Retraining Spamassassin and the Dovecot antispam plugin

2015-02-13 Thread David Mehler
Hello, I've got an email setup which includes Postfix as MTA, Amavisd-new as content filter, Spamassassin for antispam work, Dovecot for Imap services, all of which with the exception of Amavisd use a Mysql database. Mail delivery, virtual users, and Dovecot with Sieve for moving spam in to a dedi

Re: Amazon phishing spam

2015-02-13 Thread Benny Pedersen
On 14. feb. 2015 01.16.47 LuKreme wrote: Heh. Nice one. +1 i just hate anyone equal when it comes to spam :) but i still like the python shows But seriously, a working set of these pairs would be great to have. It is surprising how much of the spam is faked from various companies. prob

Re: Amazon phishing spam

2015-02-13 Thread LuKreme
On 13 Feb 2015, at 07:55 , Benny Pedersen wrote: > On 13. feb. 2015 02.35.30 LuKreme wrote: > >> > whitelist_auth *@bankofamerica.com >> > blacklist_from *@bankofamerica.com > >> Care you share your list, Dave? > > blacklist_from *@*.* > whitelist_auth *@*.* > > untested :) Heh. Nice one. B

Re: URLs with non-ASCII chars

2015-02-13 Thread Dave Wreski
On 02/13/2015 05:29 PM, Dave Pooser wrote: On 2/13/15, 4:27 PM, "Dave Wreski" wrote: I thought I would send this on to you instead of broadcasting it. You thought wrong :-) Yeah, thanks One too many emails after reading spam for the last twelve hours dave

Re: URLs with non-ASCII chars

2015-02-13 Thread Dave Pooser
On 2/13/15, 4:27 PM, "Dave Wreski" wrote: >I thought I would send this on to you instead of broadcasting it. You thought wrong :-) -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com

URLs with non-ASCII chars

2015-02-13 Thread Dave Wreski
Hi John, I thought I would send this on to you instead of broadcasting it. I just received an email with an odd URL. It contained what appears to be a non-ASCII character simulating a period, or at least one that is not part of the standard set. http://pastebin.com/x6TGNpD7 http://harvardde

Re: SPF rules do not look at spoofed From: address

2015-02-13 Thread francis picabia
My question has been misunderstood as commentary on SPF, etc. It is not about SPF, I'm just trying to steer the question towards a spamassassin tag that can be triggered. I found a solution with my own rule. I wasn't sure whether the SA rules referring to 'from' header were actually meaning sender

Re: Amazon phishing spam

2015-02-13 Thread John Hardin
On Fri, 13 Feb 2015, Benny Pedersen wrote: On 13. feb. 2015 02.35.30 LuKreme wrote: > whitelist_auth *@bankofamerica.com > blacklist_from *@bankofamerica.com Care you share your list, Dave? blacklist_from *@*.* whitelist_auth *@*.* untested :) ROFL. Thanks, Benny, that's a nice wa

Re: Amazon phishing spam

2015-02-13 Thread Benny Pedersen
On 13. feb. 2015 02.35.30 LuKreme wrote: > whitelist_auth *@bankofamerica.com > blacklist_from *@bankofamerica.com Care you share your list, Dave? blacklist_from *@*.* whitelist_auth *@*.* untested :) more info on whitelist_auth is in perldoc

Re: Amazon phishing spam

2015-02-13 Thread Martin Gregorie
On Thu, 2015-02-12 at 19:48 -0500, Alex Regan wrote: > So shouldn't there be a rule for a rule that claims to come from Amazon > but does not pass through any of its servers? > In some cases the Message-ID header can help: I have a rule that adds a point or two to messages with my own Message-ID

Re: NYTimes hitting Bayes_99?

2015-02-13 Thread Reindl Harald
Am 13.02.2015 um 03:49 schrieb LuKreme: Yeah, in my own email NYT hits bayes_00. I just switched to using spamass-milter: /usr/local/sbin/spamass-milter -f -p /var/run/spamass-milter.sock -u spamd -r 9 -- -s 5242880 And it occurs to me that maybe it is not picking up bayes properly. Should I t