Re: Spam by IP-address? Spamassassin with geoiplookup?

2016-09-24 Thread Thomas Barth
Hello Am 23.09.2016 um 22:10 schrieb Lindsay Haisley: On Fri, 2016-09-23 at 15:28 -0400, Bill Cole wrote: As much as I love BIND (no, seriously, I do) it's very hard to recommend it as the first choice for a simple recursive resolver. Setting up bind as a "simple recursive resolver" is simpli

Re: DNS Terminology

2016-09-24 Thread Lindsay Haisley
On Sat, 2016-09-24 at 00:15 -0500, Dave Funk wrote: > On Fri, 23 Sep 2016, Lindsay Haisley wrote: > > > > > On Fri, 2016-09-23 at 19:03 -0400, listsb-spamassas...@bitrate.net > > wrote: > > > > > > consider that, to do the work described as "forwarding" in many of > > > these references, the nam

Re: Spam by IP-address? Spamassassin with geoiplookup?

2016-09-24 Thread Sean Greenslade
On September 24, 2016 6:12:10 AM EDT, Thomas Barth wrote: >Instead of URIBL_BLOCKED=0.001 I see URIBL_ABUSE_SURBL=1.948, >URIBL_BLACK=1.7 > >It s still not ok, is it? That means it is working as intended, and your message has triggered hits on two separate blacklists. --Sean

Re: drive-by malware customized to the From.RealName of actual Friends

2016-09-24 Thread Chip M.
John, thanks a TON for your efforts! I was afraid this would be hard to catch. :( On the bright side, the campaign has been morphing, and they are now (IMO) much less enticing, which is a partial victory. :) ** Update: The emails have gone thru two more significant morphs, first with To.Realname

Re: spample of "data" URL in well-crafted Phish

2016-09-24 Thread Chip M.
On Fri, 16 Sep 2016, John Hardin wrote: >Chip, could you send me some spamples of non-image data: messages >offlist? The only ones I have anywhere are images. Sent last week - thanks for your ongoing work on this John! :) After that request, I decided to add (in my post SA filter) a minimally sc

spample of not(?)-yet-registered "custom" URL Shortener in Phish

2016-09-24 Thread Chip M.
Here's a spample of a well done "Dropbox" Phish sent thru Gmail, containing a custom URL shortener which (apparently) did _NOT_ exist at message arrival time: http://puffin.net/software/spam/samples/0045_shortener_phish.txt I MUNGED the To & From headers, however I left the original From do