Matching base64 subject

2013-08-28 Thread Kenneth Porter
I'm trying to use this set of rules to spot Chinese or Russian characters in the subject line: http://www.timk.de/it-blog/howto-find-chinese-or-russian-spam-encoded-in-utf-8-with-spamassassin/ To debug the rules, I've replaced the leading __ in sub-rules with T_. The rules don't seem to match

Re: one word spam

2013-08-28 Thread James Griffin
!-- On Sat 24.Aug'13 at 0:40:26 BST, Marcio Humpris (marciohump...@gmail.com), wrote: please, i know its been talked about before, but isnt there a rule to deal with 1 word spams? spams that just have text Hi! and thats it. It's unlikely, imo, that emails with just hi! will be spam. I

Re: skipped due to message size

2013-08-28 Thread Joe Acquisto-j4
On 8/23/2013 at 6:43 AM, Joe Acquisto-j4 j...@j4computers.com wrote: On 8/23/2013 at 3:42 AM, James Griffin j...@kontrol.kode5.net wrote: !-- On Wed 21.Aug'13 at 14:51:56 BST, Matus UHLAR - fantomas (uh...@fantomas.sk), wrote: On 21.08.13 09:47, Joe Acquisto-j4 wrote: I find a few of

Catching fake LinkedIn invites

2013-08-28 Thread Michael Schaap
Hi, I'm getting loads of fake LinkedIn invites, most of which aren't caught by SpamAssassin. Does anyone have a good SpamAssassin rule to catch those, while letting real LinkedIn invites through? Thanks, - Michael

Re: Catching fake LinkedIn invites

2013-08-28 Thread John Hardin
On Wed, 28 Aug 2013, Michael Schaap wrote: Hi, I'm getting loads of fake LinkedIn invites, most of which aren't caught by SpamAssassin. Does anyone have a good SpamAssassin rule to catch those, while letting real LinkedIn invites through? Do they fail SPF or DKIM? If they do, and the

Re: Catching fake LinkedIn invites

2013-08-28 Thread Michael Schaap
On 29-Aug-2013 00:30, John Hardin wrote: On Wed, 28 Aug 2013, Michael Schaap wrote: Hi, I'm getting loads of fake LinkedIn invites, most of which aren't caught by SpamAssassin. Does anyone have a good SpamAssassin rule to catch those, while letting real LinkedIn invites through? Do they

Re: Catching fake LinkedIn invites

2013-08-28 Thread Michael Schaap
On 29-Aug-2013 00:55, Michael Schaap wrote: On 29-Aug-2013 00:30, John Hardin wrote: On Wed, 28 Aug 2013, Michael Schaap wrote: Hi, I'm getting loads of fake LinkedIn invites, most of which aren't caught by SpamAssassin. Does anyone have a good SpamAssassin rule to catch those, while

Re: Catching fake LinkedIn invites

2013-08-28 Thread Dave Funk
On Thu, 29 Aug 2013, Michael Schaap wrote: On 29-Aug-2013 00:30, John Hardin wrote: On Wed, 28 Aug 2013, Michael Schaap wrote: Hi, I'm getting loads of fake LinkedIn invites, most of which aren't caught by SpamAssassin. Does anyone have a good SpamAssassin rule to catch those, while

Re: Catching fake LinkedIn invites

2013-08-28 Thread John Levine
Unfortunately not, for the most part. (The From: header is at linkedin dot com, but the envelope sender is a random address, and I guess SPF and DKIM run on the envelope sender only.) DKIM runs on the message body. If it doesn't have a valid DKIM signature from linkedin, you can be quite sure

Re: Catching fake LinkedIn invites

2013-08-28 Thread Jason Haar
On 29/08/13 13:26, Michael Schaap wrote: # Punish fake LinkedIn mail header __FROM_LINKEDIN From =~ /\@linkedin\.com/i metaFROM_LINKEDIN_NO_SPF(__FROM_LINKEDIN !SPF_PASS !SPF_HELO_PASS) score FROM_LINKEDIN_NO_SPF5.0 This seems to do the trick for most