Broken rule: FORGED_HOTMAIL_RCVD2

2024-03-28 Thread Rupert Gallagher
When hotmail user sends from outbound.protection.outlook.com, the SA rule must not intervene.

Re: localhost lookups ?

2024-02-25 Thread Rupert Gallagher
I see this in live mail, sent by RFC clueless administrators, causing business mail to be either rejected or quarantined. On production systems, the good mail server should self-discipline and fail hard, compelling the system administrator to take action. Original Message On

Re: Yahoo's DMARC reports fail DMARC themselves

2024-02-16 Thread Rupert Gallagher
cyber spaking -> cyber spanking --- The Grammar Nazi in me Original Message On Feb 16, 2024, 12:12, Rupert Gallagher wrote: > You are seing it yourself. Their e-mails fail SPF allignment, SPF > authentication and DKIM authentication. As a consequence, they fail DMA

Yahoo's DMARC reports fail DMARC themselves

2024-02-16 Thread Rupert Gallagher
You are seing it yourself. Their e-mails fail SPF allignment, SPF authentication and DKIM authentication. As a consequence, they fail DMARC. I see a deluge of DMARC failures, mostly from forwarding accounts, mailing lists, and the mass mailer musvc.com I do not have the resources to contact

FORGED_HOTMAIL_RCVD2

2024-01-26 Thread Rupert Gallagher
Rule broken. Please update.

Well hidden link mismatch

2023-03-15 Thread Rupert Gallagher
We all need a rule for things like the following: coinbase.com= /VERIFY

Re: New rule wanted

2023-02-07 Thread Rupert Gallagher
Note: Both client and server are not Windows. The attached file type is a generic "data" on unix. On a Windows client the file runs as executable. A SA rule should merely detect that the file type is a generic "data" file. Original Message On Feb 7,

New rule wanted

2023-02-07 Thread Rupert Gallagher
I received a spam with score -1. Well written, looks legit commercial, asking for a quotation, with details in the attachment, a 3MB file with unknown extension ".one". The file turns out to be a Windows Trojan:

Re: sharepoint phish routed through sharepointonline/outlook

2023-01-18 Thread Rupert Gallagher
Message-Id: Read RFC 822, pp. 44-46. If your answer is that the latest RFC allows for it, the my reply is: my mail, my rules, so I apply the most stringent rules. Original Message On 15 Jan 2023, 20:47, Alex wrote: > Hi, > > X-Spam-Status: No, score=1.102 tagged_above=-200

Re: Unicode considered harmful again

2021-11-04 Thread Rupert Gallagher
Original Message On Nov 4, 2021, 09:34, Damian < spamassas...@arcsin.de> wrote: > >> Please convert all source code to ASCII. If it fails to compile, > then it may have a trojan hiding in Unicode clothing. > > >Instructions unclear. > > CVE 2021-42574 > It remains unclear (to

Re: Unicode considered harmful again

2021-11-04 Thread Rupert Gallagher
Original Message On Nov 4, 2021, 07:45, Damian < spamassas...@arcsin.de> wrote: >> Please convert all source code to ASCII. If it fails to compile, then it may >> have a trojan hiding in Unicode clothing. >Instructions unclear. CVE 2021-42574

Unicode considered harmful again

2021-11-03 Thread Rupert Gallagher
Please convert all source code to ASCII. If it fails to compile, then it may have a trojan hiding in Unicode clothing.

Re: Message-ID with IPv6 domain-literal

2021-10-03 Thread Rupert Gallagher
Original Message On Sep 24, 2021, 18:30, Grant Taylor < gtay...@tnetconsulting.net> wrote: On 9/24/21 10:17 AM, Rupert Gallagher wrote: >> The RFC 5322 as cited is concerned about domains and their internet >> address, where the sender's address needs to be

Re: Message-ID with IPv6 domain-literal

2021-09-24 Thread Rupert Gallagher
Anyway, this part of the original RFC 822 reads loud and clear on the matter. Each new RFC aiming to improve it seems the result of spamming lobbies aiming at hiding themselves. The latest grammar for MIDs is horrible. Original Message On Sep 24, 2021, 18:17, Rupert Gallagher

Re: Message-ID with IPv6 domain-literal

2021-09-24 Thread Rupert Gallagher
autonomous systems calls for *public* fully qualified domain names and their *public* IP addresses, or the delivery will fail. Original Message On Sep 23, 2021, 19:56, Grant Taylor < gtay...@tnetconsulting.net> wrote: On 9/23/21 2:38 AM, Rupert Gallagher wrote: > A LA

Re: Message-ID with IPv6 domain-literal

2021-09-23 Thread Rupert Gallagher
A LAN address is not the "Internet address of the particular host", and therefore, by RFC 5322 line 969, the header in the OP is not RFC compliant. Original Message On Sep 21, 2021, 20:54, Grant Taylor wrote: The use of a domain name or IP literal is RECOMMENDED, not even a

Re: Message-ID with IPv6 domain-literal

2021-09-23 Thread Rupert Gallagher
My mistake in quoting. The IP was 192.168.1.30, a LAN address. Original Message On Sep 21, 2021, 19:25, Dave Funk < dbf...@engineering.uiowa.edu> wrote: On Tue, 21 Sep 2021, Bill Cole wrote: > On 2021-09-21 at 12:25:30 UTC-0400 (Tue, 21 Sep 2021 10:25:30 -0600) > Grant Taylor >

Message-ID with IPv6 domain-literal

2021-09-21 Thread Rupert Gallagher
An unknown MUA (user agent header removed by sender) writes its Message-IDs as . Is the header syntactically corrext? A custom SpamAssassin rule added a penalty for syntax error, and another for using a non-public address.

Re: Plugin to extract Links from PDF

2021-06-07 Thread Rupert Gallagher
A clickable picture should trigger a web client only if the pdf contains a script for this action, which you can detect using clamav. Original Message On Jun 4, 2021, 08:19, Benoît Panizzon < benoit.paniz...@imp.ch> wrote: Hi Gang In the last couple of weeks, I have seen a lot

Re: CHAOS v1.1.1

2021-04-07 Thread Rupert Gallagher
Original Message On Apr 7, 2021, 20:40, Jared Hall <> wrote: - Better Unibabble bibber-blabber blockage. This makes sense not.

Re: "Please send us a quote..."?

2021-04-07 Thread Rupert Gallagher
We get that from face-to-face leads from hell. Original Message On Apr 7, 2021, 03:27, Grant Taylor wrote: I've seen a few where they are asking for samples prior to -- purportedly -- submitting an order.

Re: CHAOS: Version 1.1.0

2021-03-27 Thread Rupert Gallagher
I love projects that are long in technical nonsense and short in motivation. Original Message On Mar 26, 2021, 21:40, Jared Hall < ja...@jaredsec.com> wrote: A new version of CHAOS.pm is available: https://github.com/telecom2k3/CHAOS The module can run in Tag mode, AutoISP

Re: ViraLife

2021-01-27 Thread Rupert Gallagher
Note that gmail lets the first Received non public (it is the sender's machine). This is both a violation of the RFC and a tiny data breach. If you are ok with it, then whitelist the stinker. Original Message On Jan 28, 2021, 08:11, Rupert Gallagher < r...@protonmail.

Re: ViraLife

2021-01-27 Thread Rupert Gallagher
All Received must be public domains or literals by RFC. We reject such non compliant e-mails upfront, and I recommend you do the same. Original Message On Jan 27, 2021, 20:18, Loren Wilton < lwil...@earthlink.net> wrote: Has anyone been getting spams from "ViraLife"? They have

Re: google and spam

2020-12-14 Thread Rupert Gallagher
I see a deluge of spam from google.com, catched at FROM, all containing an @NXDOMAIN. Google is tripping on its own shoe laces in this period. Original Message On Dec 14, 2020, 12:01, Iulian Stan wrote: > Hi all, > > First of all i am writing this email from yahoo because from

Re: Zero-point garbage text that isn't caught by the small-font rules

2020-08-21 Thread Rupert Gallagher
Original Message On Aug 20, 2020, 18:13, Loren Wilton < lwil...@earthlink.net> wrote: I've started receiving a bunch of spam or more likely phish mails that contain the following sort of trash in large quantities between almost every word of the visible text. The invisible font

Re: Blacklisting a stubborn sender

2020-08-03 Thread Rupert Gallagher
The domains turn out to be already in the rfc-clueless.org database since 2014. Original Message On 1 Aug 2020, 14:58, Rupert Gallagher < r...@protonmail.com> wrote: Two well known companies in my country persist in making the mistake of writing their mid with a non-publi

Re: Blacklisting a stubborn sender

2020-08-02 Thread Rupert Gallagher
Original Message On 2 Aug 2020, 17:02, Bill Cole < sausers-20150...@billmail.scconsult.com> wrote: > if you want to authenticate email, ... The helo is a necessary, but not sufficient criteria for authentication. I use them all, up to dane. However, they all fail with those

Re: Blacklisting a stubborn sender

2020-08-02 Thread Rupert Gallagher
Original Message On 2 Aug 2020, 17:02, Bill Cole < sausers-20150...@billmail.scconsult.com> wrote: > smtpd_helo_restrictions Good idea. Thank you.

Re: Blacklisting a stubborn sender

2020-08-02 Thread Rupert Gallagher
have the doubt on the authenticity of their e-mails. No thank you. Original Message On 2 Aug 2020, 15:54, Kevin A. McGrail < kmcgr...@apache.org> wrote: On 8/2/2020 9:18 AM, Rupert Gallagher wrote: > They will procrastinate until the end of time unless we do something.

Re: Blacklisting a stubborn sender

2020-08-02 Thread Rupert Gallagher
. Original Message On 2 Aug 2020, 12:30, Matus UHLAR - fantomas < uh...@fantomas.sk> wrote: On 02.08.20 05:11, Rupert Gallagher wrote: >Correction: it is not the mid, it is the helo. oh... this is something quite different. But unless multiple servers start implementing reject_unknown_helo

Re: Blacklisting a stubborn sender

2020-08-01 Thread Rupert Gallagher
Correction: it is not the mid, it is the helo. Original Message On 1 Aug 2020, 14:58, Rupert Gallagher < r...@protonmail.com> wrote: Two well known companies in my country persist in making the mistake of writing their mid with a non-public fqdn, violating the rfc. It ha

Re: Blacklisting a stubborn sender

2020-08-01 Thread Rupert Gallagher
They have explicit consent to send rfc compliant e-mail. Rfc-clueless.org seems.a good starting point. Thank you Original Message On 1 Aug 2020, 15:53, Kevin A. McGrail < kmcgr...@apache.org> wrote: On Sat, Aug 1, 2020 at 8:59 AM Rupert Gallagher wrote: Two well

Blacklisting a stubborn sender

2020-08-01 Thread Rupert Gallagher
Two well known companies in my country persist in making the mistake of writing their mid with a non-public fqdn, violating the rfc. It has been so for the past three years, with me sending detailed, manually written error messages to their painstakingly collected admin addresses. Their answer

Re: Thanks to Guardian Digital & LinuxSecurity for the nice post about SpamAssassin's upcoming change

2020-07-16 Thread Rupert Gallagher
Your LinkedIn post thanks the Guardian while hitting on us by hiding our lack of consent. Original Message On 16 Jul 2020, 01:24, Kevin A. McGrail < kmcgr...@apache.org> wrote: All: We're getting some positive attention from the verbiage change. See

Re: IMPORTANT NOTICE FOR PEOPLE RUNNING TRUNK re: [Bug 7826] Improve language around whitelist/blacklist and master/slave

2020-07-14 Thread Rupert Gallagher
> racially-charged nature of blacklist There is no such thing. Black list originates from black book, that is a book with white pages and black cover, with black ink, where sins are listed in haven for you to be judged upon. On the colour of the cover, it is black because that's how old

Re: IMPORTANT NOTICE FOR PEOPLE RUNNING TRUNK re: [Bug 7826] Improve language around whitelist/blacklist and master/slave

2020-07-10 Thread Rupert Gallagher
Whatever you do under the hood, make sure it does not affect external behaviour. On your motivation, bear in mind that *lists here contain computer addresses, not people, so the reference you are trying to fix is mistaken, and changes will be painstaking for no reason at all. And the terms

Re: Question on early detection for relay spam

2020-03-04 Thread Rupert Gallagher
Fails with travelling clients. Original Message On Mar 3, 2020, 16:49, Benny Pedersen wrote: > Marc Roos skrev den 2020-03-03 16:15: >> Use ipset, hardly causing any latency using 50k entries. > > i dont need to block 50k entries, but only whitelist few accepted client > ips,

Re: GeoIP2 packages

2019-05-06 Thread Rupert Gallagher
The real problem is their database. For the purposes of SA, the whois database is good enough. On Mon, May 6, 2019 at 17:20, Alex wrote: > Hi all, > > I'm looking for the GeoIP2 and IP Country packages for fedora/CentOS > needed for the RelayCountry plugin. I believe there were some license >

HTML/URI defuser

2019-04-17 Thread Rupert Gallagher
Let's talk about those works of art that elude our best filters. Written and posted like a legit message, their only threat is a big red button with a label that says "do not push me". In truth, they are just a "click here for your overdue bill" and similar hooks for the gullible few. There

Re: Filtering at border routers: Is it possible?

2019-03-23 Thread Rupert Gallagher
I reject tons of spam from OVH. So much that I am banning whole CIDRs. Whatever they do, it's not working. On Sat, Mar 23, 2019 at 12:53, Giovanni Bechis wrote > Hi, > this is what OVH does (article in french, sorry): >

Re: Filtering at border routers: Is it possible?

2019-03-23 Thread Rupert Gallagher
I agree with Benny on port 25. I disagree with Kevin on port 587, because it is vulnerable to mitm attacks. I was royally pissed when they introduced port 587 and deprecated port 465. Port 587 is an RFC mandated security loophole. Port 465 is golden. On Sat, Mar 23, 2019 at 03:01, Kevin A.

Re: RE: Filtering at border routers: Is it possible?

2019-03-22 Thread Rupert Gallagher
I think you are in for a lot of pain. This is the view from my seat. If my company has a client that sends spam using my IP, then my IP earns a bad reputation and is blacklisted. Therefore, my other clients are blacklisted too, even if they do not send spam. If I do not solve the problem, then

Re: Semioff-topic: DoS mitigation technique mentioned in SA-list

2019-03-11 Thread Rupert Gallagher
Tarpitting? On Mon, Mar 11, 2019 at 10:03, Pedro David Marco wrote: > Hi all, > > Not a long time ago someone in the list mentioned an interesting antiDos > mitigation technique consisting in "playing" with attackers TCP windows > sizes... (as far as i remember)... but i cannot find the post

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Rupert Gallagher
ess. It is even more > significant if you run the test locally. > > On 3/1/2019 5:09 PM, Rupert Gallagher wrote: > >> Case study: >> >> example.com bans any e-mail sent from its third levels up, and does it by >> spf. >> >> spf-banned.example.com sent ma

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Rupert Gallagher
the compliance heavy lifting by forcing a sane To header. That's all. If you want to talk more in general about GDPR, I do it everyday, so leave me alone on weekends, will you? :-) On Fri, Mar 1, 2019 at 22:41, Grant Taylor wrote: > On 03/01/2019 01:25 AM, Rupert Gallagher wrote: >>

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Rupert Gallagher
Case study: example.com bans any e-mail sent from its third levels up, and does it by spf. spf-banned.example.com sent mail, and my SA at server.com adds a big fat penalty, high enough to bounch it. Suppose I do not bounch it, and use your filter to check for its websites. It turns out that

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Rupert Gallagher
A future-proof list that complies with GDPR would automatically rewrite the To header, leaving the list address only. Any other recipient will still receive it from the original sender. On Thu, Feb 28, 2019 at 20:29, Mike Marynowski wrote: > Unfortunately I don't see a reply-to header on your

Re: Semi Off-topic: VFEMail destroyed

2019-02-15 Thread Rupert Gallagher
Live backups are unheard of. The best I can do is a write protected hourly backup, with manual restore... Sent from ProtonMail Mobile On Fri, Feb 15, 2019 at 14:07, @lbutlr wrote: > On 14 Feb 2019, at 19:31, Grant Taylor wrote: >> >> If VFE had backups stored off-site via something like

Re: New type of SPAM aggression

2019-02-13 Thread Rupert Gallagher
wrote: > On 12 Feb 2019, at 15:04, Rupert Gallagher wrote: > >> Ehhh not available on bsd with pf, or so it was the last time I >> checked. > > A good 'tarpit' tool that IS available for *BSD (originating on OpenBSD) > is 'spamd' which unfortunately shares a

Re: Semi Off-topic: VFEMail destroyed

2019-02-13 Thread Rupert Gallagher
On Wed, Feb 13, 2019 at 17:51, Pedro David Marco wrote: > FYI > >

Re: New type of SPAM aggression

2019-02-12 Thread Rupert Gallagher
On Tue, Feb 12, 2019 at 18:34, RW wrote: > On Tue, 12 Feb 2019 16:49:27 + > Rupert Gallagher wrote: > > Before the change, the >> service stated that the IP fell into their spamtrap, whatever that >> is. > > Seriously? > >> The fact remains that

Re: New type of SPAM aggression

2019-02-12 Thread Rupert Gallagher
Ehhh not available on bsd with pf, or so it was the last time I checked. Good for you as you have it! It is a fantastic piece of aikido. On Tue, Feb 12, 2019 at 18:19, John Hardin wrote: > On Tue, 12 Feb 2019, Rupert Gallagher wrote: > >> and we have now blocked their IP at

Re: New type of SPAM aggression

2019-02-12 Thread Rupert Gallagher
I like it! On Tue, Feb 12, 2019 at 18:15, John Hardin wrote: > On Tue, 12 Feb 2019, Rupert Gallagher wrote: > >> Let see if the mail arrives with the correct escaping this time. >> >> body __HAS_URI /(http|https):/// >> tflags __HAS_URI multiple >> meta TMU (

Re: New type of SPAM aggression

2019-02-12 Thread Rupert Gallagher
Ah, ok... On Tue, Feb 12, 2019 at 18:04, RW wrote: > On Tue, 12 Feb 2019 16:38:47 + > Rupert Gallagher wrote: > >> Let see if the mail arrives with the correct escaping this time. >> >> body __HAS_URI /(http|https):/// >> tflags __HAS_URI multiple >>

Re: New type of SPAM aggression

2019-02-12 Thread Rupert Gallagher
Note that the "too many uris" thing has nothing to do with the Russian gremlin who, in the meantime, has disabled the part of the rbl that explains why the IP was listed. Before the change, the service stated that the IP fell into their spamtrap, whatever that is. The fact remains that we have

Re: New type of SPAM aggression

2019-02-12 Thread Rupert Gallagher
Let see if the mail arrives with the correct escaping this time. body __HAS_URI /(http|https):\/\// tflags __HAS_URI multiple meta TMU ( _HAS_URI > 10 ) describe TMU Too many URIs (>10) score TMU 5.0 As rightly noted, the same link is counted twice, for text and html bodies when they are

Re: RE: New type of SPAM aggression

2019-02-07 Thread Rupert Gallagher
full __HAS_URI /(http|https):/// tflags __HAS_URI multiple meta TMU ( _HAS_URI > 10 ) describe TMU Too many URIs (>10) score TMU 5.0 On Thu, Feb 7, 2019 at 09:12, MAYER Hans wrote: > > >> … All emails were spam with links. … > > We receive such spam mails with a lot of links too. > > Is there

Re: New type of SPAM aggression

2019-02-06 Thread Rupert Gallagher
On Wed, Feb 6, 2019 at 15:42, RW wrote: > On Wed, 06 Feb 2019 11:55:07 + > Rupert Gallagher wrote: > >> This is to inform about a new type of SPAM aggression. >> >> We received from Russia, for months, and redirected them >> automatically to an administrat

Re: New type of SPAM aggression

2019-02-06 Thread Rupert Gallagher
no harm is done. > > The interesting part is which "engines" (I guess that you mean antispam > software or antispam saas providers) think that such a DNSBL should be > actually used. Can you disclose which parties you found? > > Kind regards, > > Tom > > On 06-02-19 14:40

Re: New type of SPAM aggression

2019-02-06 Thread Rupert Gallagher
The spammers at gremlin.ru have just created a homepage, with no information on how to delist an IP. Their fake dnsbl is listed as genuine in at least two antispam engines. On Wed, Feb 6, 2019 at 12:55, Rupert Gallagher wrote: > This is to inform about a new type of SPAM aggression. >

Re: Another form of obfuscation email.

2019-01-26 Thread Rupert Gallagher
I would focus on the headers: they have plenty for a spam flag. On the body, SA should already mark the text/code ratio, and the number of links. On Sun, Jan 27, 2019 at 05:43, Mark London wrote: > Does anyone have any rules that can catch this type of obfuscated spam? > >

Re: Huge spam increase

2019-01-23 Thread Rupert Gallagher
row Sent from ProtonMail Mobile On Wed, Jan 23, 2019 at 14:42, Rupert Gallagher wrote: > Nope. We are celebrating the 5th month in a raw with zero spam in users > folders. > > On Tue, Jan 22, 2019 at 18:12, Pedro David Marco > wrote: > >> Out of curiosity... >

Re: Huge spam increase

2019-01-23 Thread Rupert Gallagher
Nope. We are celebrating the 5th month in a raw with zero spam in users folders. On Tue, Jan 22, 2019 at 18:12, Pedro David Marco wrote: > Out of curiosity... > > we are noticing a huge spam increase (x10) from the last 2 days... maybe any > reactivated botnet??? > > is someone noticing it as

Re: gcc -> clang

2019-01-03 Thread Rupert Gallagher
Sorry! Ignore/delete. On Thu, Jan 3, 2019 at 11:42, Rupert Gallagher wrote: > The compiler returns many warnings, and the test returns two IPv6-related > errors. I am attaching both logs as reference. > > ‐‐‐ Original Message ‐‐‐ > On Thursday, January 3, 2019 9:5

Re: BITCOIN_PAY_ME and new type of blackmail, non porn.

2018-12-17 Thread Rupert Gallagher
Please paste the original header. On Mon, Dec 17, 2018 at 20:15, Mark London wrote: > This email hit the new (to me) BITCOIN_PAY_ME rule. Never ending fun.  > > Begin forwarded message: > >> From: "Broaddus Walther" >> Date: December 17, 2018 at 1:49:04 PM EST >> To: m...@psfc.mit.edu >>

Re: SpamSender with 2 @-signs in the address

2018-12-12 Thread Rupert Gallagher
Problem solved last year on this list. Sent from ProtonMail Mobile On Wed, Dec 12, 2018 at 15:32, Benny Pedersen wrote: > Matus UHLAR - fantomas skrev den 2018-12-12 14:55: > >> From: "name surname " > > From:name ne From:addr > > dont know if sa can test this

Re: spoofing mail

2018-11-30 Thread Rupert Gallagher
. On Fri, Nov 30, 2018 at 10:06, Matus UHLAR - fantomas wrote: > On 29.11.18 09:30, Rupert Gallagher wrote: >>Message-ID and To have the same domain, but From does not. You should have >> never received that mail. > > this happens when message-id is added by mailserver of the re

Re: spoofing mail

2018-11-29 Thread Rupert Gallagher
Message-ID and To have the same domain, but From does not. You should have never received that mail. On Wed, Nov 28, 2018 at 19:15, Rick Gutierrez wrote: > El mié., 28 nov. 2018 a las 6:03, Christian Grunfeld > () escribió: >> >> Hi, >> >> this is a logcould you paste the email headers? >>

Re: semi-OT - reporting an organization that ignores unsubscribe requests

2018-11-21 Thread Rupert Gallagher
The "right to be forgotten" is the natural outcome of three decades of self-inflicted pain. Some argue that deleting old e-mails is like re-writing history. Other, like me, argue that e-mail was born as an informal medium, different than, for example, a published book or factual evidence of a

Re: semi-OT - reporting an organization that ignores unsubscribe requests

2018-11-21 Thread Rupert Gallagher
On Wed, Nov 21, 2018 at 03:41, John Hardin wrote: > On Tue, 20 Nov 2018, Rupert Gallagher wrote: > >> The email address is an address, part of your personally identifiable >> data. > > I'm not disputing that. I write software that deals with PII in my day job. > &

Re: semi-OT - reporting an organization that ignores unsubscribe requests

2018-11-20 Thread Rupert Gallagher
Nov 2018, Rupert Gallagher wrote: > >> Yes, if you are European, and might get some money as compensation. > > From a US political advocacy group which has no commercial presence in EU? > How does GDPR apply in that situation? > >> On Mon, Nov 19, 2018 at 04:19, Joe Ac

Re: semi-OT - reporting an organization that ignores unsubscribe requests

2018-11-20 Thread Rupert Gallagher
Spam is income for those who sell it, a cost for those who buy it, and a liability for those who receive it. Thousands of junk and weaponized messages try their luck while wasting our resources. It is not by accident that we have anti-spam laws. Our unpaid job is to reject spam efficiently.

Re: semi-OT - reporting an organization that ignores unsubscribe requests

2018-11-19 Thread Rupert Gallagher
Yes, if you are European, and might get some money as compensation. On Mon, Nov 19, 2018 at 04:19, Joe Acquisto-j4 wrote: > Gents, > > I somehow became subscribed to a list, political in nature, in whose mail I > have no interest. This is a legitimate AFAIK, US organization. > > Thus far,

Re: config files in spamasassin is unintended tlds :/

2018-11-04 Thread Rupert Gallagher
.local is a valid tld for LANs. Please do not mess with the DNS. On Sun, Nov 4, 2018 at 17:14, Benny Pedersen wrote: > is it a problem ? > > i think it should be solved to make configfiles local dns resolved only, > if at all it needs to be dns > > so cf changes to cf.localdomain or

FireEye...

2018-10-23 Thread Rupert Gallagher
...catched sending spam to a gmail address, twice, using our fqdn. From google: google.com noreply-dmarc-supp...@google.com [...] example.com s s reject reject 100 154.57.155.23 2 none pass

Re: Is fuzzyocr i.e. Image scanning

2018-10-17 Thread Rupert Gallagher
I see a vps and an ".expert" tld sender domain. My servers handle those with a REJECT rule. On Fri, Oct 12, 2018 at 15:11, Brent Clark wrote: > Good day Guys > > I am getting quite a bit of image spam, and googling put me in the > direction of a tool called FuzzyOCR. > > What I did was

Re: Is fuzzyocr i.e. Image scanning

2018-10-17 Thread Rupert Gallagher
My comments on http://pralab.diee.unica.it/en/ImageCerberus IC is an effort to dig a hole in the water, because the problem of image spam with obfuscated text cannot be solved by ocr. My approach is a "better safe than sorry" best practice that anyone can implement with existing software: 1.

Re: Phishing email or no?

2018-10-14 Thread Rupert Gallagher
, 2018 at 08:17, Daniele Duca wrote: > On 13/10/2018 19:51, Rupert Gallagher wrote: > >> "The message was marked as spam by the content filter." >> >> Nice... so they know they are sending spam! > > Who doesn't :) > > I mean, for a setup big enough like

Re: Phishing email or no?

2018-10-13 Thread Rupert Gallagher
"The message was marked as spam by the content filter." Nice... so they know they are sending spam! Sent from ProtonMail Mobile On Sat, Oct 13, 2018 at 11:40, Daniele Duca wrote: > On 12/10/2018 23:12, Pedro David Marco wrote: > >>>On Friday, October 12, 2018,

Re: Phishing email or no?

2018-10-12 Thread Rupert Gallagher
I love outlook.com ... Sent from ProtonMail Mobile On Thu, Oct 11, 2018 at 22:30, Alex wrote: > Hi, > > I'm curious what people think of this: > > https://pastebin.com/1XjwaCY1 > > It's unsolicited, so that makes it spam to me, but is it dangerous? > yesinsights.com appears to be a legitimate

Re: Bitcoin update

2018-10-06 Thread Rupert Gallagher
correctly. The third reason is the Message-ID. RG On Fri, Oct 5, 2018 at 23:57, David Jones wrote: > On 10/5/18 4:38 PM, Antony Stone wrote: >> On Friday 05 October 2018 at 23:26:12, Rupert Gallagher wrote: >> >>>> https://pastebin.com/TRD7FzRQ >>>> >>>&

Re: Bitcoin update

2018-10-05 Thread Rupert Gallagher
> https://pastebin.com/TRD7FzRQ > I have a sample here There are at least three reasons to reject that e-mail upfront, with no need to parse its body.

Re: Non-ascii subjects with images

2018-09-01 Thread Rupert Gallagher
This is a subject line: Re: Habemus APP LG  On Sat, Sep 1, 2018 at 14:15, Antony Stone wrote: > On Saturday 01 September 2018 at 14:09:52, Rupert Gallagher wrote: > >> On Sat, Sep 1, 2018 at 09:35, Pedro David Marco wrote: >> > >> >> On Saturday, September

Re: Non-ascii subjects with images

2018-09-01 Thread Rupert Gallagher
Of course I do. On Sat, Sep 1, 2018 at 09:35, Pedro David Marco wrote: > Do you have any sample, Rupert? > >>On Saturday, September 1, 2018, 7:02:20 AM GMT+2, Rupert Gallagher >> wrote: >> >>Do you have an SA rule for it?

Non-ascii subjects with images

2018-08-31 Thread Rupert Gallagher
Do you have an SA rule for it?

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-18 Thread Rupert Gallagher
OK at a second glance I would say rejected upfront again, because its From domain is NXDOMAIN. On Wed, Jul 18, 2018 at 14:34, Daniele Duca wrote: > On 18/07/2018 14:22, Rupert Gallagher wrote: > >> At first glance I would say rejected upfront, because the client >> 18

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-18 Thread Rupert Gallagher
At first glance I would say rejected upfront, because the client 180.252.178.204 does not have RDNS. No need for SA. On Wed, Jul 18, 2018 at 02:00, Chip M. wrote: > http://puffin.net/software/spam/samples/0058_extortion_numeric_domain.txt

Line too long [rfc 2822, section 2.1.1]

2018-07-13 Thread Rupert Gallagher
A little survey on your local policies... What do you do when a subject line is longer than 78 characters? A. Reject B. Accept as spam C. Accept

Re: MISSING_SUBJECT

2018-06-13 Thread Rupert Gallagher
On Wed, Jun 13, 2018 at 10:38, Matus UHLAR - fantomas wrote: > MISSING_SUBJECT is here because when message has no Subject:, it is highly > probably spam. Right. Well, my new accountant, being an external company of 16 people, insists in sending messages without a subject, "because we always

Re: More outlook phish

2018-06-09 Thread Rupert Gallagher
On Fri, Jun 8, 2018 at 23:05, David Jones wrote: > 2.2 MISSING_HEADERS Missing To: header The fillowing is all one needs. 5.0 MISSING_HEADERS Missing To: header Remember that e-mail is mail after all.

Re: More outlook phish

2018-06-08 Thread Rupert Gallagher
You did well in noting the lack of the To header. Just raise its score to 5.0. Sent from ProtonMail Mobile On Fri, Jun 8, 2018 at 22:17, Alex wrote: > Hi, Received this one today that was delivered to about 25 recipients, lacked > a To header, routed through outlook.com and contained a link

Re: List From and Reply-To

2018-06-01 Thread Rupert Gallagher
In the example at hand, the article you linked to does not grant to Apache the right to oppose to your right to oblivion. Sent from ProtonMail Mobile On Fri, Jun 1, 2018 at 14:45, Anthony Cartmell wrote: >> Ok we both subscribed to the list, but > the GDPR gives us the right to be >>

Re: List From and Reply-To

2018-06-01 Thread Rupert Gallagher
I lost track of your reasoning. Let us start again. From the standpont of the GDPR, there is you, me, and someone in between who is responsible for our personal data. Infact, if you send to users@spamassassin.apache.org, I receive a copy of it *because* apache.org used our addresses. Ok we both

Re: Dynamic clients

2018-06-01 Thread Rupert Gallagher
Stiff piece of shit, dumped long ago. Sent from ProtonMail Mobile On Fri, Jun 1, 2018 at 08:05, @lbutlr wrote: > On 31 May 2018, at 01:52, Rupert Gallagher wrote: > How much do you pay for > it? Someone has a stiff piece of cellulose in a downward facing bodily > orifice ab

Re: List From and Reply-To

2018-05-31 Thread Rupert Gallagher
On Thu, May 31, 2018 at 17:39, Antony Stone wrote: >PS: I notice you choose to take the opposite approach with your own Reply-To >header, deliberately making it more difficult for people to reply to the list >:) I just use the official ios client, where such regulations are not possible.

Re: List From and Reply-To

2018-05-31 Thread Rupert Gallagher
Beware of the GDPR. If a current or former subscriber wants their address deleted, you are in hell. The mailing-list server can cleanup before itself with a reply-to the list only, and obfuscating the addresses, and deleting people's own banners and signatures. Sent from ProtonMail Mobile On

Re: Dynamic clients

2018-05-31 Thread Rupert Gallagher
Good job. How much do you pay for it? On Wed, May 30, 2018 at 16:42, Axb wrote: > On 05/30/2018 02:35 PM, Rupert Gallagher wrote: > What happens when your > coitus with Spamhaus is interrupted by a man > in the middle? I mean someone > that either cuts your link or plays the

Re: Dynamic clients

2018-05-30 Thread Rupert Gallagher
What happens when your coitus with Spamhaus is interrupted by a man in the middle? I mean someone that either cuts your link or plays the role of your partner while delivering poisoned answers? Good luck...

Re: Dynamic clients

2018-05-30 Thread Rupert Gallagher
of nowhere, for example. Sent from ProtonMail Mobile On Wed, May 30, 2018 at 06:06, Axb wrote: > On 05/30/2018 12:50 AM, Rupert Gallagher wrote: > We spent months herding > those free-range animals... Catching them is tedious, because there is no > standard that binds ISPs to jus

  1   2   3   >