Re: Spam slipping through

2008-12-07 Thread mouss
Benny Pedersen a écrit : > On Mon, December 8, 2008 05:25, [EMAIL PROTECTED] wrote: >> mouss said: > > bug: > Mail::SpamAssassin::Plugin::dbg("FromInTo: Comparing '$from' and > '$To"); > > fixed line: > Mail::SpamAssassin::Plugin::dbg("FromInTo: Comparing '$from' and > '$To'"); > Thanks! >> we

Re: Spam slipping through

2008-12-07 Thread hamann . w
Benny Pedersen wrote: >> >> >> On Mon, December 8, 2008 05:25, [EMAIL PROTECTED] wrote: >> > mouss said: >> >> bug: >> Mail::SpamAssassin::Plugin::dbg("FromInTo: Comparing '$from' and >> '$To"); >> >> fixed line: >> Mail::SpamAssassin::Plugin::dbg("FromInTo: Comparing '$from' and >> '$To'"); >>

Re: Spam slipping through

2008-12-07 Thread Benny Pedersen
On Mon, December 8, 2008 05:25, [EMAIL PROTECTED] wrote: > mouss said: bug: Mail::SpamAssassin::Plugin::dbg("FromInTo: Comparing '$from' and '$To"); fixed line: Mail::SpamAssassin::Plugin::dbg("FromInTo: Comparing '$from' and '$To'"); > well, I send mail to myself sometimes. The only way that t

Re: Spam slipping through

2008-12-07 Thread hamann . w
mouss said: >> >> > >> > The implementation of it is not my concern. It's a pretty basic rule to >> > require that addresses a commonly exploited spam attack vector. >> >> having the same address in the From and To is also seen in legitimate mail: >> - I send mail to myself >> - some people use

Re: Spam slipping through

2008-12-07 Thread mouss
support a écrit : > On Sat, 2008-12-06 at 23:45 -0500, Theo Van Dinter wrote: >> On Sat, Dec 06, 2008 at 08:00:10PM -0800, John Hardin wrote: >>> mechanism for. Devs: there've been wishes for this before; how hard >>> would it be to add the ability to match on the substring match captured >>> by an

Re: about fake mails

2008-12-07 Thread mouss
Yavuz Maslak a écrit : > Let me explain my problem and goal; > > For instance, a spammer installs a smtp server and he has a tool to send > his mails. He writes [EMAIL PROTECTED] in from adress and He sends his > mails using his smtp server. Namely, he doesn't use gmail's servers. I > want to giv

Re: about fake mails

2008-12-07 Thread Yavuz Maslak
Let me explain my problem and goal; For instance, a spammer installs a smtp server and he has a tool to send his mails. He writes [EMAIL PROTECTED] in from adress and He sends his mails using his smtp server. Namely, he doesn't use gmail's servers. I want to give high score for these sort of

Re: about fake mails

2008-12-07 Thread mouss
Yavuz Maslak a écrit : > Ok > I have started to use dkim verification. I defined whitelists in > local.cf. it works. > But I could not find how I give high score for a spammer who doesn't > use gmail's mail servers. > The link that I suggested in my previous post contains spamassassin rules.

Re: about fake mails

2008-12-07 Thread Kai Schaetzl
Just that most of the spam with a gmail.com sender *is* coming from Gmail .. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

RE: about fake mails

2008-12-07 Thread Benny Pedersen
On Sun, December 7, 2008 15:52, Giampaolo Tomassoni wrote: > There is no direct way (to my knowledge) to do this. perldoc Mail::SpamAssassin::Conf see whitelist_auth perldoc Mail::SpamAssassin::Plugin::DKIM but okay make a default spam score for DKIM signed mails works :) and subtract it when i

RE: about fake mails

2008-12-07 Thread Jeff Mincy
From: "Giampaolo Tomassoni" <[EMAIL PROTECTED]> Date: Sun, 7 Dec 2008 15:52:10 +0100 > -Original Message- > From: Yavuz Maslak [mailto:[EMAIL PROTECTED] > Sent: Sunday, December 07, 2008 3:02 PM > > Ok > I have started to use dkim verification. I defined whitel

Re: about fake mails

2008-12-07 Thread Matus UHLAR - fantomas
> > From: Yavuz Maslak [mailto:[EMAIL PROTECTED] > > Sent: Sunday, December 07, 2008 3:02 PM > > But I could not find how I give high score for a spammer who doesn't > > use gmail's mail servers. > > > > Although a domain has domain keys, how can I give positive score for a > > mail which comes

RE: about fake mails

2008-12-07 Thread Giampaolo Tomassoni
> -Original Message- > From: Yavuz Maslak [mailto:[EMAIL PROTECTED] > Sent: Sunday, December 07, 2008 3:02 PM > > Ok > I have started to use dkim verification. I defined whitelists in > local.cf. > it works. > But I could not find how I give high score for a spammer who doesn't > use > g

Re: about fake mails

2008-12-07 Thread Yavuz Maslak
Ok I have started to use dkim verification. I defined whitelists in local.cf. it works. But I could not find how I give high score for a spammer who doesn't use gmail's mail servers. Although a domain has domain keys, how can I give positive score for a mail which comes from a fake smtp se

Re: Live.space and Sourceforge

2008-12-07 Thread Michael Scheidell
> I've been getting a bit of spam recently via Sourceforge mailing lists > that punts live.space websites. As this is easy to detect without > running much risk of FPs, I've written a rule. > Getting so much spam, and no response from [EMAIL PROTECTED] Should just give a 2.0 to uri rule and

Live.space and Sourceforge

2008-12-07 Thread Martin Gregorie
I've been getting a bit of spam recently via Sourceforge mailing lists that punts live.space websites. As this is easy to detect without running much risk of FPs, I've written a rule. describe MG_LIVESF Spam via SourceForge but contains spaces.live.com URI uri __MG_LSF1 /^http:.{1,40}\.sp

Re: Spam slipping through

2008-12-07 Thread support
On Sat, 2008-12-06 at 23:45 -0500, Theo Van Dinter wrote: > On Sat, Dec 06, 2008 at 08:00:10PM -0800, John Hardin wrote: > > mechanism for. Devs: there've been wishes for this before; how hard > > would it be to add the ability to match on the substring match captured > > by another rule? Add a fl