On 13.10.25 19:23, Thomas Barth via users wrote:
for several days now, I have been receiving a new type of spam
email that appears to originate from a mailing list. The content
of the emails consists of automatic replies (notification of
absence, vacation, processing). Therefore, I cannot add them to
Bayes training.
Am 2025-10-16 18:20, schrieb Matus UHLAR - fantomas:
Why?
As I understand it, autoresponders, newsletters, and system
notifications should not be added to the Bayes database. If you write
to the company and receive their automatic legitimate response, it
could be mistakenly classified as spam then? Only emails whose content
is typically spam-like (e.g., advertising, phishing, dubious wording,
tracking pixels, etc.) are suitable for Bayes.
Well, if they produce no value, then no.
But if they only contain automatic responses, they apparently not spammy,
just backscatter.
And if they are spammy, it may make sense training with this kind of email.
To be frank, I was long ago interested about catching this kind of e-mail,
to help against mailbombing attacks. VBounce plugin helps much against it.
I have already lowered the score for the MAILING_LIST_MULTI check.
Lowered? Because of this?
On 16.10.25 19:56, Thomas Barth via users wrote:
The bonus MAILING_LIST_MULTI=-1 is too much for me :)
ohh, you mean increased :-)
However, the emails are not detected by Spamassassin's standard
blocklists. I don't know how to detect these emails. Which
blacklists (https://www.intra2net.com/en/support/antispam/) should
I definitely add to local.cf in addition to the standard
blocklists?
Can you provide samples? (use web, pastebin or similar service)
I imagine that spammers are also reading this list in order to
optimize their spam generators. I'm not sure if that's such a good
idea. The spam messages mentioned were only generated for
German-speaking countries because only the automatic replies from
German companies appear with the original addresses, among other
things. This type of spam is absolute chaos :-)
That highly depends on the content - if they are only responses or contain
other spammy content.
--
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Windows found: (R)emove, (E)rase, (D)elete
