> -Original Message-
> From: Rob Sterenborg [mailto:[EMAIL PROTECTED]
> Sent: Thursday, October 18, 2007 22:48
> To: users@spamassassin.apache.org
> Subject: RE: coming to your inbox: mp3 stock spams
>
>
> Luis Hernán Otegui wrote:
> > Anyway, the Faculty
Hi, Rob,
2007/10/19, Rob Sterenborg <[EMAIL PROTECTED]>:
> Luis Hernán Otegui wrote:
> > Anyway, the Faculty I work for tries to keep the e-mail system only
> > for research purposes, and mostly students and (sadly) technicians
> > tend to goof around with mail. Bandwidth isn't cheap here, so they
Luis Hernán Otegui wrote:
> Anyway, the Faculty I work for tries to keep the e-mail system only
> for research purposes, and mostly students and (sadly) technicians
> tend to goof around with mail. Bandwidth isn't cheap here, so they
> decided to straightly cut those extensions. Remember, the custo
Hi, Per
2007/10/18, Per Jessen <[EMAIL PROTECTED]>:
> Luis Hernán Otegui wrote:
>
> > We block .avi, .mp3, .mpg, etc. here, because we think it's a waste of
> > bandwith to share those extensions via email,
>
> Voicemail (from a mobile for instance) is quite often sent in .wav
> or .mp3 format, so
Luis Hernán Otegui wrote:
> We block .avi, .mp3, .mpg, etc. here, because we think it's a waste of
> bandwith to share those extensions via email,
Voicemail (from a mobile for instance) is quite often sent in .wav
or .mp3 format, so we don't just plainly block those.
/Per Jessen, Zürich
Well,
2007/10/18, ram <[EMAIL PROTECTED]>:
> On Thu, 2007-10-18 at 09:51 +0200, Yet Another Ninja wrote:
> > coming to your inbox: mp3 stock spams
>
> Atleast 70% of email users dont have their speakers on, the spammer has
> got his basics wrong
>
>
We block .avi,
On Thu, 2007-10-18 at 09:51 +0200, Yet Another Ninja wrote:
> coming to your inbox: mp3 stock spams
Atleast 70% of email users dont have their speakers on, the spammer has
got his basics wrong
Hi Yet Another Ninja,
Yes. We found a lot of such spams these days. more and more.
Any good ideas?
Yet Another Ninja wrote:
> coming to your inbox: mp3 stock spams
>
>
>
>
> Y_A_N
--
Xueron Nee <[EMAIL PROTECTED]>
coming to your inbox: mp3 stock spams
Y_A_N
On Fri, 2007-06-22 at 17:03 +0200, arni wrote:
> Marc Perkel schrieb:
> >
> > That doesn't answer his question though. He didn't ask for your
> > opinion about if he needed it. If the rules were working for him he
> > wouldn't be asking for help. When someone asks a question telling
> > them they
Matt schrieb:
I have Spamassassin setup to whitelist all my own IP pools. Do I need
to do anything else?
Matt
make sure that anything that is an MX for x@.com is in
your internal_networks
arni
http://people.ucsc.edu/~jrudd/spamassassin/
docs inside the archive - botnet is really one of the most effective
plugins i use these days (make sure you set your internal nets properly
I have Spamassassin setup to whitelist all my own IP pools. Do I need
to do anything else?
Matt
otherwise
Matt schrieb:
together with a decent bayes or 1 or 2 more rules already does the
job and
Where do I get the botnet plugin(prefer rpm) and how do I make
Spamassassin use it?
Matt
http://people.ucsc.edu/~jrudd/spamassassin/
docs inside the archive - botnet is really one of the most effective
together with a decent bayes or 1 or 2 more rules already does the job and
Where do I get the botnet plugin(prefer rpm) and how do I make
Spamassassin use it?
Matt
Marc Perkel schrieb:
Actually the fastest way to get rid of stoc/botnet spam is with fake
MX records.
fake 10
real 20
fake 30
fake 40
I dont like the idea of making life harder for ham (forcing a properly
working mailserver to make at least 2 connections) acompanied with the
same delays as
arni wrote:
Marc Perkel schrieb:
That doesn't answer his question though. He didn't ask for your
opinion about if he needed it. If the rules were working for him he
wouldn't be asking for help. When someone asks a question telling
them they don't need it is generally the wrong answer and a
Marc Perkel schrieb:
That doesn't answer his question though. He didn't ask for your
opinion about if he needed it. If the rules were working for him he
wouldn't be asking for help. When someone asks a question telling them
they don't need it is generally the wrong answer and a waste of time.
arni wrote:
Suhas Ingale schrieb:
Can someone help me writing rules to catch below content spam?
* 5.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.]
* 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
* 5.
Suhas Ingale schrieb:
Can someone help me writing rules to catch below content spam?
* 5.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.]
* 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
* 5.0 BOTNET Relay
I do it fully separately from spamassassin.
I have a list of patterns in a file that are matched by saying
m/\b$pattern\b/. (\b means word boundary). If I get more than one or
two spams advertising a particular stock, I put that stock name in the
pattern list.
All messages mentioning those spam
On Thu, March 8, 2007 20:20, John Andersen wrote:
> http://news.yahoo.com/s/nm/20070308/wr_nm/spam_sec_dc_3
its expired :/
> the SEC is investigating the companies themselves as well as outsiders, and
> that the same people are likely behind multiple spam campaigns.
no wonder its hard to stop
From the too little, too late department:
The US Securities and Exchange commission has suspended trading
of 35 penny stocks that were "linked" to stock spam.
http://news.yahoo.com/s/nm/20070308/wr_nm/spam_sec_dc_3
the SEC is investigating the companies themselves as well as outsiders, and
tha
On Thu, 08 Feb 2007 14:46:31 +0530, Ramprasad <[EMAIL PROTECTED]>
wrote:
>The stock spams are getting obfuscated to extreme lengths.
> This mail went clean thru spamassassin. All it got hit were my custom
>rules where I score mails containing companies mentioned in stock spam
The stock spams are getting obfuscated to extreme lengths.
This mail went clean thru spamassassin. All it got hit were my custom
rules where I score mails containing companies mentioned in stock spam
( risky but no alternative )
Stock spams are a real nuisance , because the spammer just has
Robert Braver wrote:
On Thursday, November 16, 2006, 8:00:09 PM, Michael Scheidell wrote:
MS> It was $500, and the law changed to make it impossible to collect
MS> anymore.
MS> Before, it was a 'first strike' and you owe $500. Now you have to 'opt
MS> out' (they can still send you one)
Opt-ou
Coffey, Neal wrote:
Bookworm wrote:
Pick up a pen, and write to your local congressman, or even to the
SEC, and insist that they penalize those companies who are being
pimped and pumped through spam emails.
Why should they? The companies being advertised in the stock spams
aren&#
On Thursday, November 16, 2006, 8:00:09 PM, Michael Scheidell wrote:
MS> It was $500, and the law changed to make it impossible to collect
MS> anymore.
MS> Before, it was a 'first strike' and you owe $500. Now you have to 'opt
MS> out' (they can still send you one)
Opt-out applies only if there
> -Original Message-
> From: Bookworm [mailto:[EMAIL PROTECTED]
> Sent: Thursday, November 16, 2006 1:52 PM
> To: users@spamassassin.apache.org
> Subject: Real fix for stock spams - pick up a pen
>
>
> Pick up a pen, and write to your local congressman, or ev
At 12:51 PM -0600 11/16/06, Bookworm wrote:
Pick up a pen, and write to your local congressman, or even to the
SEC, and insist that they penalize those companies who are being
pimped and pumped through spam emails.
Today, I got one for Mobicom Communications. If that company had
their chance t
Bookworm wrote:
> Pick up a pen, and write to your local congressman, or even to the
> SEC, and insist that they penalize those companies who are being
> pimped and pumped through spam emails.
Why should they? The companies being advertised in the stock spams
aren't responsible. I
On Thu, 2006-11-16 at 10:57 -0800, Evan Platt wrote:
>
> Imagine if ABC Corp is already public, and along comes XYZ, Inc,
> about to go public. XYZ competes with ABC. ABC hires Spammer in
> to spam for 'XYZ'. So now it looks like XYZ is
> spamming. The FTC crawls all over XYZ, who of course pl
At 10:51 AM 11/16/2006, you wrote:
Pick up a pen, and write to your local congressman, or even to the
SEC, and insist that they penalize those companies who are being
pimped and pumped through spam emails.
Today, I got one for Mobicom Communications. If that company had
their chance to go publ
Pick up a pen, and write to your local congressman, or even to the SEC,
and insist that they penalize those companies who are being pimped and
pumped through spam emails.
Today, I got one for Mobicom Communications. If that company had their
chance to go public yanked, you could be sure that
Spamassassin List wrote:
The stock spams are killing me. I had 70_sare_stocks.cf and its not
blocking them. Below is part of the spam and the score. What can i do
to beat them?
W a t c h o u t!
ALLINACE ENTERPRSIE (A ETR)
Curernt Pirce: 0.80
Add this g e m to your wat ch list, and w atch
The stock spams are killing me. I had 70_sare_stocks.cf and its not blocking
them. Below is part of the spam and the score. What can i do to beat them?
W a t c h o u t!
ALLINACE ENTERPRSIE (A ETR)
Curernt Pirce: 0.80
Add this g e m to your wat ch list, and w atch it tard closely!
Nwes
> Ben Lentz wrote:
>>
>> Thanks, I'll definitely have to give that KAM ruleset a spin
>> on our
>> system. Any chance you could tell me where that TVD tag is
>> coming from?
>> Is that another SARE rule?
>
> That's from sa-update. (TVD = Theo Van Dinter)
>
> If you are worried about sa-update brea
Ben Lentz wrote:
Thanks, I'll definitely have to give that KAM ruleset a spin on our
system. Any chance you could tell me where that TVD tag is coming from?
Is that another SARE rule?
That's from sa-update. (TVD = Theo Van Dinter)
If you are worried about sa-update breaking your system, yo
- Original Message -
*From:* David Goldsmith <[EMAIL PROTECTED]>
*Sent:* 06/07/2006 04:56:37 PM
*To:* users@spamassassin.apache.org
*Subject:* Stock Spams; aka Pump and Dump part 2
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Ben Lentz wrote:
Greetings list,
I've bee
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Ben Lentz wrote:
> Greetings list,
> I've been reading a pretty active and recent thread from one of the
> sa-users mailing list archives that talks about a high rate of these
> stock spams that are getting through. I, too, am cu
Greetings list,
I've been reading a pretty active and recent thread from one of the
sa-users mailing list archives that talks about a high rate of these
stock spams that are getting through. I, too, am currently suffering
from this problem and am wondering if anyone has any recommendatio
You're absolutely right of course - but those of us relying on Debian
stable have only got 3.0.3-2sarge1 to go on.
Is it safe to pin spamassassin to the version in testing (currently
3.1.1-1) when everything else i use (sendmail/mimedefang/clamav) is out of
stable - or should i pin those 'u
On 03/06/2006, at 8:13 AM, Kenneth Porter wrote:
For most software, I'd strongly agree with you. But anti-spam
software is like anti-virus software. The battle evolves rapidly,
and you need to evolve with it if you're going to be effective in
fighting it.
With SA 3.1.2 just released, 3.
DAve wrote:
> Kenneth Porter wrote:
> > With SA 3.1.2 just released, 3.0.4 is archaic. It's like fighting
> > the Gulf War with WWII weapons. (And anyone using SA 2.xx is using
> > stuff from the 19th century.)
>
> I would, without a moments hesitation, trade a M-16 for a M1 Garrand
> or an M-14.
Kenneth Porter wrote:
--On Thursday, June 01, 2006 1:41 PM -0400 DAve
<[EMAIL PROTECTED]> wrote:
Currently 3.0.4 on the toasters, 3.0.2 on the MailScanner boxes. These
may or may not get updates this month. I've never been fond of "update"
as a solution to a problem unless I know the change in
David Goldsmith wrote:
We are running SA 3.1.0. Reading this thread today, I just found the
SARE_STOCKS ruleset. I updated the rules_du_jour script and pulled down
the ruleset. Have received some messages already that are being caught.
Some others are making it through with scores of 6.7 -
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Kenneth Porter wrote:
> --On Thursday, June 01, 2006 1:41 PM -0400 DAve
> <[EMAIL PROTECTED]> wrote:
>
>> Currently 3.0.4 on the toasters, 3.0.2 on the MailScanner boxes. These
>> may or may not get updates this month. I've never been fond of "update"
--On Thursday, June 01, 2006 1:41 PM -0400 DAve <[EMAIL PROTECTED]>
wrote:
Currently 3.0.4 on the toasters, 3.0.2 on the MailScanner boxes. These
may or may not get updates this month. I've never been fond of "update"
as a solution to a problem unless I know the change in version will
directly
> Bayes, arrgg!! More than once I've been given examples of bayes being
> the solution I need. I really really really want bayes to
> work. But each
> time I set it up, the db gets huge, scan times go through the
> roof, and
> I end up disappointed. The one time it worked for me I ended
> up traini
> time to try them again. SpamCop, I won't go there, we have issues with
> the people at SpamCop. I neither use them nor trust them.
You REALLY need to try URIBL, and probably uriblack, and a few more of the
URI based lists. These get feeds from SpamCop and the like. But they work.
Lore
stock hit plus any other rule, add 5 points.
If it isn't hitting your stock spams we probably need to see a few of them
to improve the ruleset. It sure catches most all of mine.
Loren
On Thursday June 1 2006 20:53, DAve wrote:
> Bayes, arrgg!! More than once I've been given examples of bayes being
> the solution I need. I really really really want bayes to work. But each
> time I set it up, the db gets huge, scan times go through the roof, and
> I end up disappointed.
> I curre
On Thu, Jun 01, 2006 at 02:53:56PM -0400, DAve wrote:
> Theo, I appreciate the results, that means more to me than "upgrade".
> Results speak louder than anything else. Could you tell me the scores
> for each test? If you are as busy as I am, I understand if you can not
Not off hand, but they'r
Theo Van Dinter wrote:
On Thu, Jun 01, 2006 at 01:41:36PM -0400, DAve wrote:
Currently 3.0.4 on the toasters, 3.0.2 on the MailScanner boxes. These
[...]
http://pixelhammer.com/spam/spam1.txt
http://pixelhammer.com/spam/spam2.txt
http://pixelhammer.com/spam/spam3.txt
http://pixelhammer.com/spa
;http://pixelhammer.com/spam/spam3.txt
>http://pixelhammer.com/spam/spam4.txt
>http://pixelhammer.com/spam/spam5.txt
>http://pixelhammer.com/spam/spam6.txt
>
>Thanks,
>
>DAve
>
>
>>
>> KR
>>
>> Nigel
>>
>> On Thu, 01 Jun 2006 12:48:50 -04
On Thu, Jun 01, 2006 at 01:41:36PM -0400, DAve wrote:
> Currently 3.0.4 on the toasters, 3.0.2 on the MailScanner boxes. These
[...]
> http://pixelhammer.com/spam/spam1.txt
> http://pixelhammer.com/spam/spam2.txt
> http://pixelhammer.com/spam/spam3.txt
> http://pixelhammer.com/spam/spam4.txt
> htt
ils.. i don't think its normal. You *should* have a BAYES score for
every mail (even HAM) unless you use the skip option.
- dhawal
Thanks,
DAve
KR
Nigel
On Thu, 01 Jun 2006 12:48:50 -0400, DAve <[EMAIL PROTECTED]>
wrote:
Doc Schneider wrote:
DAve wrote:
Howdy,
My users a
ED]>
wrote:
Doc Schneider wrote:
DAve wrote:
Howdy,
My users are just about tired of the stock spams, we are getting many
now that are barely hitting any stock rules at all. The funny thing is
they are pretty much a legit email. No obfuscation, no funky headers,
no URL.
I am nearly r
wrote:
>Doc Schneider wrote:
>> DAve wrote:
>>> Howdy,
>>>
>>> My users are just about tired of the stock spams, we are getting many
>>> now that are barely hitting any stock rules at all. The funny thing is
>>> they are pretty much a legit ema
Doc Schneider wrote:
DAve wrote:
Howdy,
My users are just about tired of the stock spams, we are getting many
now that are barely hitting any stock rules at all. The funny thing is
they are pretty much a legit email. No obfuscation, no funky headers,
no URL.
I am nearly ready to just
DAve wrote:
Howdy,
My users are just about tired of the stock spams, we are getting many
now that are barely hitting any stock rules at all. The funny thing is
they are pretty much a legit email. No obfuscation, no funky headers, no
URL.
I am nearly ready to just stomp any and all stock
Howdy,
My users are just about tired of the stock spams, we are getting many
now that are barely hitting any stock rules at all. The funny thing is
they are pretty much a legit email. No obfuscation, no funky headers, no
URL.
I am nearly ready to just stomp any and all stock messages and
On Tue, Feb 28, 2006 at 11:37:46AM -0800, Loren Wilton wrote:
> I'm not absolutely sure what @name in a regex really means to perl, but it
> seems to not be what I usually expect. Escaping the @ ends up producing the
> right results.
@name means the array "name". Perl isn't sure whether or not y
> Could you kindly explain to me about the @ character and why it needs to
be
> escaped, or in what conditions it needs to be escaped? Eg. you seem to
imply
> that it only needs to be escaped if followed by an alphabetic character.
Is
It seems to be a Perl thing, if it sees @name in a regex it see
r to use
the + until it reaches the end of the line and the \n. Hope I make sense! I
understand me anyway which I'm sure should count for something..
Cheers,
Jeremy
- Original Message -
From: "Loren Wilton" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, February 2
ites like
http://www.regular-expressions.info.
Cheers,
Jeremy
- Original Message -
From: "Loren Wilton" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, February 28, 2006 10:14 AM
Subject: Re: GIF stock spams
Interesting set of rules, they look like they should do fairly well. I&
> although I imagine
> they would be able to find a more efficient or less FP-risky way of
writing
> them.
Not necessarily. Other than the things I mentioned, I don't see anything
particularly scarey about these rules. We have certainly written rules of
this sort to catch other things. By prefe
Wilton" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, February 28, 2006 10:14 AM
Subject: Re: GIF stock spams
Interesting set of rules, they look like they should do fairly well. I'll
run a masscheck on them in a minute. If they are decent I'm sure SARE
would
be happy to incl
Interesting set of rules, they look like they should do fairly well. I'll
run a masscheck on them in a minute. If they are decent I'm sure SARE would
be happy to include them in the stock spam ruleset if you give permission.
The only thing I see that makes me a little nervous is the unescaped @
ould score them according
to your own needs. I find in my own setup that Bayes always gives a negative
score to these spams due to the random text they have at the end of them, so
I actaully score these two rules of mine much higher to counter that.
Incidentally, none of the GIF stock spams I've receiv
Joey a écrit :
> So if I use postfix I'm SOL?
amavisd-new.
[EMAIL PROTECTED]
> Enviado el: viernes, 24 de febrero de 2006 19:06
> Para: 'Ruben Cardenal'; users@spamassassin.apache.org
> Asunto: RE: GIF stock spams
>
> Sorry wasn't thinking, should this work?
>
>
> header ICAB_FW2 Subject =~ /^Fw:\s\d{1,9}$/i s
users@spamassassin.apache.org
Subject: RE: GIF stock spams
Hi Joel,
Well, I have spamassassin scoring as spam from 3.0 on, and until 14 gets
quarantined for review for messages not scoring BAYES_99. Almost 250.000
messages scoring over 14 with only 1 FP being rejected (and was quite an
unusual situ
So if I use postfix I'm SOL?
-Original Message-
From: Ruben Cardenal [mailto:[EMAIL PROTECTED]
Sent: Friday, February 24, 2006 1:02 PM
To: users@spamassassin.apache.org
Subject: RE: GIF stock spams
Hi Joel,
Well, I have spamassassin scoring as spam from 3.0 on, and until 14
llinare.org/qmail-scanner/) That kind of funcinality has
been added in the Qmail-Scanner 2.00 RC1 .
Good luck,
Ruben
> -Mensaje original-
> De: Joey [mailto:[EMAIL PROTECTED]
> Enviado el: viernes, 24 de febrero de 2006 18:47
> Para: users@spamassassin.apache.org
> Asun
I get a ton of these. However, I've also got about 30 spamtrap addresses
aliased to my account. I also run my SA threshold at 7, so those two factors
probably account for a lot of the reason I get so many.
Anyway, the SARE stock rules help quite a bit, but I still see a fair number
of these t
* 6.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
So 6.0 point for your BAYES I hope your BAYES is well trained and never
gets corrupted
Works like a charm :)
i've only dared goto a 3 however so far so good
>
> > * 6.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
>
> So 6.0 point for your BAYES I hope your BAYES is well trained and never
> gets corrupted
Works like a charm :)
Ruben
: users@spamassassin.apache.org
Subject: RE: GIF stock spams
I catch them all, for example:
X-Spam-Report:
* 1.0 ICAB_FW2 ICAB_FW2
* 1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type=
entry
* 1.9 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of
words
nt: Friday, February 24, 2006 11:35 AM
To: users@spamassassin.apache.org
Subject: GIF stock spams
Hello,
Has anyone written any rules to catch the following types of spam
http://nisk.creenet.com/~cconn/sa/
They consist of a few lines of text (sometimes), and a .gif attachment that
is in fact some p
: Bayesian spam probability is 99 to 100%
>
> header ICAB_FW2 Subject =~ /^Fw:\s\d{1,9}$/i
> score ICAB_FW2 1
>
> Ruben
>
>
> > -Mensaje original-
> > De: Chris Conn [mailto:[EMAIL PROTECTED]
> > Enviado el: viernes, 24 de febrero de 2006 1
org
> Asunto: GIF stock spams
>
> Hello,
>
> Has anyone written any rules to catch the following types of spam
>
>
> http://nisk.creenet.com/~cconn/sa/
>
>
> They consist of a few lines of text (sometimes), and a .gif attachment
> that
> is in fact so
Hello,
Has anyone written any rules to catch the following types of spam
http://nisk.creenet.com/~cconn/sa/
They consist of a few lines of text (sometimes), and a .gif attachment that
is in fact some penny stock being pushed.
Thanks in advance,
Chris
82 matches
Mail list logo
