Re: FIlter

2017-12-02 Thread Benny Pedersen
Junk skrev den 2017-12-03 04:09: Is there any list that can be trusted and is publicly available or unless you pay nothing is trusted? if paid dont trust its same boat as let me hold your pocket

Re: FIlter

2017-12-02 Thread Junk
Is there any list that can be trusted and is publicly available or unless you pay nothing is trusted? > On Dec 2, 2017, at 7:44 PM, Bill Cole > wrote: > >> On 2 Dec 2017, at 13:33 (-0500), David Jones wrote: >> >> Then you can start experimenting

Re: FIlter

2017-12-02 Thread Junk
> On Dec 2, 2017, at 12:53 PM, John Hardin wrote: > > On Sat, 2 Dec 2017, Junk wrote: > >>> If you trust your Bayes you might consider implementing a BAYES_999 rule >>> that adds another point. >> >> I might look into it >> >>> Getting past URIBL_BLOCKED will help. >>

Re: FIlter

2017-12-02 Thread Junk
I am using sendmail. > On Dec 2, 2017, at 12:33 PM, David Jones wrote: > >> On 12/02/2017 10:39 AM, Junk wrote: >> i implemented all of the filters yo mentioned and the score went up from >> 3.5. to 3.9 on an example spam email i was testing. >> I will look further into more

Re: FIlter

2017-12-02 Thread Bill Cole
On 2 Dec 2017, at 13:33 (-0500), David Jones wrote: Then you can start experimenting with RBLs at http://multirbl.valli.org/lookup/ Be VERY careful with that list of DNSBLs. For years they listed and tested my local, private, never-public DNSBL (which has always had an external view that

Re: FIlter

2017-12-02 Thread John Hardin
On Sat, 2 Dec 2017, Junk wrote: If you trust your Bayes you might consider implementing a BAYES_999 rule that adds another point. I might look into it Getting past URIBL_BLOCKED will help. Yes once it started to work again there is less spam although i still get some that are formatted

Re: HTML_IMAGE_ONLY_* generating too many FP's

2017-12-02 Thread David Jones
On 12/02/2017 11:22 AM, Sebastian Arcus wrote: On 02/12/17 13:06, Matus UHLAR - fantomas wrote: On 12/01/2017 11:17 AM, Sebastian Arcus wrote: -0.2 RCVD_IN_MSPIKE_H2  RBL: Average reputation (+2) [212.227.126.131 listed in wl.mailspike.net] 0.4

Re: FIlter

2017-12-02 Thread David Jones
On 12/02/2017 10:39 AM, Junk wrote: i implemented all of the filters yo mentioned and the score went up from 3.5. to 3.9 on an example spam email i was testing. I will look further into more filters. I see lots of spam that is formatted as image and those are not being caught. What is your

Re: HTML_IMAGE_ONLY_* generating too many FP's

2017-12-02 Thread Sebastian Arcus
On 02/12/17 13:06, Matus UHLAR - fantomas wrote: On 12/01/2017 11:17 AM, Sebastian Arcus wrote: -0.2 RCVD_IN_MSPIKE_H2  RBL: Average reputation (+2) [212.227.126.131 listed in wl.mailspike.net] 0.4 MIME_HTML_MOSTLY   BODY: Multipart message mostly

Re: FIlter

2017-12-02 Thread Junk
i implemented all of the filters yo mentioned and the score went up from 3.5. to 3.9 on an example spam email i was testing. I will look further into more filters. I see lots of spam that is formatted as image and those are not being caught. > On Dec 1, 2017, at 5:05 PM, Kevin Miller

Re: FIlter

2017-12-02 Thread Junk
> On Dec 1, 2017, at 7:07 PM, John Hardin wrote: > > On Fri, 1 Dec 2017, Junk wrote: > >> Thx for the tips. >> I will look at theses and try to implement. >> I definitely need more ways to get more scores so those that score 3.4-4.9 >> finally go over 5 and are marked

Re: Rule to match when multiple FROM addresses exist

2017-12-02 Thread Simeon Ott
On 2017-12-01 16:17, Bill Cole wrote: On 1 Dec 2017, at 8:44 (-0500), Tom Hendrikx wrote: You're mistaken about postfix. It does not rewrite the From headers in the way you describe, unless you explicitly configured it to. It will if it is very old (<2.2) OR if it has an organically-evolved

Re: HTML_IMAGE_ONLY_* generating too many FP's

2017-12-02 Thread Matus UHLAR - fantomas
On 12/01/2017 11:17 AM, Sebastian Arcus wrote: -0.2 RCVD_IN_MSPIKE_H2  RBL: Average reputation (+2) [212.227.126.131 listed in wl.mailspike.net] 0.4 MIME_HTML_MOSTLY   BODY: Multipart message mostly text/html MIME 1.6 HTML_IMAGE_ONLY_24 BODY: HTML: images

Re: HTML_IMAGE_ONLY_* generating too many FP's

2017-12-02 Thread Matus UHLAR - fantomas
On 28.11.17 19:39, Sebastian Arcus wrote: I'm having more and more problems with the HTML_IMAGE_ONLY_* set of rules recently generating false positives. On 30/11/17 12:45, Matus UHLAR - fantomas wrote: those have lower scorew with BAYES and network rules enabled. configure BAYES and enable