[Mimedefang] greylisting and HABEAS_SWE

[Lee Dilkie]

not related
> > to those headers in any manner) The greylisting is working for
> > numerous other spams.
>
> I am familiar with this Habeas test and have seen the exact spam and
> problems you are referring to on our network.
>
> [...]
> I am considering removing the negative score for their tag
> because we have
> seen an upswell of spam using this.  The spammer either doesn't know,
> doesn't care, or will get shutdown pretty quickly.
>

Following up on some advice given early this week, I installed the bigevil
and other .cf's from the meglo-cf-mart
(http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm).

Interestingly enough, those pharma Habeas emails were being tagged with a
negative score for the Habeas test but they were also being tagged with
numerous positive scores from some of the new sa .cf's and that had the
effect of overriding the Habeas score. net result was the spam still ended
up in my spam folder.

I'm very impressed. Only had to figure out that on freeBSD the folder to
drop the .cf's into is /usr/local/etc/mail/spamassassin... My first guess at
/usr/local/etc/mimedefang/spamasassin didn't work out so well ;)

-lee