote: > >> May be spamassassin should create set of tests intended for use before >> replying "RCPT TO:" in SMTP session? > > Check out > > MIMEDefang includes SA integration. I k

Re: Dealing with low scoring spam - tighter MTA integration [was: 2 + 2 != 4 - Spamassassin needs a new paradigm]

--On Wednesday, March 04, 2009 4:02 PM +0100 Andrzej Adam Filip wrote: May be spamassassin should create set of tests intended for use before replying "RCPT TO:" in SMTP session? Check out MIMEDefang includes SA integration.

Re: Dealing with low scoring spam - tighter MTA integration [was: 2 + 2 != 4 - Spamassassin needs a new paradigm]

At 07:02 04-03-2009, Andrzej Adam Filip wrote: May be spamassassin should create set of tests intended for use before replying "RCPT TO:" in SMTP session? [ test based on: sending IP address, envelope sender, envelope recipient, and name in helo/ehlo ] SpamAssassin processes the message and ret

Re: Dealing with low scoring spam - tighter MTA integration

John Hardin wrote: > On Wed, 4 Mar 2009, Andrzej Adam Filip wrote: > >>> This would be an entirely different application, not SA, wouldn't it? >> >> It can be developed using the same "spam score" logic, based subset of >> all tests requiring only the subset of "final data" available during >> "c

Re: Dealing with low scoring spam - tighter MTA integration

On Wed, 4 Mar 2009, Andrzej Adam Filip wrote: This would be an entirely different application, not SA, wouldn't it? It can be developed using the same "spam score" logic, based subset of all tests requiring only the subset of "final data" available during "classic run". So in other words som

Re: Dealing with low scoring spam - tighter MTA integration

> >> > The problem lies with the LOW scoring spam. Alas, these do not tend to >> > trigger on a solid subset or meta as you proposed. In particular, RBL >> > hits are quite rare, even more so for multiple hits. The few rules hit >> > by low scorers are quite diver

Re: Dealing with low scoring spam - tighter MTA integration [was: 2 + 2 != 4 - Spamassassin needs a new paradigm]

On Wed, 2009-03-04 at 16:02 +0100, Andrzej Adam Filip wrote: > Karsten Bräckelmann wrote: > > About 98-99% of my spam in-stream scores as high, that any such proposal > > results in a useless increase of the score. > > > > The problem lies with the LOW scoring spam.

Dealing with low scoring spam - tighter MTA integration [was: 2 + 2 != 4 - Spamassassin needs a new paradigm]

..] >> Anyhow - just throwing this out there for people to chew on and think about. > > Oh, and another problem with this: > > About 98-99% of my spam in-stream scores as high, that any such proposal > results in a useless increase of the score. > > The problem lies with the L

Re: OT Alert: Forward low scoring SPAM to sa-learn.

On 17.07.07 10:40, Anthony Kamau wrote: > I'm faced with a dilemma on how to use sa-learn with mail forwarded from > a user's inbox on Exchange to the sendmail server. Since we just > recently started using sendmail as a front end server, our bayes system > is still in its infancy and spam is gett

RE: OT Alert: Forward low scoring SPAM to sa-learn.

> -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: Tuesday, 17 July 2007 11:35 AM > To: Anthony Kamau > Cc: users@spamassassin.apache.org > Subject: Re: OT Alert: Forward low scoring SPAM to sa-learn. > > That said, if you're just d

RE: OT Alert: Forward low scoring SPAM to sa-learn.

> -Original Message- > From: Michael Scheidell [mailto:[EMAIL PROTECTED] > Sent: Tuesday, 17 July 2007 2:51 PM > To: Anthony Kamau; users@spamassassin.apache.org > Subject: RE: OT Alert: Forward low scoring SPAM to sa-learn. > > Only hope it to create shared, publi

RE: OT Alert: Forward low scoring SPAM to sa-learn.

> -Original Message- > From: Anthony Kamau [mailto:[EMAIL PROTECTED] > Sent: Monday, July 16, 2007 8:40 PM > To: users@spamassassin.apache.org > Subject: OT Alert: Forward low scoring SPAM to sa-learn. > > > Hello all. > > > The next step is what has

Re: OT Alert: Forward low scoring SPAM to sa-learn.

Anthony Kamau wrote: > Hello all. > > I'm faced with a dilemma on how to use sa-learn with mail forwarded from > a user's inbox on Exchange to the sendmail server. Since we just > recently started using sendmail as a front end server, our bayes system > is still in its infancy and spam is getting

OT Alert: Forward low scoring SPAM to sa-learn.

Hello all. I'm faced with a dilemma on how to use sa-learn with mail forwarded from a user's inbox on Exchange to the sendmail server. Since we just recently started using sendmail as a front end server, our bayes system is still in its infancy and spam is getting through to user inboxes with sco

Re: Low scoring spam

Now that I got bayes working my next question is should I reactivate autowhitelist and autolearn? Thanks Robert

Re: Low scoring spam

Robert Bartlett wrote: Ok Im sorry I mis understood. I ran it the way you suggested and it did come with headers this time. I attached the results. I still feel like something else is wrong. Install Razor.

Re: Low scoring spam

> Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it It isn't. > find it but I dont see it actually being used. If that is the case how do I > make sure Bayes will be used for each message? debug: bayes: Not available for scanning, only 48 ham(s) in Bayes DB < 200 Make sur

Re: Low scoring spam

Without seeing the actual spam it is hard to say how high it could score. However, getting enough ham into Bayes such that it will run will up the score considerably. Loren

RE: Low scoring spam

PM To: users@spamassassin.apache.org Subject: RE: Low scoring spam Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it find it but I dont see it actually being used. If that is the case how do I make sure Bayes will be used for each message? Thanks Robert >From your l

RE: Low scoring spam

@spamassassin.apache.org Subject: RE: Low scoring spam Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it find it but I dont see it actually being used. If that is the case how do I make sure Bayes will be used for each message? Thanks Robert >From your logs. debug: ba

RE: Low scoring spam

Message- From: Ken Goods [mailto:[EMAIL PROTECTED] Sent: Thursday, February 24, 2005 5:43 PM To: users@spamassassin.apache.org Subject: RE: Low scoring spam Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it find it but I dont see it actually being used. If that is the case

RE: Low scoring spam

Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it find it but I dont see it actually being used. If that is the case how do I make sure Bayes will be used for each message? Thanks Robert >From your logs. debug: bayes: Not available for scanning, only 48 ham(s) in Baye

RE: Low scoring spam

, February 24, 2005 10:38 AM To: [EMAIL PROTECTED] Cc: users@spamassassin.apache.org Subject: RE: Low scoring spam At 11:59 AM 2/24/2005, [EMAIL PROTECTED] wrote: >spamd is aliases to spamassassin. Ok... May I ask why?

RE: Low scoring spam

To: [EMAIL PROTECTED] Cc: users@spamassassin.apache.org Subject: RE: Low scoring spam At 11:59 AM 2/24/2005, [EMAIL PROTECTED] wrote: >spamd is aliases to spamassassin. Ok... May I ask why? (I excluded the rest of the headers for privacy reasons, but its just the top part of a regular em

RE: Low scoring spam

At 11:59 AM 2/24/2005, [EMAIL PROTECTED] wrote: spamd is aliases to spamassassin. Ok... May I ask why?

RE: Low scoring spam

spamd is aliases to spamassassin. I forgot to insert the < part in my email but that is what I did. Robert > At 08:06 PM 2/23/2005, Robert Bartlett wrote: > >>Well all I did was run spamd -D /path/to/message > > > Wait.. even if it is a typo, it still won't work. > > You need to redirect things w

RE: Low scoring spam

At 08:06 PM 2/23/2005, Robert Bartlett wrote: Well all I did was run spamd -D /path/to/message Wait.. even if it is a typo, it still won't work. You need to redirect things when calling spamc.. You can't pass it a filename. And spamc doesn't take a -D parameter, only spamd does... but spamd does

RE: Low scoring spam

At 08:06 PM 2/23/2005, Robert Bartlett wrote: Well all I did was run spamd -D /path/to/message Is that a typo of spamc, or did you really try to feed a message to spamd?

Re: Low scoring spam

Hello Robert, Not directly related to your problem, I don't think, but from your debug listing I see you're using the following rules files: > debug: config: read file ... > debug: config: read file /etc/mail/spamassassin/70_sare_random.cf > ... > debug: config: read file /etc/mail/spamassassin/ra

RE: Low scoring spam

lto:[EMAIL PROTECTED] Sent: Wednesday, February 23, 2005 8:44 AM To: [EMAIL PROTECTED]; users@spamassassin.apache.org Subject: RE: Low scoring spam At 10:31 AM 2/23/2005, Robert Bartlett wrote: >Do you suggest until resolved disable this? If to disable it what exactly do >I need to disable?

RE: Low scoring spam

At 10:31 AM 2/23/2005, Robert Bartlett wrote: Do you suggest until resolved disable this? If to disable it what exactly do I need to disable? Upon closer inspection are you sure you fed SA the actual message with complete headers? Are you sure that's not the output of spamassasin --lint?? It look

RE: Low scoring spam

PROTECTED] Sent: Wednesday, February 23, 2005 8:33 AM To: [EMAIL PROTECTED] Cc: 'Matt Kettler'; users@spamassassin.apache.org Subject: Re: Low scoring spam Robert set the score to zero in local.cf score ALL_TRUSTED 0 -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +

Re: Low scoring spam

-Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Wednesday, February 23, 2005 8:28 AM To: [EMAIL PROTECTED]; users@spamassassin.apache.org Subject: Re: Low scoring spam At 10:09 AM 2/23/2005, Robert Bartlett wrote: I have one client who gets 15-20 spam emails a day. Currently Im

RE: Low scoring spam

: Low scoring spam At 10:09 AM 2/23/2005, Robert Bartlett wrote: >I have one client who gets 15-20 spam emails a day. Currently Im using SA >3.0.1. I had auto whitelist and auto learn on and since turned this off. I >ran spamd -D on one of the emails that got through that should of bee

Re: Low scoring spam

At 10:09 AM 2/23/2005, Robert Bartlett wrote: I have one client who gets 15-20 spam emails a day. Currently Im using SA 3.0.1. I had auto whitelist and auto learn on and since turned this off. I ran spamd -D on one of the emails that got through that should of been marked spam. From your log: deb

Low scoring spam

I have one client who gets 15-20 spam emails a day. Currently Im using SA 3.0.1. I had auto whitelist and auto learn on and since turned this off. I ran spamd -D on one of the emails that got through that should of been marked spam. I noticed it scored a 2.6 with the regex test at the beginning

Re: low scoring SPAM

> >> BAYES_99(1.886),RCVD_IN_BL_SPAMCOP_NET(1.216),RISK_FREE(0.230),NO_REAL_NAME( 0.007) Your Bayes_99 score seems very low. I know the default for bayes-99 is less than bayes-90, but I thought it was still a fairly significant score. Either I'm misremembering the release value for bayes-99, or i

Re: low scoring SPAM

>> I've recently (about a month ago) installed a new mail server and >> upgraded to SA 3.01. I've been training the bayes database by hand >> (most of our mail is japanese and the autolearning wasn't a good way to >> start the bayes learning) >> >> anyways, I'm not using any custom or 3rd

RE: low scoring SPAM

|-Original Message- |From: alan premselaar [mailto:[EMAIL PROTECTED] |Sent: 04 December 2004 15:23 |To: users@spamassassin.apache.org |Subject: low scoring SPAM | |I've recently (about a month ago) installed a new mail server and |upgraded to SA 3.01. I've been training

low scoring SPAM

I've recently (about a month ago) installed a new mail server and upgraded to SA 3.01. I've been training the bayes database by hand (most of our mail is japanese and the autolearning wasn't a good way to start the bayes learning) anyways, I'm not using any custom or 3rd party rules. I'm

Re: low scoring spam

Well, first off I'd send a note to Geocities letting them know they are being used as a spam host. That may not appreciate that, and take appropriate action. Second I'd look to some of the SARE rules. The OEM rules *might* have added a point or two to this spam. However, it only mentions a sing

low scoring spam

Hi List. I have been receiving some very low scoring spam messages lately. Any ideas on how to increase the scores a bit. Here are the results: @:ö0 Start SpamAssassin results -- This mail is probably spam. The original message has been altered so you