Re: Where can read about SA's FARAWAY tags

[EMAIL PROTECTED] wrote: > Where can I read about how SA arrives at the FARAWAY tags. > > Its not always from charset headers or two letter country indicators > in header address's. At least I think I'm seeing some mail that > contains neither but SA has still correctly identified them. > Well,

Re: Paiment Repre sentative spams

On Mon, 26 Nov 2007, Igor Chudov wrote: > for thieves who are moving stolen money to their real accounts, using A german radio-station in Berlin had a feature abount those criminals. Sending trojans as spam to people using homebanking, they capture money, and to transfer this money to themselves

Re: Paiment Repre sentative spams

Igor Chudov schrieb am 26.11.2007 18:01: I get a lot of spams where I am being "offered" a lucrative occupation that involves transferring finanscial assets from one place to another. It is clearly a scam, however, I am now sure what. This is the way phishers transfer stolen money from a "phis

Where can read about SA's FARAWAY tags

Where can I read about how SA arrives at the FARAWAY tags. Its not always from charset headers or two letter country indicators in header address's. At least I think I'm seeing some mail that contains neither but SA has still correctly identified them.

Re: Paiment Repre sentative spams

On Mon, 2007-11-26 at 11:01 -0600, Igor Chudov wrote: > I get a lot of spams where I am being "offered" a lucrative occupation > that involves transferring finanscial assets from one place to > another. It is clearly a scam, however, I am now sure what. Are these > for thieves who are moving stole

Paiment Repre sentative spams

I get a lot of spams where I am being "offered" a lucrative occupation that involves transferring finanscial assets from one place to another. It is clearly a scam, however, I am now sure what. Are these for thieves who are moving stolen money to their real accounts, using victims as decoys (maybe

FAKE_HELO_LYCOS false positive

I'm pretty sure that the FAKE_HELO_LYCOS rule is hitting legit mail from Lycos. Add that on top of the fact it is sending bogus HTML mail and it is pushed above 5.0. Looking at the check_for_rdns_helo_mismatch code, I do see there are debug statements in there to indicated why the rule fired. H

Re: Rule(s) to tie From and To addresses together?

Thanks, Matt. That seems to be the type of rule what I was looking for. On Nov 26, 2007 8:02 AM, Matt Kettler <[EMAIL PROTECTED]> wrote: > The following greylist.conf would do what you want: > --- > acl whitelist from [EMAIL PROTECTED] rcpt [EMAIL PROTECTED] > acl blackli

Re: Rule(s) to tie From and To addresses together?

mouss wrote: > Mike Kenny wrote: >> >> >> I hope to use this to cut down on spam and phishing attempts, >> because >> I could identify legitimate mail by virtue of having the correct >> sender address (or at least domain) and recipient. That is, mail >> from >> [EMAIL PROTECTED]

Re: Rule(s) to tie From and To addresses together?

Mike Kenny wrote: I hope to use this to cut down on spam and phishing attempts, because I could identify legitimate mail by virtue of having the correct sender address (or at least domain) and recipient. That is, mail from [EMAIL PROTECTED] to the

Re: Add Keyword

I have seen replica watch keywords in the mail but didnt see scores like belows - Original Message From: Matthias Haegele <[EMAIL PROTECTED]> To: SpamAssassin Sent: Monday, November 26, 2007 10:48:59 AM Subject: Re: Add Keyword Emre BALCI schrieb: > Hii All > I want to add some keywo

Re: Add Keyword

Emre BALCI schrieb: Hii All I want to add some keywords like replicas,rolex into a rule file which file and which rule that you advice ? I dont think this is neccessary?, your mail gets: X-Spam-Status: No, score=3.537-3 required=3.5 tests=[BAYES_00=-2.599, EM_ROLEX=1.57, REPLICA_WATCH