Re: Google Drive/Docs spam

2016-02-18 Thread Alex
Hi, >> > I seem to remember a botnet plugin from about 2010, but didn't think >> > it was maintained or worked properly anymore? >> >> That very same. Seems to work fine, so I have not disabled it. > > It works for me too, but I don't have any IPv6. > > IIRC at one time it FP'ed on IPv6, and I'm n

Re: Google Drive/Docs spam

2016-02-18 Thread RW
On Wed, 17 Feb 2016 19:16:46 -0500 Alex wrote: > I can't even imagine almost doubling the bayes score from the default, > basically making it a poison pill, when the default score is generated > as part of the rule development process. AFAIK the BAYES_* scores are just made-up - although it is t

Re: Google Drive/Docs spam

2016-02-18 Thread Jari Fredriksson
RW kirjoitti 18.2.2016 14:40: On Thu, 18 Feb 2016 09:35:18 +0200 Jari Fredriksson wrote: > I seem to remember a botnet plugin from about 2010, but didn't think > it was maintained or worked properly anymore? > That very same. Seems to work fine, so I have not disabled it. It works for me to

Re: Google Drive/Docs spam

2016-02-18 Thread RW
On Thu, 18 Feb 2016 09:35:18 +0200 Jari Fredriksson wrote: > > I seem to remember a botnet plugin from about 2010, but didn't think > > it was maintained or worked properly anymore? > > > > That very same. Seems to work fine, so I have not disabled it. It works for me too, but I don't have a

Re: Google Drive/Docs spam

2016-02-18 Thread Reindl Harald
Am 18.02.2016 um 12:29 schrieb Matus UHLAR - fantomas: Am 17.02.2016 um 17:49 schrieb Alex: http://pastebin.com/zKWUUQ0Q Obviously they're coming in advance of being on an RBL or DNSBL. I was thinking to correlate the body text somehow with something that checks to see if it actually passed

Re: Google Drive/Docs spam

2016-02-18 Thread Matus UHLAR - fantomas
Am 17.02.2016 um 17:49 schrieb Alex: http://pastebin.com/zKWUUQ0Q Obviously they're coming in advance of being on an RBL or DNSBL. I was thinking to correlate the body text somehow with something that checks to see if it actually passed through Google (SPF, etc?), but that won't work for messag

Re: Google Drive/Docs spam

2016-02-17 Thread Jari Fredriksson
Alex kirjoitti 18.2.2016 2:16: Hi, On Wed, Feb 17, 2016 at 4:29 PM, Jari Fredriksson wrote: pts rule name description -- -- 1.5 BOTNET Relay might be a spambot or virusbot What rule is th

Re: Google Drive/Docs spam

2016-02-17 Thread Reindl Harald
Am 18.02.2016 um 01:16 schrieb Alex: Reindl Harald wrote: 7.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% I can't even imagine almost doubling the bayes score from the default, basically making it a poison pill, when the default score is generated as part of the rule d

Re: Google Drive/Docs spam

2016-02-17 Thread Alex
Hi, On Wed, Feb 17, 2016 at 4:29 PM, Jari Fredriksson wrote: > Alex kirjoitti 17.2.2016 18:49: >> >> Hi all, >> >> I recall some rules that were written years ago to address these, but >> it appears they're back. We've been hit with a few, including users >> actually following the link. I was hop

Re: Google Drive/Docs spam

2016-02-17 Thread Jari Fredriksson
Alex kirjoitti 17.2.2016 18:49: Hi all, I recall some rules that were written years ago to address these, but it appears they're back. We've been hit with a few, including users actually following the link. I was hoping someone had some recommendations on how to stop them. http://pastebin.com/z

Re: Google Drive/Docs spam

2016-02-17 Thread Reindl Harald
Am 17.02.2016 um 17:49 schrieb Alex: Hi all, I recall some rules that were written years ago to address these, but it appears they're back. We've been hit with a few, including users actually following the link. I was hoping someone had some recommendations on how to stop them. http://pastebi

Re: Google Drive/Docs spam

2016-02-17 Thread John Hardin
On Wed, 17 Feb 2016, Alex wrote: Hi all, I recall some rules that were written years ago to address these, but it appears they're back. We've been hit with a few, including users actually following the link. I was hoping someone had some recommendations on how to stop them. http://pastebin.com

Re: Google Drive/Docs spam

2016-02-17 Thread Alex
Oh, please note I just noticed bayes wasn't consulted for this. It's a new system and was having some database problems, but bayes hasn't always been effective on these anyway. Thanks, Alex On Wed, Feb 17, 2016 at 11:49 AM, Alex wrote: > Hi all, > > I recall some rules that were written years ag

Google Drive/Docs spam

2016-02-17 Thread Alex
Hi all, I recall some rules that were written years ago to address these, but it appears they're back. We've been hit with a few, including users actually following the link. I was hoping someone had some recommendations on how to stop them. http://pastebin.com/zKWUUQ0Q Obviously they're coming