spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From dar...@chaosreigns.com
Subject Re: Hijacked email accounts
Date Mon, 04 Apr 2011 16:41:24 GMT
On 04/04, Benny Pedersen wrote:
> freemail_domain hotmail.com
> freemail_whitelist abuse@hotmail.com
> freemail_whitelist postmaster@hotmail.com

SpamAssassin already has 2,133 domains listed via freemail_domain, so you
shouldn't need to add that part for any domain.  If you do, you should file
a bug to get it added.

The rule that goes with this is FREEMAIL_FROM, which has a default score of
0.001 (basically nothing), because it hits 21.6% of non-spam (11.4%
of spam).

But if you want it to actually do anything, you'd need to increase the
score via something like:

score FREEMAIL_FROM 1

But these scores are chosen by some pretty extensive real world data
analysis:

http://ruleqa.spamassassin.org/20110321-r1083702-n/FREEMAIL_FROM/detail


It looks like the way to just penalize a single domain would be:

blacklist_from *@yahoo.com
score USER_IN_BLACKLIST 1

By default it has a score of 100, which would usually block everything.  

I was actually doing something with a similar effect, to hotmail for a 
while.  I recently noticed yahoo is much worse, I think this graph deserves 
its own post: http://www.chaosreigns.com/dnswl/dnswlabusehistory.svg


On 04/04, David wrote:
> The emails to which I refer where sent by email accounts stolen by
> viruses on computers running Windows.

I had always assumed the spammers just registered the accounts directly.
Why do you think they were stolen, by viruses or otherwise?

-- 
"Life is but a walking shadow, a poor player that struts and frets his
hour upon the stage--and then is heard no more. It is a tale told by an
idiot, full of sound and fury, signifying nothing." - William Shakespeare
http://www.ChaosReigns.com

Mime
View raw message