Spamihilator

von **Bob Loeffler** » 29. Jun 2007, 16:35

Hi Ponder,

Ah, yes. This will not work for you. I'm sorry. If I think of anything else, I will let you know.

Regards,

Bob

von **Ponder** » 28. Jun 2007, 01:58

Hi Bob

We have two PC's in a small office and in fact send emails back and forth...so maybe putting our own email address in the bocked senders list would not work, but I hope that some of the folks that know much more about these issues than I can post....as your suggestion seems straight forward and reasonable.

Thanks for you interest and help....Regards, Ponder

von **Bob Loeffler** » 27. Jun 2007, 17:15

Ponder hat geschrieben:I just wish there was a defined way to classify mail as spam if the sender uses my own email address.

Hi all,

I'm still a little tired, so maybe I'm not thinking straight. But is there a reason why we don't put our own e-mail address into the Blocked Senders list? That would take care of this issue. Would it cause any problems? As long as you don't send e-mails to yourself, I can't think of any other problems it could cause.

Regards,

Bob

von **Quellcore** » 21. Jun 2007, 20:36

Hello Ponder!

Thanks for the feeback, X-Files closed.

Good luck with your Spami-Setup in the future.

greetings,
Quellcore

P.S. New version 0.9.9.29 out today :!:

von **Ponder** » 21. Jun 2007, 00:53

Hi Quellcore.

I configured Hercule almost like your configuration....and did some more work on spam words...

It' no doubt working....received about 120 spam mails today...Many of which listed my email address as sender and receiver.....but Spami with the new configuration of the filters etc...classified every one correctly!!

Have also noticed that since I compacted the Learning filter, that there are several filters now classifying spam and non spam...before Learning was compacted, it seemed that the learning Filter was classifying most of the emails...

I just read what is available on the signature filter......this one looks very interesting....I'll add it and see.....

Thanks for everything once again....Best Regards...Ponder

von **Quellcore** » 20. Jun 2007, 03:13

Ponder hat geschrieben:I just wish there was a defined way to classify mail as spam if the sender uses my own email address.

You might want to take look at the signature plugin:
http://www.spamihilator.com/plugins/index.php?category=1&start=15&limit=15&detail=35

I'm not using it these days, but ccording to the desription it could work, too.

Regards,
Quellcore

von **Quellcore** » 20. Jun 2007, 02:43

Hello Ponder!

Thanks for your feedback!
To get back on the topics tuning/optimizing:
You have only two filters iin front of the learning filter that can classify spam.
We're talking about the URL-Filter and the Substring-Filter.
You can't do anything about the URL-Filter since it's automated, but it might be worth checking some of these tricky mails to find some common expressions that you could add to the substring-filter.

Here is an incomplete list of common expression that i added to the substring-filter:

Code: Alles auswählen: Accucast advertisement ANUNCIO asshole Back to School Special best meds big5 bitches black cock brainchild Buy cheap Campaign Enterprise Canon Rebel Cartier cheapest pills Cheating-Wives * POLICY VIOLATION ! * Soft Tab -Claim your CLERICAL Dell Laptop Dell Notebook diet pills Do you want a Watch? Ejaculation Enlargement e-pharmacy euc-kr Flat Screen TV found a school for you free laptop Girls Gone Wild GoIdenStake Health Newsletter -Help us Historic Low Retes IBM Laptop IBM Thinkpad Icy1112 iMac G5 infiltrate Internet pharamcy iPod mini iso-2022-jp iso-2022-kr iso-8859-3 Keep your memories koi8 koi8-r ks_c_5601-1987 ks_c_5601-1987 Large Screen TV let's shake hands or Not life-insurance companies-nationwide Livecam Lose your weight losethosepounds low rates Lower Your Monthly Make Memories Last manhood Matchmaker News MedCentral medications meds available metabolic m o r t g a g e msnmessenger natural enlargement Natural Weight Loss Need a cheap watch Need a Laptop Need a low cost watch new laptop No classes! No examinations! No textbooks! Online Education online pharmacy Only Few Minutes painkiller PermanentEnlarger Pharmaceuticals Please see attachment for today's special offers Police Bribe Premature Prescription Preview Free Teen Preview Hot Babes pussy ripping Regalis sexual health Size does matter Sony DVD Sony Vaio stamina stretched pussy tripod VP-RX want a cheap want a free want a new Want a Watch? watch replica We give you weightloss You can be smart

The best ones with the most hits within the last weeks are probably:

Code: Alles auswählen: Cartier Enlargement Girls Gone Wild koi8 koi8-r medication metabolic m o r t g a g e (without the spaces) Natural Weight Loss online pharmacy Pharmaceuticals Premature Prescription weightloss

How about pushing other filter like the empty mail filter in front of the learning filter :?:

Other canditates for this acton would also be the RFC-Validator and the Spam-Word-Filter.
The Hercule is a little bit tricky. It offers a huge amount of options, unfortunetely the preconfigured standard setting tend to give some false-positives.
After i disabled quite few of the standard settings it seems to be pretty safe now, but it doesn't filter that much anymore:

These are the settings in german, sorry.
I guess you can still figure what is what :!:

That's it for now, be good!

Regards,
Quellcore

von **Ponder** » 20. Jun 2007, 00:48

Hi Quellcore

I think I am seeing some progress against spammers sending mails from my own address....
Got quite a few today...total spam 105 so far, and many were from spammers using my email address....In the past, most or all would be classified as non-spam...but today only 3 were classified as non spam....and all the rest were classified as spam...

Some of the ones that were classified as spam were classified by the learning filter...and I know in the past these would have been classified as non spam....so I think we have made some progress by compacting the learning filter......

I just wish there was a defined way to classify mail as spam if the sender uses my own email address.

Thank you for all your good help....Ponder

von **Ponder** » 19. Jun 2007, 03:32

Thanks Quellcore...

I compacted the learning filter and increased the size...last time was early April when we were posting back then. Yes, I remember that post.

Is the Bad Recipient filter same as the Addressee filter?

As information...I saw an email today that was spam and that the sender had used my email address as the sender....Spami correctly listed it as spam by the word filter....

Will advise further in a day or two...

Thanks for so much help....Ponder

von **Quellcore** » 19. Jun 2007, 00:34

Ponder hat geschrieben:Filter Logging is enabeled, and shows that the learning filter is classifying these spam mails as non-spam.

This gives us several points to start tuning/optimizing.

Making the learning filter more effective by compacting the wordlists
Adjust the filter order that other filters plugins have a chance to classify these mails as Spam before the learning filter is able to classify it as non-Spam
Install additional filters and put them before the learning filter to catch those mails

Ponder hat geschrieben:Since Spami is treating these emails like my email address is listed in the friends filter....

No, it doesn't :!:

If it would the mails wouldn't show up in the training area (I think this even applies when " ... automatically learn from my friends" is unchecked)

First i wanted to give you some more ideas how to improve the filter order and other filters, but when i reread your posts again i'm starting to focus on #1 :idea:

Maybe the word lists from the learning filter are full again. Do you remember this post :?:

<click>
Spami will stop adding new entries to the bad.spamihilator.wordlist and good.spamihilator.wordlist and just increase the hits from the words that are already in these list if the size limit is reached.
Try to compact it again through the Spami settings (this time the Non-Spam-Words are more important) and consider increasing the size limit, too.
See if it'll help and report back, pls.

Regards,
Quellcore

von **Quellcore** » 18. Jun 2007, 01:12

Hello Ponder!

I didn't mean to sound angry with you, i was just unlucky to make a wrong guess which i used as a base for my replies.

Thanks for your information, might be able to reply tomorrow, right now it's getting too late.

Good night,
Quellcore

von **Ponder** » 18. Jun 2007, 00:58

Hi Quellcore.

After this, I would not blame you for not helping if I have more questions. I'll try to be more clear and complete here...and try to answer your questions from your last post..

Here are my filters in priority order

1 Newsletter
2. Whitestring
3. URL
4. Substring
5. Learning
6. Word
7. Hercule
8. RFC
9. Empty Mail
10. DCC
11. Blacklist

Filter Logging is enabeled, and shows that the learning filter is classifying these spam mails as non-spam.

While I do not have any of my email addresses listed in the friends filter, I did have them listed at one time in the past...Since Spami is treating these emails like my email address is listed in the friends filter, is it possible that the record of my email addresses in the friends filter is not completely deleted and is still in a log or in history somewhere???

Thanks Quellcore for your help...I sure appreciate it...Regards, Ponder

von **Quellcore** » 17. Jun 2007, 20:30

Ponder hat geschrieben:When these spams come to my inbox (all three email accounts) each does go through spami....and each is noted as Non-spam by Spami in the training area.

Then you should provide much more information:

Please post your filter priority list
Which Filter classifies these mails as Non-Spam

Spami seems to be working ok then, so it's just a matter of a smart selection of filters and their order.

Ponder hat geschrieben:I notice that after the spammers name, my email address is listed, and I think it's always the same email address

Check out the Misnamed Filter: http://www.spamihilator.com/plugins/index.php?category=1&start=0&limit=15&detail=77
That might be a good filter for this kind, but i'm sure it sghould also work without this one.

Ponder hat geschrieben:Does this change what I should be checking since Spami does see the spam mail and considers it non-spam?

Yes, that changes everything. All 300 lines that i've written before don't apply anymore.

Ponder hat geschrieben:One additional thought: When I first started to use Spami, I did list my email addresses in the friends list but realized the problems with this strategy...so I deleted them.....Is it possible that one of the logs continues to list my email addresses. But then Spami would not record seeing the emails at all, right?

Can you try to put it in other words, i'm afraid i misunderstand you again.
Don't want to make another lenghtly post for nothing.
Are you using the filter.log already :?:

Regards,
Quellcore

von **Ponder** » 17. Jun 2007, 18:13

Hi Quellcore..

Sorry I did not realize that more info was needed....

When these spams come to my inbox (all three email accounts) each does go through spami....and each is noted as Non-spam by Spami in the training area.

I noticed that the spam mail lists the senders name and lists one of my email addresses as the spammers email address....so the mail looks like it's from me, and then the delivered line shows where the mail is going....which is one of my email addresses. This take place in each of my three email addresses, but this might be interesting. I notice that after the spammers name, my email address is listed, and I think it's always the same email address...which is one of the three that I use.

Does this change what I should be checking since Spami does see the spam mail and considers it non-spam?

One additional thought: When I first started to use Spami, I did list my email addresses in the friends list but realized the problems with this strategy...so I deleted them.....Is it possible that one of the logs continues to list my email addresses. But then Spami would not record seeing the emails at all, right?

Sorry my initial info was not clear....and thanks for helping me...Ponder

von **Quellcore** » 17. Jun 2007, 12:19

Hallo Ponder!

You didn't answer my question yet, if my assumption was right that these mails dont show up in the training area.
I simply want to clarify that by stating "I have noticed that certain spam mails do not get caught by spami" you actually mean exactly that.

If a mail is bypassing the Training Area and goes right to your mail client it should be easy to check all possibilities one by one.

account where you receive that mail is not configured to work through Spami
Sender of that mail is on your firends list (please also check wildcard-entries)
"Automatically learn from messages from my friends" is activated
You've put your own Email- adress in the section "Newsgroups" within the Newsletter-Plugin
"Don't store Newsletters in the Trainings Area" is activated

In theory Spami's plugin architecture allows every plugin to beahve like that:

Code: Alles auswählen: classify a mail as Non-Spam and don't put a copy of the mail in the training area

But then i don't know any actual plugin that does that except for the Newsletter-Plugin.

If your Email adresse is not on the friends list my next guess would be the Newsletter-Plugin.
See also this thread for a explanation:
http://www.spamihilator.com/forum/viewt ... 4100#34100

For future investigation:
Do you have Bob's Filter Statistics v1.1.1 installed.
This plugins enables Filter-Logging which you can also do manually if you don't have it installed or you don't want to install it.
http://www.spamihilator.com/forum/viewtopic.php?p=36751#36751
After a restart Spami will log all filtering. This is done for evrey Mail that reaches Spami and includes the reason (e.g. Friend, Blocked Sender, Plugin BlaBlaBla)
Depending on the Spami version and the installation method this file called filter.log might be in Spami's installation folder or in the USER-Folder. It will be created when the first new mail is received by Spami, so if you didn't receive any new mails through Spami don't panic that you can't find that file.

Regards,
Quellcore

Spamihilator

New Twist from Spammers ?

Antwort erstellen

Ansicht erweitern Die letzten Beiträge des Themas: New Twist from Spammers ?