Re: Phishing rules?

2008-10-30 Thread Brent Clark
Hiya See SA examples http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists Also add hostkarma.junkemailfilter.com to you DNSBL. Works really well. Another thing I do find is useful is adding additional higher valued MX records. http://www.junkemailfilter.com/spam/support.html HTH Rega

Re: Phishing rules?

2008-10-30 Thread Jeff Chan
On Thursday, October 30, 2008, 12:56:53 PM, Micah Anderson wrote: > I keep getting hit by phishing attacks, and they aren't being stopped by > anything I've thrown up in front of them: [...] > I've got spamassassin 3.2.5 with URIBL plugin loaded (which I understand > pulls in the 25_uribl.cf auto

Re: Phishing rules?

2008-10-30 Thread Joseph Brennan
Micah Anderson <[EMAIL PROTECTED]> wrote: I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: Do you mean attempts to get your users to send their passwords, or fake mail pretending to be from banks? Joseph Brennan Lead Email S

Re: Phishing rules?

2008-10-30 Thread Kelson
Micah Anderson wrote: reject_rbl_client list.dsbl.org, DSBL has shut down, and you should remove the query from your list. It won't help with the phishing, but it'll free up some network resources. Info: http://dsbl.org/node/3 I've got clamav pulling signatures updated once

Re: Phishing rules?

2008-10-30 Thread Karsten Bräckelmann
On Thu, 2008-10-30 at 15:56 -0400, Micah Anderson wrote: > I keep getting hit by phishing attacks, and they aren't being stopped by > anything I've thrown up in front of them: > > postfix is doing: > reject_rbl_client b.barracudacentral.org, > reject_rbl_client zen.spamhaus

Re: Phishing rules?

2008-10-30 Thread Bill Landry
Micah Anderson wrote: > I keep getting hit by phishing attacks, and they aren't being stopped by > anything I've thrown up in front of them: > > postfix is doing: > reject_rbl_client b.barracudacentral.org, > reject_rbl_client zen.spamhaus.org, > reject_rbl_client

Re: Phishing rules?

2008-10-30 Thread Randy
Micah Anderson wrote: I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: postfix is doing: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client lis

Phishing rules?

2008-10-30 Thread Micah Anderson
I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: postfix is doing: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client list.dsbl.org, I've got c

Re: Getting hammered by backscatter

2008-10-30 Thread Martin Gregorie
On Thu, 2008-10-30 at 10:28 -0600, Karl Pearson wrote: > On Wed, 29 Oct 2008, Chris Arnold wrote: > > > We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the > > present time, my mailbox is filled with backscatter; getting around 10 a > > minute since 4:30 today. I have postf

Re: Getting hammered by backscatter

2008-10-30 Thread Karl Pearson
On Wed, 29 Oct 2008, Chris Arnold wrote: We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the present time, my mailbox is filled with backscatter; getting around 10 a minute since 4:30 today. I have postfix backscatter rules in postfix of zimbra, http://www.postfix.org/BAC

Re: Problems with the email adress of our company

2008-10-30 Thread Greg Troxel
Asking someone to change their domain name to match an SA rule seems a bit extreme to me! Why not propose that de establish a gmbh 2nd level for companies, and make him rss.gmbh.de? FROM_DOMAIN_NOVOWEL was logged for only 3 messages here yesterday, of 1.3 million logged as scoring 7.0

Re: Problems with the email adress of our company

2008-10-30 Thread Joseph Brennan
Greg Troxel <[EMAIL PROTECTED]> wrote: But even with gmx addressed separately, 4.2 points is a very high score, and there is a large installed base. So I would advise considering registering rss-gmbh.de and using that instead, but doing your own testing first. Asking someone to change their

Re: Spamassassin+amavis

2008-10-30 Thread SM
At 05:51 30-10-2008, Luis Hernán Otegui wrote: Just to check, you know you should run a RBL check in Postfix BEFORE it accepts te message, do you? This reduces dramatically the number of messages your server has to scan. And improves the performance a lot. You should not run RBL checks on outbo

Re: Problems with the email adress of our company

2008-10-30 Thread Matt Kettler
Greg Troxel wrote: > we have some problems with the email-address of our company. When we > write emails to people with a [EMAIL PROTECTED] address, the receiver won't > get the email because it's in the spam folder. > > Gmx's support told us that they use spam assassin. > > Can you hel

Re: Problems with the email adress of our company

2008-10-30 Thread Greg Troxel
we have some problems with the email-address of our company. When we write emails to people with a [EMAIL PROTECTED] address, the receiver won't get the email because it's in the spam folder. Gmx's support told us that they use spam assassin. Can you help us? Can you verify that we a

Re: Spamassassin+amavis

2008-10-30 Thread Luis Hernán Otegui
Luis: 2008/10/29 Luis Croker <[EMAIL PROTECTED]>: > > How can I tunr off the Network tests (RBLs) ??? Just to probe if it can > make the delivery faster. Just to check, you know you should run a RBL check in Postfix BEFORE it accepts te message, do you? This reduces dramatically the number of

Problems with the email adress of our company

2008-10-30 Thread Marie Gabriele Licht
Hi there, we have some problems with the email-address of our company. When we write emails to people with a [EMAIL PROTECTED] address, the receiver won't get the email because it's in the spam folder. Gmx's support told us that they use spam assassin. Can you help us? Can you verif

Getting hammered by backscatter

2008-10-30 Thread Chris Arnold
We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the present time, my mailbox is filled with backscatter; getting around 10 a minute since 4:30 today. I have postfix backscatter rules in postfix of zimbra, http://www.postfix.org/BACKSCATTER_README.html#real but still ge