New Spam

[Martin Hepworth]

Roger

make sure the plugin is enabled in /etc/mail/spamassassin/init.pre and
as long you have a recent Net::DNS module installed it should work fine
- oh and network tests enabled, which seem to be out of the box.

test with spamassassin -p <path-to>/spam.assassin.prefs.conf -D --lint
and make sure it's loading the URI-RBL pluging and doesn't complain the
NET::DNS perl module is too old.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Roger Jochem wrote:
> What do I have to do to enable URIBLs ?
>
> I'm not shure I'm using that... I'm using spamassassin 3.0.2
>
> ----- Original Message -----
> From: "Drew Marshall" <drew at THEMARSHALLS.CO.UK>
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Sent: Wednesday, March 23, 2005 7:20 AM
> Subject: Re: New Spam
>
>
>
>>Roger Jochem said:
>>
>>>Hello all!
>>>
>>>I'm receiving messages like the attached one for a while now. Is there
>>>some spamassassin rule that can block this kind of spam? Aparently the
>>>message, lokking the code, is very diferent from what is appearing on
>>>screen. And the original text (that doesn't appear) is always very
>>>diferent...
>>
>>Worked for me...
>>
>>Our MailScanner believes that the attachment to this message sent to you
>>
>>    From: owner-mailscanner at jiscmail.ac.uk
>> Subject: [MAILSCANNER] New Spam
>>
>>is Unsolicited Commercial Email (spam). Unless you are sure that this
>
> message
>
>>is incorrectly thought to be spam, please delete this message without
>
> opening
>
>>it. Opening spam messages might allow the spammer to verify your email
>>address.
>>
>>If you believe that this message has been incorrectly marked as spam,
>
> please
>
>>forward this email to postmaster.
>>
>> pts rule name              description
>>---- ----------------------
>>--------------------------------------------------
>> 2.5 SARE_SPOOF_COM2OTH     URI: a.com.b.c
>> 2.5 SARE_SPOOF_OURI        URI: URL has items in odd places
>> 2.3 BIZ_TLD                URI: Contains an URL in the BIZ top-level
>
> domain
>
>> 0.1 HTML_TEXT_AFTER_BODY   BODY: HTML contains text after BODY close tag
>> 0.1 HTML_TAG_EXIST_TBODY   BODY: HTML has "tbody" tag
>>-2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
>>                            [score: 0.0000]
>> 0.0 HTML_TEXT_AFTER_HTML   BODY: HTML contains text after HTML close tag
>> 0.0 HTML_MESSAGE           BODY: HTML included in message
>> 0.1 HTML_FONT_BIG          BODY: HTML tag for a big font size
>> 0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76
>
> chars
>
>> 1.0 URIBL_SBL              Contains an URL listed in the SBL blocklist
>>                            [URIs: spacedrugs.com]
>> 3.2 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL
>
> blocklist
>
>>                            [URIs: spacedrugs.com]
>>
>>As you can see the URIBLs did their job very well. I would ensure that you
>>are using the latest SpamAssassin and have URIBL turned on.
>>
>>Drew
>>
>>--
>>In line with our policy, this message has
>>been scanned for viruses and dangerous
>>content by MailScanner, and is believed to be clean.
>>www.themarshalls.co.uk/policy
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!