NOTE: Warning to Abusers of Update Servers

2017-11-20 Thread Kevin A. McGrail
All, If you are checking the SpamAssassin updates more than 2x a day, expect to be blocked in the very near future.  We have people checking literally every minute and we only release rules currently 1x per day.  There is no need to check this often! Regards, KAM -- Kevin A. McGrail Asst.

Re: Why doesn't HK_RANDOM_FROM trigger on this email address?

2017-11-20 Thread Jens Schleusener
On Mon, 20 Nov 2017, John Hardin wrote: On Mon, 20 Nov 2017, Markus Clardy wrote: Why not just have it be a meta test that doesn't trigger if it contains "sch"? I realize that cuts out things like tjmkln...@fakeemail.com, but it would catch tsjmhw...@fakeemail.com, so maybe a bit better in bot

Re: Understanding SPF-verified spam from dropbox

2017-11-20 Thread Alex
On Mon, Nov 20, 2017 at 12:58 PM, Axb wrote: > On 11/20/2017 06:26 PM, Alex wrote: >> >> Hi, we have an email that originated from email.dropbox.com and has a >> link to https://hyzas.xss.ht/ which is a "payload to test for >> Cross-site Scripting" from the XSS Hunter Team. >> >> Was it sent in er

Re: Why doesn't HK_RANDOM_FROM trigger on this email address?

2017-11-20 Thread John Hardin
On Mon, 20 Nov 2017, Markus Clardy wrote: Why not just have it be a meta test that doesn't trigger if it contains "sch"? I realize that cuts out things like tjmkln...@fakeemail.com, but it would catch tsjmhw...@fakeemail.com, so maybe a bit better in both catch rate and false positives? Better

Re: Understanding SPF-verified spam from dropbox

2017-11-20 Thread Axb
On 11/20/2017 06:26 PM, Alex wrote: Hi, we have an email that originated from email.dropbox.com and has a link to https://hyzas.xss.ht/ which is a "payload to test for Cross-site Scripting" from the XSS Hunter Team. Was it sent in error? How was it sent? I know what XSS is and how it can be used

Understanding SPF-verified spam from dropbox

2017-11-20 Thread Alex
Hi, we have an email that originated from email.dropbox.com and has a link to https://hyzas.xss.ht/ which is a "payload to test for Cross-site Scripting" from the XSS Hunter Team. Was it sent in error? How was it sent? I know what XSS is and how it can be used, but this was reported as malicious,

Re: Why doesn't HK_RANDOM_FROM trigger on this email address?

2017-11-20 Thread Markus Clardy
Why not just have it be a meta test that doesn't trigger if it contains "sch"? I realize that cuts out things like tjmkln...@fakeemail.com, but it would catch tsjmhw...@fakeemail.com, so maybe a bit better in both catch rate and false positives? On Mon, Nov 20, 2017 at 8:03 AM, Jens Schleusener <

Re: Why doesn't HK_RANDOM_FROM trigger on this email address?

2017-11-20 Thread Jens Schleusener
On Sun, 19 Nov 2017, Bill Cole wrote: On 19 Nov 2017, at 17:11 (-0500), Mark London wrote: Also, 5 consonants in a row, is unlikely. Well, F. W. Nietzsche never had kids, but I don't think the surname is extinct. I'm aware of multiple people with the surname Pietschmann. There is also a co