Re: RP rules helping spam get through

2013-04-29 Thread Margot Romary
Hi All... Alain, no need to confirm the message body, it was the compromise campaign. iPhone truncated the message; couldn't see the full deal until after I'd sent my reply. Thanks all-- Mkr Sent from my iPhone On Apr 29, 2013, at 10:00 PM, "Margot Romary" wrote: > Hi Alain... Apologies f

Re: RP rules helping spam get through

2013-04-29 Thread Margot Romary
Hi Alain... Apologies for the delayed reply. I'm mid-move cross country with my family and have limited access to email. Living Social, stemming from their recent internal compromise, sent notifications of the breach to any address from which they'd had a touchpoint in the past. They hit a *l

Re: .pw / Palau URL domains in spam

2013-04-29 Thread John Levine
In article <517f122c.3050...@trimble.com> you write: >I agree. We've seen a huge increase in ".pw" email - 100% spam > >I see one antispam vendor is telling its customers to just block >anything containing .pw references - I'm rapidly warming to the idea... You can report them to ab...@registry.pw

Re: .pw / Palau URL domains in spam

2013-04-29 Thread Jason Haar
I agree. We've seen a huge increase in ".pw" email - 100% spam I see one antispam vendor is telling its customers to just block anything containing .pw references - I'm rapidly warming to the idea... http://www.fortantispam.com/top-level-pw-domain-source-of-spam-outbreak/ -- Cheers Jason Haar

RE: sa-lean

2013-04-29 Thread Rick Cone
Matus, A couple of questions. If I created 2 IMAP email users, "ham" and "spam", and had users participating by sending their good/bad emails to these, would it matter if they moved the emails there in Outlook 2010, or would copy be okay? In Outlook 2010, if you right-click the email and select

Re: sa-lean

2013-04-29 Thread Matus UHLAR - fantomas
On 29.04.13 10:14, Rick Cone wrote: Actually, I have already partially done something like this, but I've been told it's not enough. I created 1 special email user called "junk", and we use it as IMAP type, and participating users move their SPAM to the "Junk E-mail" folder of "junk". I then ha

Re: Filter against newsletters

2013-04-29 Thread Martin Gregorie
On Mon, 2013-04-29 at 12:46 -0400, Alex wrote: > First, asking the users to look in the headers (or body) to find an > unsubscribe link, and telling them to make sure it's "confirmed" just > doesn't happen. They just want it blocked. > Did they subscribe to the list? Then tell 'em to get a clue an

Re: Filter against newsletters

2013-04-29 Thread John Hardin
On Mon, 29 Apr 2013, Alex wrote: What if it's a "semi-legit" newsletter that user has not subscribed into? A newsletter that does unconfirmed subscriptions is not even *semi*-legit. Treat them as spam. Write a rule for any identifying headers, and report them to URIBL. I asked about this is

Re: Filter against newsletters

2013-04-29 Thread Alex
Hi, >> What if it's a "semi-legit" newsletter that user has not subscribed into? > > A newsletter that does unconfirmed subscriptions is not even *semi*-legit. > > Treat them as spam. Write a rule for any identifying headers, and report > them to URIBL. I asked about this issue on the list some t

RE: sa-lean

2013-04-29 Thread Rick Cone
Matas, Thanks for the reply... Actually, I have already partially done something like this, but I've been told it's not enough. I created 1 special email user called "junk", and we use it as IMAP type, and participating users move their SPAM to the "Junk E-mail" folder of "junk". I then have "s

Re: URL spam and RP_MATCHES_RCVD

2013-04-29 Thread Niamh Holding
Hello Kris, Friday, April 12, 2013, 4:23:55 PM, you wrote: KD> I see the score showing a little less in the current update: KD> score RP_MATCHES_RCVD -0.551 -1.344 -0.551 -1.344 Since gone back up :( score RP_MATCHES_RCVD -0.553 -2.438 -0.553 -2.438

Re: Filter against newsletters

2013-04-29 Thread John Hardin
On Mon, 29 Apr 2013, Matus UHLAR - fantomas wrote: What if it's a "semi-legit" newsletter that user has not subscribed into? A newsletter that does unconfirmed subscriptions is not even *semi*-legit. Treat them as spam. Write a rule for any identifying headers, and report them to URIBL. --

Re: Filter against newsletters

2013-04-29 Thread Martin Gregorie
On Mon, 2013-04-29 at 13:06 +0200, Matus UHLAR - fantomas wrote: > What if it's a "semi-legit" newsletter thatuserhas not subscribed into? > I have seen receiving this kind of e-mails from some "world saviours" > repeatedly to many addressess that did not subscribe... > So have I, though not from '

Re: Filter against newsletters

2013-04-29 Thread Matus UHLAR - fantomas
On Mon, 2013-04-29 at 07:46 +0530, Blason rock wrote: Recently I observed that users started receiving those newsletters kinda mail. May be sombody internally subscribing it and that is why they do receive. However as a general concept would like to know if such mails can be stopped or is there a

Re: Filter against newsletters

2013-04-29 Thread Martin Gregorie
On Mon, 2013-04-29 at 07:46 +0530, Blason rock wrote: > Hey fellas, > > Recently I observed that users started receiving those newsletters > kinda mail. May be sombody internally subscribing it and that is why > they do receive. However as a general concept would like to know if > such mails can b

Re: sa-lean

2013-04-29 Thread Matus UHLAR - fantomas
On 28.04.13 10:31, Rick Cone wrote: I have spamassassin available for use in a POP environment with Outlook 2010. We don't use IMAP. How would someone recommend getting the SPAM and HAM information to sa-learn? On 29.04.13 09:10, Matus UHLAR - fantomas wrote: start using IMAP... Well, sorr

Re: sa-lean

2013-04-29 Thread Matus UHLAR - fantomas
On 28.04.13 10:31, Rick Cone wrote: I have spamassassin available for use in a POP environment with Outlook 2010. We don't use IMAP. How would someone recommend getting the SPAM and HAM information to sa-learn? start using IMAP... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fant