spam - Women Pictures an sharing Contact

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

spam - Women Pictures an sharing Contact

Maurizio Caloro-2

Hello

how i can stronger filter or ban E-Mail from Spamers like Hotmail, Outlook, or any other domains with a lot of women pictures.

I will receive every day 10-20 Email like this…..

 

Yes spamassassin, SPF, MX Record, Dkim, Dmarc, tls1.2+1.3, the hole reputation are still good but to meny spam or rubbish Email

will be transfer I think that I am on the right way with the application Spamassassin, I also write to userspamassassin group, no

one have answer?? Please friendly ask, I need to know how I can define more and stronger filtering bad email.

 

Spamassassin update to 3.4.5

body LOCAL_OBFU_VIAGRA /(?:\b[vu]|\B(?:\\\/|\xCE\xBD))[\W_]{0,3}(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\W_]{0,3}(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\W_]{0,3}(?:[g6]|\xC4[\x9C-\xA3]])[\W_]{0,3}(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\W_]{0,3}(?:[a4]\b|(?:[\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)\B)/i

score LOCAL_OBFU_VIAGRA 1.8

describe LOCAL_OBFU_VIAGRA Obfuscated 'VIAGRA' in body

 

describe MANGLED_VIAGRA mangled viagra

body     MANGLED_VIAGRA /(?!viagra)v{1,3}(?:[_\W]{0,5}|[viagra])[iÌÍÎÏìíîï\|1l\!](?:[_\W]{0,5}|[viagra])[aÀÁÂÃÄÅàáâãäå4\@](?:[_\W]{0,5}|[viagra])g(?:[_\W]{0,5}|[viagra])r(?:[_\W]{0,5}|[viagra])[aÀÁÂÃÄÅàáâãäå4\@]/i

score    MANGLED_VIAGRA 2.5

 

postfix - 3.4.14

smtp      inet  n       -       -       -       1       postscreen             -o content_filter=spamassassin

 

postscreen_dnsbl_sites = zen.spamhaus.org*3

               

             

meny thanks for help

regards thanks

Mauri

 

 

Reply | Threaded
Open this post in threaded view
|

Re: spam - Women Pictures an sharing Contact

Benny Pedersen-2
On 2021-04-05 14:06, Maurizio Caloro wrote:

> how i can stronger filter or ban E-Mail from Spamers like Hotmail,
> Outlook, or any other domains with a lot of women pictures.

postfix is not a content filter

you can add rules to milter-reqex if you know what to search for in the
spam mails

i will not share mý own defence since it will be abuse fast if its
shared

in spamassassin you can block email from return-path and check if
dkim_valid_au and dkim_valid_ef is hitting

if both is there its strongly direct mailed

on the url side make enlist host list and score based on that lists

all local.cf

YMMV
Reply | Threaded
Open this post in threaded view
|

Re: spam - Women Pictures an sharing Contact

Jaroslaw Rafa
In reply to this post by Maurizio Caloro-2
Dnia  5.04.2021 o godz. 14:06:02 Maurizio Caloro pisze:
>
> how i can stronger filter or ban E-Mail from Spamers like Hotmail, Outlook,
> or any other domains with a lot of women pictures.
>
> I will receive every day 10-20 Email like this…..

As always, the best solution is to write your own content filtering rules
(you can use eg. spamassassin, procmail, sieve etc. to do the actual
filtering - there are many tools available) that target these particular
messages.
--
Regards,
   Jaroslaw Rafa
   [hidden email]
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."
Reply | Threaded
Open this post in threaded view
|

Re: spam - Women Pictures an sharing Contact

Matus UHLAR - fantomas
In reply to this post by Maurizio Caloro-2
On 05.04.21 14:06, Maurizio Caloro wrote:
>how i can stronger filter or ban E-Mail from Spamers like Hotmail, Outlook,
>or any other domains with a lot of women pictures.
>
>I will receive every day 10-20 Email like this…..

>Yes spamassassin, SPF, MX Record, Dkim, Dmarc, tls1.2+1.3, the hole
>reputation are still good but to meny spam or rubbish Email

reject spam at SMTP level.

>will be transfer I think that I am on the right way with the application
>Spamassassin, I also write to userspamassassin group, no

... yes or no?

>postfix - 3.4.14
>
>smtp      inet  n       -       -       -       1       postscreen
>-o content_filter=spamassassin

I think content_filter is not option for postscreen.


try using spamass-milter or amavisd-milter instead of content_filter.


--
Matus UHLAR - fantomas, [hidden email] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Fighting for peace is like fucking for virginity...