Re: Phishing email or no?

2018-10-11 Thread Martin Gregorie
On Thu, 2018-10-11 at 20:41 -0400, Alex wrote: > Is it spam because of your own rules, or something I'm missing? Could > it be failing DKIM because of my santizing? > Spotted in one - its was spam because a local rule triggered on your munging of some body URIs to contain 'example.com'. This

Re: Phishing email or no?

2018-10-11 Thread Alex
Hi, > > I'm curious what people think of this: > > > > https://pastebin.com/1XjwaCY1 > > > My SA setup thinks its spam. > > I notice its DKIM is invalid and that the envelope from doesn't match > the message-ID, which makes me suspicious. Doesn't a $100 draw look a > little bit too big for a

Re: Phishing email or no?

2018-10-11 Thread Alex
Hi, On Thu, Oct 11, 2018 at 5:15 PM David Jones wrote: > > On 10/11/18 3:30 PM, Alex wrote: > > Hi, > > > > I'm curious what people think of this: > > > > https://pastebin.com/1XjwaCY1 > > > > It's unsolicited, so that makes it spam to me, but is it dangerous? > > yesinsights.com appears to be a

Re: Phishing email or no?

2018-10-11 Thread Martin Gregorie
On Thu, 2018-10-11 at 16:30 -0400, Alex wrote: > Hi, > > I'm curious what people think of this: > > https://pastebin.com/1XjwaCY1 > My SA setup thinks its spam. I notice its DKIM is invalid and that the envelope from doesn't match the message-ID, which makes me suspicious. Doesn't a $100 draw

sa-learn memleak ?

2018-10-11 Thread Benny Pedersen
i have a maildir of over 2 mails of all ham mails, want to learn all of them to bayes as ham, so far so good :=) cd /path/to/maildir/cur/ ls >/tmp/sa-ham sa-learn --ham --progress -f /tmp/sa-ham monitoring this on another shell wheree i can see sa-learn begins to use more and more rss in

Re: Phishing email or no?

2018-10-11 Thread David Jones
On 10/11/18 3:30 PM, Alex wrote: > Hi, > > I'm curious what people think of this: > > https://pastebin.com/1XjwaCY1 > > It's unsolicited, so that makes it spam to me, but is it dangerous? > yesinsights.com appears to be a legitimate company, but the sender, > e...@hrteamerus.com, is a

Phishing email or no?

2018-10-11 Thread Alex
Hi, I'm curious what people think of this: https://pastebin.com/1XjwaCY1 It's unsolicited, so that makes it spam to me, but is it dangerous? yesinsights.com appears to be a legitimate company, but the sender, e...@hrteamerus.com, is a registered domain but has no DNS record. Is it just a lame

Re: RBL

2018-10-11 Thread Matus UHLAR - fantomas
On 10/11/2018 01:35 AM, Matus UHLAR - fantomas wrote: I for example run spamass-milter with -r 10 (rejects score over 10) at one machine, and amavisd-milter with "spam_kill_level_maps=> 10", along with postscreen. This way mail gets refused when listed in DNSBLs, while not when DNSWL

Re: RBL

2018-10-11 Thread Grant Taylor
On 10/11/2018 01:35 AM, Matus UHLAR - fantomas wrote: note that spamassassin can run at MTA level, refusing mail when it's found to be sure spam and tagging when it's not. Yes. That's how and why I recommend that people run SpamAssassin if they have the choice to do so. I for example run

Re: sa-compile after sa-update

2018-10-11 Thread Kenneth Porter
An RH bug was opened and closed on this in 2014: https://bugzilla.redhat.com/show_bug.cgi?id=1151565 I attached a patch to the bug for the latest sa-update.cron script from the 3.4.2 RPM to invoke sa-compile if the plugin is enabled and re2c is installed.

Re: RBL

2018-10-11 Thread Matus UHLAR - fantomas
On 10/10/2018 01:56 PM, Tom Hendrikx wrote: However, in general it's better to use DNSBLs at the MTA level, which uses a lot less resources than implementing them in Spamassassin. So try and set them up in postfix first. On 10.10.18 14:09, Grant Taylor wrote: I conceptually agree. However,