Re: Finance spam

2024-07-16 Thread Alex
> this whole range of 185.3.229.x is on my dns blacklist and everything on > that is either rejected or marked. I can only suggest doing something > similar ;) > Very helpful. Thanks for sharing. > RCVD_IN_HOSTKARMA_W=-2.5 > change to -0.1 That does seem to be a bit heavy-handed. > and lastly i

Re: X-Amavis-Alert: BANNED, message contains x.com

2024-07-16 Thread Gerald Vogt
Hi, On 16.07.24 17:28, Thomas Barth via users wrote: today a mail has been banned (false positive). It says message contains x.com X-Quarantine-ID: X-Amavis-Alert: BANNED, message contains x.com I couldnt find x.com in the mail body itself, but the mail had a zipfile as an attachment. The

Re: X-Amavis-Alert: BANNED, message contains x.com

2024-07-16 Thread Benny Pedersen
Bill Cole skrev den 2024-07-16 19:00: asking to be sure That is NOT a SpamAssassin message, as SA does nothing so silly. It is clearly and strictly an Amavis issue. i know :)

Re: X-Amavis-Alert: BANNED, message contains x.com

2024-07-16 Thread Bill Cole
On 2024-07-16 at 11:55:50 UTC-0400 (Tue, 16 Jul 2024 17:55:50 +0200) Benny Pedersen is rumored to have said: Thomas Barth via users skrev den 2024-07-16 17:28: X-Quarantine-ID: X-Amavis-Alert: BANNED, message contains x.com Are there any further explanations for the banning of x.com? as

Re: Finance spam

2024-07-16 Thread Benny Pedersen
Alex skrev den 2024-07-16 15:00: Hi all, Does anyone have any further ideas on how to block "approved for funding" spam? https://pastebin.com/2rKiAEpt This one is another namecheap domain registered from Reykjavik. I can create body rules, but the language is very much in line with legitimate l

Re: X-Amavis-Alert: BANNED, message contains x.com

2024-07-16 Thread Benny Pedersen
Thomas Barth via users skrev den 2024-07-16 17:28: X-Quarantine-ID: X-Amavis-Alert: BANNED, message contains x.com Are there any further explanations for the banning of x.com? ask on amavis maillist are spamassassin using extractext ? asking to be sure

X-Amavis-Alert: BANNED, message contains x.com

2024-07-16 Thread Thomas Barth via users
Hello, today a mail has been banned (false positive). It says message contains x.com X-Quarantine-ID: X-Amavis-Alert: BANNED, message contains x.com I couldnt find x.com in the mail body itself, but the mail had a zipfile as an attachment. The zip file probably contains invoices. Are the

RE: Finance spam

2024-07-16 Thread Marc
this whole range of 185.3.229.x is on my dns blacklist and everything on that is either rejected or marked. I can only suggest doing something similar ;) 185.3.229.4 perfstat.hostex.lt. 185.3.229.5 post.alfa.lt. 185.3.229.6 185.3.229.7 185.3.229.8 185.3.229.9 185.3.22

Finance spam

2024-07-16 Thread Alex
Hi all, Does anyone have any further ideas on how to block "approved for funding" spam? https://pastebin.com/2rKiAEpt This one is another namecheap domain registered from Reykjavik. I can create body rules, but the language is very much in line with legitimate lending companies. I've also added t