<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 4/12/19 6:14 PM, Mark Sapiro wrote:<br>
</div>
<blockquote type="cite"
cite="mid:260bc914-29c7-4628-84fc-65e946e84dcd@msapiro.net">
<pre class="moz-quote-pre" wrap="">On 4/12/19 7:57 AM, George Papamichelakis wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">it's google groups sure but the users never subscribed to them ...
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
If the spam is actually being sent from the Google group, Google should
deal with it.
</pre>
</blockquote>
<p>its spam definetly , they use google and it's not spoofing.</p>
<p>funny thing is when you search for googlegroups abuse : <br>
</p>
<p><span style="color: rgb(34, 34, 34); font-family: Arial,
Helvetica, sans-serif; font-size: 13px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255); text-decoration-style: initial; text-decoration-color:
initial; display: inline !important; float: none;">Friendly
reminder that if you encounter emails on this list that you
believe are spam or abuse of the list, please report the abuse
using the google groups Report Abuse feature in the drop-down in
the top right of the message in the web interface. All emails
should have a "</span><span style="margin: 0px; padding: 0px;
border: 0px; font-size: 13px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255); text-decoration-style: initial; text-decoration-color:
initial; color: rgb(117, 117, 117); font-family: sans-serif;">To
view this discussion on the web visit</span><span style="color:
rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif;
font-size: 13px; font-style: normal; font-variant-ligatures:
normal; font-variant-caps: normal; font-weight: 400;
letter-spacing: normal; orphans: 2; text-align: start;
text-indent: 0px; text-transform: none; white-space: normal;
widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); text-decoration-style:
initial; text-decoration-color: initial; display: inline
!important; float: none;">" link in their footer that will
direct you to the web interface. This is for if you are
subscribed through the google group.</span></p>
<p>Seems you can only report google groups abuse from your google
account , that leaves <br>
</p>
<p>out a lot of people if they don't have a google account . Also
what happens when the you're <br>
</p>
<p>spammed on your business email but you have to report the abuse
from your personal gmail account ? <br>
</p>
<p>This is very grey and vague I think .</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:260bc914-29c7-4628-84fc-65e946e84dcd@msapiro.net">
<pre class="moz-quote-pre" wrap="">
On the other hand, if it's just mail that cleverly spoofs the google
group as the sender, the originator's IP address should be somewhere in
the Received: headers, and it should be possible to detect the
difference between these and real Google groups email in a SpamAssassin
rule.
Or, if as you say elsewhere they all have a header like
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">List-Unsubscribe: <a class="moz-txt-link-rfc2396E" href="mailto:googlegroups-manage+30218623922+unsubscribe@googlegroups.com"><mailto:googlegroups-manage+30218623922+unsubscribe@googlegroups.com></a>,
<a class="moz-txt-link-rfc2396E" href="https://groups.google.com/group/azovwave2/subscribe"><https://groups.google.com/group/azovwave2/subscribe></a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
You should be able to get that with a spamassassin rule like
header RULE_NAME List-Unsubscribe =~ /subscribe>$/</pre>
</blockquote>
<p>This is more likely to work probably , I will create a rule with
low score at first to check</p>
<p>thanks for suggesting</p>
<p><br>
</p>
<p>George<br>
</p>
<br>
</body>
</html>