Re: Points for improbable Received header date?

2021-02-11 Thread Loren Wilton
and if you want to become an hero patches to document those evals are always welcome ;-) Well, if I use undocumented code I have to figure out, I always do my own documentation, since my memory these days is about five minutes long. The trick for me will be figuring out how I could submit

Re: URLs hidden in Morse code

2021-02-11 Thread Bill Cole
On 11 Feb 2021, at 10:36, Kris Deugau wrote: After a close look again at Thunderbird I've apparently been misreading one of the about:config flags (javascript.enabled), although if it's not for email HTML rendering I'm not sure what it's used for. Thunderbird will open links in its own

Re: SA's bayes with the Redis backend?

2021-02-11 Thread Dean Carpenter
On 2021-02-11 12:58 pm, Alex wrote: > Hi, > >> I've had good luck with using mariadb and galera to share the spamassassin >> database across systems. I run a small 3-node setup for email, 2x servers >> running dovecot replicating to each other, and a 3rd galera quorum server. >> Mariadb

Re: SA's bayes with the Redis backend?

2021-02-11 Thread Antony Stone
On Thursday 11 February 2021 at 17:21:41, deano-spamassas...@areyes.com wrote: > Is there an easy/efficient way of converting an existing mariadb bayes > database to redis? > > Perhaps "sa-learn --backup", set up redis, then restore?

Re: SA's bayes with the Redis backend?

2021-02-11 Thread deano-spamassassin
On 2021-02-11 9:54 am, Alex wrote: > Hi, > There is no real question, but what I would like to find out is (and to ask), > does it scale and are any pitfalls? Naturally, we would look at doing HA, but > am asking for that any comment, any tip, any opinion on using redis for > bayes. Been

Re: URLs hidden in Morse code

2021-02-11 Thread Kris Deugau
Kris Deugau wrote: Thunderbird and Seamonkey both have it supported and enabled out of the box.  I would not be surprised if Outlook did, along with no way to disable it.  Mac Mail probably does, again likely with at best a tedious hassle to disable it.  Windows Mail (AKA "the descendant of

Re: netflix phishing emails forwarded via sendgrid

2021-02-11 Thread Benny Pedersen
On 2021-02-11 14:56, John Hardin wrote: On Thu, 11 Feb 2021, Benny Pedersen wrote: On 2021-02-11 12:46, Giovanni Bechis wrote: With the updated Esp plugin[¹] just committed to trunk you could use Sendgrid files downloaded from Invaluement as well as local generated files. this files do

Re: SA's bayes with the Redis backend?

2021-02-11 Thread Alex
Hi, > > There is no real question, but what I would like to find out is (and to > > ask), does it scale and are any pitfalls? > > Naturally, we would look at doing HA, but am asking for that any > > comment, any tip, any opinion on using redis for bayes. > > Been using it from day one (I'm party

Re: Points for improbable Received header date?

2021-02-11 Thread Bill Cole
On 11 Feb 2021, at 8:55, Giovanni Bechis wrote: > On Thu, Feb 11, 2021 at 08:52:59AM -0500, Bill Cole wrote: [...] >> There is a received_within_months() eval in the HeaderEval plugin which >> someone wrote at some point but failed to suitably document or even use. >> There are also private

Re: netflix phishing emails forwarded via sendgrid

2021-02-11 Thread John Hardin
On Thu, 11 Feb 2021, Benny Pedersen wrote: On 2021-02-11 12:46, Giovanni Bechis wrote: With the updated Esp plugin[¹] just committed to trunk you could use Sendgrid files downloaded from Invaluement as well as local generated files. this files do work if sendgrid did not allow non

Re: Points for improbable Received header date?

2021-02-11 Thread Giovanni Bechis
On Thu, Feb 11, 2021 at 08:52:59AM -0500, Bill Cole wrote: > On 11 Feb 2021, at 7:00, Loren Wilton wrote: > > > I'm getting a lot of spams that all have a series of completely bogus > > Received headers in them. A characteristic of these headers is a > > rather improbable datestamp, considering

Re: Points for improbable Received header date?

2021-02-11 Thread Bill Cole
On 11 Feb 2021, at 7:00, Loren Wilton wrote: I'm getting a lot of spams that all have a series of completely bogus Received headers in them. A characteristic of these headers is a rather improbable datestamp, considering today's date: Received: from 69-171-232-143.mail-mail.facebook.com

Re: netflix phishing emails forwarded via sendgrid

2021-02-11 Thread John Hardin
On Thu, 11 Feb 2021, Giovanni Bechis wrote: On 2/9/21 10:03 PM, Benny Pedersen wrote: On 2021-02-02 03:25, Kevin A. McGrail wrote: Since it's already hitting 8.9, why do more? got one more today http://multirbl.valli.org/lookup/167.89.112.86.html envelope sender is not sendgrid.net

Re: netflix phishing emails forwarded via sendgrid

2021-02-11 Thread Benny Pedersen
On 2021-02-11 12:46, Giovanni Bechis wrote: With the updated Esp plugin[¹] just committed to trunk you could use Sendgrid files downloaded from Invaluement as well as local generated files. this files do work if sendgrid did not allow non sendgrid.net envelope senders :( KAM_SENDGRID_REDIR

Re: Points for improbable Received header date?

2021-02-11 Thread Benny Pedersen
On 2021-02-11 13:00, Loren Wilton wrote: Anyone know an easy way to check for a Received header date more than say a week old and add some points? http://multirbl.valli.org/lookup/69.171.232.143.html why is date important ?, spamassassin do test it already DATE_IN_PAST *

Points for improbable Received header date?

2021-02-11 Thread Loren Wilton
I'm getting a lot of spams that all have a series of completely bogus Received headers in them. A characteristic of these headers is a rather improbable datestamp, considering today's date: Received: from 69-171-232-143.mail-mail.facebook.com ([69.171.232.143]) by

Re: netflix phishing emails forwarded via sendgrid

2021-02-11 Thread Giovanni Bechis
On 2/9/21 10:03 PM, Benny Pedersen wrote: > On 2021-02-02 03:25, Kevin A. McGrail wrote: >> Since it's already hitting 8.9, why do more? > > got one more today > > http://multirbl.valli.org/lookup/167.89.112.86.html > > envelope sender is not sendgrid.net > > spamurls to the phishing is

Re: URLs hidden in Morse code

2021-02-11 Thread Kenneth Porter
On 2/10/2021 11:30 AM, Bill Cole wrote: CONFIRMED: SeaMonkey v2.53.6 (latest version) DOES NOT execute JavaScript in email. I don't think the intent is to run it in the MUA. It's probably distributed as an attachment (ie. inline) to save to disk and be viewed outside the MUA in a normal