spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Reindl Harald <h.rei...@thelounge.net>
Subject Re: Investigating facebook spam
Date Tue, 06 Oct 2015 17:52:50 GMT

Am 06.10.2015 um 19:44 schrieb Reindl Harald:
> Am 06.10.2015 um 19:38 schrieb Alex:
>> I've received a handful of messages that appear to be facebook
>> notifications, but fail SPF. They otherwise look completely legit -
>> links to profiles, only URLs to facebook.com and CDN caching sites,
>> and even appears to have been routed through facebook's outgoing mail.
>>
>> All of that could be faked, but it would mean the payload is in the
>> actual facebook profiles themselves. Has anyone else found this to be
>> the case?
>>
>> http://pastebin.com/jE8G5LXJ
>
> whitelist_auth *@facebookmail.com *@pages.facebookmail.com
>
> and then safely train the junk as spam

BTW: i trained your sample with 5 copies (generic date/message-id) as 
spam reaching BAYES_95 and none of the 70 facebook ham-smaples in our 
corpus lost it's BAYES_00


Mime
View raw message