Do I still need these old spamtips.org rules in local.cf?

2019-01-22 Thread Ian Evans
Several years ago I added a bunch of rules to my local.cf that I picked up from spamtips.org. That was back in the days of Spamassassin 3.3.2, about 2012. Just curious, six years later, if it's worth keep any of these rules or whether their functionally has been rolled into or supplanted by later

Re: The latest bitcoin spam 1/22/19

2019-01-22 Thread Kevin A. McGrail
On 1/22/2019 2:46 PM, John Hardin wrote: > On Tue, 22 Jan 2019, Joseph Brennan wrote: > >> Sent to me personally. Incredible amount of obfuscation. > > Okay, it looks like the fuzzy versions are still needed... > I've added a few tweaks to my CRIM rules as well. -- Kevin A. McGrail VP

Re: The latest bitcoin spam 1/22/19

2019-01-22 Thread John Hardin
On Tue, 22 Jan 2019, John Hardin wrote: On Tue, 22 Jan 2019, Joseph Brennan wrote: Sent to me personally. Incredible amount of obfuscation. Okay, it looks like the fuzzy versions are still needed... Restored. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/

Re: The latest bitcoin spam 1/22/19

2019-01-22 Thread John Hardin
On Tue, 22 Jan 2019, Joseph Brennan wrote: Sent to me personally. Incredible amount of obfuscation. Okay, it looks like the fuzzy versions are still needed... -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a

Re: The latest bitcoin spam 1/22/19

2019-01-22 Thread Bill Cole
On 22 Jan 2019, at 12:30, Kevin A. McGrail wrote: > Are you using KAM.cf rules? The crim rules are designed for these. Unfortunately, only 3 of the subrules match. However, as I said in my prior message, the stock rules do catch this one.

Re: The latest bitcoin spam 1/22/19

2019-01-22 Thread Bill Cole
On 22 Jan 2019, at 12:26, Joseph Brennan wrote: Sent to me personally. Incredible amount of obfuscation. They are all coming in from hosts in 185.118.165 and 185.118.166. Note on X-Spam-Score header-- the local rule CU_INVOICE accounts for 0.5, HTML_MESSAGE is 0.01, and CU_SPF_softfail is

Re: The latest bitcoin spam 1/22/19

2019-01-22 Thread Kevin A. McGrail
Are you using KAM.cf rules? The crim rules are designed for these. On Tue, Jan 22, 2019, 12:27 Joseph Brennan > Sent to me personally. Incredible amount of obfuscation. They are all > coming in from hosts in 185.118.165 and 185.118.166. > > Note on X-Spam-Score header-- the local rule CU_INVOICE

The latest bitcoin spam 1/22/19

2019-01-22 Thread Joseph Brennan
Sent to me personally. Incredible amount of obfuscation. They are all coming in from hosts in 185.118.165 and 185.118.166. Note on X-Spam-Score header-- the local rule CU_INVOICE accounts for 0.5, HTML_MESSAGE is 0.01, and CU_SPF_softfail is just information with a zero score.

Re: Huge spam increase

2019-01-22 Thread Pedro David Marco
Sure, i agree Reindl, thanks..  i just was asking whether this sudden increase has been seen as well in other places...  too sudden!!  PedroD On Tuesday, January 22, 2019, 6:18:01 PM GMT+1, Reindl Harald wrote: Am 22.01.19 um 18:12 schrieb Pedro David Marco: > Out of

Huge spam increase

2019-01-22 Thread Pedro David Marco
Out of curiosity... we are noticing a huge spam increase (x10) from the last 2 days... maybe any reactivated botnet??? is someone noticing it as well? -PedroD

Re: Phishing.pm

2019-01-22 Thread Bill Cole
[Pulling this conversation back on-list where I can misinform everyone publicly] On 22 Jan 2019, at 5:04, Ian Evans wrote: On Tue, Jan 22, 2019 at 2:15 AM Bill Cole < sausers-20150...@billmail.scconsult.com> wrote: [snip] Note that because the plugin is disabled by default, the default