Re: Whatsapp spam

2015-07-01 Thread John Hardin
On Wed, 1 Jul 2015, Alex wrote: Hi, I've been receiving a handful of spam claiming to be from whatsapp, and I can't figure out how to block it. http://pastebin.com/8E66QRkn http://pastebin.com/KrTgKGh1 What does a legitimate whatsapp email look like? I've searched their site, and their DNS e

Re: Whatsapp spam

2015-07-01 Thread Alex
Hi, >> I've been receiving a handful of spam claiming to be from whatsapp, >> and I can't figure out how to block it. >> >> http://pastebin.com/8E66QRkn >> http://pastebin.com/KrTgKGh1 >> >> What does a legitimate whatsapp email look like? I've searched their >> site, and their DNS entry doesn't e

Re: Whatsapp spam

2015-07-01 Thread John Hardin
On Wed, 1 Jul 2015, Alex wrote: I've been receiving a handful of spam claiming to be from whatsapp, and I can't figure out how to block it. http://pastebin.com/8E66QRkn http://pastebin.com/KrTgKGh1 What does a legitimate whatsapp email look like? I've searched their site, and their DNS entry d

Re: Whatsapp spam

2015-07-01 Thread Jeroen de Neef
Hi, You could look into training your Bayesian classifier. Just use *sa-learn --spam filename* To teach the filter that a message isn't spam use *sa-learn --spam filename* 2015-07-02 2:56 GMT+02:00 Alex : > Hi guys, > > I've been receiving a handful of spam claiming to be from whatsapp, > and

Whatsapp spam

2015-07-01 Thread Alex
Hi guys, I've been receiving a handful of spam claiming to be from whatsapp, and I can't figure out how to block it. http://pastebin.com/8E66QRkn http://pastebin.com/KrTgKGh1 What does a legitimate whatsapp email look like? I've searched their site, and their DNS entry doesn't even have an MX re

Re: Detecting macros in word files

2015-07-01 Thread Axb
On 01.07.2015 17:41, David B Funk wrote: On Wed, 1 Jul 2015, Axb wrote: On 01.07.2015 17:08, Steve Freegard wrote: On 01/07/15 15:18, Marc Perkel wrote: Is there any way to detect macros inside of word doc files as attachments? Or linux command line utils to do so? If you use ClamAV; you c

Re: Detecting macros in word files

2015-07-01 Thread David B Funk
On Wed, 1 Jul 2015, Axb wrote: On 01.07.2015 17:08, Steve Freegard wrote: On 01/07/15 15:18, Marc Perkel wrote: Is there any way to detect macros inside of word doc files as attachments? Or linux command line utils to do so? If you use ClamAV; you can enable the "OLE2BlockMacros yes" option

Re: Detecting macros in word files

2015-07-01 Thread Axb
On 01.07.2015 17:08, Steve Freegard wrote: On 01/07/15 15:18, Marc Perkel wrote: Is there any way to detect macros inside of word doc files as attachments? Or linux command line utils to do so? If you use ClamAV; you can enable the "OLE2BlockMacros yes" option and then catch the 'Heuristics.O

Re: Detecting macros in word files

2015-07-01 Thread Steve Freegard
On 01/07/15 15:18, Marc Perkel wrote: Is there any way to detect macros inside of word doc files as attachments? Or linux command line utils to do so? If you use ClamAV; you can enable the "OLE2BlockMacros yes" option and then catch the 'Heuristics.OLE2.ContainsMacros' reported by ClamAV (wh

Re: Detecting macros in word files

2015-07-01 Thread John Hardin
On Wed, 1 Jul 2015, Marc Perkel wrote: Is there any way to detect macros inside of word doc files as attachments? Or linux command line utils to do so? http://impsec.org/email-tools/procmail-security.html I've been mulling trying to migrate the archive filename scan part to an SA plugin but

Re: Detecting macros in word files

2015-07-01 Thread Axb
On 01.07.2015 16:18, Marc Perkel wrote: Is there any way to detect macros inside of word doc files as attachments? Or linux command line utils to do so? SSDEEP may be your friend

Re: Detecting macros in word files

2015-07-01 Thread Kevin A. McGrail
On 7/1/2015 10:18 AM, Marc Perkel wrote: Is there any way to detect macros inside of word doc files as attachments? Or linux command line utils to do so? This was discussed on MD list (for example, https://www.mail-archive.com/mimedefang@lists.roaringpenguin.com/msg15713.html) but I'm doing i

Detecting macros in word files

2015-07-01 Thread Marc Perkel
Is there any way to detect macros inside of word doc files as attachments? Or linux command line utils to do so? -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot com 415-992-3400

Re: Write a custom rule to match sender's ip address.

2015-07-01 Thread RW
On Wed, 01 Jul 2015 19:19:07 +1200 Alex King wrote: > How can I write custom rules that test where the mail came from, ie, > the IP address noted by the first received header in my trusted > networks? > > I've seen http://wiki.apache.org/spamassassin/TrustPath, but it > doesn't explain how to do

Re: Write a custom rule to match sender's ip address.

2015-07-01 Thread Matus UHLAR - fantomas
On 01.07.15 19:19, Alex King wrote: How can I write custom rules that test where the mail came from, ie, the IP address noted by the first received header in my trusted networks? that should be by internal network, from external network, which means you have to check for -lastexternal I've se

Write a custom rule to match sender's ip address.

2015-07-01 Thread Alex King
How can I write custom rules that test where the mail came from, ie, the IP address noted by the first received header in my trusted networks? I've seen http://wiki.apache.org/spamassassin/TrustPath, but it doesn't explain how to do this. Do I need to add: add_header all RelaysUntrusted _RELA