Re: Whatsapp spam

2015-07-02 Thread John Hardin
On Thu, 2 Jul 2015, Alex wrote: Hi, On Thu, Jul 2, 2015 at 12:07 PM, John Hardin wrote: On Thu, 2 Jul 2015, John Wilcock wrote: Le 02/07/2015 04:23, Alex a écrit : Not sure if the Unicode replace stuff will catch it, but you might try this: body FUZZY_DETAILS /(?:etails)/

Re: Whatsapp spam

2015-07-02 Thread Alex
Hi, On Thu, Jul 2, 2015 at 10:58 AM, Axb wrote: > On 02.07.2015 02:56, Alex wrote: >> >> Hi guys, >> >> I've been receiving a handful of spam claiming to be from whatsapp, >> and I can't figure out how to block it. >> >> http://pastebin.com/8E66QRkn >> http://pastebin.com/KrTgKGh1 >> >> What does

Re: Whatsapp spam

2015-07-02 Thread Alex
Hi, On Thu, Jul 2, 2015 at 12:07 PM, John Hardin wrote: > On Thu, 2 Jul 2015, John Wilcock wrote: > >> Le 02/07/2015 04:23, Alex a écrit : >>> >>> > Not sure if the Unicode replace stuff will catch it, but you might try >>> > > this: >>> > > > >body FUZZY_DETAILS >>> > > > > /(?:et

Re: Whatsapp spam

2015-07-02 Thread RW
On Thu, 02 Jul 2015 23:40:04 +0200 Benny Pedersen wrote: > RW skrev den 2015-07-02 23:21: > > On Thu, 02 Jul 2015 19:21:12 +0200 > > Benny Pedersen wrote: > >> co.dk was dropped before it got populary, i dont like to se tlds > >> that try to force nic to sell less, > > > > I'm not sure what you

Re: Whatsapp spam

2015-07-02 Thread Reindl Harald
Am 02.07.2015 um 23:40 schrieb Benny Pedersen: RW skrev den 2015-07-02 23:21: On Thu, 02 Jul 2015 19:21:12 +0200 Benny Pedersen wrote: John Hardin skrev den 2015-07-02 19:08: >> # if version >3.3.x >> blacklist_uri_hosts co.uk > > That seems to be a rather big hammer you're recommending. Of

Re: Whatsapp spam

2015-07-02 Thread Benny Pedersen
RW skrev den 2015-07-02 23:21: On Thu, 02 Jul 2015 19:21:12 +0200 Benny Pedersen wrote: John Hardin skrev den 2015-07-02 19:08: >> # if version >3.3.x >> blacklist_uri_hosts co.uk > > That seems to be a rather big hammer you're recommending. Of course, > if you don't do any business with anyon

Re: Whatsapp spam

2015-07-02 Thread RW
On Thu, 02 Jul 2015 19:21:12 +0200 Benny Pedersen wrote: > John Hardin skrev den 2015-07-02 19:08: > > >> # if version >3.3.x > >> blacklist_uri_hosts co.uk > > > > That seems to be a rather big hammer you're recommending. Of course, > > if you don't do any business with anyone in the UK (and do

Re: Write a custom rule to match sender's ip address.

2015-07-02 Thread Matthias Leisi
> I want to do this because there are some senders who are vulnerable to > phishing or forgery but still don't bother to use SPF or DKIM. I can work out > who they use as outbound servers through by learning from traffic patterns, > and I want to give some SA credit when they're sending through

Re: Whatsapp spam

2015-07-02 Thread Axb
On 02.07.2015 18:52, Benny Pedersen wrote: # if version >3.3.x blacklist_uri_hosts co.uk Lets blame a heatwave... you can't be serious suggesting such a thing in public

Re: Whatsapp spam

2015-07-02 Thread Reindl Harald
Am 02.07.2015 um 19:21 schrieb Benny Pedersen: John Hardin skrev den 2015-07-02 19:08: # if version >3.3.x blacklist_uri_hosts co.uk That seems to be a rather big hammer you're recommending. Of course, if you don't do any business with anyone in the UK (and don't ever intend to) it may be r

Re: Whatsapp spam

2015-07-02 Thread Benny Pedersen
John Hardin skrev den 2015-07-02 19:08: # if version >3.3.x blacklist_uri_hosts co.uk That seems to be a rather big hammer you're recommending. Of course, if you don't do any business with anyone in the UK (and don't ever intend to) it may be reasonable. co.dk was dropped before it got popul

Re: Whatsapp spam

2015-07-02 Thread John Hardin
On Thu, 2 Jul 2015, Benny Pedersen wrote: Alex skrev den 2015-07-02 02:56: http: //pastebin.com/8E66QRkn http: //pastebin.com/KrTgKGh1 # if version >3.3.x blacklist_uri_hosts co.uk That seems to be a rather big hammer you're recommending. Of course, if you don't do any business with anyon

Re: Whatsapp spam

2015-07-02 Thread Benny Pedersen
Alex skrev den 2015-07-02 02:56: http://pastebin.com/8E66QRkn http://pastebin.com/KrTgKGh1 # if version >3.3.x blacklist_uri_hosts co.uk # for all versions and sagrey plugin, track single ipv4, and ipv6 /64 i dont use txrep since it seems its does not yet works with sagrey :/

Re: Whatsapp spam

2015-07-02 Thread John Hardin
On Thu, 2 Jul 2015, John Wilcock wrote: Le 02/07/2015 04:23, Alex a écrit : > Not sure if the Unicode replace stuff will catch it, but you might try > this: > > > >body FUZZY_DETAILS /(?:etails)/i > >replace_rules FUZZY_DETAILS It doesn't catch it, and I don't know enough

Re: Whatsapp spam

2015-07-02 Thread John Hardin
On Thu, 2 Jul 2015, John Wilcock wrote: Le 02/07/2015 04:50, John Hardin a écrit : > Is there supposed to be an existing FUZZY_DETAILS rule? I don't think so. If you were to envisage such a rule, it's worth noting that it would almost certainly need a special case to avoid FPs on genuine

Re: Whatsapp spam

2015-07-02 Thread John Wilcock
Le 02/07/2015 04:23, Alex a écrit : Not sure if the Unicode replace stuff will catch it, but you might try this: > > body FUZZY_DETAILS /(?:etails)/i > replace_rules FUZZY_DETAILS It doesn't catch it, and I don't know enough about replace_rules to figure it out. Shouldn't that ?:

Re: Whatsapp spam

2015-07-02 Thread John Wilcock
Le 02/07/2015 04:50, John Hardin a écrit : Is there supposed to be an existing FUZZY_DETAILS rule? I don't think so. If you were to envisage such a rule, it's worth noting that it would almost certainly need a special case to avoid FPs on genuine French "détails" with an acute accent. There

Re: Whatsapp spam

2015-07-02 Thread Axb
On 02.07.2015 02:56, Alex wrote: Hi guys, I've been receiving a handful of spam claiming to be from whatsapp, and I can't figure out how to block it. http://pastebin.com/8E66QRkn http://pastebin.com/KrTgKGh1 What does a legitimate whatsapp email look like? I've searched their site, and their D