Re: Google Safe Browsing plugin?

2017-04-25 Thread Merijn van den Kroonenberg
>> Hi everyone, >> >> I want to try and detect malicious uri in the body of emails better and >> thought there might be something I could use, since I imagine google >> have >> a good list of them. I found this link, but it fails to install. >> >> http://search.cpan.org/~danborn/Bundle-SafeBrowsing

Re: Google Safe Browsing plugin?

2017-04-25 Thread Merijn van den Kroonenberg
> Hi everyone, > > I want to try and detect malicious uri in the body of emails better and > thought there might be something I could use, since I imagine google have > a good list of them. I found this link, but it fails to install. > > http://search.cpan.org/~danborn/Bundle-SafeBrowsing/lib/Bundl

Google Safe Browsing plugin?

2017-04-25 Thread Richard Mealing
Hi everyone, I want to try and detect malicious uri in the body of emails better and thought there might be something I could use, since I imagine google have a good list of them. I found this link, but it fails to install. http://search.cpan.org/~danborn/Bundle-SafeBrowsing/lib/Bundle/SafeBrow

Re: TVD_PH_SEC score problem

2017-04-25 Thread RW
On Tue, 25 Apr 2017 08:40:27 -0400 Alex wrote: > Even 2.8 points for merely the word "xanax" alone, without any other > basis for consideration, sounds too high. Actually it's looking for something that looks like xanax, but isn't xanax. Unless I'm misunderstanding something, these FUZZY rules

Re: TVD_PH_SEC score problem

2017-04-25 Thread Alex
Hi, On Mon, Apr 24, 2017 at 11:43 PM, Bill Cole wrote: > On 24 Apr 2017, at 21:35, Alex wrote: > >> Hi, >> Hi, this rule hit a citibank.com email. Adding 1.8 points simply for the phrase "your account security" does not seem reasonable. Apr 24 20:13:18.660 [28524] dbg: rules:

Re: TVD_PH_SEC score problem

2017-04-25 Thread Alex
Hi, >> It also hit a secondary RBL for an IP that it shouldn't have, as well >> as bayes00 and hostkarma_bl, totaling 5.044, making it spam. The IP >> that was hit was 52.40.63.1, mta1b3.c1-t.msyscloud.com. >> >> I would have included that initially, but I figured any one phrase >> shouldn't be en

utf-16 spam :(

2017-04-25 Thread Benny Pedersen
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7252 can it be solved in 3.4.2 ? only tools i have here is sigtool from clamav that can decode it, so i could for the time make a clamav local sig that reject this spam mails

Re: Score maths

2017-04-25 Thread Geoff Soper
Hi Tom, Thanks for your explanation, I hadn't appreciated that there was higher precision being hidden. Thanks, Geoff > On 25 Apr 2017, at 09:39, Tom Hendrikx wrote: > > Hoi Geoff, > > The scores actually have a precision of 3 numerals after the dot. The > actual score of NO_RELAYS = -0.001.

Re: Score maths

2017-04-25 Thread Tom Hendrikx
Hoi Geoff, The scores actually have a precision of 3 numerals after the dot. The actual score of NO_RELAYS = -0.001. While rounding would still give you 3.0 as final score for this message, the actual score is below 3. When you would have a ham/spam threshold at exactly 3, and the final score wou

Re: Score maths

2017-04-25 Thread Benny Pedersen
Geoff Soper skrev den 2017-04-25 10:27: Can anyone explain why this isn't scoring 3.0? take your calculator: 1000/3 = ? if you take that results with a good calculator and * 3 it will say 1000 as a result, but most cheap ones say 999 :=) where did that 1 go ?

Re: Score maths

2017-04-25 Thread Markus Clardy
A score of -0.0 is actually not 0, it is something like -0.01 (or smaller). If it had a score of actual 0, it wouldn't trigger. As such, due to rounding, it ends up becoming 2.9, instead of 3. On 04/25/2017 09:27 AM, Geoff Soper wrote: X-Spam-Status: No, Score=2.9 X-Spam-Report: * -0.0 NO_R

Score maths

2017-04-25 Thread Geoff Soper
X-Spam-Status: No, Score=2.9 X-Spam-Report: * -0.0 NO_RELAYS Informational: message was not relayed via SMTP * 3.0 GS_NO_RLYS_PHP No description available. X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on server.alphaworks.co.uk Can anyone explain why this isn't scoring 3.0? :)