On Sun, Feb 01, 2009 at 01:45:50PM +0100, mouss wrote:
> Henrik K a écrit :
> > On Sat, Jan 31, 2009 at 12:40:24PM +0100, mouss wrote:
> >> if you use the RelayCountry plugin, you can add rules for a few countries:
> >
> > If you are lazy, here is about all of africa..
> >
> > header RELAYED_419
RobertH wrote:
> matt
>
> i hear ya.
>
> ill be using it and scoring low (or whatever i desire) and using meta's it
> appears.
>
> i wasnt asking for it to be some major contention in SA core scoring...
>
> i just honestly cannot belive that there are still people out there sending
> these emails p
RobertH wrote:
looking hard?
of course i did.
You did say you didn't see Nigeria anywhere. I took this to mean
that you dodn't see it anywhere in the SA default rules, which
you would have done using a quick grep.
Now I don't know what you meant when you said you didn't see it
anywhere
RobertH wrote on Fri, 30 Jan 2009 08:53:47 -0800:
> i hear you, yet lets get real...
>
> and, we do use jm_sought stuff.
>
> the word nigeria alone is worth a point is all i was saying.
Wrong. It is worth a point for *you* and maybe for others. Not for
everyone. So, please add a custom rule a
Henrik K a écrit :
> On Sat, Jan 31, 2009 at 12:40:24PM +0100, mouss wrote:
>> if you use the RelayCountry plugin, you can add rules for a few countries:
>
> If you are lazy, here is about all of africa..
>
> header RELAYED_419 X-Relay-Countries =~
> /\b(?:AO|B[IJW]|C[DFGIMV]|DJ|E[RT]|G[AHMNQW]|
RobertH a écrit :
> thanks mouss
>
> u the reason i made the subject, "country in africa" was that i didnt
> want to use the exact word
>
you can if you try :)
> i can see my mistake it that now.
>
> as always, i sincerely appreciate the vast progr
matt
i hear ya.
ill be using it and scoring low (or whatever i desire) and using meta's it
appears.
i wasnt asking for it to be some major contention in SA core scoring...
i just honestly cannot belive that there are still people out there sending
these emails pretending to be someone from that
RobertH wrote:
>
>
> how many legitimate emails a day do you people get with the work Nigeria in
> it?
>
Daily, not really.
But often enough in email news feeds.
i.e. I got one within the last 24 hours.. Remember the rebels
threatening oil supplies in Nigeria 4 months ago? Yeah, they called
RobertH wrote:
it should get a hit.
how many legitimate emails a day do you people get with the work Nigeria in
it?
several now that we are sending the 'n word' back and forth on this list
now!
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
> *| *SECNAP Network Security Corporat
is this good enough for a basic rule to flag that word
or should it be different or raw or what?
something better?
body LOCAL_NIGERIA /\bnigeria\b/i
score LOCAL_NIGERIA 0.1
describe LOCAL_NIGERIA This is a simple test rule for nigeria
i know that single word rules in general are a bad
On Sat, 31 Jan 2009, SM wrote:
We then have to obfuscate the words so that we can mention them on this
mailing list.
If you're running SA mailing list messages through SA you get what you
deserve.
--
John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
jhar...@impsec.org
At 08:18 31-01-2009, RobertH wrote:
and if i understand correctly, you can tell the SA config not to
bayes_ignore_from *...@spamassassin.apache.org
bayes_ignore_to users@spamassassin.apache.org
Right. There are still some subscribers who don't realize that some
of the messages from this mai
thanks mouss
u the reason i made the subject, "country in africa" was that i didnt
want to use the exact word
i can see my mistake it that now.
as always, i sincerely appreciate the vast programming and SA application
wisdom & knowledge on this list.
thank you all for you he
>
> You could score the content if it mentions a country in
> Africa. We then have to obfuscate the words so that we can
> mention them on this mailing list. It's better to use Bayes
> to deal with that type of email.
>
> Regards,
> -sm
>
>
actuall
At 22:39 30-01-2009, RobertH wrote:
when an email comes in with the word nigeria in it, it should get scored
something.
You could score the content if it mentions a country in Africa. We
then have to obfuscate the words so that we can mention them on this
mailing list. It's better t
On Sat, Jan 31, 2009 at 12:40:24PM +0100, mouss wrote:
>
> if you use the RelayCountry plugin, you can add rules for a few countries:
If you are lazy, here is about all of africa..
header RELAYED_419 X-Relay-Countries =~
/\b(?:AO|B[IJW]|C[DFGIMV]|DJ|E[RT]|G[AHMNQW]|K[EM]|L[RS]|M[WZ]|N[AEG]|RW|S
Benny Pedersen a écrit :
> On Sat, January 31, 2009 12:40, mouss wrote:
>> The above assumes you don't get (much) mail from these countries.
>> adjust the score as you see fit. and of course, use at your own rix.
>
> i see more spam from outside this countrys, eg 419 spams not sent
> from there an
On Sat, January 31, 2009 12:40, mouss wrote:
> The above assumes you don't get (much) mail from these countries.
> adjust the score as you see fit. and of course, use at your own rix.
i see more spam from outside this countrys, eg 419 spams not sent
from there anyway, botnet sooks :)
--
http://
funny story: we just got an inquiry from a large ISP in 'that country'
to implement a hosted anti-spam solution for them.
Seems we were the only company that they looked at that didn't block
email to/from or mentioning 'that country'.
(other providers they emailed blocked their email!)
They
RobertH a écrit :
>
>
>> No. Scoring based on single-words is pretty much the
>> opposite of the SA approach. That's all I was saying.
>>
>
> karsten,
>
> i get the SA approach
>
> and to the no answer, baloney
>
> this word should get a *HIT* no mattter how small it is scored.
>
if you
>
> No. Scoring based on single-words is pretty much the
> opposite of the SA approach. That's all I was saying.
>
karsten,
i get the SA approach
and to the no answer, baloney
this word should get a *HIT* no mattter how small it is scored.
- rh
>
> You must not be looking very hard. It's there, both in the
> default ruleset and in the updated ruleset, but not as a
> single-word rule:
>
> grep -i nigeria
> /var/db/spamassassin/3.002005/updates_spamassassin_org/*
> jo...@chip:~$ grep -i nigeria
> /var/db/spamassassin/3.002005/updates_
RobertH wrote:
how is it that the country in africa so often mentioned in email scams is
not worth a point in SA default config
You mean the rules?
nor do i see it anywhere
You must not be looking very hard. It's there, both in the
default ruleset and in the updated ruleset, but not
On 30.01.09 08:53, RobertH wrote:
> the word nigeria alone is worth a point is all i was saying.
It was already explained by Karsten...
> guess that should be in local rules eh?
if you want... yes.
But note that scoring on a single word is really a bad idea...
--
Matus UHLAR - fantomas, uh...
On Fri, 2009-01-30 at 08:53 -0800, RobertH wrote:
> Karsten and Matus
>
> i hear you, yet lets get real...
>
> and, we do use jm_sought stuff.
>
> the word nigeria alone is worth a point is all i was saying.
No. Scoring based on single-words is pretty much the opposite of the SA
approach. That
Karsten and Matus
i hear you, yet lets get real...
and, we do use jm_sought stuff.
the word nigeria alone is worth a point is all i was saying.
guess that should be in local rules eh?
;-)
- rh
On 30.01.09 08:42, RobertH wrote:
> what i mean is how could an email with nigeria make it through SA without a
> score based on the word nigeria?
because if they could not, I could not see this e-mail nor answer it.
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning:
matus,
what i mean is how could an email with nigeria make it through SA without a
score based on the word nigeria?
- rh
On Fri, 2009-01-30 at 08:22 -0800, RobertH wrote:
> how is it that the country in africa so often mentioned in email scams is
> not worth a point in SA default config
Because single-word rules are a bad idea.
Use JM_SOUGHT_FRAUD (part of the general Sought rule-set). Some of us
are *ma
On 30.01.09 08:22, RobertH wrote:
> how is it that the country in africa so often mentioned in email scams is
> not worth a point in SA default config
What do you mean? How and why should it be mentioned in the defalt config?
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fanto
how is it that the country in africa so often mentioned in email scams is
not worth a point in SA default config
nor do i see it anywhere
- rh
31 matches
Mail list logo