>...
>On Sat, 2005-11-12 at 10:56 -0500, Pierre Thomson wrote:
>> A slightly more compact way to treat the final digit:
>>
>> > > bodyPROLO_LEO1 /85\,45|1\,2[12]/
>> > > bodyPROLO_LEO2 /69\,95|3\,3[23]/
>
>New uri showed up today, so the updated ru
On Sun, 2005-11-13 at 01:24 +0100, Raymond Dijkxhoorn wrote:
> Hi!
>
> bodyPROLO_LEO1 /85\,45|1\,2[12]/
> bodyPROLO_LEO2 /69\,95|3\,3[23]/
> >
> > New uri showed up today, so the updated rule I use is now:
> >
> > bodyPROLO_LEO1
Hi!
bodyPROLO_LEO1 /85\,45|1\,2[12]/
bodyPROLO_LEO2 /69\,95|3\,3[23]/
New uri showed up today, so the updated rule I use is now:
bodyPROLO_LEO1 /85\,45|1\,2[12]/
bodyPROLO_LEO2 /69\,95|3\,3[23]/
bodyPROLO_LEO3
On Sat, 2005-11-12 at 10:56 -0500, Pierre Thomson wrote:
> A slightly more compact way to treat the final digit:
>
> > > bodyPROLO_LEO1 /85\,45|1\,2[12]/
> > > bodyPROLO_LEO2 /69\,95|3\,3[23]/
New uri showed up today, so the updated rule I use is
List Mail User wrote:
> They should hit a well trained BAYES
They get some from bayes but not enough, I hand feed every one I get into my
bayes and each new run always comes up with less bayes score.
The past few I received got:
BAYES_60
BAYES_60
BAYES_80
BAYES_95 <- I think this one was a few we
Hi!
bodyPROLO_LEO1 /85\,45|1\,21|1\,22/
bodyPROLO_LEO2 /69\,95|3\,33|3\,32/
No need to have 1\,21 twice in there.
Huh? One is 1,21 (original) the other 1,22 (my addition).
Must be my lack of coffee ;)
Bye,
Raymond.
On Sat, 2005-11-12 at 10:06 +0100, Raymond Dijkxhoorn wrote:
> Hi!
>
> >
> > bodyPROLO_LEO1 /85\,45|1\,21|1\,22/
> > bodyPROLO_LEO2 /69\,95|3\,33|3\,32/
> >
>
> No need to have 1\,21 twice in there.
Huh? One is 1,21 (original) the other 1,22 (my
Hi!
bodyPROLO_LEO1 /85\,45|1\,21|1\,22/
bodyPROLO_LEO2 /69\,95|3\,33|3\,32/
No need to have 1\,21 twice in there.
Bye,
Raymond.
On Wed, 2005-11-09 at 23:47 +0100, Raymond Dijkxhoorn wrote:
> Hi!
>
> >>A slightly earlier one got a much lower score with:
> >>
> >
> > Umm... I don't see any SARE rules in there. The fact is, SARE isn't
> > terribly effective against these 1-column drug spams. The only SARE hit
> > I got
On Wednesday, November 9, 2005, 10:31:30 AM, Pierre Thomson wrote:
> Where are those URIBL_RHS_* tests from? I see no mention of them on either
> SA or URIBL sites.
> Pierre
See:
http://www.uribl.com/usage.shtml
Jeff C.
--
Jeff Chan
mailto:[EMAIL PROTECTED]
http://www.surbl.org/
Hi!
A slightly earlier one got a much lower score with:
Umm... I don't see any SARE rules in there. The fact is, SARE isn't
terribly effective against these 1-column drug spams. The only SARE hit
I got was SARE_SPEC_LEO_LINE03f with a whopping 0.18 points, or
occasionally SARE_SP
>>>...
>> Pierre,
>>
>> I does seem that the digests plus Bayes are the best defense against
>> these. Just a few minutes ago another arrived:
>>
>> Y 15 -
>> BAYES_99,DCC_CHECK,DIGEST_MULTIPLE,HTML_90_100,HTML_MESSAGE,MIME_QP_LONG_LINE,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_BL_S
List Mail User wrote:
>>> ...
>>
>> I'm not really THAT badly off; I run all default 3.1.0 tests plus
>> Bayes and DCC, three RBL's, URIBL/SURBL, some SARE rule sets and a
>> bunch of local rules. I do MTA-level blocking with Spamhaus
>> SBL-XBL, which knocks off at least half the junk before it
>>...
>> do not use SARE tests, just check, read and try to follow what they
>> are doing).
>>
>
>Paul,
>
>I'm not really THAT badly off; I run all default 3.1.0 tests plus Bayes and
>DCC, three RBL's, URIBL/SURBL, some SARE rule sets and a bunch of local rules.
> I do MTA-level blocking with Sp
> -Original Message-
> From: Rosenbaum, Larry M. [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, November 09, 2005 10:45 AM
> To: users@spamassassin.apache.org
> Subject: RE: More spam getting through
>
>
> > From: Loren Wilton [mailto:[EMAIL PROTECTED]
> &g
> From: Loren Wilton [mailto:[EMAIL PROTECTED]
>
> > I'm not sure if Loren's rules made it into any particular
> > ruleset or if Leo "morph"'d too often to bother; Maybe someone
> ...
> Of
> course, the urls are going to end up in SURBL before most of you get
the
> spams, so those will aslo
List Mail User wrote:
>> ...
>> List Mail User wrote:
...
>>> I believe some people using the SARE rules report ~100 points for
>>> them (after half a day or so, they fail every net test, and very
>>> many "small" rules). Also, the typical ones are delivered by
>>> zombies, so often the
>...
>List Mail User wrote:
>>> ...
>>>
>> I believe some people using the SARE rules report ~100 points for them
>> (after half a day or so, they fail every net test, and very many
>> "small" rules). Also, the typical ones are delivered by zombies, so
>> often the DUL tests hit right away, and if
From: Loren Wilton [mailto:[EMAIL PROTECTED]
>
> > If anyone can formulate a regex to catch these letters in any
> > order, while avoiding a repeating sequence like "A A A A A ", it
> > would make this a safer rule.
>
> SARE has quite a number of rules specifically to catch these table
> drug spa
List Mail User wrote:
>> ...
>>
> I believe some people using the SARE rules report ~100 points for them
> (after half a day or so, they fail every net test, and very many
> "small" rules). Also, the typical ones are delivered by zombies, so
> often the DUL tests hit right away, and if you can aff
Thomson [mailto:[EMAIL PROTECTED]
Sent: 08 November, 2005 4:14 PM
To: Bowie Bailey; Spamassassin List (E-mail)
Subject: RE: More spam getting through
Bowie Bailey wrote:
>
> Some of the medication spams are using an obnoxious html table
> structure that makes the contents of eac
> I'm not sure if Loren's rules made it into any particular
> ruleset or if Leo "morph"'d too often to bother; Maybe someone
They were in specific.cf as I recall. Yes, they were in there, and yes, Leo
tended to get around them every few days. A couple of them are still there
and still hit occas
> If anyone can formulate a regex to catch these letters in any order, while
avoiding a
> repeating sequence like "A A A A A ", it would make this a safer rule.
SARE has quite a number of rules specifically to catch these table drug
spams.
Loren
>...
>From: List Mail User [mailto:[EMAIL PROTECTED]
>>
>> >...
>> >I'm running SA 3.1 and I have started to notice more spam come through
>> >recently.
>> >[snip - original table drug spam]
>> >
>> >Has anyone else been having this problem? Any rules to catch medication
>> >names in those types
On Tuesday 08 November 2005 08:57 am, Bowie Bailey wrote:
> I'm running SA 3.1 and I have started to notice more spam come through
> recently.
>
> Some are porn and some are medication. They don't hit much of anything
> beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
>
> Som
From: List Mail User [mailto:[EMAIL PROTECTED]
>
> >...
> >I'm running SA 3.1 and I have started to notice more spam come through
> >recently.
> >
> >Some are porn and some are medication. They don't hit much of anything
> >beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
>
>...
>I'm running SA 3.1 and I have started to notice more spam come through
>recently.
>
>Some are porn and some are medication. They don't hit much of anything
>beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
>
>Some of the medication spams are using an obnoxious html tabl
Pierre Thomson wrote:
> Bowie Bailey wrote:
>>
>> Some of the medication spams are using an obnoxious html table
>> structure that makes the contents of each cell print vertically.
>>
>> For example:
>>
>>
>> a d g
>> b e h
>> c f i
>>
>> <\tr>
>>
>>
>> Th
Bowie Bailey wrote:
>
> Some of the medication spams are using an obnoxious html table
> structure that makes the contents of each cell print vertically.
>
> For example:
>
>
> a d g
> b e h
> c f i
>
> <\tr>
>
>
> This results in:
> a b c
> d e f
> g h i
>
I'm running SA 3.1 and I have started to notice more spam come through
recently.
Some are porn and some are medication. They don't hit much of anything
beyond Razor2 and Chickenpox, which isn't enough to mark them as spam.
Some of the medication spams are using an obnoxious html table structure
30 matches
Mail list logo
