Re: dropbox phish

2016-11-01 Thread RW
On Mon, 31 Oct 2016 21:11:06 -0400 Bill Cole wrote: > Well, I find this quite useful with very few false positives: > > uridnsblURIBL_SBLXBLsbl-xbl.spamhaus.org. TXT > bodyURIBL_SBLXBLeval:check_uridnsbl('URIBL_SBLXBL') > describeURIBL_SBLXBLContains a U

RE: local.cf example

2016-11-01 Thread Motty Cruz
If I disable AWL: X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: 5.5 X-Spam-Level: * X-Spam-Status: No, score=5.5 tagged_above=-999.9 required=5.6 tests=[RDNS_NONE=5.5] autolearn=no autolearn_force=no Received: from HOST1.fqdn.com ([127.0.0.1]) This-election i

RE: local.cf example

2016-11-01 Thread John Hardin
On Tue, 1 Nov 2016, Motty Cruz wrote: If I disable AWL: X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: 5.5 X-Spam-Level: * X-Spam-Status: No, score=5.5 tagged_above=-999.9 required=5.6 tests=[RDNS_NONE=5.5] autolearn=no autolearn_force=no Received: from HOST1.

Re: local.cf example

2016-11-01 Thread Matus UHLAR - fantomas
On 01.11.16 08:43, Motty Cruz wrote: X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: 5.5 X-Spam-Level: * X-Spam-Status: No, score=5.5 tagged_above=-999.9 required=5.6 tests=[RDNS_NONE=5.5] autolearn=no autolearn_force=no Received: from HOST1.fqdn.com ([127.0.0.1]

RE: local.cf example

2016-11-01 Thread Motty Cruz
Very strange, missed configuration, here is another header and I have not change any configuration and yet this one was scanned: X-Virus-Scanned: amavisd-new at fqdn.com X-Spam-Flag: NO X-Spam-Score: 2.604 X-Spam-Level: ** X-Spam-Status: No, score=2.604 tagged_above=-999.9 required=5.6 te

Re: dropbox phish

2016-11-01 Thread Alex
Hi, On Mon, Oct 31, 2016 at 9:11 PM, Bill Cole wrote: > On 31 Oct 2016, at 20:38, Alex wrote: > >> Hi all, >> >> We keep receiving variations of this dropbox phish that's never tagged >> properly. I was hoping someone had some ideas for catching them. >> >> I've added a few more body rules, and s

Re: dropbox phish

2016-11-01 Thread Bill Cole
On 1 Nov 2016, at 20:31, Alex wrote: Hi, On Mon, Oct 31, 2016 at 9:11 PM, Bill Cole wrote: On 31 Oct 2016, at 20:38, Alex wrote: Hi all, We keep receiving variations of this dropbox phish that's never tagged properly. I was hoping someone had some ideas for catching them. I've added a f

Re: dropbox phish

2016-11-01 Thread Alex
Hi, >>> Well, I find this quite useful with very few false positives: >>> >>> uridnsblURIBL_SBLXBLsbl-xbl.spamhaus.org. TXT >>> bodyURIBL_SBLXBLeval:check_uridnsbl('URIBL_SBLXBL') >>> describeURIBL_SBLXBLContains a URL listed in the SBL/XBL block