You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Alex <my...@gmail.com> on 2024/07/16 13:00:26 UTC
Finance spam
Hi all,
Does anyone have any further ideas on how to block "approved for funding"
spam?
https://pastebin.com/2rKiAEpt
This one is another namecheap domain registered from Reykjavik. I can
create body rules, but the language is very much in line with legitimate
lending companies. I've also added the phone to my phone rules, but
everyone knows they only last for a few days.
Other ideas greatly appreciated.
Re: Finance spam
Posted by Alex <my...@gmail.com>.
> this whole range of 185.3.229.x is on my dns blacklist and everything on
> that is either rejected or marked. I can only suggest doing something
> similar ;)
>
Very helpful. Thanks for sharing.
> RCVD_IN_HOSTKARMA_W=-2.5
> change to -0.1
That does seem to be a bit heavy-handed.
> and lastly i unsubscribed you :=)
lol, thanks :-)
RE: Finance spam
Posted by Marc <Ma...@f1-outsourcing.eu>.
this whole range of 185.3.229.x is on my dns blacklist and everything on that is either rejected or marked. I can only suggest doing something similar ;)
185.3.229.4 perfstat.hostex.lt.
185.3.229.5 post.alfa.lt.
185.3.229.6
185.3.229.7
185.3.229.8
185.3.229.9
185.3.229.10
185.3.229.11
185.3.229.12 lexsystem.data.lt.
185.3.229.13
185.3.229.14
185.3.229.15
185.3.229.16
185.3.229.17 sys6.placetgroup.com.
185.3.229.18
185.3.229.19
185.3.229.20
185.3.229.21
185.3.229.22
185.3.229.23 ox-proxy1.data.lt.
185.3.229.24 ox-proxy2.data.lt.
185.3.229.25
185.3.229.26
185.3.229.27
185.3.229.28
185.3.229.29
185.3.229.30 mail.turbotransfers.com.
185.3.229.31 ttexpress.data.lt.
185.3.229.32
185.3.229.33
185.3.229.34
185.3.229.35
185.3.229.36
185.3.229.37 mail2.oxgroup.com.
185.3.229.38
185.3.229.39
185.3.229.40
185.3.229.41
185.3.229.42
185.3.229.43
185.3.229.44
185.3.229.45
185.3.229.46
185.3.229.47
185.3.229.48
185.3.229.49
185.3.229.50
185.3.229.51
185.3.229.52
185.3.229.53
185.3.229.54
185.3.229.55 bs-backups-dir1-ext.data.lt.
185.3.229.56 news.masinis.lt.
185.3.229.57 ox-mail2.data.lt.
185.3.229.58 ox-mail3.data.lt.
185.3.229.59 ox-php.data.lt.
185.3.229.60
185.3.229.61
185.3.229.62
185.3.229.63
185.3.229.64
185.3.229.65
185.3.229.66
185.3.229.67
185.3.229.68
185.3.229.69
185.3.229.70 alfa-lamp.data.lt.
185.3.229.71
185.3.229.72 hnit-baltic-mail.data.lt.
185.3.229.73
185.3.229.74
185.3.229.75
185.3.229.76
185.3.229.77
185.3.229.78
185.3.229.79
185.3.229.80
185.3.229.81
185.3.229.82
185.3.229.83
185.3.229.84
185.3.229.85
185.3.229.86 post.okgbi.ru.
185.3.229.87
185.3.229.88 pzx-pastas.data.lt.
185.3.229.89
185.3.229.90
185.3.229.91
185.3.229.92
185.3.229.93
185.3.229.94
185.3.229.95
185.3.229.96
185.3.229.97 news.masinis.lt.
185.3.229.98 aliuminiok-web.data.lt.
185.3.229.99
185.3.229.100
185.3.229.101 ns3.data.lt.
185.3.229.102 webapp2.supermama.lt.
185.3.229.103
185.3.229.104
185.3.229.105
185.3.229.106 alfa-sentry.data.lt.
185.3.229.107 ox-mail4.data.lt.
185.3.229.108 ox-mail2.data.lt.
185.3.229.109 ox-mail3.data.lt.
185.3.229.110
185.3.229.111
185.3.229.112
185.3.229.113
185.3.229.114
185.3.229.115
185.3.229.116
185.3.229.117
185.3.229.118
185.3.229.119
185.3.229.120 cloud.miskas.org.
185.3.229.121
185.3.229.122
185.3.229.123
185.3.229.124 oneview2.hostex.lt.
185.3.229.125 mail1.sendersrv.com.
185.3.229.126 mail2.sendersrv.com.
185.3.229.127 mail3.sendersrv.com.
185.3.229.128 mail4.sendersrv.com.
185.3.229.129 mail5.sendersrv.com.
185.3.229.130 mail6.sendersrv.com.
185.3.229.131 mail7.sendersrv.com.
185.3.229.132 mail8.sendersrv.com.
185.3.229.133 mail9.sendersrv.com.
185.3.229.134 mail10.sendersrv.com.
185.3.229.135 mail1.sendersrv2.com.
185.3.229.136 mail2.sendersrv2.com.
185.3.229.137 mail3.sendersrv2.com.
185.3.229.138 mail4.sendersrv2.com.
185.3.229.139 mail5.sendersrv2.com.
185.3.229.140 mail6.sendersrv2.com.
185.3.229.141 mail7.sendersrv2.com.
185.3.229.142 mail8.sendersrv2.com.
185.3.229.143 mail9.sendersrv2.com.
185.3.229.144 mail10.sendersrv2.com.
185.3.229.145 mail1.sendersrv3.com.
185.3.229.146 mail2.sendersrv3.com.
185.3.229.147 mail3.sendersrv3.com.
185.3.229.148 mail4.sendersrv3.com.
185.3.229.149 mail5.sendersrv3.com.
185.3.229.150 mail6.sendersrv3.com.
185.3.229.151 mail7.sendersrv3.com.
185.3.229.152 mail8.sendersrv3.com.
185.3.229.153 mail9.sendersrv3.com.
185.3.229.154 mail10.sendersrv3.com.
185.3.229.155 mail11.sendersrv3.com.
185.3.229.156 mail12.sendersrv3.com.
185.3.229.157
185.3.229.158
185.3.229.159
185.3.229.160
185.3.229.161
185.3.229.162
185.3.229.163
185.3.229.164 mail-3.owexxhosting.com.
185.3.229.165 mail2-3.owexxhosting.com.
185.3.229.166
>
> Does anyone have any further ideas on how to block "approved for funding"
> spam?
> https://pastebin.com/2rKiAEpt
>
>
> This one is another namecheap domain registered from Reykjavik. I can
> create body rules, but the language is very much in line with legitimate
> lending companies. I've also added the phone to my phone rules, but
> everyone knows they only last for a few days.
>
> Other ideas greatly appreciated.
Re: Finance spam
Posted by Benny Pedersen <me...@junc.eu>.
Alex skrev den 2024-07-16 15:00:
> Hi all,
>
> Does anyone have any further ideas on how to block "approved for
> funding" spam?
> https://pastebin.com/2rKiAEpt
>
> This one is another namecheap domain registered from Reykjavik. I can
> create body rules, but the language is very much in line with
> legitimate lending companies. I've also added the phone to my phone
> rules, but everyone knows they only last for a few days.
>
> Other ideas greatly appreciated.
spf_helo_none add more possitive score to it
RCVD_IN_HOSTKARMA_W=-2.5
change to -0.1
and lastly i unsubscribed you :=)