Re: Romance spam

2013-03-09 Thread Benny Pedersen
Kenneth Porter skrev den 2013-03-09 14:44: Presumably the autolearn=ham applies to anything that doesn't get marked as spam. nope, it still need to score below -0.1 to learn as ham, so i would check whitelist scores, or scores that hits on negatives Once I move it to my Uncaught folder, it

Re: Romance spam

2013-03-09 Thread Kenneth Porter
--On Thursday, March 07, 2013 11:26 PM +0100 Benny Pedersen wrote: only bayes hitting ?, and it autolearns ham ? Presumably the autolearn=ham applies to anything that doesn't get marked as spam. Once I move it to my Uncaught folder, it gets retrained that night as spam. But I need to upg

Re: Romance spam

2013-03-07 Thread Benny Pedersen
Kenneth Porter skrev den 2013-03-06 18:04: --On Wednesday, March 06, 2013 9:27 AM -0500 "Kevin A. McGrail" wrote: I haven't seen any of this at all. Do you have an example on pastebin and I can look through my logs? Might be getting hammered by another rule/rbl/etc. Here's an example:

Re: Romance spam

2013-03-06 Thread Axb
On 03/06/2013 05:52 PM, Kenneth Porter wrote: --On Wednesday, March 06, 2013 3:35 PM +0100 Axb wrote: aren't these the ones with the @yandex.ru dropbox in the body? Good catch. I just checked for that in my Uncaught folder (which I feed to Bayes each night) and the List-Id appears in most bu

Re: Romance spam

2013-03-06 Thread Kevin A. McGrail
On 3/6/2013 12:04 PM, Kenneth Porter wrote: --On Wednesday, March 06, 2013 9:27 AM -0500 "Kevin A. McGrail" wrote: I haven't seen any of this at all. Do you have an example on pastebin and I can look through my logs? Might be getting hammered by another rule/rbl/etc. Here's an example:

Re: Romance spam

2013-03-06 Thread Kenneth Porter
--On Wednesday, March 06, 2013 9:27 AM -0500 "Kevin A. McGrail" wrote: I haven't seen any of this at all. Do you have an example on pastebin and I can look through my logs? Might be getting hammered by another rule/rbl/etc. Here's an example:

Re: Romance spam

2013-03-06 Thread Kenneth Porter
--On Wednesday, March 06, 2013 3:35 PM +0100 Axb wrote: aren't these the ones with the @yandex.ru dropbox in the body? Good catch. I just checked for that in my Uncaught folder (which I feed to Bayes each night) and the List-Id appears in most but not all that have that dropbox address.

Re: Romance spam

2013-03-06 Thread Axb
in recent "romance" spam that looks like it might be an easy pattern to match. It's an unsubscribe link with a mailto link with a hex digit username of up to 20 digits. This is from a grep of my Uncaught folder. aren't these the ones with the @yandex.ru dropbox in the body?

Re: Romance spam

2013-03-06 Thread Kevin A. McGrail
I haven't seen any of this at all. Do you have an example on pastebin and I can look through my logs? Might be getting hammered by another rule/rbl/etc. On 2/21/2013 8:03 PM, Kenneth Porter wrote: I'm noticing the following header in recent "romance" spam that looks like

Re: Romance spam

2013-02-22 Thread Benny Pedersen
Kenneth Porter skrev den 2013-02-22 02:03: I'm noticing the following header in recent "romance" spam that looks like it might be an easy pattern to match. its easy to make clamav sigs aswell :) but is the envelope-sender matching the unsubscribe domain ?, if so reject sender domain in mta

Romance spam

2013-02-21 Thread Kenneth Porter
I'm noticing the following header in recent "romance" spam that looks like it might be an easy pattern to match. It's an unsubscribe link with a mailto link with a hex digit username of up to 20 digits. This is from a grep of my Uncaught folder. List-Unsubscribe: <