Mailing List Archive by Gossamer Threads http://www.gossamer-threads.com/lists/spamassassin/users/ en-us (c) Gossamer Threads Inc. All rights reserved. 16 May 2008 16:57:52 -0800 120 75 23 http://www.gossamer-threads.com/lists/spamassassin/users/ http://www.gossamer-threads.com/images/lists/rss_logo.jpg X-Mailer: eGroups Message Poster X-Priority: 1 X-MSMail-Priority: High hmm does yahoo use microsoft already ? Benny Pedersen Need more webspace ? 16 May 2008 14:38:56 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/121004 The message at <http://pastebin.com/m42c297fd>[1] hit ANY_BOUNCE_MESSAGE and BOUNCE_MESSAGE despite the host that sent it (mailgw02.wolfnettech.com) 16 May 2008 11:45:08 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120996 > > Does the Spam Assassin work on Mac's? > > Thank you for your help. -- Michelle Acosta Bookkeeper/Office Manager The TEAK Fellowship 16 West 2 16 May 2008 08:18:04 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120991 Need a little help for MySQL users. I'm running several servers that are using a common MySQL server for bayes for all the SA servers. What I'm seei 16 May 2008 06:30:28 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120979 Hi, Any one else seen emails with word documents attached and the word document has text of an 'African fraud'? example: http://pastebin.com/mad34c9 16 May 2008 04:49:39 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120976 I am currently using SpamAssassin 3.2.4 on cygwin. All is good, except DCC. When I call dcc alone, the result is good: ============================ 15 May 2008 14:17:51 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120950 Yahoo.com says that they can't control email sent from third parties, relayed through their mail servers. " Yahoo! has no control over activities o 15 May 2008 10:25:10 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120936 I'm writing a custom plugin and using $pms->get('To') to get my to address but it can be full of all kinds of junk. Multiple cc's, names of account 15 May 2008 07:59:18 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120930 Hello, Apologies if this is a FAQ or old news, but I did a bit of searching yesterday and didn't find an answer to this one. I'm using SA (3.2.4) si 15 May 2008 07:19:13 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120928 Hi, I have an Server programm sending mail to an PC. This PC reading mail then forward it to user group. Mails are reading correctly, but when it 15 May 2008 05:42:49 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120924 When manually running spamassassin -r on a spam I sometimes see this: [27497] warn: reporter: razor2 report failed: No such file or directory report 14 May 2008 19:23:47 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120913 I haven't heard anything about the DOB list from Support Intelligence in several months and that was only to hear about timeouts. Is it still a via 14 May 2008 17:25:09 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120912 Hi, I use version 3.1.9-1 on an SME Linux server and am getting confusing results.   I have SpamAssassin Sensitivity set to 'Very High (2)' and Au 14 May 2008 13:46:04 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120899 I was wondering if there could be a hosted site where I could cut paste my spams and find what scores would they get on a standard SA configuration wi 14 May 2008 08:47:35 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120885 Hi all, Can the "tflags multiple" setting be used with mimeheader rules? Or only with header, body, rawbody, uri, and full tests? Also, where can I f 14 May 2008 08:32:27 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120881 Hi, I'm giving some though to deploying the Vbounce ruleset into an existing SA 3.1.9+Maia Mailguard / 5,000 user email environment. It makes good 14 May 2008 07:45:19 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120882 Hi, I'm using the following configuration: Qmail, vpopmail 5.4.1, qmail-scanner 1.25st, spamassassin 3.11. This is a hosting server so several domain 14 May 2008 05:51:06 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120880 Hi Can someone suggest a rule (or rules) which will count the number of lines in the body of a mail message? Or alternatively, a rule which will tel 14 May 2008 00:19:59 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120858 Hi all, My installation of spamassassin seems to have stopped using all the rules I have added when checking email. They now reside in /var/lib/spa 13 May 2008 21:06:08 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120853 In my local.cf I have: add_header all Spammy _SPAMMYTOKENS(2,long)_ add_header all Hammy _HAMMYTOKENS(2,long)_ which according to Mail::SpamAssassin 13 May 2008 19:30:53 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120851 Hello all, since some longer time I have a little problem with the spam learning method, which is used in a script on my box. The script runs as user 13 May 2008 18:29:01 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120850 On Tue, 2008-05-13 at 16:16 -0500, Robotech_Master wrote: > I'm using SpamAssassin 3.2.3 w/ Perl 5.8.8 on Linux. I'm not the > sysadmin of the machine 13 May 2008 15:05:12 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120845 I'm not the sysadmin but a user on someone else's machine. This other machine has SpamAssassin set up, and the VBounceRuleset module loaded, but does 13 May 2008 14:20:27 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120837 I'm using SpamAssassin 3.2.3 w/ Perl 5.8.8 on Linux. I'm not the sysadmin of the machine, but a user. I invoke it through a procmail recipe that says 13 May 2008 14:16:05 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120836 Hello Guys, i got a message that was flagged with MISSING_SUBJECT rule. The message has, among other headers: From: <patricia.borges@something. 13 May 2008 14:00:47 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120831 Hello, I have a client that uses Spanish content and is getting filtered due to some of the symbols used. Is there anything in SpamAssasin tha 13 May 2008 10:59:51 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120820 Spamd is not using  whitelist_from_rcvd or whitelist_from_spf in local.cf but when i run a test msg spamassassin --test-mode < 113.msg orspamassas 13 May 2008 10:46:06 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120819 I am using the spamassassin that is installed when you install cPanel. I have been attempting to get the automatic bayes learning to work. I have 13 May 2008 10:36:44 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120818 I've got those: http://rafb.net/p/q3eZwd93.html anyone can see any sense in it? it uses my hostname to fake a bounceback that claims i sent a mess 12 May 2008 12:49:41 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120771 Upgrading from 3.1.7 to 3.2.4 resulted in my server becoming seriously overloaded. Normally I see 3 to 6 slaves running with scan times averaging 5-10 12 May 2008 10:37:30 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120770 Hi all, I am having trouble with VBounce. I think I followed the FAQ to the letter yet most of the backscatter still ends up in my mailbox. For e 12 May 2008 08:32:39 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120768 Hoping somebody out there can help. After noticing a dramatic increase in male enhancement spam lately, I started to investigate what was going on a 12 May 2008 06:38:08 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120766 Hi, I could not update SANE Security signatures in the last couple of days. It looks like domain msrbl.com disappeared. Could please anyone shed som 11 May 2008 07:07:02 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120749 Hi, I looked on the wiki to see how do I test my installation of spamassassin. I'm confused because it's not really giving me a method that works ri 11 May 2008 00:13:28 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120740 I've previously used RDJ to keep my SA rules up-to-date but have got the impression I should be using sa-update instead. My first step was to run "s 10 May 2008 07:42:25 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120725 fyi: post in bugtraq. You may wish to look for and remove any whitelists based on google, googlegroups, or gmail accounts until google fixes this. - 10 May 2008 06:57:24 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120720 Hi Just built SA3.2.4 on FC3 and running spamassassin --lint i get [root@proteus2 Mail-SpamAssassin-3.2.4]# spamassassin --lint [29374] warn: plugin 09 May 2008 23:52:22 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120713 I am not sure how to ask this We have a test URIBL # # # ########################################################################### # urirhssub URI 09 May 2008 09:42:45 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120696 Hi: Our users are getting false positives with hits on 4.2 FORGED_MUA_OUTLOOK and are saying they are 100% certain that the email was sent from MS 09 May 2008 09:08:26 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120693 Odd how mailing lists that don't obfuscate addresses don't see more trusted mailing list subscriber spam. All a spam program would have to do is say 08 May 2008 10:19:17 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120658 Hi, could someone kindly tell me what the file "triplets.txt" is used for, and if I need to have it in my rules directory or not? Cheers, Jeremy 08 May 2008 06:38:16 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120628 At the MTA( postfix) I am inserting X-Envelope-From: If The mail had already a X-Envelope-From before landing at my MTA then There would be multiple 08 May 2008 00:34:24 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120604 I have been reading throught the Shortcircuit manpage as well as some articles within the Wiki, and the manner in which I see it performing within o 07 May 2008 21:19:17 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120600 I'm new to SA so bear with me. I've got a Debian server as a gateway server that has SA installed. I tried to release some mail that was marked as s 07 May 2008 20:47:08 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120598 One of the users (actually the boss) had the email address harvested and we got clobbered by backscatter. Looking at the emails of the various 'unabl 07 May 2008 14:58:34 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120589 Hi, what I want to do is: If score >= 5 && <= 15 change subject to ***SPAM*** If score >= 15 change subject to ****HIGH_SPAM*** with procmail I ca 07 May 2008 09:39:58 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120563 Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and m 07 May 2008 08:50:20 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120559 Hi, over the last couple of days I seem to get more and more spam wich looks like a bounced email with subjects like "MAILER DAEMON ... " and other v 07 May 2008 00:57:58 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120530 http://wiki.apache.org/spamassassin/PluginWritingTips Gives plugin writing tips. But is there a beginners plugin-writing-howto. What are requisite 06 May 2008 23:43:19 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120527 Is there a way to have Spamassassin look for spoofed email addresses being used as the sender's address (myname@mydomain.com) but using a different us 06 May 2008 18:14:34 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120518 Hi all, as I'm facing raising amount of bounces on my mailserver in the last 2 months, I tried to use the vbounce ruleset to identify the ones caused 06 May 2008 15:01:02 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120516 -- html code -- <div class=3DSection1> <p class=3DMsoNormal>Hi!<a href=3D"http://{MACCCLINK=3Dtestmaclink,3,http= ://67.228.184.50/links1.txt,www.eas 06 May 2008 12:48:29 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120506 Hello list, here is a part of the header from a mail I like to whitelist: X-Spam-Status: Yes, score=6.958 tagged_above=-999 required=5 tests 06 May 2008 12:32:49 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120505 Hi, Your Bayesian database has become dirty: too mush ham mails get a score of BAYES_99, certainly for one of your customer domains. Is there a way t 06 May 2008 07:16:06 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120492 I'm sure I'm missing something obvious, but I can't for the life of me spot it. Whenever the VBounce rules fire, I'm getting loads of warnings of this 06 May 2008 05:03:05 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120488 Hi, in order to separate backscatter from "real" bounces, I would like to write rules that match only the headers within attachments > Content-Descr 05 May 2008 14:30:15 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120478 Hello list, I'm using spamassassin 3.2.4 (running on PERL 5.8.3) with amavisd-new 2.5.4 and IP::Country 2.23. From time to time (~ twice a day) I se 05 May 2008 10:43:44 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120470 Return-Path: <printer@afts.com> Received: (qmail 73832 invoked by uid 99); 5 May 2008 00:31:15 -0000 Received: from nike.apache.org (HELO nike.apache. 05 May 2008 10:12:59 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120467 I just received around 2000 bounce messages from various servers rejecting messages (supposedly) coming from my email address. This has happened to 05 May 2008 09:45:32 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120464 # spamassassin -V SpamAssassin version 3.2.4 running on Perl version 5.8.8 From my /usr/local/scripts/update_spamassassin cronjob /usr/bin/sa-u 05 May 2008 06:23:55 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120459 Hey guys, got some strange problem during my vacation the last week. For once it seems that the network stack of SA crashed so no new processes could 05 May 2008 02:12:35 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120454 Greetings. I'm working on creating a system-wide SpamAssassin installation with virtual users, using Postfix on the front-end and dbmail on the bac 04 May 2008 11:14:23 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120434 Hello Guys, im running SA 3.2.4 and, on the same machine, horde/imp as webmail application. Sometimes, mails sent through imp are getting f 03 May 2008 08:51:32 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120388 Dear spamassassin users, we are using spamassassin on a site-wide basis. It is invoked via a script from postfix and is simply called by "spamassas 03 May 2008 00:50:02 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120377 http://RMAILinEmacs.blogspot.com 02 May 2008 21:19:12 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120373 Hello, Recently, on 4/30/2008, Perl update 5.8.8-39 for Fedora was released which addresses the following: Common Vulnerabilities and Expo 02 May 2008 16:49:47 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120371 When already running Spamassassin with Razor how much would adding Pyzor and DCC to the mix help? Matt 02 May 2008 15:13:51 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120370 SA-Users, I'm running spamassassin rules 648641 for 3.2.4 fetched by sa-update. I've run into two issues with my current setup. First, group messag 02 May 2008 08:24:19 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120349 I am getting spams on my spamtraps which are coming with HABEAS_ACCREDITED_COI Where do I report these ----------- X-Envelope-From: <invitatio 02 May 2008 06:41:09 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120342 Hi, Am I right to say that picture spam has dropped dramatically since the last months? Is it still reasonable to run an orc plugin? I see the latest 02 May 2008 06:38:41 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120341 hi all, i think this is my 1st mail.. here's the problem i'm facing i want to know how to setup or configure spamc in detailed and is it relat 01 May 2008 16:06:02 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120340 How are SpamAssassin headers dealt with on RMAIL messages in Emacs ?... using already existing EMACS commands rather than programming. Not all new us 01 May 2008 10:51:17 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120321 Almost every night between 1 and 4am I get a few messages like this: 2008-04-29 01:39:23 1JqlKN-0007RA-TD spam acl condition: error reading from spamd 01 May 2008 10:26:49 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120318 In regards to Pyzor. I'm wondering if anyone out there is using this at any large scale. Unlike the razor-agent which appears to be a Perl modul 30 Apr 2008 07:46:02 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120285 Has something happened to msrbl.com ? I have been using the Image database with success for some time, but it seems to have vanished. ==John ffitch 30 Apr 2008 04:29:34 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120280 New to SA 3.2.4 running on Ubuntu 8.04. I noticed SA attaches an analysis summary for all mails it detects as spam which is a nice feature. However, 29 Apr 2008 11:08:22 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120250 I was running in major overloads on my box and I kept noticing entries such as these enewsletter11.ru.2500 TIME_WAIT enewsletter11.ru.2353 ESTABLIS 29 Apr 2008 07:56:05 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120241 Hello, I'm searching for history of scores for some rules (e.g. MISSING_MID) in the past. Can anybody help me to find it? -- Matus UHLAR - fantomas, 29 Apr 2008 07:12:16 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120239 Hey y'all! Have any of you tweaked the spamc/spamd setup on a DirectAdmin box to point to a dedicated spamd server? I've been surfing around the 28 Apr 2008 19:55:09 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120230 Has anyone tested SpamAssassin with FreeBSD 7? Are there any known problems? I use SA with MIMEDefang/Sendmail. TIA. Richard 28 Apr 2008 12:21:02 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120238 ------- Forwarded Message Date: Sat, 26 Apr 2008 00:11:32 +0200 From: Florian Sager <sager@agitos.de> To: me@jmason.org Subject: Measuring 28 Apr 2008 08:46:36 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120225 Hi, is there a simple way of using the same Bayes-DB (mysql based) for multiple Spamassassin installations concurrently? Can I just point all mach 28 Apr 2008 04:52:26 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120221 Trying to do something that should be simple. Using sed to remove the first part of a hostname but not working. I want: abc.def.com to become def.co 26 Apr 2008 11:17:45 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120179 I was just wondering from those of you who have done it - how to start a URIBL. I'm guessing the process (simplified) is: 1) Mine messages for links 26 Apr 2008 09:49:58 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120176 I noticed that the AWL database was getting rather large, so I used the check_whitelist script to remove the stale entries. While this seems to have r 25 Apr 2008 16:32:23 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120164 I recently started recieving complaints from some users about spam getting through. Upon looking at these messages they are scorring 0.0 from spamassa 25 Apr 2008 11:46:09 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120154 I just want to make sure that all the plugins I've supposedly enabled... including rbl and spf checking are working. What's the best way to see? -- 25 Apr 2008 10:55:15 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120153 I found a possible reason for such a low hit rate with 3.2.4, uridnsbl_skip_domain. Holy smokes it has been killing me. We routinely get thousands o 25 Apr 2008 09:46:55 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120147 yahoo too has started sending backscatter. Not the yahoo.com domain , but yahoo.co.kr I got a mail (on my spamtrap domain) that "my" mail could not 24 Apr 2008 23:20:52 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120120 Greetings, I am attempting to implement SPF within SA and I have been receiving the following errors in my spamd logfile. dbg: spf: already checke 24 Apr 2008 09:43:31 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120094 After months of doing a great job, I started to get spam back into my system again. Apr 23 16:26:06 mail sqlgrey: grey: new: 82.67.64.191(82.67.64 24 Apr 2008 07:27:33 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120079 Hello, I found out that some ReplaceTags rules cause false positives with words in non-english languages, like: "medzi" (between) and/or "medzinaroz 24 Apr 2008 03:54:04 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120073 Hello, the FAKE_REPLY_C seems to mean an indication that message looks like reply, while it's not really a reply: however I don't really understand 24 Apr 2008 03:39:43 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120072 I received a spam from googlemail.com I had assumed googlemail.com was not available for free domains, Am I wrong. Can I register a googlemail.com id 24 Apr 2008 00:07:37 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120057 Hi there I'm getting more and more valid email from Windows environments that have been totally encoded in BASE64. Mixtures of Unicode and forwardi 23 Apr 2008 20:58:55 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120056 I'm starting to see some new phishing/scam attempts. What I was thinking was that it might be worthwhile to add a rule to not so much check links, bu 23 Apr 2008 20:35:02 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120054 Dear Spamassassin Users list: I'm running version 3.2.4. A couple of weeks ago, in response to a blowback storm, I turned on the VBounce ruleset, se 23 Apr 2008 10:06:46 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120043 So, when I used sa-update to grab additional rule sets, I could tell they were being used by scanning my mail logs for references to them. Yup, they 23 Apr 2008 09:30:20 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120040 I noticed that FROM_LOCAL_HEX scores more often on legit mail than on spam. Specifically it hits on Myspace invitations and some type of group mail f 23 Apr 2008 06:27:07 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120025 Hi Running SA3.2.3 but seeing a lot of bounced emails being sent to my customers. (not emails they are sending out but faked returns) various subje 23 Apr 2008 00:42:48 -0800 http://www.gossamer-threads.com/lists/spamassassin/users/120010