Re: feed spamassassin with a catch-all address

2015-12-17 Thread Kris Deugau
Alex wrote: > Can anyone share the technique/mechanism they use for specifically > collecting the IPs, URLs, etc to put them in a format useful to > postfix/spamassassin? I wrote a script to do part of the job; it's part of a local DNSBL utility - https://secure.deepnet.cx/trac/dnsbl. (Specifica

bayes problem? (was: Re: feed spamassassin with a catch-all address)

2015-12-17 Thread Matthias Apitz
Hello, Since some days (I think(!) after I run 'sa-update') a lot of technical mails are declared as SPAM due to BAYES_99 (99-100% SPAM), for example this mail I'm responding now; I saved it as 'rh.mail' and run it through: $ spamassassin -tD < rh.mail > rh.out 2> rh.debug The results are here

Re: feed spamassassin with a catch-all address

2015-12-17 Thread Reindl Harald
Am 17.12.2015 um 03:54 schrieb Alex: This type of honeypot can find numerous bad actors and identify dictionary attackers. It has excellent merit and many people use this type of data. You might find it useful for blocking IPs, finding bad URLs, identifying spam for bayes, etc. easy to kill

Re: feed spamassassin with a catch-all address

2015-12-16 Thread Alex
Hi, >> This type of honeypot can find numerous bad actors and identify >> dictionary attackers. It has excellent merit and many people use this >> type of data. You might find it useful for blocking IPs, finding bad >> URLs, identifying spam for bayes, etc. > > easy to kill legit/ESP bulk and us

Re: feed spamassassin with a catch-all address

2015-12-16 Thread Reindl Harald
Am 16.12.2015 um 16:22 schrieb Shawn Bakhtiar: On Dec 16, 2015, at 1:11 AM, Reindl Harald wrote: Am 15.12.2015 um 23:25 schrieb Juerg Reimann: I have a domain which gets a lot of spam to non-existent addresses. I thought why not set that domain to catch-all and feed all non-existent addresse

Re: feed spamassassin with a catch-all address

2015-12-16 Thread Reindl Harald
Am 15.12.2015 um 23:25 schrieb Juerg Reimann: I have a domain which gets a lot of spam to non-existent addresses. I thought why not set that domain to catch-all and feed all non-existent addresses directly to spamassassin. Any thoughts why this could be a bad idea? Of course any typos from real

Re: feed spamassassin with a catch-all address

2015-12-15 Thread Axb
On 12/15/2015 11:33 PM, Kevin A. McGrail wrote: On 12/15/2015 5:25 PM, Juerg Reimann wrote: I have a domain which gets a lot of spam to non-existent addresses. I thought why not set that domain to catch-all and feed all non-existent addresses directly to spamassassin. Any thoughts why this could

Re: feed spamassassin with a catch-all address

2015-12-15 Thread Martin Gregorie
On Tue, 2015-12-15 at 23:25 +0100, Juerg Reimann wrote: > I have a domain which gets a lot of spam to non-existent addresses. I > thought why not set that domain to catch-all and feed all non > -existent > addresses directly to spamassassin. Any thoughts why this could be a > bad > idea? Of course

Re: feed spamassassin with a catch-all address

2015-12-15 Thread Kevin A. McGrail
On 12/15/2015 5:25 PM, Juerg Reimann wrote: I have a domain which gets a lot of spam to non-existent addresses. I thought why not set that domain to catch-all and feed all non-existent addresses directly to spamassassin. Any thoughts why this could be a bad idea? Of course any typos from real sen

feed spamassassin with a catch-all address

2015-12-15 Thread Juerg Reimann
I have a domain which gets a lot of spam to non-existent addresses. I thought why not set that domain to catch-all and feed all non-existent addresses directly to spamassassin. Any thoughts why this could be a bad idea? Of course any typos from real senders would also end up in sa, however, I belie