user scores not used by spamassassin

2015-01-02 Thread J.J. Day
Hi, I am using SpamAssassin with MimeDefang as a sendmail milter. I would like each recipient to have an individual user score configuration. None of the recipients have an account on the host so MySQL was installed and the needed lines added to the default local.cf file to provide that capabil

Re: New type of obfuscation?

2015-01-02 Thread Martin Gregorie
On Fri, 2015-01-02 at 06:18 -0600, Dave Pooser wrote: > Wouldn't that have to be a rawbody rule? > Thanks, Dave. I thought I was probably missing something obvious and that was it. Martin

Re: New type of obfuscation?

2015-01-02 Thread Dave Pooser
On 1/2/15 6:08 AM, "Martin Gregorie" wrote: >The resulting >regexes pass SA lint tests and match example spam when run as, for >instance > >grep -P '\&\#959;' >but don't generate hits when used in an SA body rule as: > >body MG_OBFUSCATION /\&\#959;/ Wouldn't that have to be a rawbody

Re: New type of obfuscation?

2015-01-02 Thread Martin Gregorie
On Fri, 2015-01-02 at 09:15 +0100, Joolee wrote: > You can start with http://homoglyphs.net/?unicodepos=1 and the search term > homoglyphs might get you even more extensive lists. > I realised that this was spam containing homoglyphs: a look at the message showed it to be using an abnormal size an

Re: New type of obfuscation?

2015-01-02 Thread Joolee
You can start with http://homoglyphs.net/?unicodepos=1 and the search term homoglyphs might get you even more extensive lists. On 1 January 2015 at 03:54, John Hardin wrote: > On Wed, 31 Dec 2014, Martin Gregorie wrote: > > During last night I received a phishing message with a new (to me >> an