Interesting email based blacklist

Questions and answers about how to do stuff
Post Reply
nicola.piazzi
Posts: 282
Joined: 23 Apr 2015 09:45

Interesting email based blacklist

Post by nicola.piazzi » 24 Nov 2017 13:20

Take a look to this
https://msbl.org

here 2 config files to put in /etc/mail/spamassassin
http://msbl.org/tools/sa-hashbl.tar.gz

I installed it 1 hour ago and i have no hits at the moment

User avatar
pdwalker
Posts: 1137
Joined: 18 Mar 2015 09:16

Re: Interesting email based blacklist

Post by pdwalker » 24 Nov 2017 18:10

Can’t hurt to try. I’ll implement it tomorrow and see what happens.

nicola.piazzi
Posts: 282
Joined: 23 Apr 2015 09:45

Re: Interesting email based blacklist

Post by nicola.piazzi » 27 Nov 2017 07:43

Only 11 hits in the weekend but absolutely no false positive, i ' ll increase score to 3.00

User avatar
pdwalker
Posts: 1137
Joined: 18 Mar 2015 09:16

Re: Interesting email based blacklist

Post by pdwalker » 27 Nov 2017 07:50

I just turned it on less than three hours ago, and I've already gotten three hits.

Excellent.

nicola.piazzi
Posts: 282
Joined: 23 Apr 2015 09:45

Re: Interesting email based blacklist

Post by nicola.piazzi » 27 Nov 2017 07:59

yes,
there are not a lot of hits because this is non a rbl
this is email address based so it have few entries but these are sure that is spam

User avatar
pdwalker
Posts: 1137
Joined: 18 Mar 2015 09:16

Re: Interesting email based blacklist

Post by pdwalker » 27 Nov 2017 08:20

Every little bit helps.

User avatar
pdwalker
Posts: 1137
Joined: 18 Mar 2015 09:16

Re: Interesting email based blacklist

Post by pdwalker » 12 Jan 2018 07:51

So far, I've gotten 242 messages to trigger this rule. 100% spam. Increasing the spam score to 4.0

nicola.piazzi
Posts: 282
Joined: 23 Apr 2015 09:45

Re: Interesting email based blacklist

Post by nicola.piazzi » 12 Jan 2018 08:22

yes, they are based on real case so hit is 100%

Alleyviper
Posts: 71
Joined: 16 Oct 2018 05:55
Location: Portugal

Re: Interesting email based blacklist

Post by Alleyviper » 08 Jan 2019 02:57

Hi there,

Where to put pm file included?

nicola.piazzi
Posts: 282
Joined: 23 Apr 2015 09:45

Re: Interesting email based blacklist

Post by nicola.piazzi » 08 Jan 2019 07:27

same dir where local.cf

Alleyviper
Posts: 71
Joined: 16 Oct 2018 05:55
Location: Portugal

Re: Interesting email based blacklist

Post by Alleyviper » 22 Jan 2019 23:17

Hi Nicola,

Works like a charm :)

Check the custom phishing.bad.sites.custom to enhance event more blocking bad stuff

Code: Select all


https://forum.efa-project.org/viewtopic.php?f=14&t=3334


ovizii
Posts: 450
Joined: 11 May 2016 08:08

Re: Interesting email based blacklist

Post by ovizii » 05 Mar 2019 12:09

Alleyviper wrote:
08 Jan 2019 02:57
Hi there,

Where to put pm file included?
I don't think its necessary to do anything. as of Sa 3.4.2 if you have /etc/mail/spamassassin/hashbl.cf look inside, mine says:

Code: Select all

loadplugin Mail::SpamAssassin::Plugin::HashBL   HashBL.pm

ifplugin Mail::SpamAssassin::Plugin::HashBL
    header   HASHBL_EMAIL       eval:check_hashbl_emails('ebl.msbl.org')
    describe HASHBL_EMAIL       Message contains email address found on the EBL
    score    HASHBL_EMAIL       1.0
endif
then go to your EFA dashboard => Tools and Links => Spamassassin Lin (Test) then check if HASHBL_EMAIL was loaded.

Post Reply