You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by LuKreme <kr...@kreme.com> on 2005/12/21 21:07:05 UTC

Paypal Spoof

I used to have a set of rules that dealt with the paypal and ebay  
spoof emails, however since upgrading to SA 3.x I seem to have lost  
them (along with several other rules that I liked).

Return-Path: <ww...@chel.tv>
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on  
akane.covisp.net
X-Spam-Level: **
X-Spam-Status: No, score=2.4 required=5.0  
tests=BAYES_50,DATE_IN_PAST_06_12,
	HTML_MESSAGE,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,
	RCVD_IN_BL_SPAMCOP_NET autolearn=no version=3.1.0
X-Original-To: *munged*@*munged*.com
Delivered-To: *munged*@*munged*.com
X-Greylist: delayed 16289 seconds by postgrey-1.21 at  
akane.covisp.net; Wed, 21 Dec 2005 02:52:06 MST
Received: from master.chel.tv (master.chel.tv [212.57.161.3])
	by mail.covisp.net (Postfix) with ESMTP id BD861118AC6E
	for <*munged*@*munged*.com>; Wed, 21 Dec 2005 02:51:59 -0700 (MST)
Received: by master.chel.tv (Postfix, from userid 33)
	id 50CD132818; Wed, 21 Dec 2005 08:48:27 +0500 (YEKT)
To: *munged*@*munged*.com
From: PayPal <co...@paypal.com>

I mean, it seems to be something claiming to be from paypal, ebay,  
citibank, wamu, etc that is NOT from them should score a lot higher  
than 2.4.  So what can I do to catch these before some idiot -- er,  
luser-- um USER gets fooled into giving up their account info?

-- 
Naked blonde walks into a bar with a poodle under one arm, and a two- 
foot salami under the other. The bartender says, I guess you won't be  
needing a drink. Naked lady says…

Re: Paypal Spoof

Posted by jdow <jd...@earthlink.net>.
From: "LuKreme" <kr...@kreme.com>

I used to have a set of rules that dealt with the paypal and ebay  
spoof emails, however since upgrading to SA 3.x I seem to have lost  
them (along with several other rules that I liked).

Return-Path: <ww...@chel.tv>
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on  
akane.covisp.net
X-Spam-Level: **
X-Spam-Status: No, score=2.4 required=5.0  
tests=BAYES_50,DATE_IN_PAST_06_12,
HTML_MESSAGE,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,
RCVD_IN_BL_SPAMCOP_NET autolearn=no version=3.1.0
X-Original-To: *munged*@*munged*.com
Delivered-To: *munged*@*munged*.com
X-Greylist: delayed 16289 seconds by postgrey-1.21 at  
akane.covisp.net; Wed, 21 Dec 2005 02:52:06 MST

>> Either this is really from something related to PayPal, which it quite
>> obviously is not, or we've just witnessed the inevitable death of
>> greylisting.

Received: from master.chel.tv (master.chel.tv [212.57.161.3])
by mail.covisp.net (Postfix) with ESMTP id BD861118AC6E
for <*munged*@*munged*.com>; Wed, 21 Dec 2005 02:51:59 -0700 (MST)
Received: by master.chel.tv (Postfix, from userid 33)
id 50CD132818; Wed, 21 Dec 2005 08:48:27 +0500 (YEKT)
To: *munged*@*munged*.com
From: PayPal <co...@paypal.com>

I mean, it seems to be something claiming to be from paypal, ebay,  
citibank, wamu, etc that is NOT from them should score a lot higher  
than 2.4.  So what can I do to catch these before some idiot -- er,  
luser-- um USER gets fooled into giving up their account info?

>> Are you running any SARE rules?

{^_^}