You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by ra...@gmail.com on 2008/08/18 19:46:56 UTC
Honeypot Email Addresses
Hello,
Long time SA user here. I have googled much for an answer for this. I have a
few email addresses that are clearly now spam only. I would like to
blacklist them and use them as a honeypot to help train my Bayes through
autolearn, does anyone have any suggestions on how to do this?
Thanks!
Richard Ahlquist
Systems Analyst
http://www.patentlystupid.com
Re: Honeypot Email Addresses
Posted by Kevin Parris <KP...@ed.sc.gov>.
Maybe this is a completely crazy notion, but if the mail for these accounts is in fact actually flowing into/through your system, and being sent through SA already, you might create a rule so that any item with one of those addresses in it gets a high score so in turn your auto-learn threshold would trigger and process the item. And if that works, then you don't have to do anything else.
>>> <ra...@gmail.com> 08/18/08 2:08 PM >>>
On Mon, Aug 18, 2008 at 1:59 PM, John Hardin <jh...@impsec.org> wrote:
> On Mon, 18 Aug 2008, rahlquist@gmail.com wrote:
>
> Long time SA user here. I have googled much for an answer for this. I have
>> a few email addresses that are clearly now spam only. I would like to
>> blacklist them and use them as a honeypot to help train my Bayes through
>> autolearn, does anyone have any suggestions on how to do this?
>>
>
> Training from those users' mailboxes is pretty straightforward using
> sa-learn in a script run from cron. I wouldn't worry about trying to get
> autolearn involved.
>
> --
>
> I guess I should have been more clear. Most of these email addresses have
been forwarding into a junkemail gmail account and have no 'local' mailboxes
of their own, and I would like to keep it that way. I am also using
MailScanner if thats of any use. Basically I want (yes I dont care if a
spambot gets this addy) thewall@pcsites.com to always only be recognized as
spam content and have it learned. Since there isnt a mailbox how would this
best be accomplished?
Thanks!
Richard Ahlquist
Re: Honeypot Email Addresses
Posted by James Wilkinson <sa...@aprilcottage.co.uk>.
jdow wrote:
> I believe you could "blacklist_from". That would train SpamAssassin's
> Bayes filter -
Or not. Both USER_IN_BLACKLIST and USER_IN_BLACKLIST_TO have tflags set
to userconf noautolearn (in current 3.2.5 rules), which means that
SpamAssassin will ignore their scores when deciding whether to
autolearn.
> if you use global (shudder) Bayes.
Um. There is research ( http://www.ceas.cc/2007/papers/paper-74.pdf )
suggesting that “globally-trained text classification easily outperforms
personally-trained classification under realistic settings” (the
text-classifier they used was Bayes).
James.
--
E-mail: james@ | Ah yes. Thingie and thingamagig, and I'll throw in
aprilcottage.co.uk | whatchamacallit too. Because in tech support, "button" is
| sometimes a bit too technical for the average caller.
| -- "mr_scoot"
Re: Honeypot Email Addresses
Posted by jdow <jd...@earthlink.net>.
From: <ra...@gmail.com>
Sent: Monday, 2008, August 18 11:08
> On Mon, Aug 18, 2008 at 1:59 PM, John Hardin <jh...@impsec.org> wrote:
>
>> On Mon, 18 Aug 2008, rahlquist@gmail.com wrote:
>>
>> Long time SA user here. I have googled much for an answer for this. I
>> have
>>> a few email addresses that are clearly now spam only. I would like to
>>> blacklist them and use them as a honeypot to help train my Bayes through
>>> autolearn, does anyone have any suggestions on how to do this?
>>>
>>
>> Training from those users' mailboxes is pretty straightforward using
>> sa-learn in a script run from cron. I wouldn't worry about trying to get
>> autolearn involved.
>>
>> --
>>
>> I guess I should have been more clear. Most of these email addresses have
> been forwarding into a junkemail gmail account and have no 'local'
> mailboxes
> of their own, and I would like to keep it that way. I am also using
> MailScanner if thats of any use. Basically I want (yes I dont care if a
> spambot gets this addy) thewall@pcsites.com to always only be recognized
> as
> spam content and have it learned. Since there isnt a mailbox how would
> this
> best be accomplished?
I believe you could "blacklist_from". That would train SpamAssassin's
Bayes filter - if you use global (shudder) Bayes. As for automating
building a block list you'll have to pester someone else into providing
a clue.
If you use per-user Bayes then you have more of a problem because you
need to train it from messages not sent to the user. For that you will
need a local spam repository that operates as a fifo buffer. How you
implement that is an exercise for the student.
{^_^}
Re: Honeypot Email Addresses
Posted by ra...@gmail.com.
On Mon, Aug 18, 2008 at 1:59 PM, John Hardin <jh...@impsec.org> wrote:
> On Mon, 18 Aug 2008, rahlquist@gmail.com wrote:
>
> Long time SA user here. I have googled much for an answer for this. I have
>> a few email addresses that are clearly now spam only. I would like to
>> blacklist them and use them as a honeypot to help train my Bayes through
>> autolearn, does anyone have any suggestions on how to do this?
>>
>
> Training from those users' mailboxes is pretty straightforward using
> sa-learn in a script run from cron. I wouldn't worry about trying to get
> autolearn involved.
>
> --
>
> I guess I should have been more clear. Most of these email addresses have
been forwarding into a junkemail gmail account and have no 'local' mailboxes
of their own, and I would like to keep it that way. I am also using
MailScanner if thats of any use. Basically I want (yes I dont care if a
spambot gets this addy) thewall@pcsites.com to always only be recognized as
spam content and have it learned. Since there isnt a mailbox how would this
best be accomplished?
Thanks!
Richard Ahlquist
Re: Honeypot Email Addresses
Posted by Ron Smith <po...@pmbx.net>.
Yes, because rather than use a honeypot, you can forward as an
attachment to Spamcop. SA uses Spamcop in its scoring so indirectly
you improve your SA scoring accuracy if you do that. I strongly
recommend all our users do that also.
Ron Smith
postmaster@pmbx.net
"Having an email problem is painful, but character-building."
On Aug 18, 2008, at 3:27 PM, John Hardin wrote:
> On Mon, 18 Aug 2008, Ron Smith wrote:
>
>> You might want to think about using Spamcop to submit those instead
>> as the SA scoring of these spam do increase the accuracy for all of
>> your users.
>
> Did you mean to send that to the list?
Re: Honeypot Email Addresses
Posted by John Hardin <jh...@impsec.org>.
On Mon, 18 Aug 2008, rahlquist@gmail.com wrote:
> Long time SA user here. I have googled much for an answer for this. I
> have a few email addresses that are clearly now spam only. I would like
> to blacklist them and use them as a honeypot to help train my Bayes
> through autolearn, does anyone have any suggestions on how to do this?
Training from those users' mailboxes is pretty straightforward using
sa-learn in a script run from cron. I wouldn't worry about trying to get
autolearn involved.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The first time I saw a bagpipe, I thought the player was torturing
an octopus. I was amazed they could scream so loudly.
-- cat_herder_5263 on Y! SCOX
-----------------------------------------------------------------------
6 days until the 1929th anniversary of the destruction of Pompeii
Re: Honeypot Email Addresses
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Am 2008-08-18 13:46:56, schrieb rahlquist@gmail.com:
> Hello,
> Long time SA user here. I have googled much for an answer for this. I have a
> few email addresses that are clearly now spam only. I would like to
> blacklist them and use them as a honeypot to help train my Bayes through
> autolearn, does anyone have any suggestions on how to do this?
Install a "maildrop" or "procmail" rule for it and do something like
:0
* TO_(<list_of_burned_email_addresses>)
|/uar/bin/sa-learn --spam -
Maybe use the additional option "--no-sync" too.
Thanks, Greetings and nice Day/Evening
Michelle Konzack
Systemadministrator
24V Electronic Engineer
Tamay Dogan Network
Debian GNU/Linux Consultant
--
Linux-User #280138 with the Linux Counter, http://counter.li.org/
##################### Debian GNU/Linux Consultant #####################
Michelle Konzack Apt. 917 ICQ #328449886
+49/177/9351947 50, rue de Soultz MSN LinuxMichi
+33/6/61925193 67100 Strasbourg/France IRC #Debian (irc.icq.com)