Re: Catching well directed spear phishing messages

[Reindl Harald]

Am 28.06.2016 um 16:08 schrieb Jari Fredriksson:

Reindl Harald kirjoitti 28.6.2016 16:56:

Am 28.06.2016 um 15:25 schrieb Jari Fredriksson:

Almost all the phishes I've received in the last few years have done
this - except that they have something like "paypal support" rather
than an individual's name.

Ah, so true

you should look at that - enters my junk folder even with a
whitelist_auth because of the domain-blacklist

URIBL_BLACK
Contains an URL listed in the URIBL blacklist
[URIs: bitwell.biz]

I don't see that happening in my SA, nor at
https://admin.uribl.com/?section=lookup

X-Spam-Report: Flag: No,        *  6.5 URIBL_BLACK Contains an URL listed in the

 RBL: score.senderscore.com (Low Trust) *      [140.211.11.3 listed in
 score.senderscore.com] * -0.5 CUST_DNSWL_11_ORG_HIGH RBL: list.dnswl.org
 (High Trust)   *      [140.211.11.3 listed in list.dnswl.org]  * -0.2
 CUST_DNSWL_8_TL_NT RBL: dnswl-aggregate.thelounge.net (No Trust)       *
 [140.211.11.3 listed in dnswl-aggregate.thelounge.net] * -0.1
 CUST_DNSWL_3_JEF_LOW RBL: hostkarma.junkemailfilter.com (Low Trust)    *
 [140.211.11.3 listed in hostkarma.junkemailfilter.com] * -0.1
 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)    *      [140.211.11.3 listed in
 wl.mailspike.net]      * -100 USER_IN_SPF_WHITELIST From: address is in the
 user's SPF whitelist   *  0.0 SHORTCIRCUIT Not all rules were run, due to a
 shortcircuited rule    *  0.0 CUST_SHORTCIRCUIT Skip tests based on
 whitelists/blacklists and      *      local relays
Return-Path:
 users-return-112640-h.reindl=thelounge....@spamassassin.apache.org
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

dunno - but all your mails including my own to the list pointing it out are ending in the junk folder URIBL blacklist * [URIs: bitwell.biz] * -0.1 CUST_DNSWL_2_SENDERSC_LOW

signature.asc
Description: OpenPGP digital signature