Re: Fake amavisd-new header lines in recent spam

2014-11-10 Thread Rich Wales
/do we have your permission to add this rule to SA's masscheck / autopromoting ?/ Yes, by all means, go ahead. -- *Rich Wales* ri...@richw.org

Re: Fake amavisd-new header lines in recent spam

2014-11-10 Thread Axb
On 11/10/2014 09:01 AM, Rich Wales wrote: /do we have your permission to add this rule to SA's masscheck / autopromoting ?/ Yes, by all means, go ahead. Thanks, Commited to http://svn.apache.org/repos/asf/spamassassin/trunk/rulesrc/sandbox/emailed/sa_users_contrib.cf masscheck results

new wetransfer phishing?

2014-11-10 Thread Reindl Harald
* content looks like wetransfer mail * sent from a known hotmail user (likely hacked account) the download link goes to http://cdfhs.org/view/index.htm; and the login-forms for several services are more then questionable URI_GOOGLE_PROXY Accessing a blacklisted URI or obscuring source of

Re: OT: parking-nameservers

2014-11-10 Thread Reindl Harald
Am 09.11.2014 um 12:08 schrieb Axb: On 11/09/2014 08:03 AM, Robert Schetterer wrote: Am 08.11.2014 um 21:11 schrieb Reindl Harald: slightly OT but don't know a better list - has somebody a larger list of parking-only nameservers than below? sadly you find easily parking companies but not the

Re: Good rules for PGP-Signed/Encrypted mail?

2014-11-10 Thread RW
On Fri, 7 Nov 2014 15:26:06 -0800 (PST) Dan Mahoney, System Admin wrote: Hey all, The Day Job (and some of you may know what job that is) does enough PGP related stuff that we've had encrypted messages get dropped on occasion, and we'd like to whitelist this stuff. ... Does anyone see any

Spams with dot link or European Union suffixes

2014-11-10 Thread Igor Chudov
I am receiving a torrent of spam coming from dot-eu and dot-link domains. Those spams have perfectly correct mail settings, such as resolvable nameserver names, SPF, seem to all match. They also are all based on domains less than one day old. I deal with them in a custom way, and block any

Re: Spams with dot link or European Union suffixes

2014-11-10 Thread Kevin A. McGrail
On 11/10/2014 9:23 PM, Igor Chudov wrote: I am receiving a torrent of spam coming from dot-eu and dot-link domains. Those spams have perfectly correct mail settings, such as resolvable nameserver names, SPF, seem to all match. They also are all based on domains less than one day old. I deal

Re: Spams with dot link or European Union suffixes

2014-11-10 Thread John Hardin
On Mon, 10 Nov 2014, Igor Chudov wrote: They also are all based on domains less than one day old. Does the DOB URIBL catch them? Please note that I have developed my own solution, however ugly, that looks up WHOIS information where it is available That will likely be considered abusive by

Re: Spams with dot link or European Union suffixes

2014-11-10 Thread Noel Butler
On 11/11/2014 12:23, Igor Chudov wrote: I am receiving a torrent of spam coming from dot-eu and dot-link domains. Those spams have perfectly correct mail settings, such as resolvable nameserver names, SPF, seem to all match. They also are all based on domains less than one day old.

whitelist_from_rcvd / trusted_networks

2014-11-10 Thread Derek Diget
We have a department that has subscribed to a service in the cloud product that is sending email to us via our MX record. The problem is that they appear to be using shared servers/IPs and thus every once in a while mail will source from an IP address that will cause it to score above 5. I

Re: whitelist_from_rcvd / trusted_networks

2014-11-10 Thread David B Funk
Even in that configuration (which is -very- much like ours) you must have your MXs (at least their IP addrs) in your internal_networks. All kinds of things break if your MXs aren't listed as trusted/internal. Just be sure that synthetic Received header is constructed correctly (the one