tag:old.nabble.com,2006:forum-191Nabble - SpamAssassin2009-11-25T15:39:26Z<div style="float:left;padding:5px">
<img src="http://spamassassin.apache.org/images/arrowlogo.png" title="SpamAssassin" width="150" height="75">
</div>
<a href="http://spamassassin.apache.org/" target="_top" rel="nofollow">SpamAssassin</a> is a mature, widely-deployed open source project that serves as a mail filter to identify Spam. SpamAssassin uses a variety of mechanisms including header and text analysis, Bayesian filtering, DNS blocklists, and collaborative filtering databases. SpamAssassin runs on a server, and filters spam before it reaches your mailbox.tag:old.nabble.com,2006:post-26522268[Bug 6155] generate new scores for 3.3.0 release2009-11-25T15:39:26Z2009-11-25T15:39:26ZBugzilla from bugzilla-daemon@bugzilla.spamassassin.org<a href="https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6155" target="_top" rel="nofollow">https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6155</a><br><br>--- Comment #170 from Warren Togami <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26522268&i=0" target="_top" rel="nofollow">wtogami@...</a>> 2009-11-25 15:39:17 UTC ---
<br>Created an attachment (id=4579)
<br> --> (<a href="https://issues.apache.org/SpamAssassin/attachment.cgi?id=4579" target="_top" rel="nofollow">https://issues.apache.org/SpamAssassin/attachment.cgi?id=4579</a>)
<br>patch for 10_force_active.cf
<br><br>Nobody responded to the previous comment. I didn't know how this file was
<br>generated before. I took 50_scores.cf and took all rule names that were not
<br>commented out for this patch. Is this correct?
<br><br>--
<br>Configure bugmail: <a href="https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email" target="_top" rel="nofollow">https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email</a><br>------- You are receiving this mail because: -------
<br>You are the assignee for the bug.
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Dev-f194.html" embed="fixTarget[194]" target="_top" >SpamAssassin - Dev</a></p>tag:old.nabble.com,2006:post-26522224[OT] Re: well, isnt that special...2009-11-25T15:34:25Z2009-11-25T15:34:25ZAlex-325Hi,
<br><br>> not relevant to Spamassassin, is it?
<br>>
<br>> if you have to go way off topic at pleas be considerat and add an OT: tag to
<br>> the subject.. > /dev/null
<br>>
<br>> or try: <a href="http://spam-l.com/mailman/listinfo" target="_top" rel="nofollow">http://spam-l.com/mailman/listinfo</a><br><br>Yes, very much OT. I was following along with the other iptables comments.
<br><br>Thanks for the pointer to spam-l.
<br><br>Alex
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26521913Re: well, isnt that special...2009-11-25T15:08:02Z2009-11-25T15:08:02ZYet Another NinjaOn 11/25/2009 11:29 PM, Alex wrote:
<div class='shrinkable-quote'><br>>>> iptables -A FIREWALL -s 127.0.0.0/8 -j DROP
<br>>>>
<br>>> Very good. That was nearly funny :-) Why don't you add:
<br>>> iptables -A FIREWALL -s 0.0.0.0/0 -j DROP and enjoy the silence :-)
<br>>
<br>> Trouble is that you have to be the one that drives to the colo to
<br>> eventually undo the rules :-)
<br>>
<br>> Speaking of fw rules, has anyone considered something to automate the
<br>> SANS top 10?
<br>>
<br>> <a href="http://isc.sans.org/top10.html" target="_top" rel="nofollow">http://isc.sans.org/top10.html</a><br>>
<br>> Would that be effective?
</div><br>not relevant to Spamassassin, is it?
<br><br>if you have to go way off topic at pleas be considerat and add an OT:
<br>tag to the subject.. > /dev/null
<br><br>or try: <a href="http://spam-l.com/mailman/listinfo" target="_top" rel="nofollow">http://spam-l.com/mailman/listinfo</a><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26521407Re: well, isnt that special...2009-11-25T14:29:55Z2009-11-25T14:29:55ZAlex-325>> iptables -A FIREWALL -s 127.0.0.0/8 -j DROP
<br>>>
<br>> Very good. That was nearly funny :-) Why don't you add:
<br>> iptables -A FIREWALL -s 0.0.0.0/0 -j DROP and enjoy the silence :-)
<br><br>Trouble is that you have to be the one that drives to the colo to
<br>eventually undo the rules :-)
<br><br>Speaking of fw rules, has anyone considered something to automate the
<br>SANS top 10?
<br><br><a href="http://isc.sans.org/top10.html" target="_top" rel="nofollow">http://isc.sans.org/top10.html</a><br><br>Would that be effective?
<br><br>Alex
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26520173Re: UCEPROTECT questions2009-11-25T12:58:20Z2009-11-25T12:58:20ZMichael Scheidell-2Alex wrote:
<div class='shrinkable-quote'><br>> Hi,
<br>>
<br>> I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
<br>> works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
<br>> wondered if I was doing something wrong.
<br>>
<br>> I've set the score to 0.01 for now, while I watch and see how it works
<br>> here. What's a more reasonable score? I don't think I would ever use
<br>> UCEPROTECT2 or UCEPROTECT3, as we have a lot of verizon/comcast users
<br>> where the whole block or ASN could be blacklisted.
<br>>
<br>> Can you give me some history of this blocklist?
<br>>
<br>> Thanks,
<br>> Alex
<br>>
</div>this is actually an interesting addition to your MTA
<br><br>from their web site:
<br>Edit /etc/postfix/main.cf:
<br>smtpd_recipient_restrictions =
<br>...
<br>check_sender_access dbm:/etc/postfix/check_backscatterer
<br>...
<br>Create new file:/etc/postfix/check_backscatterer:
<br><> reject_rbl_client ips.backscatterer.org
<br>postmaster reject_rbl_client ips.backscatterer.org
<br><br><br>I decided to try it here with
<br>check_sender_access pcre:check_backscatter.
<br><br>new file has this in it:
<br><br>/^(<>$|postmaster@|MAILER-DAEMON)/ reject_rbl_client ips.backscatterer.org
<br><br><br>beauty of that is, that it only triggers if the SMTP envelope is <> or
<br>postmaster@* or MAILER-DAEMON*
<br>then it checks the senders ip against the backscatter list.
<br><br>MOSTLY, what do I care if I don't get ANY bounce, let alone if they are
<br>on the backscatter list.
<br><br>so, the FPs' would be confined to bounces anyway.
<br><br>and, at smtp time, the error goes direct to responsible smtp server, and
<br>doesn't create your own backscatter.
<br><br><br>_________________________________________________________________________
<br>This email has been scanned and certified safe by SpammerTrap(r).
<br>For Information please see <a href="http://www.spammertrap.com" target="_top" rel="nofollow">http://www.spammertrap.com</a><br>_________________________________________________________________________
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26519161Re: UCEPROTECT questions2009-11-25T11:49:00Z2009-11-25T11:49:00ZMariusz Kruk-3Alex pisze:
<br>> I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
<br>> works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
<br>> wondered if I was doing something wrong.
<br><br>Yes, UCEPROTECT seems to be just a big scam. Only thing it seems to care
<br>about is the money for 'express delisting' or for whitelisting hosts (I
<br>suppose that's why they list whole big networks).
<br>Just one opinion - <a href="http://www.aaroncake.net/misc/showthought.asp?thought=57" target="_top" rel="nofollow">http://www.aaroncake.net/misc/showthought.asp?thought=57</a><br>There are many more like this one on the web.
<br>Too bad there are some commercial appliances that use this RBL by
<br>default. Otherwise noone in their sane minds would use this (at least
<br>not any levels higher than 1).
<br><br><br>--
<br>Mariusz Kruk
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26519062Re: well, isnt that special...2009-11-25T11:42:12Z2009-11-25T11:42:12Zrichard@buzzhost.co.ukOn Wed, 2009-11-25 at 14:04 -0500, Alex wrote:
<br>> > iptables -A FIREWALL -s 127.0.0.0/8 -j DROP
<br>>
<br>> Nah, use REJECT so you get that immediate satisfaction :-)
<br>>
<br>> Alex
<br><br>NO NO NO NO NO!
<br>Drop has the effect of tarpitting them :-) As the Supremes sang;
<br>"Set me free why don't you baby? .... You just keep me hangin' on...."
<br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26519030Re: well, isnt that special...2009-11-25T11:40:21Z2009-11-25T11:40:21Zrichard@buzzhost.co.ukOn Wed, 2009-11-25 at 19:20 +0100, Benny Pedersen wrote:
<br>> On ons 25 nov 2009 18:55:11 CET, "<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26519030&i=0" target="_top" rel="nofollow">richard@...</a>" wrote
<br>> > Any more ranges most welcome :-)
<br>>
<br>> iptables -A FIREWALL -s 127.0.0.0/8 -j DROP
<br>>
<br>Very good. That was nearly funny :-) Why don't you add:
<br>iptables -A FIREWALL -s 0.0.0.0/0 -j DROP and enjoy the silence :-)
<br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26519016Re: UCEPROTECT questions2009-11-25T11:39:06Z2009-11-25T11:39:06Zrichard@buzzhost.co.ukOn Wed, 2009-11-25 at 13:45 -0500, Alex wrote:
<div class='shrinkable-quote'><br>> Hi,
<br>>
<br>> I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
<br>> works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
<br>> wondered if I was doing something wrong.
<br>>
<br>> I've set the score to 0.01 for now, while I watch and see how it works
<br>> here. What's a more reasonable score? I don't think I would ever use
<br>> UCEPROTECT2 or UCEPROTECT3, as we have a lot of verizon/comcast users
<br>> where the whole block or ASN could be blacklisted.
<br>>
<br>> Can you give me some history of this blocklist?
<br>>
<br>> Thanks,
<br>> Alex
</div>I would not trust it to block on as it does appear to catch lots of ham.
<br>Claus, the ?owner? of Uceprotect is a bit of an assclown with an odd
<br>listing policy. This includes buying old expired domains and then
<br>listing anything that emails them. This includes opt-in mail from the
<br>previous domain owner.
<br><br>There has been quite a bit of discussion on this in the NANAE Usenet
<br>group. You can find references to it via google groups, but be warned
<br>it's a very nasty, aggressive and abusive group to visit.
<br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26518985Re: well, isnt that special...2009-11-25T11:37:11Z2009-11-25T11:37:11ZTara Natanson-2<br><br><div class="gmail_quote">On Wed, Nov 25, 2009 at 1:49 PM, R-Elists <span dir="ltr"><<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26518985&i=0" target="_top" rel="nofollow">lists07@...</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im"><br></div>
<br>
umm side note, i spose to Tara...<br>
<br>
is Constant Contact like the default email marketing system (or one of them)<br>
for <a href="http://salesforce.com" target="_blank" rel="nofollow">salesforce.com</a> or whatever other large "online" customer management<br>
software??? or do you own them or they own you or what is the scoop?<br>
<br></blockquote></div><br>Someone recently developed an API to port your salesforce contacts to CC (same permission standards apply). There are a few others out there like Quickbooks I think who have built similar APIs. <br>
<br>Any reason in particular? <br><br>Tara <br>
<p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26518749RE: Problems with whitelists and simscan2009-11-25T11:21:15Z2009-11-25T11:21:15ZJose Luis Marin Perez<html>
<head>
</head>
<body class='hmmessage'>
Hi Rick,<br><br><span id="result_box" class="medium_text"><span title="Gracias por tu respuesta.">Thanks for your answer.<br><br></span><span title="Entonces para estos casos como podria hacer para que funcionen las listas blancas?">So for these cases as could do to work whitelists?<br><br></span><span title="Se puede solucinar en spamassassin o simscan?">It can be solution in spamassassin or simscan?<br><br></span><span title="Gracias">Thanks<br><br>Jose Luis<br></span></span><div class='shrinkable-quote'><br>> Date: Wed, 25 Nov 2009 13:23:02 -0500<br>> From: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26518749&i=0" target="_top" rel="nofollow">rickm@...</a><br>> To: <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26518749&i=1" target="_top" rel="nofollow">users@...</a><br>> Subject: Re: Problems with whitelists and simscan<br>> <br>> Jose Luis Marin Perez wrote:<br>> > Dear Sirs<br>> > <br>> > I noticed a problem with Spamassassin whitelists and Simscan:<br>> > <br>> > Spamassassin is configured to use white lists using mysql (for example)<br>> > <br>> > *mysql> select * from userpref;<br>> > +------------------------------+----------------+-------------------------+--------+<br>> > | username | preference | <br>> > value | prefid |<br>> > +------------------------------+----------------+-------------------------+--------+<br>> > | <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26518749&i=2" target="_top" rel="nofollow">jmarin@...</a> | whitelist_from | <br>> > <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26518749&i=3" target="_top" rel="nofollow">jolumape_al@...</a> | 2 |<br>> > | <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26518749&i=4" target="_top" rel="nofollow">lcampo@...</a> | whitelist_from | <br>> > <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26518749&i=5" target="_top" rel="nofollow">jolumape_al@...</a> | 3 |<br>> > +------------------------------+----------------+-------------------------+--------+<br>> > 2 rows in set (0.01 sec)*<br>> <br>> Hello,<br>> <br>> When more than one recipient for an email is received simscan uses the <br>> default user when passing to spamd. So install of -u <br>> <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26518749&i=6" target="_top" rel="nofollow">jmarin@...</a> being passed by spamc, no -u is used and <br>> spamd uses the default values.<br>> <br>> Regards,<br>> <br>> Rick<br>> </div> <br /><hr />Explore the seven wonders of the world <a href='http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE' target='_new' rel="nofollow">Learn more!</a></body>
</html><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26518482Re: well, isnt that special...2009-11-25T11:04:14Z2009-11-25T11:04:14ZAlex-325> iptables -A FIREWALL -s 127.0.0.0/8 -j DROP
<br><br>Nah, use REJECT so you get that immediate satisfaction :-)
<br><br>Alex
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26518464RE: UCEPROTECT questions2009-11-25T11:03:07Z2009-11-25T11:03:07ZMcDonald, DanOn Wed, 2009-11-25 at 10:53 -0800, R-Elists wrote:
<br>>
<br>> >
<br>> > I'm interested in people's opinion of UCEPROTECT. I'm aware
<br>> > of how it works, but even UCEPROTECT1 seems to catch an awful
<br>> > lot of ham, and I wondered if I was doing something wrong.
<br>> >
<br><br>>
<br>> Alex,
<br>>
<br>> we use all 3 and adjust score accordingly...
<br><br>Ditto.
<br><br>of more interest to me was the ips.backscatterer list. I configured it
<br>like so:
<br><br>meta RCVD_IN_BACKSCATTER_RELAY (__BOUNCE_FROM_DAEMON && __RCVD_IN_BACKSCATTER) && ! __RCVD_IN_UCEWHITE
<br>tflags RCVD_IN_BACKSCATTER_RELAY net
<br>describe RCVD_IN_BACKSCATTER_RELAY received from a host that does a lot of backscatter
<br>score RCVD_IN_BACKSCATTER_RELAY 1.30
<br><br>It's helped with some of the backscatter problems we were seeing. I
<br>also haven't been overly scientific about it, but I've not had any
<br>false-positive reports, and I recall at least one false-negative
<br>complaint where RCVD_IN_BACKSCATTER_RELAY had been triggered. (the total
<br>score was only about 4.6, IIRC).
<br><br><br><br><br><br><br>--
<br>Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
<br>www.austinenergy.com
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26518311RE: UCEPROTECT questions2009-11-25T10:53:46Z2009-11-25T10:53:46ZR-Elists
<br><div class='shrinkable-quote'><br>>
<br>> I'm interested in people's opinion of UCEPROTECT. I'm aware
<br>> of how it works, but even UCEPROTECT1 seems to catch an awful
<br>> lot of ham, and I wondered if I was doing something wrong.
<br>>
<br>> I've set the score to 0.01 for now, while I watch and see how
<br>> it works here. What's a more reasonable score? I don't think
<br>> I would ever use
<br>> UCEPROTECT2 or UCEPROTECT3, as we have a lot of
<br>> verizon/comcast users where the whole block or ASN could be
<br>> blacklisted.
<br>>
<br>> Can you give me some history of this blocklist?
<br>>
<br>> Thanks,
<br>> Alex
<br>>
</div><br>Alex,
<br><br>we use all 3 and adjust score accordingly...
<br><br>have had good general results since we started using them...
<br><br>we are not or have not been doing anything scientific with that info, so it
<br>is just another potential spammy sign...
<br><br> - rh
<br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26518241RE: well, isnt that special...2009-11-25T10:49:07Z2009-11-25T10:49:07ZR-Elists
<br><br>>
<br>> uri LOCAL_URI_C_CONTACT m{constantcontact\.com\b}
<br>> score LOCAL_URI_C_CONTACT 12
<br>> describe LOCAL_URI_C_CONTACT contains link to
<br>> constant contact [dot] com
<br>>
<br><br>thanks Ned,
<br><br>i do have a coupla companies that use CC for email so i wont totally whack.
<br>they are getting a bit to generous on those marking emails to me though.
<br><br>umm side note, i spose to Tara...
<br><br>is Constant Contact like the default email marketing system (or one of them)
<br>for salesforce.com or whatever other large "online" customer management
<br>software??? or do you own them or they own you or what is the scoop?
<br><br> - rh
<br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26518173UCEPROTECT questions2009-11-25T10:45:20Z2009-11-25T10:45:20ZAlex-325Hi,
<br><br>I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
<br>works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
<br>wondered if I was doing something wrong.
<br><br>I've set the score to 0.01 for now, while I watch and see how it works
<br>here. What's a more reasonable score? I don't think I would ever use
<br>UCEPROTECT2 or UCEPROTECT3, as we have a lot of verizon/comcast users
<br>where the whole block or ASN could be blacklisted.
<br><br>Can you give me some history of this blocklist?
<br><br>Thanks,
<br>Alex
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26518137RE: well, isnt that special...2009-11-25T10:43:17Z2009-11-25T10:43:17ZR-Elists<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.18852"></HEAD>
<BODY>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN class=421584018-25112009>thanks Tara, not the hugest
biggie...</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN class=421584018-25112009></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN class=421584018-25112009>yet since we are only on a few select lists and use
this email address, i figured several others on this list were getting it
too</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN class=421584018-25112009></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN class=421584018-25112009>i did forward both to abuse at your site with
headers</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN class=421584018-25112009></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN class=421584018-25112009>happy gobble gobble everyone!</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN class=421584018-25112009></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN class=421584018-25112009> - rh</SPAN></FONT></DIV><BR>
<BLOCKQUOTE style="BORDER-LEFT: #0000ff 2px solid; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px">
<DIV dir=ltr lang=en-us class=OutlookMessageHeader align=left><FONT color=#0000ff size=2 face=Arial></FONT><BR>I've got Compliance on it already
thanks. And if I find the money pile I'll let ya know. ;) <BR>I'll
report back to you what they find. <BR> <SPAN class=421584018-25112009><FONT color=#0000ff size=2 face=Arial> </FONT></SPAN></DIV></BLOCKQUOTE></BODY></HTML>
<p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26517902[Bug 6046] Add BayesStore backend using direct calls to BerkeleyDB2009-11-25T10:25:39Z2009-11-25T10:25:39ZBugzilla from bugzilla-daemon@bugzilla.spamassassin.org<a href="https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6046" target="_top" rel="nofollow">https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6046</a><br><br>Mark Martinec <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517902&i=0" target="_top" rel="nofollow">Mark.Martinec@...</a>> changed:
<br><br> What |Removed |Added
<br>----------------------------------------------------------------------------
<br> Target Milestone|3.3.0 |3.3.1
<br><br>--- Comment #26 from Mark Martinec <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517902&i=1" target="_top" rel="nofollow">Mark.Martinec@...</a>> 2009-11-25 10:25:36 UTC ---
<br>I tried it running for a couple of hours, seems to work: it did learn tokens
<br>starting with an empty database, it did start providing good results once
<br>it reached the 200 messages limit, but after a couple of hours it became
<br>slower and slower (using libdb47), so I had to turn it off.
<br><br>As it is, it's good enough for 3.3.0 (provided some warning text is written
<br>in release notes). I'm moving it off to 3.3.1 target, perhaps someone would
<br>be willing to improve it by then.
<br><br>--
<br>Configure bugmail: <a href="https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email" target="_top" rel="nofollow">https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email</a><br>------- You are receiving this mail because: -------
<br>You are the assignee for the bug.
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Dev-f194.html" embed="fixTarget[194]" target="_top" >SpamAssassin - Dev</a></p>tag:old.nabble.com,2006:post-26517866Re: Problems with whitelists and simscan2009-11-25T10:23:02Z2009-11-25T10:23:02ZRick Macdougall-2Jose Luis Marin Perez wrote:
<div class='shrinkable-quote'><br>> Dear Sirs
<br>>
<br>> I noticed a problem with Spamassassin whitelists and Simscan:
<br>>
<br>> Spamassassin is configured to use white lists using mysql (for example)
<br>>
<br>> *mysql> select * from userpref;
<br>> +------------------------------+----------------+-------------------------+--------+
<br>> | username | preference |
<br>> value | prefid |
<br>> +------------------------------+----------------+-------------------------+--------+
<br>> | <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517866&i=0" target="_top" rel="nofollow">jmarin@...</a> | whitelist_from |
<br>> <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517866&i=1" target="_top" rel="nofollow">jolumape_al@...</a> | 2 |
<br>> | <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517866&i=2" target="_top" rel="nofollow">lcampo@...</a> | whitelist_from |
<br>> <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517866&i=3" target="_top" rel="nofollow">jolumape_al@...</a> | 3 |
<br>> +------------------------------+----------------+-------------------------+--------+
<br>> 2 rows in set (0.01 sec)*
</div><br>Hello,
<br><br>When more than one recipient for an email is received simscan uses the
<br>default user when passing to spamd. So install of -u
<br><a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517866&i=4" target="_top" rel="nofollow">jmarin@...</a> being passed by spamc, no -u is used and
<br>spamd uses the default values.
<br><br>Regards,
<br><br>Rick
<br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26517827Re: well, isnt that special...2009-11-25T10:20:30Z2009-11-25T10:20:30ZBenny PedersenOn ons 25 nov 2009 18:55:11 CET, "<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517827&i=0" target="_top" rel="nofollow">richard@...</a>" wrote
<br>> Any more ranges most welcome :-)
<br><br>iptables -A FIREWALL -s 127.0.0.0/8 -j DROP
<br><br>--
<br>xpoint
<br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26517789[Bug 5883] support for Communigate Pro Received: header2009-11-25T10:17:34Z2009-11-25T10:17:34ZBugzilla from bugzilla-daemon@bugzilla.spamassassin.org<a href="https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5883" target="_top" rel="nofollow">https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5883</a><br><br>--- Comment #5 from Mark Martinec <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517789&i=0" target="_top" rel="nofollow">Mark.Martinec@...</a>> 2009-11-25 10:17:32 UTC ---
<br> Bug 5883 - support for Communigate Pro 'Received' header field;
<br> folded-in all supplied test cases into t/rcvd_parser.t
<br>Sending lib/Mail/SpamAssassin/Message/Metadata/Received.pm
<br>Sending t/rcvd_parser.t
<br>Committed revision 884223.
<br><br><br>The situation is much improved now, thanks!
<br><br>There is still one of the supplied test cases failing, which is why
<br>I left it commented out in rcvd_parser.t (the last one).
<br><br>According to the problem description (contains 'verified'), the following
<br>header field should provide the 'docsis-77-106-72-91.tomtelnet.ru' both as
<br>a helo name, as well as the rdns name - yet it leaves rdns empty:
<br><br>Received: from docsis-77-106-72-91.tomtelnet.ru (account
<br><a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517789&i=1" target="_top" rel="nofollow">moskalenko@...</a> [77.106.72.91] verified) by relay2.tomsk.ru
<br>(CommuniGate Pro SMTP 5.1.13) with ESMTPSA id 9828571 for
<br><a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517789&i=2" target="_top" rel="nofollow">hostmaster@...</a>; Sun, 06 Apr 2008 04:00:16 +0700
<br><br><br>expected: [ ip=77.106.72.91 rdns=docsis-77-106-72-91.tomtelnet.ru
<br>helo=docsis-77-106-72-91.tomtelnet.ru by=relay2.tomsk.ru ident= envfrom=
<br>id=9828571 auth=ESMTPSA msa=0 ]
<br><br>got : [ ip=77.106.72.91 rdns= helo=docsis-77-106-72-91.tomtelnet.ru
<br>by=relay2.tomsk.ru ident= envfrom= id=9828571 auth=ESMTPSA msa=0 ]
<br><br><br>Please improve the patch.
<br><br>--
<br>Configure bugmail: <a href="https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email" target="_top" rel="nofollow">https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email</a><br>------- You are receiving this mail because: -------
<br>You are the assignee for the bug.
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Dev-f194.html" embed="fixTarget[194]" target="_top" >SpamAssassin - Dev</a></p>tag:old.nabble.com,2006:post-26517524Problems with whitelists and simscan2009-11-25T09:59:23Z2009-11-25T09:59:23ZJose Luis Marin Perez<html>
<head>
</head>
<body class='hmmessage'>
<span id="result_box" class="long_text"><span title="Estimados Sres.">Dear Sirs<br><br></span><span title="He notado un problema con las listas blancas de Spamassasin y Simscan:">I noticed a problem with Spamassassin whitelists and Simscan:<br><br></span><span style="" title="Spamassassin esta configurado para utilizar listas blancas mediante mysql (Para ejemplos)">Spamassassin is configured to use white lists using mysql (for example)<br><br><b><font style="font-size: 8pt;" size="1">mysql> select * from userpref;</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">+------------------------------+----------------+-------------------------+--------+</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">| username | preference | value | prefid |</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">+------------------------------+----------------+-------------------------+--------+</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">| <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=0" target="_top" rel="nofollow">jmarin@...</a> | whitelist_from | <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=1" target="_top" rel="nofollow">jolumape_al@...</a> | 2 |</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">| <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=2" target="_top" rel="nofollow">lcampo@...</a> | whitelist_from | <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=3" target="_top" rel="nofollow">jolumape_al@...</a> | 3 |</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">+------------------------------+----------------+-------------------------+--------+</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">2 rows in set (0.01 sec)</font></b><br><br></span><span style="" title="Cuando envio correo individualmente a estas cuentas funciona corectamente la lista blanca:">When I send mail to these accounts individually operate normally white list (SIMSCAN DEBUG):<br><br><font style="font-size: 8pt;" size="1"><b>@400000004b0d6d6c1ea5738c qmail-smtpd: pid 27178 Accept::RCPT::Rcpthosts_Rcptto: P:ESMTP S:65.55.34.221:unknown H:col0-omc4-s19.col0.hotmail.com F:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=4" target="_top" rel="nofollow">jolumape_al@...</a> T:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=5" target="_top" rel="nofollow">jmarin@...</a><br>@400000004b0d6d6c2c0e677c simscan: cdb looking up<br>@400000004b0d6d6c2c11da4c simscan: cdb for found clam=yes,spam=yes,spam_hits=5.0,attach=.pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll<br>@400000004b0d6d6c2c12862c simscan: pelookup clam = yes<br>@400000004b0d6d6c2c1312cc simscan: pelookup spam = yes<br>@400000004b0d6d6c2c137474 simscan: pelookup spam_hits = 5.0<br>@400000004b0d6d6c2c14b0dc simscan: Per Domain Hits set to : 5.000000<br>@400000004b0d6d6c2c15260c simscan: pelookup attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll<br>@400000004b0d6d6c2c1587b4 simscan: attachment flag attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll<br>@400000004b0d6d6c2c162bc4 simscan: .pif is attachment number 0<br>@400000004b0d6d6c2c16953c simscan: .scr is attachment number 1<br>@400000004b0d6d6c2c16f2fc simscan: .vbs is attachment number 2<br>@400000004b0d6d6c2c174cd4 simscan: .bat is attachment number 3<br>@400000004b0d6d6c2c17a6ac simscan: .bas is attachment number 4<br>@400000004b0d6d6c2c180084 simscan: .cmd is attachment number 5<br>@400000004b0d6d6c2c185a5c simscan: .com is attachment number 6<br>@400000004b0d6d6c2c18b04c simscan: .exe is attachment number 7<br>@400000004b0d6d6c2c190a24 simscan: .dll is attachment number 8<br>@400000004b0d6d6c2c19fc54 simscan: starting: work dir: /var/qmail/simscan/1259171170.739859.27217<br>@400000004b0d6d6c3998fccc simscan: pelookup: called with <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=6" target="_top" rel="nofollow">jolumape_al@...</a><br>@400000004b0d6d6c3999143c simscan: pelookup: domain is hotmail.com<br>@400000004b0d6d6c399923dc simscan: cdb looking up hotmail.com<br>@400000004b0d6d6c3999337c simscan: pelookup: local part is jolumape_al<br>@400000004b0d6d6c3999431c simscan: cdb looking up <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=7" target="_top" rel="nofollow">jolumape_al@...</a><br>@400000004b0d6d6c399952bc simscan: pelookup: called with <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=8" target="_top" rel="nofollow">jmarin@...</a><br>@400000004b0d6d6c39995e74 simscan: pelookup: domain is enlaceaduanero.com.pe<br>@400000004b0d6d6c399a5c5c simscan: cdb looking up enlaceaduanero.com.pe<br>@400000004b0d6d6c399a6bfc simscan: cdb for enlaceaduanero.com.pe found clam=yes,spam=yes,spam_passthru=no,spam_hits=5.0,attach=.pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll<br>@400000004b0d6d6c399a7f84 simscan: pelookup clam = yes<br>@400000004b0d6d6c399a8f24 simscan: pelookup spam = yes<br>@400000004b0d6d6c399a9adc simscan: pelookup spam_passthru = no<br>@400000004b0d6d6c399aaa7c simscan: unimplemented flag spam_passthru = no<br>@400000004b0d6d6c399ac9bc simscan: pelookup spam_hits = 5.0<br>@400000004b0d6d6c399ad95c simscan: Per Domain Hits set to : 5.000000<br>@400000004b0d6d6c399ae8fc simscan: pelookup attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll<br>@400000004b0d6d6c399af89c simscan: attachment flag attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll<br>@400000004b0d6d6c399b083c simscan: .pif is attachment number 0<br>@400000004b0d6d6c399b17dc simscan: .scr is attachment number 1<br>@400000004b0d6d6c399b3334 simscan: .vbs is attachment number 2<br>@400000004b0d6d6c399b42d4 simscan: .bat is attachment number 3<br>@400000004b0d6d6c399b7d6c simscan: .bas is attachment number 4<br>@400000004b0d6d6c399b8924 simscan: .cmd is attachment number 5<br>@400000004b0d6d6c399b98c4 simscan: .com is attachment number 6<br>@400000004b0d6d6c399ba864 simscan: .exe is attachment number 7<br>@400000004b0d6d6c399bb804 simscan: .dll is attachment number 8<br>@400000004b0d6d6c399bc3bc simscan: pelookup: local part is jmarin<br>@400000004b0d6d6c399bd35c simscan: cdb looking up <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=9" target="_top" rel="nofollow">jmarin@...</a><br>@400000004b0d6d6c399bf29c simscan: regex opening message file msg.1259171170.739859.27217<br>@400000004b0d6d6c399c023c simscan: regex reading message<br>@400000004b0d6d6c399c11dc simscan: regex freeing memory<br>@400000004b0d6d6c399c1d94 simscan: cdb looking up version regex<br>@400000004b0d6d6c39bebcdc simscan: cdb looking up version attach<br>@400000004b0d6d6c39bfce4c simscan: calling clamdscan<br>@400000004b0d6d6c3a7bf644 simscan: cdb looking up version clamav<br>@400000004b0d6d6c3a7d51ec simscan: normal clamdscan return code: 0<br>@400000004b0d6d6c3a7efbb4 simscan: calling spamc<br>@400000004b0d6d6c3a7fe22c simscan: calling /usr/bin/spamc spamc -s 200000 -t 60 -U /tmp/spamd.sock -u <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=10" target="_top" rel="nofollow">jmarin@...</a><br>@400000004b0d6d701fda26e4 simscan: cdb looking up version spam<br>@400000004b0d6d701fda3e54 simscan:[27178]:CLEAN (-69.30/5.00):3.7908s:Correo 1-18:65.55.34.221:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=11" target="_top" rel="nofollow">jolumape_al@...</a>:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=12" target="_top" rel="nofollow">jmarin@...</a><br>@400000004b0d6d701fda51dc simscan: done, execing qmail-queue<br>@400000004b0d6d7027f1652c simscan: qmail-queue exited 0<br>@400000004b0d6d70349fcb4c tcpserver: end 27178 status 0<br>@400000004b0d6d7034a0b1c4 tcpserver: status: 0/800</b></font><br><br></span><span title="Pero cuando envio un correo a ambas correos electronicos (CC o BCC) no trabaja correctamente la lista blanca y le asigna un valor cercano a 5.0">But when I send mail to both emails (CC or BCC) does not work properly whitelisted and assigns a value close to 5.0 </span></span><span id="result_box" class="long_text"><span title="Cuando envio correo individualmente a estas cuentas funciona corectamente la lista blanca:">(SIMSCAN DEBUG):</span></span><br><span id="result_box" class="long_text"><span style="" title="Pero cuando envio un correo a ambas correos electronicos (CC o BCC) no trabaja correctamente la lista blanca y le asigna un valor cercano a 5.0"><br><b><font style="font-size: 8pt;" size="1">@400000004b0d6e222906c4fc tcpserver: ok 27737 :172.16.4.5:25 :65.55.34.24::2436</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e2502164f34 qmail-smtpd: pid 27737 Accept::RCPT::Rcpthosts_Rcptto: P:ESMTP S:65.55.34.24:unknown H:col0-omc1-s14.col0.hotmail.com F:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=13" target="_top" rel="nofollow">jolumape_al@...</a> T:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=14" target="_top" rel="nofollow">lcampo@...</a></font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25021666a4 qmail-smtpd: pid 27737 Accept::RCPT::Rcpthosts_Rcptto: P:ESMTP S:65.55.34.24:unknown H:col0-omc1-s14.col0.hotmail.com F:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=15" target="_top" rel="nofollow">jolumape_al@...</a> T:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=16" target="_top" rel="nofollow">jmarin@...</a></font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250be1773c simscan: cdb looking up</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250be4ceb4 simscan: cdb for found clam=yes,spam=yes,spam_hits=5.0,attach=.pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250be576ac simscan: pelookup clam = yes</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250be60734 simscan: pelookup spam = yes</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250be66cc4 simscan: pelookup spam_hits = 5.0</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250be7d424 simscan: Per Domain Hits set to : 5.000000</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250be8550c simscan: pelookup attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250be8ba9c simscan: attachment flag attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250be96a64 simscan: .pif is attachment number 0</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250bea1e14 simscan: .scr is attachment number 1</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250bed370c simscan: .vbs is attachment number 2</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250bed4a94 simscan: .bat is attachment number 3</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250bed5a34 simscan: .bas is attachment number 4</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250bed69d4 simscan: .cmd is attachment number 5</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250bed758c simscan: .com is attachment number 6</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250bed852c simscan: .exe is attachment number 7</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250bed94cc simscan: .dll is attachment number 8</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e250beda084 simscan: starting: work dir: /var/qmail/simscan/1259171355.199932.27747</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e2516196304 simscan: pelookup: called with <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=17" target="_top" rel="nofollow">jolumape_al@...</a></font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e2516197e5c simscan: pelookup: domain is hotmail.com</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e2516198dfc simscan: cdb looking up hotmail.com</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161999b4 simscan: pelookup: local part is jolumape_al</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e251619a954 simscan: cdb looking up <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=18" target="_top" rel="nofollow">jolumape_al@...</a></font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e251619b8f4 simscan: pelookup: called with <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=19" target="_top" rel="nofollow">lcampo@...</a></font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e251619c894 simscan: pelookup: domain is enlaceaduanero.com.pe</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161a35f4 simscan: cdb looking up enlaceaduanero.com.pe</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161a4594 simscan: cdb for enlaceaduanero.com.pe found clam=yes,spam=yes,spam_passthru=no,spam_hits=5.0,attach=.pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161a591c simscan: pelookup clam = yes</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161a68bc simscan: pelookup spam = yes</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161a7474 simscan: pelookup spam_passthru = no</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161a8414 simscan: unimplemented flag spam_passthru = no</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161a9f6c simscan: pelookup spam_hits = 5.0</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161af55c simscan: Per Domain Hits set to : 5.000000</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161b04fc simscan: pelookup attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161b149c simscan: attachment flag attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161b243c simscan: .pif is attachment number 0</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161b33dc simscan: .scr is attachment number 1</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161b531c simscan: .vbs is attachment number 2</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161b62bc simscan: .bat is attachment number 3</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161b996c simscan: .bas is attachment number 4</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161ba524 simscan: .cmd is attachment number 5</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161bb4c4 simscan: .com is attachment number 6</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161bc464 simscan: .exe is attachment number 7</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161bd01c simscan: .dll is attachment number 8</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161bdfbc simscan: pelookup: local part is lcampo</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161bef5c simscan: cdb looking up <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=20" target="_top" rel="nofollow">lcampo@...</a></font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161c0e9c simscan: pelookup: called with <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=21" target="_top" rel="nofollow">jmarin@...</a></font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161c1e3c simscan: pelookup: domain is enlaceaduanero.com.pe</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161c2ddc simscan: cdb looking up enlaceaduanero.com.pe</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161c3994 simscan: cdb for enlaceaduanero.com.pe found clam=yes,spam=yes,spam_passthru=no,spam_hits=5.0,attach=.pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161c4d1c simscan: pelookup clam = yes</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161d106c simscan: pelookup spam = yes</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161d200c simscan: pelookup spam_passthru = no</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161d2bc4 simscan: unimplemented flag spam_passthru = no</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161d3b64 simscan: pelookup spam_hits = 5.0</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161d4b04 simscan: Per Domain Hits set to : 5.000000</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161d5aa4 simscan: pelookup attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161d6a44 simscan: attachment flag attach = .pif:.scr:.vbs:.bat:.bas:.cmd:.com:.exe:.dll</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161d8984 simscan: .pif is attachment number 0</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161d9924 simscan: .scr is attachment number 1</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161dd3bc simscan: .vbs is attachment number 2</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161de35c simscan: .bat is attachment number 3</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161def14 simscan: .bas is attachment number 4</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161dfeb4 simscan: .cmd is attachment number 5</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161e0e54 simscan: .com is attachment number 6</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161e1a0c simscan: .exe is attachment number 7</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161e29ac simscan: .dll is attachment number 8</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161e394c simscan: pelookup: local part is jmarin</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161e588c simscan: cdb looking up <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=22" target="_top" rel="nofollow">jmarin@...</a></font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161e682c simscan: regex opening message file msg.1259171355.199932.27747</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161e77cc simscan: regex reading message</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161e8384 simscan: regex freeing memory</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e25161e9324 simscan: cdb looking up version regex</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e2516423824 simscan: cdb looking up version attach</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e251642537c simscan: calling clamdscan</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e2516fe872c simscan: cdb looking up version clamav</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e2517002154 simscan: normal clamdscan return code: 0</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e251701c34c simscan: calling spamc</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e2517029254 simscan: calling /usr/bin/spamc spamc -s 200000 -t 60 -U /tmp/spamd.sock</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e273143b79c simscan: cdb looking up version spam</font><font style="font-size: 8pt;" size="1"><br></font><font style="font-size: 8pt;" size="1">@400000004b0d6e273143cf0c simscan:[27737]:CLEAN (4.10/5.00):2.6227s:Correo 1-21:65.55.34.24:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=23" target="_top" rel="nofollow">jolumape_al@...</a>:<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=24" target="_top" rel="nofollow">lcampo@...</a>,<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=25" target="_top" rel="nofollow">jmarin@...</a></font></b><br><br></span></span><span id="result_box" class="long_text"><span title="Que puede estar fallando?">What is wrong?<br><br>Thanks<br><br>Jose Luis<br></span></span><span id="result_box" class="long_text"><span title="Pero cuando envio un correo a ambas correos electronicos (CC o BCC) no trabaja correctamente la lista blanca y le asigna un valor cercano a 5.0"><br><font style="font-size: 8pt;" size="1"><b>SETTINGS:<br><br>Mail Server: Qmail + Spamassassin + ClamAV + Simscan<br><br></b></font></span></span><font style="font-size: 8pt;" size="1"><b><span id="result_box" class="long_text"><span title="Configuracion Simscan">/etc/init.d/spamassassin.rc<br><br>#!/bin/sh<br># spamassassin This script starts and stops the spamd daemon<br>#<br><br>PATH=$PATH:/usr/local/sbin:/usr/local/bin<br>case "$1" in<br> start)<br> cd /<br><br> /usr/bin/spamd -v -u vpopmail -m 3 -x -q -s stderr -r /var/run/spamd/spamd.pid \<br> --socketpath=/tmp/spamd.sock 2>&1 | \<br> /usr/local/bin/setuidgid qmaill \<br> /usr/local/bin/multilog t !spamdappend /var/log/qmail/spamd &<br> echo "spamd started"<br> ;;<br><br> stop)<br> if [ -r /var/run/spamd/spamd.pid ]; then<br> pid=`cat /var/run/spamd/spamd.pid`<br> kill $pid || ( echo "failed to stop spamd" && exit 1 )<br> echo "spamd (pid $pid) stopped"<br> else<br> echo "/var/run/spamd/spamd.pid doesn't exist, is spamd running?"<br> fi<br> ;;<br><br> restart)<br> $0 stop && sleep 2 && $0 start<br> ;;<br><br> *)<br> echo "usage: spamassassin.rc (start|stop|restart)"<br> ;;<br>esac<br><br><br>/etc/mail/spamassassin/local.cf<br><br># This is the right place to customize your installation of SpamAssassin.<br>#<br># See 'perldoc Mail::SpamAssassin::Conf' for details of what can be<br># tweaked.<br>#<br>###########################################################################<br>#<br># rewrite_header Subject *****SPAM*****<br># report_safe 1<br># trusted_networks 212.17.35.<br># lock_method flock<br><br><br>required_score 5.0<br>rewrite_header Subject *****SPAM*****<br>report_safe 0<br>add_header spam Flag _YESNOCAPS_<br>add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ bayes=_BAYES_ report=_REPORT_ autolearn=_AUTOLEARN_ version=_VERSIO<br>N_<br>add_header all Level _STARS(*)_<br>add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_<br>ok_locales all<br>skip_rbl_checks 0<br>auto_whitelist_factor 0.5<br>bayes_auto_learn 1<br>bayes_file_mode 0666<br>whitelist_from *@surfcontrol.com<br>whitelist_from <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=26" target="_top" rel="nofollow">servicios@...</a><br>whitelist_from <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517524&i=27" target="_top" rel="nofollow">juan.enciso@...</a><br><br># auto_whitelist_file_mode 0666<br><br>#####################<br>user_scores_dsn DBI:mysql:spamassassin:localhost<br>user_scores_sql_username spamuser<br>user_scores_sql_password spampass<br>user_scores_sql_custom_query SELECT preference, value FROM _TABLE_ WHERE username = '$GLOBAL' OR username = CONCAT('%',_DOMAIN_) OR userna<br>me = _USERNAME_ ORDER BY username ASC<br><br>auto_whitelist_factory Mail::SpamAssassin::SQLBasedAddrList<br>user_awl_dsn DBI:mysql:spamassassin:localhost<br>user_awl_sql_username spamuser<br>user_awl_sql_password spampass<br>user_awl_sql_table awl<br><br>bayes_store_module Mail::SpamAssassin::BayesStore::MySQL<br>bayes_sql_dsn DBI:mysql:spamassassin:localhost<br>bayes_sql_username spamuser<br>bayes_sql_password spampass<br>#####################<br><br>header PUBLICIDAD_ASUNTO Subject =~ /publicidad/i<br>describe PUBLICIDAD_ASUNTO Subject: comienza con publicidad<br>score PUBLICIDAD_ASUNTO 5.0<br><br>Simscan</span></span><br></b></font><span id="result_box" class="long_text"><span title="Pero cuando envio un correo a ambas correos electronicos (CC o BCC) no trabaja correctamente la lista blanca y le asigna un valor cercano a 5.0"><font style="font-size: 8pt;" size="1"><b><br>./configure --enable-clamav=y --enable-clamdscan=/usr/local/bin/clamdscan --enable-dropmsg=y --enable-custom-smtp-reject=n --enable-per-domain=y --enable-attach=y --enable-spam=y --enable-ripmime=/usr/local/bin/ripmime --enable-received=y --enable-spam-hits=5.0 --enable-spamc=/usr/bin/spamc --enable-spamc-args="-s 200000 -t 60 -U /tmp/spamd.sock" --enable-spamc-user=y --enable-regex=y --with-pcre-include=/usr/local/include --enable-quarantinedir<br><br><br>qmail-smtpd<br><br>#!/bin/bash<br>QMAILDUID=`id -u qmaild`<br>NOFILESGID=`id -g qmaild`<br>export NOP0FCHECK="1"<br>export MFDNSCHECK=""<br>export BADMIMETYPE=""<br>export BADLOADERTYPE="M"<br>export HELOCHECK=""<br>export SIMSCAN_DEBUG=2<br>exec /usr/local/bin/softlimit -m 24000000 \<br>/usr/local/bin/tcpserver -H -p -R -x /usr/vpopmail/etc/tcp.smtp.cdb \<br>-u $QMAILDUID -g $NOFILESGID -v -c 800 0 smtp rblsmtpd -t 180 \<br>-r zen.spamhaus.org \<br>-r bl.spamcop.net \<br>-r dnsbl.njabl.org \<br>/usr/local/bin/fixcrio /var/qmail/bin/qmail-smtpd 2>&1<br></b></font><br></span></span> <br /><hr />Get news, entertainment and everything you care about at Live.com. <a href='http://www.live.com/getstarted.aspx ' target='_new' rel="nofollow">Check it out!</a></body>
</html><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26517442Re: well, isnt that special...2009-11-25T09:55:11Z2009-11-25T09:55:11Zrichard@buzzhost.co.ukOn Wed, 2009-11-25 at 17:34 +0000, Ned Slider wrote:
<div class='shrinkable-quote'><br>> Aaron Wolfe wrote:
<br>> > On Wed, Nov 25, 2009 at 12:04 PM, Ned Slider <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517442&i=0" target="_top" rel="nofollow">ned@...</a>> wrote:
<br>> >> R-Elists wrote:
<br>> >>>
<br>> >>> on a much more important note, can those on the list that have a good
<br>> >>> handle
<br>> >>> on better filtering spam and/or UCE from Constant please share your SA
<br>> >>> info
<br>> >>> on that please?
<br>> >>>
<br>> >> Here's mine:
<br>> >>
<br>> >> uri LOCAL_URI_C_CONTACT m{constantcontact\.com\b}
<br>> >> score LOCAL_URI_C_CONTACT 12
<br>> >> describe LOCAL_URI_C_CONTACT contains link to constant contact
<br>> >> [dot] com
<br>> >>
<br>> >> Got fed up with these clowns a long time ago so I hammer anything from them
<br>> >> on sight.
<br>> >
<br>> > That score is a bit extreme, but I've also found that a small positive
<br>> > score is appropriate for constantcrap mail.
<br>> >
<br>> > -Aaron
<br>> >
<br>>
<br>> Indeed, and I wouldn't advocate anyone following *my* scoring, just
<br>> posted the rule as an example of one way to whack this particular mole :)
<br>>
<br>> I chose the high score to counteract any dns whitelists or AWL negative
<br>> scoring etc that may otherwise rescue their crap from being marked as
<br>> spam on my system. If there's anything I particularly want I can
<br>> whitelist it, but the default action here is to tag and quarantine all
<br>> mail from Constant Contact. The high score probably also reflects my
<br>> level of frustration with them at the time I wrote the rule!
</div><br>I don't think that's harsh at all Ned. I have a different solution:
<br><br>#CHEETAH (EXPERIAN)
<br>iptables -A FIREWALL -s 66.165.100.0/24 -j DROP
<br>#CONSTANT CONTACT
<br>iptables -A FIREWALL -s 63.251.0.0/16 -j DROP
<br>iptables -A FIREWALL -s 66.151.234.144/28 -j DROP
<br>iptables -A FIREWALL -s 208.75.120.0/22 -j DROP
<br>#dotmailer offenders
<br>iptables -A FIREWALL -s 80.87.10.0/30 -j DROP
<br>iptables -A FIREWALL -s 80.87.10.4/31 -j DROP
<br>iptables -A FIREWALL -s 80.87.10.6/32 -j DROP
<br><br>Any more ranges most welcome :-)
<br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26517127Re: HABEAS_ACCREDITED SPAMMER2009-11-25T09:36:32Z2009-11-25T09:36:32ZMichelle Konzack-2Am 2009-11-25 00:23:34, schrieb LuKreme:
<br>> I get HABEAS mail sent to email addresses that have not been active in
<br>> 10 years and have never EVER signed up for anything whatsoever. I get
<br>> HABEAS mail sent to new admin@ email addresses on new domains, domains
<br>> that have never sent any email at all.
<br><br>I have never send an E-Mail using my domains <flexray4linux.org>,
<br><tdwave.net> and <can4linux.org> so how can it be? There is only a
<br><postmaster>, <abuse>, <webmaster> and <admin> on the domain, which will
<br>never send messages outside, because they are configured to do so.
<br><br>> No I won't, because I don't use spamassassin to BLOCK mail. I simply
<br>> score it and if it scores over 5.0 it gets moved to the .SPAM folder
<br>> where people are free to recover it if they want. I've never had a
<br>> single complaint about HABEAS messages being misstagged as spam.
<br><br>Here too, at least for the 73 users of <tamay-dogan.net>
<br><br>> I prefer to give it a positive score as in my tests, it is a definite
<br>> spam sign
<br><br><br>Thanks, Greetings and nice Day/Evening
<br> Michelle Konzack
<br> Systemadministrator
<br> Tamay Dogan Network
<br> Debian GNU/Linux Consultant
<br><br>--
<br>Linux-User #280138 with the Linux Counter, <a href="http://counter.li.org/" target="_top" rel="nofollow">http://counter.li.org/</a><br>##################### Debian GNU/Linux Consultant #####################
<br><<a href="http://www.tamay-dogan.net/" target="_top" rel="nofollow">http://www.tamay-dogan.net/</a>> Michelle Konzack
<br><<a href="http://www.can4linux.org/" target="_top" rel="nofollow">http://www.can4linux.org/</a>> Apt. 917
<br><<a href="http://www.flexray4linux.org/" target="_top" rel="nofollow">http://www.flexray4linux.org/</a>> 50, rue de Soultz
<br>Jabber <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517127&i=0" target="_top" rel="nofollow">linux4michelle@...</a> 67100 Strabourg/France
<br>IRC #Debian (irc.icq.com) Tel. DE: +49 177 9351947
<br>ICQ #328449886 Tel. FR: +33 6 61925193
<br><br /> <div class="small"><br/><img src="http://old.nabble.com/images/icon_attachment.gif" > <strong>signature.pgp</strong> (196 bytes) <a href="http://old.nabble.com/attachment/26517127/0/signature.pgp" target="_top">Download Attachment</a></div><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26517069Re: well, isnt that special...2009-11-25T09:34:11Z2009-11-25T09:34:11ZNed SliderAaron Wolfe wrote:
<div class='shrinkable-quote'><br>> On Wed, Nov 25, 2009 at 12:04 PM, Ned Slider <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517069&i=0" target="_top" rel="nofollow">ned@...</a>> wrote:
<br>>> R-Elists wrote:
<br>>>>
<br>>>> on a much more important note, can those on the list that have a good
<br>>>> handle
<br>>>> on better filtering spam and/or UCE from Constant please share your SA
<br>>>> info
<br>>>> on that please?
<br>>>>
<br>>> Here's mine:
<br>>>
<br>>> uri LOCAL_URI_C_CONTACT m{constantcontact\.com\b}
<br>>> score LOCAL_URI_C_CONTACT 12
<br>>> describe LOCAL_URI_C_CONTACT contains link to constant contact
<br>>> [dot] com
<br>>>
<br>>> Got fed up with these clowns a long time ago so I hammer anything from them
<br>>> on sight.
<br>>
<br>> That score is a bit extreme, but I've also found that a small positive
<br>> score is appropriate for constantcrap mail.
<br>>
<br>> -Aaron
<br>>
</div><br>Indeed, and I wouldn't advocate anyone following *my* scoring, just
<br>posted the rule as an example of one way to whack this particular mole :)
<br><br>I chose the high score to counteract any dns whitelists or AWL negative
<br>scoring etc that may otherwise rescue their crap from being marked as
<br>spam on my system. If there's anything I particularly want I can
<br>whitelist it, but the default action here is to tag and quarantine all
<br>mail from Constant Contact. The high score probably also reflects my
<br>level of frustration with them at the time I wrote the rule!
<br><br><br><br><br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26517008Re: HABEAS_ACCREDITED SPAMMER2009-11-25T09:29:50Z2009-11-25T09:29:50ZMichelle Konzack-2Am 2009-11-24 17:23:29, schrieb Jeff Mincy:
<br>> I find it a little hard to believe that your spam is so much different from
<br>> my spam. On my mail, not one single spam message (out of 228k total) hit
<br>> HABEAS for all of 2009. The few messages (480 out of 11k) that hit HABEAS
<br>> were all ham, either professional organizations/newsletters, transactions
<br>> from places like Vanguard or retail stores that I have a relationship with.
<br><br>I think, this depends where you live, because my french/german customers
<br>have not such contact, and even not me. How can it be, that all 4 EMail
<br>used by me
<br><br> <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517008&i=0" target="_top" rel="nofollow">linux4michelle@...</a>
<br> @freenet.de
<br><br> <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517008&i=1" target="_top" rel="nofollow">michelle.konzack@...</a>
<br> @freenet.de
<br><br>are hit by the same 2000 HABEAS spam yearly?
<br><br>> I don't know who these legitimate marketers are, but I don't feel I'm
<br>> missing anything.
<br>>
<br>> You WILL 'block' legitimate mail. However, It's your email, so you
<br>> can do anything you want. If you think HABEAS is so bad just set the
<br>> HABEAS scores to zero and save the network bandwidth.
<br><br>These "legitimate" messages maybe interesting for peoples/enterprises in
<br>the USA and maybe in te UK, but not in France or Germany
<br><br>And yes, in the last two month I have nearly rejected 50% of all HABEAS
<br>spam of this year.
<br><br>The same count for TWITTER, Facebook, Blogger and other social networks
<br>spam including invitations. I get per day 10-20 of them... Can you
<br>believe, I have arround 6500 friends worldwide? Facebook of course
<br>believe it. Time to sue them from spain since they have very nice laws.
<br><br>Thanks, Greetings and nice Day/Evening
<br> Michelle Konzack
<br> Systemadministrator
<br> Tamay Dogan Network
<br> Debian GNU/Linux Consultant
<br><br>--
<br>Linux-User #280138 with the Linux Counter, <a href="http://counter.li.org/" target="_top" rel="nofollow">http://counter.li.org/</a><br>##################### Debian GNU/Linux Consultant #####################
<br><<a href="http://www.tamay-dogan.net/" target="_top" rel="nofollow">http://www.tamay-dogan.net/</a>> Michelle Konzack
<br><<a href="http://www.can4linux.org/" target="_top" rel="nofollow">http://www.can4linux.org/</a>> Apt. 917
<br><<a href="http://www.flexray4linux.org/" target="_top" rel="nofollow">http://www.flexray4linux.org/</a>> 50, rue de Soultz
<br>Jabber <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26517008&i=2" target="_top" rel="nofollow">linux4michelle@...</a> 67100 Strabourg/France
<br>IRC #Debian (irc.icq.com) Tel. DE: +49 177 9351947
<br>ICQ #328449886 Tel. FR: +33 6 61925193
<br><br /> <div class="small"><br/><img src="http://old.nabble.com/images/icon_attachment.gif" > <strong>signature.pgp</strong> (196 bytes) <a href="http://old.nabble.com/attachment/26517008/0/signature.pgp" target="_top">Download Attachment</a></div><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26516728Re: well, isnt that special...2009-11-25T09:18:44Z2009-11-25T09:18:44ZAaron WolfeOn Wed, Nov 25, 2009 at 12:04 PM, Ned Slider <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26516728&i=0" target="_top" rel="nofollow">ned@...</a>> wrote:
<div class='shrinkable-quote'><br>> R-Elists wrote:
<br>>>
<br>>> just got spammed via constant contact via Aloha Communications Group on
<br>>> our
<br>>> "email lists" email address from <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26516728&i=1" target="_top" rel="nofollow">afritsch@...</a>
<br>>>
<br>>> obviously trolling for email addresses
<br>>>
<br>>> would the Constant Contact employee(s) and advocate on this list please
<br>>> kick
<br>>> some hiney after you are done rolling around in the money pile?
<br>>>
<br>>> on a much more important note, can those on the list that have a good
<br>>> handle
<br>>> on better filtering spam and/or UCE from Constant please share your SA
<br>>> info
<br>>> on that please?
<br>>>
<br>>
<br>> Here's mine:
<br>>
<br>> uri LOCAL_URI_C_CONTACT m{constantcontact\.com\b}
<br>> score LOCAL_URI_C_CONTACT 12
<br>> describe LOCAL_URI_C_CONTACT contains link to constant contact
<br>> [dot] com
<br>>
<br>> Got fed up with these clowns a long time ago so I hammer anything from them
<br>> on sight.
</div><br>That score is a bit extreme, but I've also found that a small positive
<br>score is appropriate for constantcrap mail.
<br><br>-Aaron
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26516686Re: HABEAS_ACCREDITED SPAMMER2009-11-25T09:16:25Z2009-11-25T09:16:25ZMichelle Konzack-2Am 2009-11-23 17:08:11, schrieb LuKreme:
<br>> On Nov 23, 2009, at 7:39, Matus UHLAR - fantomas <<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26516686&i=0" target="_top" rel="nofollow">uhlar@...</a>>
<br>> wrote:
<br>>
<br>> >Yes, why to differ between non-abusing and abusing marketers...
<br>>
<br>> We've been through this before. On my mail, habeas is a very strong
<br>> indicator of spam. It does not appear in legitimate mail.
<br><br>Here too.
<br><br>> I don't know who these legitimate marketers are, but I don't feel
<br>> I'm missing anything.
<br><br>I do not get very much HABEAS spam, but arround 2000 per year. Not a
<br>singel one was legitimate. What is th difference between a spamer and a
<br>"legitimate" marketer if I even do not know both?
<br><br>By definition: Both are non-welcome @me.
<br><br>Thanks, Greetings and nice Day/Evening
<br> Michelle Konzack
<br> Systemadministrator
<br> Tamay Dogan Network
<br> Debian GNU/Linux Consultant
<br><br>--
<br>Linux-User #280138 with the Linux Counter, <a href="http://counter.li.org/" target="_top" rel="nofollow">http://counter.li.org/</a><br>##################### Debian GNU/Linux Consultant #####################
<br><<a href="http://www.tamay-dogan.net/" target="_top" rel="nofollow">http://www.tamay-dogan.net/</a>> Michelle Konzack
<br><<a href="http://www.can4linux.org/" target="_top" rel="nofollow">http://www.can4linux.org/</a>> Apt. 917
<br><<a href="http://www.flexray4linux.org/" target="_top" rel="nofollow">http://www.flexray4linux.org/</a>> 50, rue de Soultz
<br>Jabber <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26516686&i=1" target="_top" rel="nofollow">linux4michelle@...</a> 67100 Strabourg/France
<br>IRC #Debian (irc.icq.com) Tel. DE: +49 177 9351947
<br>ICQ #328449886 Tel. FR: +33 6 61925193
<br><br /> <div class="small"><br/><img src="http://old.nabble.com/images/icon_attachment.gif" > <strong>signature.pgp</strong> (196 bytes) <a href="http://old.nabble.com/attachment/26516686/0/signature.pgp" target="_top">Download Attachment</a></div><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26516508Custom rule that looks at the charset= in the Content-Type header?2009-11-25T09:06:46Z2009-11-25T09:06:46ZThomas Harold-3Is it possible to create a custom rule that looks at the charset= string
<br>in the Content-Type header?
<br><br>We're getting a lot of Chinese language spam here at the moment
<br>(charset="gb2312") and they're only scoring in about a 6.3, but I'd like
<br>to push that slightly higher. I'm thinking that the proper response
<br>would be to write a header rule to score those a bit heavier (possibly
<br>+1.5).
<br><br>Seems like the proper way is:
<br><br>header LOCAL_CHARSET_ZHO Content-Type =~
<br>/charset=\"?(gbk|gb2312|gb18030)\"?/i
<br>score LOCAL_CHARSET_ZHO 3.5 3.0 2.5 2.0
<br><br>So, my questions are:
<br><br>1) Does a score like that make sense? Too high? Too low? Are there
<br>guidelines or suggestions for using the advanced scores?
<br><br>2) Does the perl regex look correct? It fires on the test message and I
<br>think it will properly handle variations on the usual "charset=" strings.
<br><br>3) Is anyone else using a similar rule or rule set? Have you found it
<br>useful or not?
<br><br>4) What happens if the Content-Type header is spread across more then
<br>one line?
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26516466Re: well, isnt that special...2009-11-25T09:04:15Z2009-11-25T09:04:15ZNed SliderR-Elists wrote:
<div class='shrinkable-quote'><br>>
<br>> just got spammed via constant contact via Aloha Communications Group on our
<br>> "email lists" email address from <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26516466&i=0" target="_top" rel="nofollow">afritsch@...</a>
<br>>
<br>> obviously trolling for email addresses
<br>>
<br>> would the Constant Contact employee(s) and advocate on this list please kick
<br>> some hiney after you are done rolling around in the money pile?
<br>>
<br>> on a much more important note, can those on the list that have a good handle
<br>> on better filtering spam and/or UCE from Constant please share your SA info
<br>> on that please?
<br>>
</div><br>Here's mine:
<br><br>uri LOCAL_URI_C_CONTACT m{constantcontact\.com\b}
<br>score LOCAL_URI_C_CONTACT 12
<br>describe LOCAL_URI_C_CONTACT contains link to constant contact [dot] com
<br><br>Got fed up with these clowns a long time ago so I hammer anything from
<br>them on sight.
<br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26516165Re: well, isnt that special...2009-11-25T08:46:45Z2009-11-25T08:46:45ZTara Natanson-2<br><br><div class="gmail_quote">On Wed, Nov 25, 2009 at 10:53 AM, R-Elists <span dir="ltr"><<a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26516165&i=0" target="_top" rel="nofollow">lists07@...</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
<br>
just got spammed via constant contact via Aloha Communications Group on our<br>
"email lists" email address from <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26516165&i=1" target="_top" rel="nofollow">afritsch@...</a><br>
<br>
obviously trolling for email addresses<br>
<br>
would the Constant Contact employee(s) and advocate on this list please kick<br>
some hiney after you are done rolling around in the money pile?<br>
<br></blockquote><div><br>I've got Compliance on it already thanks. And if I find the money pile I'll let ya know. ;) <br>I'll report back to you what they find. <br> <br></div></div><br>
<p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26516003Re: well, isnt that special...2009-11-25T08:38:31Z2009-11-25T08:38:31ZowencOn Nov 25, 2009, at 10:12 AM, Michael Scheidell wrote:
<br><div class='shrinkable-quote'><br>> R-Elists wrote:
<br>>> on a much more important note, can those on the list that have a good handle
<br>>> on better filtering spam and/or UCE from Constant please share your SA info
<br>>> on that please?
<br>>>
<br>> header CONSTANTCONTACT List-Unsubscribe =~ /\bconstantcontact\.com\b/
<br>> score CONSTANTCONTACT 0.6
<br>>
<br>> we score it pretty low since most of the constantcontact users arn't abusers. but we score it, keep track of it, and clients complain about missed spam, we bump it up, then drop it down when FP, then bump it up..
<br>> (rinse, repeat)
</div><br>This is mostly conjecture on my part but I think CC does some of the work for you. For years we did SMTP level rejects from roving.com hosts and this seemed to have blocked a lot of the CC crap. I think CC may segregate unknown/untrusted senders in roving.com rather than constantcontact.com.
<br><br>At any rate no one ever complained about the roving.com block until we had a customer who couldn't send themselves mail from their own lists. Knowing this customer only reinforces my theory because their lists are dirty as hell.
<br><br>Chris
<br><br>-------------------------------------------------------------------------
<br>Chris Owen - Garden City (620) 275-1900 - Lottery (noun):
<br>President - Wichita (316) 858-3000 - A stupidity tax
<br>Hubris Communications Inc www.hubris.net
<br>-------------------------------------------------------------------------
<br><br><br><br><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26515817Re: I am a spammer says TVD_FROM_12009-11-25T08:27:26Z2009-11-25T08:27:26ZWarren TogamiThe scores have changed since that snapshot of spamassassin. You will
<br>get the new scores if you sa-update.
<br><br>* TVD_FROM_1 is not an active rule.
<br>* score BAYES_50 0 0 2.0 0.8
<br>* score RDNS_NONE 2.399 1.274 1.228 0.793
<br><br>So it appears RDNS_NONE will become more hostile toward you than before.
<br><br>Hmm, why is BAYES_50 fixed to such a high number? This doesn't seem right.
<br><br>Warren Togami
<br><a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26515817&i=0" target="_top" rel="nofollow">wtogami@...</a>
<br><br>On 11/25/2009 09:31 AM, Florian Lohoff wrote:
<div class='shrinkable-quote'><br>>
<br>> Hi,
<br>> i guess you are "censoring" my e-mail adress in one of the default
<br>> spamassin rules - not very nice and probably a litle overparanoid ...
<br>>
<br>> ##{ TVD_FROM_1
<br>> header TVD_FROM_1 From:addr =~ /[^\@0-9]{2}\d{3}\.(?:com|net|org|info|biz)$/i
<br>> ##} TVD_FROM_1
<br>>
<br>>> X-Spam-Checker-Version: SpamAssassin 3.3.0-alpha3-r816412 (2009-09-17) on
<br>>> eddie.linux-mips.org
<br>>> X-Spam-Flag: YES
<br>>> X-Spam-Level: *****
<br>>> X-Spam-Status: Yes, score=5.0 required=5.0 tests=BAYES_50,RDNS_NONE,TVD_FROM_1
<br>>> autolearn=no version=3.3.0-alpha3-r816412
<br>>> X-Spam-Report:
<br>>> * 1.0 TVD_FROM_1 TVD_FROM_1
<br>>> * 3.0 BAYES_50 BODY: Bayes spam probability is 40 to 60%
<br>>> * [score: 0.5000]
<br>>> * 1.0 RDNS_NONE Delivered to internal network by a host with no rDNS
<br>>
<br>> Flo
</div><br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Dev-f194.html" embed="fixTarget[194]" target="_top" >SpamAssassin - Dev</a></p>tag:old.nabble.com,2006:post-26515513Re: well, isnt that special...2009-11-25T08:12:24Z2009-11-25T08:12:24ZMichael Scheidell-2R-Elists wrote:
<div class='shrinkable-quote'><br>> just got spammed via constant contact via Aloha Communications Group on our
<br>> "email lists" email address from <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26515513&i=0" target="_top" rel="nofollow">afritsch@...</a>
<br>>
<br>> obviously trolling for email addresses
<br>>
<br>> would the Constant Contact employee(s) and advocate on this list please kick
<br>> some hiney after you are done rolling around in the money pile?
<br>>
<br>> on a much more important note, can those on the list that have a good handle
<br>> on better filtering spam and/or UCE from Constant please share your SA info
<br>> on that please?
<br>>
<br>> - rh
<br>>
<br>>
<br>>
</div>header CONSTANTCONTACT List-Unsubscribe =~ /\bconstantcontact\.com\b/
<br>score CONSTANTCONTACT 0.6
<br><br>we score it pretty low since most of the constantcontact users arn't
<br>abusers. but we score it, keep track of it, and clients complain about
<br>missed spam, we bump it up, then drop it down when FP, then bump it up..
<br>(rinse, repeat)
<br><br>_________________________________________________________________________
<br>This email has been scanned and certified safe by SpammerTrap(r).
<br>For Information please see <a href="http://www.secnap.com/products/spammertrap/" target="_top" rel="nofollow">http://www.secnap.com/products/spammertrap/</a><br>_________________________________________________________________________
<br>
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>tag:old.nabble.com,2006:post-26515362Re: HABEAS_ACCREDITED SPAMMER2009-11-25T08:03:01Z2009-11-25T08:03:01ZMatus UHLAR - fantomasOn 25.11.09 03:23, jdow wrote:
<br>> Having a little help might help them maintain a better product.
<br>> But (that bitter word), the basic concept is broken. If the spammer
<br>> can make more money than it costs to get on the Habeas whitelist
<br>> then they will pull the same trick I've seen here in California in the
<br>> construction trades.
<br><br>Some time ago they used to sue spammers, according to discussion here they
<br>don't anymore. Maybe that's one of their biggest problems.
<br><br>> A business owner creates a new business, incorporates it, accepts a job,
<br>> and when the job goes sour bankrupt and fold the shell corporation. The
<br>> same trick is available for the HABEAS spoof. Hence, I figure the concept
<br>> is unworkable on its face.
<br><br>Btw, would be nice from you if you quoted mail you are replying to.
<br>--
<br>Matus UHLAR - fantomas, <a href="http://old.nabble.com/user/SendEmail.jtp?type=post&post=26515362&i=0" target="_top" rel="nofollow">uhlar@...</a> ; <a href="http://www.fantomas.sk/" target="_top" rel="nofollow">http://www.fantomas.sk/</a><br>Warning: I wish NOT to receive e-mail advertising to this address.
<br>Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
<br>Your mouse has moved. Windows NT will now restart for changes to take
<br>to take effect. [OK]
<br><p>From forum: <a href="http://old.nabble.com/SpamAssassin---Users-f195.html" embed="fixTarget[195]" target="_top" >SpamAssassin - Users</a></p>