Re: What is BODY: IMH_ED_SPAM rule?

2020-04-09 Thread Toolworker
Bill Cole wrote > "Toolworker" was replying to a message from 2014. > > !!! I wasn't looking for help - I was providing it. It was a problem in 2014 and it's a problem today - although only for InMotion Hosting customers. And now there's an answer to the question. And I suggest that anyone both

Re: Spoofed From: names

2020-04-09 Thread Kevin A. McGrail
On 4/9/2020 10:16 AM, micah anderson wrote: > What is the current state of the art for dealing with tricking people in > the From with the "Name" part? For example: Hi Micah, I believe the FromNameSpoof plugin is the current state of the art. -- Kevin A. McGrail kmcgr...@apache.org Member, Apach

Re: Spoofed From: names

2020-04-09 Thread Grant Taylor
On 4/9/20 10:12 AM, Lindsay Haisley wrote: I don't know. I'm no SA expert, but I've worked with DMARC mitigation code and would assume that a RFC-2822 compliant understanding of the From address would be the first step. More caffeine and a little more Googling, I think that SpamAssassin alread

Re: Spoofed From: names

2020-04-09 Thread Grant Taylor
On 4/9/20 9:19 AM, Grant Taylor wrote: Would you be willing to rephrase your paragraph hilighting which addresses you are comparing when? Thank you for the off-list reply Rick. I know understand that you are referring to the simple cases where the human friendly name is abused to look like th

Re: Spoofed From: names

2020-04-09 Thread Lindsay Haisley
On Thu, 2020-04-09 at 10:02 -0600, Grant Taylor wrote: > Please elaborate > on what else SpamAssassin needs to know about and do. I don't know. I'm no SA expert, but I've worked with DMARC mitigation code and would assume that a RFC-2822 compliant understanding of the >From address would be the f

Re: Spoofed From: names

2020-04-09 Thread Grant Taylor
On 4/9/20 9:33 AM, Lindsay Haisley wrote: This is actually a common, legitimate technique for dealing with DMARC mitigation issues on mailing lists and mail redirections. Yes, re-writing the From: address is a common technique. How it's re-written is important. (See below.) I don't know if

Re: Spoofed From: names

2020-04-09 Thread Lindsay Haisley
On Thu, 2020-04-09 at 10:47 -0400, Rick Cooper wrote: > I wrote my own plugin for that but I don't score very high anymore because > of things likes this: > (obviously Mr Bill is not real but the netsuite address is) > > From: "Mr Bill (mb...@legitemail.com)" > > I find more and more companies

Re: Spoofed From: names

2020-04-09 Thread Grant Taylor
On 4/9/20 8:47 AM, Rick Cooper wrote: For detecting possible fraud addresses involving our own people I wrote a backend look up for exim that looks at any name like "Rick Cooper" and compares that to a DB with all email addresses for all employees in all locations and then , if the actual rcoo...

Re: Problem with SpamAssassin rules wiki. What is the new link ?

2020-04-09 Thread Bill Cole
On 9 Apr 2020, at 5:12, Antoine Chiris wrote: Dear SpamAssassin users/team, I have a little problem with *SpamAssassin*. I don't find the documentation for the rules. The definitive documentation of the rules that are distributed as part of the project is the rules files themselves. Most r

RE: Spoofed From: names

2020-04-09 Thread Rick Cooper
I wrote my own plugin for that but I don't score very high anymore because of things likes this: (obviously Mr Bill is not real but the netsuite address is) From: "Mr Bill (mb...@legitemail.com)" I find more and more companies, I believe intuit is doing something like that, that do this. I cou

Spoofed From: names

2020-04-09 Thread micah anderson
Hi, What is the current state of the art for dealing with tricking people in the From with the "Name" part? For example: From: "supp...@example.com" The "Real Name" part is used to put a fake email address of the actual domain (example.com would be my domain, or gmail.com or something other th

Problem with SpamAssassin rules wiki. What is the new link ?

2020-04-09 Thread Antoine Chiris
Dear SpamAssassin users/team, I have a little problem with *SpamAssassin*. I don't find the documentation for the rules. For example, for the rule MIME_HTML_MOSTLY I have a link to this wiki : https://wiki.apache.org/spamassassin/Rules/MIME_HTML_MOSTLY But apparently the documentation is no longe