Blacklist mail

["Johnson, S" <sj...@edina.k12.mn.us>]

A few months ago I created a fake user and advertised it in a hidden
mailto on our home page.  It took a few weeks but I'm getting good spam
messages being dropped into this box now.  I know I can use the learn
function to pull the messages from my exchange server, however I know
these messages are strong spam.  Should I just use the learn function or
is there a way to blacklist the servers sending these messages? (or is
there a better method?)

Re: Blacklist mail

[Brian Godette <bg...@idcomm.com>]

Johnson, S wrote:
> The only reason I ask about if I should "learn" the messages is that
> my users have a hard time putting good email into the good email
> folder.  Everyone is quick to put in spam messages though.  My filter
> is getting about 50 to 1 spam to ham right now.  Everything I've
> read/heard states that I should try to be close to 1 to 1 for optimum
> spam hits.  If I add this into the learn then I'll be shooting up the
> filter to close to 100 to 1 (or more).  Should I be worried about
> that?
> 

About that only thing you can do to get more ham learned, without
invading your user's illusion of email privacy, is turn on auto-learning
and adjust bayes_auto_learn_threshold_spam to something reasonably high
since you have a user driven spam feed, and maybe adjust
bayes_auto_learn_threshold_nonspam to be a little more free with what it
considers ham (shouldn't need to tho).

RE: Blacklist mail

["Johnson, S" <sj...@edina.k12.mn.us>]

The only reason I ask about if I should "learn" the messages is that my users have a hard time putting good email into the good email folder.  Everyone is quick to put in spam messages though.  My filter is getting about 50 to 1 spam to ham right now.  Everything I've read/heard states that I should try to be close to 1 to 1 for optimum spam hits.  If I add this into the learn then I'll be shooting up the filter to close to 100 to 1 (or more).  Should I be worried about that?

-----Original Message-----
From: Giampaolo Tomassoni [mailto:g.tomassoni@libero.it] 
Sent: Thursday, August 16, 2007 9:43 AM
To: Johnson, S; users@spamassassin.apache.org
Subject: R: Blacklist mail

> Da: Johnson, S [mailto:sjohnson@edina.k12.mn.us] 
>
> A few months ago I created a fake user and advertised it
> in a hidden mailto on our home page.  It took a few weeks
> but I'm getting good spam messages being dropped into this
> box now.  I know I can use the learn function to pull the
> messages from my exchange server, however I know these
> messages are strong spam.  Should I just use the learn
> function or is there a way to blacklist the servers sending
> these messages? (or is there a better method?)

Reporting is fine.

Make sure you run "sa-learn --spam" with the same user you run spamassassin.
Also, you may think enabling reporting to DCC, Razor and Pyzor, since they
allow auto-reporting from spamtraps. Also, contact SpamCop and tell 'em
you've got a good spamtrap: they will instruct you about how to route
messages to them in order to mark the sender in their RBL (this is not the
same route then reporting with spamcop).

Giampaolo

R: Blacklist mail

[Giampaolo Tomassoni <g....@libero.it>]

> Da: Johnson, S [mailto:sjohnson@edina.k12.mn.us] 
>
> A few months ago I created a fake user and advertised it
> in a hidden mailto on our home page.  It took a few weeks
> but I’m getting good spam messages being dropped into this
> box now.  I know I can use the learn function to pull the
> messages from my exchange server, however I know these
> messages are strong spam.  Should I just use the learn
> function or is there a way to blacklist the servers sending
> these messages? (or is there a better method?)

Reporting is fine.

Make sure you run "sa-learn --spam" with the same user you run spamassassin.
Also, you may think enabling reporting to DCC, Razor and Pyzor, since they
allow auto-reporting from spamtraps. Also, contact SpamCop and tell 'em
you've got a good spamtrap: they will instruct you about how to route
messages to them in order to mark the sender in their RBL (this is not the
same route then reporting with spamcop).

Giampaolo

Re: Blacklist mail

[Matthias Haegele <mh...@linuxrocks.dyndns.org>]

Johnson, S schrieb:
> A few months ago I created a fake user and advertised it in a hidden
> mailto on our home page.  It took a few weeks but I'm getting good spam
> messages being dropped into this box now.  I know I can use the learn
> function to pull the messages from my exchange server, however I know
> these messages are strong spam.  Should I just use the learn function or
> is there a way to blacklist the servers sending these messages? (or is
> there a better method?)

Dont know if its useful (or worth it) to blacklist the "servers" (maybe 
they are lots of spambots or changing rapidly).
sa-learn --spam ... works fine for my spamcatcher here ...

> 


-- 
Grüsse/Greetings
MH


Dont send mail to: ubecatcher@linuxrocks.dyndns.org
--