[anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 12

Suman,

* Suman Kumar Saha <suman at bdcert.org>:
> Hi.
> My point was current popular open source tools like Mailscanner/Amavis not working perfectly to fight against spam.So I expect someone from the working group can share better anti spam tool.We extremely disagree to give business opportunity to anti spam solution provider like barracuda or to others.Rather if we can enrich open source tools that will really be benefited for the community.

we use open source tools at ISPs and they work very well. But they alone will
not do the job. It requires a set of connection, session and content filters
to keep spam and malware away.

These include RBLs, SPF, DKIM and DMARC filters, session filters that check
for simple RFC errors (not too strict) and configured (!) spam filters such as
SpamAssassin. In combination these work very well.

For the record: Fighting abuse and phishing is something we put in more
effort.

p at rick




> > On Oct 10, 2015, at 11:38 PM, Marilson <marilson.mapa at gmail.com> wrote:
> > 
> > Hi
> > 
> >> Mailscanner/amavis with clamav can not protect spammers very well
> > 
> > Sorry, I did not understand this frase...
> > 
> >> ip block lists  are a first and still quite useful  line of defense.
> >> Can you share which open source anti spam application works well.
> >> We do not want to let them do business with spam by taking cloud based solution like zero spam/comodo anti spam. Rather we are trying to find a open source solution that works well against spam.
> > 
> > If you are saying... good and thanks, but without the help of the good ISPs is that possible?
> > Look for that. I took the HEADER POSTED BY YOU and made a research. Note the existing structure behind this spammer (links below). There are all kinds of support, courses and tools, to enable spam. Including how to avoid spam box.
> > 
> > https://www.ecommercebrasil.com.br/
> > http://www.socialminer.com.br/
> > https://clube.ecommercebrasil.com.br/
> > https://cursos.ecommercebrasil.com.br/
> > http://imasters.expert/
> > 
> > Include domains on blocklist will resolve or mitigate this hell created by greedy Sociopaths and predators?
> > 
> > Guys, we can divide the history of capitalism in before and after the email marketing. This e-mail marketing is an aberration, a distortion of the capitalist system, and is worse than the financial capitalism that creates resources without generating corresponding riches, and from time to times the bubble explodes and the losses are distributed equally among all, as if we live in a communist system. Similarly e-mail marketing does not create any wealth, only directs people misinformed to buy a good that needs, in one or another place. And do it in a way that borders on sociopathy, without respect for people, sending again and again, ad infinitum, the same junk.
> > 
> > Thanks
> > Marilson
> > 
> > 
> > -----Mensagem Original----- From: anti-abuse-wg-request at ripe.net
> > Sent: Saturday, October 10, 2015 10:58 AM
> > To: anti-abuse-wg at ripe.net
> > Subject: anti-abuse-wg Digest, Vol 48, Issue 12
> > 
> > Send anti-abuse-wg mailing list submissions to
> > anti-abuse-wg at ripe.net
> > 
> > To subscribe or unsubscribe via the World Wide Web, visit
> > https://www.ripe.net/mailman/listinfo/anti-abuse-wg
> > or, via email, send a message with subject or body 'help' to
> > anti-abuse-wg-request at ripe.net
> > 
> > You can reach the person managing the list at
> > anti-abuse-wg-owner at ripe.net
> > 
> > When replying, please edit your Subject line so it is more specific
> > than "Re: Contents of anti-abuse-wg digest..."
> > 
> > 
> > Today's Topics:
> > 
> >  1.  Anti spam gateway (Suman Kumar Saha)
> >  2. Re: Anti spam gateway (Suresh Ramasubramanian)
> >  3. Re: Anti spam gateway (Suman Kumar Saha)
> >  4. Re: Anti spam gateway (Suresh Ramasubramanian)
> >  5. Re: Anti spam gateway (Suman Kumar Saha)
> > 
> > 
> > ----------------------------------------------------------------------
> > 
> > Message: 1
> > Date: Sat, 10 Oct 2015 18:44:07 +0600
> > From: Suman Kumar Saha <suman at bdcert.org>
> > To: "anti-abuse-wg at ripe.net" <anti-abuse-wg at ripe.net>
> > Subject: [anti-abuse-wg]  Anti spam gateway
> > Message-ID: <845D06FB-9540-4B4E-BF27-47F951884486 at bdcert.org>
> > Content-Type: text/plain; charset="us-ascii"
> > 
> > Dear ALL,
> > In our community mostly using mailscanner or amavis with postfix/exim as anti spam email gateway.But its perfection is not satisfactory now-a-days.Can you share which open source anti spam application works well.
> > 
> > Thanks
> > Suman
> > bdCERT
> > -------------- next part --------------
> > A non-text attachment was scrubbed...
> > Name: signature.asc
> > Type: application/pgp-signature
> > Size: 842 bytes
> > Desc: Message signed with OpenPGP using GPGMail
> > URL: <https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20151010/73127b51/attachment-0001.sig>
> > 
> > ------------------------------
> > 
> > Message: 2
> > Date: Sat, 10 Oct 2015 18:29:45 +0530
> > From: Suresh Ramasubramanian <ops.lists at gmail.com>
> > To: Suman Kumar Saha <suman at bdcert.org>
> > Cc: "anti-abuse-wg at ripe.net" <anti-abuse-wg at ripe.net>
> > Subject: Re: [anti-abuse-wg] Anti spam gateway
> > Message-ID: <927D9503-073B-4761-A6A0-BEF679C54B5F at gmail.com>
> > Content-Type: text/plain; charset=us-ascii
> > 
> > Spamassassin together with free and/or cheap depending on usage pattern block lists such as  Spamhaus and SURBL
> > 
> > Mailscanner plus amavis does a sort of OK job on antivirus but that's a different ball game
> > 
> > --srs
> > 
> >> On 10-Oct-2015, at 6:14 PM, Suman Kumar Saha <suman at bdcert.org> wrote:
> >> 
> >> Dear ALL,
> >> In our community mostly using mailscanner or amavis with postfix/exim as anti spam email gateway.But its perfection is not satisfactory now-a-days.Can you share which open source anti spam application works well.
> >> 
> >> Thanks
> >> Suman
> >> bdCERT
> > 
> > 
> > 
> > ------------------------------
> > 
> > Message: 3
> > Date: Sat, 10 Oct 2015 19:04:30 +0600
> > From: Suman Kumar Saha <suman at bdcert.org>
> > To: "anti-abuse-wg at ripe.net" <anti-abuse-wg at ripe.net>
> > Subject: Re: [anti-abuse-wg] Anti spam gateway
> > Message-ID: <85E06579-9F70-4632-BD45-085B8B2B551E at bdcert.org>
> > Content-Type: text/plain; charset="utf-8"
> > 
> > 
> > RBL  and even PTR record check doesn?t work well.Now spammer also use clean IP and with PTR.Mailscanner/amavis with clamav can?t protect spammers very well.
> > 
> > Thanks
> > Suman
> > 
> >> On Oct 10, 2015, at 6:59 PM, Suresh Ramasubramanian <ops.lists at gmail.com> wrote:
> >> 
> >> Spamassassin together with free and/or cheap depending on usage pattern block lists such as  Spamhaus and SURBL
> >> 
> >> Mailscanner plus amavis does a sort of OK job on antivirus but that's a different ball game
> >> 
> >> --srs
> >> 
> >>> On 10-Oct-2015, at 6:14 PM, Suman Kumar Saha <suman at bdcert.org> wrote:
> >>> 
> >>> Dear ALL,
> >>> In our community mostly using mailscanner or amavis with postfix/exim as anti spam email gateway.But its perfection is not satisfactory now-a-days.Can you share which open source anti spam application works well.
> >>> 
> >>> Thanks
> >>> Suman
> >>> bdCERT
> > 
> > -------------- next part --------------
> > A non-text attachment was scrubbed...
> > Name: signature.asc
> > Type: application/pgp-signature
> > Size: 842 bytes
> > Desc: Message signed with OpenPGP using GPGMail
> > URL: <https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20151010/ae2328ed/attachment-0001.sig>
> > 
> > ------------------------------
> > 
> > Message: 4
> > Date: Sat, 10 Oct 2015 18:41:02 +0530
> > From: Suresh Ramasubramanian <ops.lists at gmail.com>
> > To: Suman Kumar Saha <suman at bdcert.org>
> > Cc: "anti-abuse-wg at ripe.net" <anti-abuse-wg at ripe.net>
> > Subject: Re: [anti-abuse-wg] Anti spam gateway
> > Message-ID: <76B1E60C-A38A-4452-86A2-5E43261FF924 at gmail.com>
> > Content-Type: text/plain; charset=utf-8
> > 
> > ip block lists  are a first and still quite useful  line of defense. Spam assassin is a series of score based content filters that supplement Spamhaus and such.  SURBL is a URL block list.
> > 
> > Beyond a point however filtering has grown enormously complex (and add issues such as dmarc and other authentication) so your constituents might be better off outsourcing their mail hosting to one of several large players in this field (none that are local to Asia / saarc though)
> > 
> > --srs
> > 
> >> On 10-Oct-2015, at 6:34 PM, Suman Kumar Saha <suman at bdcert.org> wrote:
> >> 
> >> 
> >> RBL  and even PTR record check doesn?t work well.Now spammer also use clean IP and with PTR.Mailscanner/amavis with clamav can?t protect spammers very well.
> >> 
> >> Thanks
> >> Suman
> >> 
> >>> On Oct 10, 2015, at 6:59 PM, Suresh Ramasubramanian <ops.lists at gmail.com> wrote:
> >>> 
> >>> Spamassassin together with free and/or cheap depending on usage pattern block lists such as  Spamhaus and SURBL
> >>> 
> >>> Mailscanner plus amavis does a sort of OK job on antivirus but that's a different ball game
> >>> 
> >>> --srs
> >>> 
> >>>> On 10-Oct-2015, at 6:14 PM, Suman Kumar Saha <suman at bdcert.org> wrote:
> >>>> 
> >>>> Dear ALL,
> >>>> In our community mostly using mailscanner or amavis with postfix/exim as anti spam email gateway.But its perfection is not satisfactory now-a-days.Can you share which open source anti spam application works well.
> >>>> 
> >>>> Thanks
> >>>> Suman
> >>>> bdCERT
> >> 
> > 
> > 
> > 
> > ------------------------------
> > 
> > Message: 5
> > Date: Sat, 10 Oct 2015 19:58:23 +0600
> > From: Suman Kumar Saha <suman at bdcert.org>
> > To: "anti-abuse-wg at ripe.net" <anti-abuse-wg at ripe.net>
> > Subject: Re: [anti-abuse-wg] Anti spam gateway
> > Message-ID: <E45B3CD7-C780-4704-AFB6-14BE801B7425 at bdcert.org>
> > Content-Type: text/plain; charset="utf-8"
> > 
> > Now spam sender is more intelligent  and they use IP with PTR and most of the cases their IP not been listed in RBLs like the header.We don?t want to let them do business with spam by taking cloud based solution like zero spam/comodo anti spam.Rather we are trying to find a open source solution that works well against spam.
> > 
> > Return-Path: <return at ecommerce.eng.br>
> > X-Original-To: technical at dhakacom.com
> > Delivered-To: technical at dhakacom.com
> > Received: from mail.bdneg.com (ns3.dhakacom.com [118.179.223.10])
> >   by mail.dhakacom.com (Postfix) with ESMTP id 24B188003F6
> >   for <technical at dhakacom.com>; Sat, 10 Oct 2015 07:23:42 +0600 (BDT)
> > Received: from spcr-11.ecommerce.eng.br (spcr-11.ecommerce.eng.br [ ])
> >   by mail.bdneg.com (Postfix) with ESMTP id EE713F802BC
> >   for <technical at dhakacom.com>; Sat, 10 Oct 2015 07:29:15 +0600 (BDT)
> > DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=ecommerce.eng.br;
> >   h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=abuse at ecommerce.eng.br;
> >   bh=o93ep8+n7HSq2EnXXlh49f9uThs=;
> >   b=Pu7rSAzPy6dlxqPWxYAd5l14JXkykPVOuBPX2FWM3OmDiHyt92N4PYG5k9sJ3tGqrJgdV25kUjBu
> >   Hf1TQRCDnPTFDkp+/gymCd7sF/B/SLQyvo0GkLO62WIWqYY2ufqw2dq9dNGiIfACoMt3K0C5Pn7B
> >   EM2/02aTMn9feNfu0kc=
> > To: technical at dhakacom.com
> > Subject: =?UTF-8?B?UHJvbW/Dp8OjbyBkZSBQbmV1cyBOb3Zvcw==?=
> > Message-ID: <c00dc236b2712482879b6c1117cdc090 at ecommerce.eng.br>
> > Date: Fri, 09 Oct 2015 19:48:51 -0300
> > From: "tatuape" <nao-responda at ecommerce.eng.br/>
> > Reply-To: nao-responda at ecommerce.eng.br/
> > MIME-Version: 1.0
> > X-Mailer-LID: 3,5
> > List-Unsubscribe: <http://ecommerce.eng.br/unsubscribe.php?M=420221&C=218ae60a7946264a4d590f99bba14b00&L=3&N=102>
> > X-Mailer-RecptId: 420221
> > X-Mailer-SID: 102
> > X-Mailer-Sent-By: 6
> > Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_d3ab14ba7a57d5b09e9e3daefd4680ba"
> > Content-Transfer-Encoding: 8bit
> > X-dhakacom-MailScanner-ID: EE713F802BC.AAF1E
> > X-dhakacom-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details
> > X-dhakacom-MailScanner-SpamScore: sss
> > X-dhakacom-MailScanner-From: return at ecommerce.eng.br
> > X-Spam-Status: No
> > 
> > 
> > Thanks
> > Suman
> > 
> >> On Oct 10, 2015, at 7:11 PM, Suresh Ramasubramanian <ops.lists at gmail.com> wrote:
> >> 
> >> ip block lists  are a first and still quite useful  line of defense. Spam assassin is a series of score based content filters that supplement Spamhaus and such.  SURBL is a URL block list.
> >> 
> >> Beyond a point however filtering has grown enormously complex (and add issues such as dmarc and other authentication) so your constituents might be better off outsourcing their mail hosting to one of several large players in this field (none that are local to Asia / saarc though)
> >> 
> >> --srs
> >> 
> >>> On 10-Oct-2015, at 6:34 PM, Suman Kumar Saha <suman at bdcert.org> wrote:
> >>> 
> >>> 
> >>> RBL  and even PTR record check doesn?t work well.Now spammer also use clean IP and with PTR.Mailscanner/amavis with clamav can?t protect spammers very well.
> >>> 
> >>> Thanks
> >>> Suman
> >>> 
> >>>> On Oct 10, 2015, at 6:59 PM, Suresh Ramasubramanian <ops.lists at gmail.com> wrote:
> >>>> 
> >>>> Spamassassin together with free and/or cheap depending on usage pattern block lists such as  Spamhaus and SURBL
> >>>> 
> >>>> Mailscanner plus amavis does a sort of OK job on antivirus but that's a different ball game
> >>>> 
> >>>> --srs
> >>>> 
> >>>>> On 10-Oct-2015, at 6:14 PM, Suman Kumar Saha <suman at bdcert.org> wrote:
> >>>>> 
> >>>>> Dear ALL,
> >>>>> In our community mostly using mailscanner or amavis with postfix/exim as anti spam email gateway.But its perfection is not satisfactory now-a-days.Can you share which open source anti spam application works well.
> >>>>> 
> >>>>> Thanks
> >>>>> Suman
> >>>>> bdCERT
> >>> 
> > 
> > -------------- next part --------------
> > An HTML attachment was scrubbed...
> > URL: <https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20151010/00150b92/attachment.html>
> > -------------- next part --------------
> > A non-text attachment was scrubbed...
> > Name: signature.asc
> > Type: application/pgp-signature
> > Size: 842 bytes
> > Desc: Message signed with OpenPGP using GPGMail
> > URL: <https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20151010/00150b92/attachment.sig>
> > 
> > End of anti-abuse-wg Digest, Vol 48, Issue 12
> > *********************************************
> 



-- 
Patrick Ben Koetter
p at state-of-mind.de