Re: Strange Issues.

2017-04-28 Thread Billy Huddleston
Also looks like the amount of incoming spam has doubled over the past few days. DateSPAMTIMEHAMTimeTOTALTime 4/20/201732013.075729393.611661403.3322 4/21/201727974.126813.886354783.9954 4/22/201723052.5721

Re: idn phishing

2017-04-28 Thread RW
On Fri, 28 Apr 2017 15:57:16 +0100 RW wrote: > > >if idn decode gives 7bit domain hostname, its a fake domain > > > If he meant something like > >xn--example.com > > it seems unlikely that *any* registrar would allow that to be > registered as an ordinary ascii domain. Actually xn

Re: idn phishing

2017-04-28 Thread Matus UHLAR - fantomas
On 4/28/2017 4:56 AM, Matus UHLAR - fantomas wrote: On 22.04.17 00:37, Benny Pedersen wrote: https://www.xudongz.com/blog/2017/idn-phishing/ should we care in spammassassin ? yes. i ask since its solved in chrome, but its entirely a bad nic tld handling on that isssue if idn decode gives

Re: idn phishing

2017-04-28 Thread Kevin A. McGrail
On 4/28/2017 10:57 AM, RW wrote: it seems unlikely that*any* registrar would allow that to be registered as an ordinary ascii domain. The question to me is do they? If they do, it's a legit domain and not really up to us to judge them unless it shows signs of fraud...

Re: idn phishing

2017-04-28 Thread RW
On Fri, 28 Apr 2017 10:56:45 +0200 Matus UHLAR - fantomas wrote: > On 22.04.17 00:37, Benny Pedersen wrote: > >https://www.xudongz.com/blog/2017/idn-phishing/ > > > >should we care in spammassassin ? > > yes. > > >i ask since its solved in chrome, but its entirely a bad nic tld > >handling on

Re: idn phishing

2017-04-28 Thread Kevin A. McGrail
On 4/28/2017 4:56 AM, Matus UHLAR - fantomas wrote: On 22.04.17 00:37, Benny Pedersen wrote: https://www.xudongz.com/blog/2017/idn-phishing/ should we care in spammassassin ? yes. i ask since its solved in chrome, but its entirely a bad nic tld handling on that isssue if idn decode gives

tests_pri on new server

2017-04-28 Thread Simon Wilson
Hi list, I'm running spamassassin 3.4.0 on CentOS 7, being in the process of migrating from an old SA 3.3.1 on CentOS 5 server. I am running tests etc before moving over at the moment to make sure all is working OK. Both servers are VMs on the same host, which is not highly loaded at all,

Re: Strange Issues.

2017-04-28 Thread RW
On Thu, 27 Apr 2017 17:34:16 -0400 Billy Huddleston wrote: > OKay, Copy of of a spam is located at https://pastebin.com/gdCB9V6U > > It processed okay with spamassassin -t -D That's probably because it's only doing one at a time. I suspect that these spams are so CPU intensive that you would be

Re: Match for IP address links in body

2017-04-28 Thread Kevin A. McGrail
On 4/28/2017 7:56 AM, Vlad Mazek wrote: We've been seeing a ton of spam with links using http/https links to IP addresses instead of hostnames. Has anyone else seen this pattern recently? If so, would you mind sharing a rule to match these links in the body of the message? -Vlad Hi Vlad, l

Match for IP address links in body

2017-04-28 Thread Vlad Mazek
We've been seeing a ton of spam with links using http/https links to IP addresses instead of hostnames. Has anyone else seen this pattern recently? If so, would you mind sharing a rule to match these links in the body of the message? -Vlad

Re: idn phishing

2017-04-28 Thread Matus UHLAR - fantomas
On 22.04.17 00:37, Benny Pedersen wrote: https://www.xudongz.com/blog/2017/idn-phishing/ should we care in spammassassin ? yes. i ask since its solved in chrome, but its entirely a bad nic tld handling on that isssue if idn decode gives 7bit domain hostname, its a fake domain agreed. --