Re: Spam slipping through

2008-12-07 Thread support
On Sat, 2008-12-06 at 23:45 -0500, Theo Van Dinter wrote: On Sat, Dec 06, 2008 at 08:00:10PM -0800, John Hardin wrote: mechanism for. Devs: there've been wishes for this before; how hard would it be to add the ability to match on the substring match captured by another rule? Add a flag to

Live.space and Sourceforge

2008-12-07 Thread Martin Gregorie
I've been getting a bit of spam recently via Sourceforge mailing lists that punts live.space websites. As this is easy to detect without running much risk of FPs, I've written a rule. describe MG_LIVESF Spam via SourceForge but contains spaces.live.com URI uri __MG_LSF1

Re: Live.space and Sourceforge

2008-12-07 Thread Michael Scheidell
I've been getting a bit of spam recently via Sourceforge mailing lists that punts live.space websites. As this is easy to detect without running much risk of FPs, I've written a rule. Getting so much spam, and no response from [EMAIL PROTECTED] Should just give a 2.0 to uri rule and add

Re: about fake mails

2008-12-07 Thread Yavuz Maslak
Ok I have started to use dkim verification. I defined whitelists in local.cf. it works. But I could not find how I give high score for a spammer who doesn't use gmail's mail servers. Although a domain has domain keys, how can I give positive score for a mail which comes from a fake smtp

RE: about fake mails

2008-12-07 Thread Giampaolo Tomassoni
-Original Message- From: Yavuz Maslak [mailto:[EMAIL PROTECTED] Sent: Sunday, December 07, 2008 3:02 PM Ok I have started to use dkim verification. I defined whitelists in local.cf. it works. But I could not find how I give high score for a spammer who doesn't use gmail's

Re: about fake mails

2008-12-07 Thread Matus UHLAR - fantomas
From: Yavuz Maslak [mailto:[EMAIL PROTECTED] Sent: Sunday, December 07, 2008 3:02 PM But I could not find how I give high score for a spammer who doesn't use gmail's mail servers. Although a domain has domain keys, how can I give positive score for a mail which comes from a fake

RE: about fake mails

2008-12-07 Thread Jeff Mincy
From: Giampaolo Tomassoni [EMAIL PROTECTED] Date: Sun, 7 Dec 2008 15:52:10 +0100 -Original Message- From: Yavuz Maslak [mailto:[EMAIL PROTECTED] Sent: Sunday, December 07, 2008 3:02 PM Ok I have started to use dkim verification. I defined whitelists in

RE: about fake mails

2008-12-07 Thread Benny Pedersen
On Sun, December 7, 2008 15:52, Giampaolo Tomassoni wrote: There is no direct way (to my knowledge) to do this. perldoc Mail::SpamAssassin::Conf see whitelist_auth perldoc Mail::SpamAssassin::Plugin::DKIM but okay make a default spam score for DKIM signed mails works :) and subtract it when

Re: about fake mails

2008-12-07 Thread Kai Schaetzl
Just that most of the spam with a gmail.com sender *is* coming from Gmail .. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

Re: about fake mails

2008-12-07 Thread mouss
Yavuz Maslak a écrit : Ok I have started to use dkim verification. I defined whitelists in local.cf. it works. But I could not find how I give high score for a spammer who doesn't use gmail's mail servers. The link that I suggested in my previous post contains spamassassin rules.

Re: about fake mails

2008-12-07 Thread Yavuz Maslak
Let me explain my problem and goal; For instance, a spammer installs a smtp server and he has a tool to send his mails. He writes [EMAIL PROTECTED] in from adress and He sends his mails using his smtp server. Namely, he doesn't use gmail's servers. I want to give high score for these sort of

Re: about fake mails

2008-12-07 Thread mouss
Yavuz Maslak a écrit : Let me explain my problem and goal; For instance, a spammer installs a smtp server and he has a tool to send his mails. He writes [EMAIL PROTECTED] in from adress and He sends his mails using his smtp server. Namely, he doesn't use gmail's servers. I want to give

Re: Spam slipping through

2008-12-07 Thread mouss
support a écrit : On Sat, 2008-12-06 at 23:45 -0500, Theo Van Dinter wrote: On Sat, Dec 06, 2008 at 08:00:10PM -0800, John Hardin wrote: mechanism for. Devs: there've been wishes for this before; how hard would it be to add the ability to match on the substring match captured by another rule?

Re: Spam slipping through

2008-12-07 Thread hamann . w
mouss said: The implementation of it is not my concern. It's a pretty basic rule to require that addresses a commonly exploited spam attack vector. having the same address in the From and To is also seen in legitimate mail: - I send mail to myself - some people use their address in

Re: Spam slipping through

2008-12-07 Thread Benny Pedersen
On Mon, December 8, 2008 05:25, [EMAIL PROTECTED] wrote: mouss said: bug: Mail::SpamAssassin::Plugin::dbg(FromInTo: Comparing '$from' and '$To); fixed line: Mail::SpamAssassin::Plugin::dbg(FromInTo: Comparing '$from' and '$To'); well, I send mail to myself sometimes. The only way that this

Re: Spam slipping through

2008-12-07 Thread hamann . w
Benny Pedersen wrote: On Mon, December 8, 2008 05:25, [EMAIL PROTECTED] wrote: mouss said: bug: Mail::SpamAssassin::Plugin::dbg(FromInTo: Comparing '$from' and '$To); fixed line: Mail::SpamAssassin::Plugin::dbg(FromInTo: Comparing '$from' and '$To'); well, I send mail to

Re: Spam slipping through

2008-12-07 Thread mouss
Benny Pedersen a écrit : On Mon, December 8, 2008 05:25, [EMAIL PROTECTED] wrote: mouss said: bug: Mail::SpamAssassin::Plugin::dbg(FromInTo: Comparing '$from' and '$To); fixed line: Mail::SpamAssassin::Plugin::dbg(FromInTo: Comparing '$from' and '$To'); Thanks! well, I send mail