Re: unusual new pump-and-dump campaign ("RCHA")

2014-04-16 Thread Chip M.
Thanks Alex! :) As Alex's rules imply, it switched over to 100% image spam (in my spamtraps), and continued its excellent syncing. Just on April 11, the volume more than tripled, and it hit many different spamtraps than all previous days. Some of those traps had never been hit before, and/or are

Abuse contacts (was Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives)

2014-04-16 Thread Kris Deugau
John Hardin wrote: > On Wed, 16 Apr 2014, Matthias Leisi wrote: >> abuse@ should be >> available. >> Wiki and docs are fine, but should not be needed if possible. > > Oh my god, yes! Sites who force you to go through a web page rather than > having a working abuse@ address are saying "we really do

Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives

2014-04-16 Thread Matthias Leisi
On Wed, Apr 16, 2014 at 8:58 PM, John Hardin wrote: abuse@ should be available. >> Wiki and docs are fine, but should not be needed if possible. >> > > Oh my god, yes! Sites who force you to go through a web page rather than > having a working abuse@ address are saying "we really don't want you t

Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives

2014-04-16 Thread John Hardin
On Wed, 16 Apr 2014, Matthias Leisi wrote: (FTR & transparency, speaking for dnswl.org - a whitelist without paid-for-listing model, but with a pay-for-heavy-use model) On Wed, Apr 16, 2014 at 6:43 PM, Greg Troxel wrote: b) meet the following transparency and responsiveness rules

Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives

2014-04-16 Thread Matthias Leisi
(FTR & transparency, speaking for dnswl.org - a whitelist without paid-for-listing model, but with a pay-for-heavy-use model) On Wed, Apr 16, 2014 at 6:43 PM, Greg Troxel wrote: > b) meet the following transparency and responsiveness rules > i) Have a page on the SA wiki which poi

Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives

2014-04-16 Thread Kevin A. McGrail
On 4/16/2014 12:50 PM, Axb wrote: On 04/16/2014 06:43 PM, Greg Troxel wrote: If the whitelist company doesn't want to make a wiki page and be transparent and responsive, SA users shouldn't have that whitelist imposed on them. nothing is imposed on SA users. They have a choice to disable whatev

Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives

2014-04-16 Thread Kevin A. McGrail
On 4/16/2014 12:43 PM, Greg Troxel wrote: So I'm not sure what you mean about volunteers; I view this as a basic policy problem rather than a needs-implementation problem. Once policy is declared, almost all the work is on the part of paid whitelist operators to do things they should have been

Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives

2014-04-16 Thread Axb
On 04/16/2014 06:43 PM, Greg Troxel wrote: If the whitelist company doesn't want to make a wiki page and be transparent and responsive, SA users shouldn't have that whitelist imposed on them. nothing is imposed on SA users. They have a choice to disable whatever they don't like (or have it don

Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives

2014-04-16 Thread Greg Troxel
Dave Warren writes: > I just thought I'd mention the rules since it seemed to be outside > them, but if it's grandfathered in, that's not unfair. I disagreed about grandfathering. The purpose of the policy is to decide what's ok. Just because something was added earlier doesn't mean

Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives

2014-04-16 Thread Greg Troxel
"Kevin A. McGrail" writes: > We do have a policy for this: > http://wiki.apache.org/spamassassin/DnsBlocklistsInclusionPolicy Sorry for the delay. For some reason firefox will not load that page, but will load other wiki pages; I gave up after a bit and fetched it a different way. So relative

Re: RCVD_IN_IADB_VOUCHED pushed spam into false negatives

2014-04-16 Thread Dave Warren
On 2014-04-15 06:42, Kevin A. McGrail wrote: On 4/14/2014 7:34 PM, Dave Warren wrote: On 2014-04-13 12:22, Dave Pooser wrote: And looking at the IADB web page, what I see is them bragging about how little c

Re: Check language of mail inside a rule

2014-04-16 Thread Toni Schornböck
Hi. Thank you, that was exactly what I was looking for. I checked for X-Spam-Languages in my prior test. kind regards m...@shambhu.info schrieb am 16. April 2014 um 13:13 +0200: >Hi Toni, > >you can check the language with a simple header rule like this: > > header LANGUAGE_TH X-Languages =~

Re: Check language of mail inside a rule

2014-04-16 Thread Christian Laußat
Hi Toni, you can check the language with a simple header rule like this: header LANGUAGE_TH X-Languages =~ /th/ describe LANGUAGE_TH Thai language scoreLANGUAGE_TH 5.7 Regards Christian Laußat Am 16.04.2014 13:00, schrieb Toni Schornböck: Hi. Thank your for your response, but how

Re: Check language of mail inside a rule

2014-04-16 Thread Toni Schornböck
Hi. Thank your for your response, but how do I check message metadata inside a rule? Do I have to write a plugin for this or is it possible to check the metadata inside a normal rule? Thank you. m...@shambhu.info schrieb am 16. April 2014 um 12:26 +0200: >Hi Toni, > >try to check the X-Languages

Re: Check language of mail inside a rule

2014-04-16 Thread Christian Laußat
Hi Toni, try to check the X-Languages pseudo header instead of X-Spam-Languages. As described in perldoc Mail::SpamAssassin::Plugin::TextCat: It will always add the results to a "X-Language" name-value pair in the message metadata data structure. This may be useful as Bayes tokens and ca

Check language of mail inside a rule

2014-04-16 Thread Toni Schornböck
Hi. I am using Spamassassin 3.3.1 (latest CentOS release) and Amavis 2.8 (also latest CentOS release). I am using TextCat to add headers to our mails to see which language they are. This works fine. But now I want to write a SA rule to match a certain language. I tried to check for the X-Spam-Lan