Re: how to remove T_RP_MATCHES_RCVD

2018-04-05 Thread Kevin A. McGrail
It's pedantic but I am 99.9% sure that a Test Rule (prefix T_) is scored at 0.001 but scores in the report are rounded to a ceiling so it displaces as .01. -- Kevin A. McGrail Asst. Treasurer & VP Fundraising, Apache Software Foundation Chair Emeritus Apache SpamAssassin Project https://www.linked

Re: how to remove T_RP_MATCHES_RCVD

2018-04-05 Thread RW
On Thu, 5 Apr 2018 10:23:50 -0700 (PDT) John Hardin wrote: > Actually, I retract that suggestion, I wasn't aware of the special > automatic scoring for T_ rules. Leave it alone. There's little point in this case, but I don't think there's any harm in changing such scores locally. IIRC the "T_"

Re: how to remove T_RP_MATCHES_RCVD

2018-04-05 Thread John Hardin
On Thu, 5 Apr 2018, Motty Cruz wrote: Thanks for your prompt reply John, X-Spam-Status: No, score=5.27 tagged_above=-999.9 required=5.7     tests=[BAYES_50=4.3, FROM_EXCESS_BASE64=0.979, HTML_MESSAGE=0.001,     T_RP_MATCHES_RCVD=-0.01] autolearn=no autolearn_force=no always the score i

Re: how to remove T_RP_MATCHES_RCVD

2018-04-05 Thread Motty Cruz
Thanks Tom, my scores were definitely a problem. Thanks again, Motty On 04/05/2018 09:48 AM, Tom Hendrikx wrote: On 05-04-18 18:40, Motty Cruz wrote: Thanks for your prompt reply John, X-Spam-Status: No, score=5.27 tagged_above=-999.9 required=5.7     tests=[BAYES_50=4.3, FROM_EXCESS_BA

Re: how to remove T_RP_MATCHES_RCVD

2018-04-05 Thread Tom Hendrikx
On 05-04-18 18:40, Motty Cruz wrote: > Thanks for your prompt reply John, > > X-Spam-Status: No, score=5.27 tagged_above=-999.9 required=5.7 >     tests=[BAYES_50=4.3, FROM_EXCESS_BASE64=0.979, HTML_MESSAGE=0.001, >     T_RP_MATCHES_RCVD=-0.01] autolearn=no autolearn_force=no > BAYES_00

Re: how to remove T_RP_MATCHES_RCVD

2018-04-05 Thread Motty Cruz
Thanks for your prompt reply John, X-Spam-Status: No, score=5.27 tagged_above=-999.9 required=5.7     tests=[BAYES_50=4.3, FROM_EXCESS_BASE64=0.979, HTML_MESSAGE=0.001,     T_RP_MATCHES_RCVD=-0.01] autolearn=no autolearn_force=no always the score is -0.01 regardless; I will take your sug

Re: how to remove T_RP_MATCHES_RCVD

2018-04-05 Thread RW
On Thu, 5 Apr 2018 09:12:45 -0700 Motty Cruz wrote: > Hello, T_RP_MATCHES_RCVD  this rule is allowing spammy emails past > through. Is there a way to disable in local.cf? How's that happening? A T_* rule only scores +/- 0.01.

Re: how to remove T_RP_MATCHES_RCVD

2018-04-05 Thread John Hardin
On Thu, 5 Apr 2018, Motty Cruz wrote: Hello, T_RP_MATCHES_RCVD  this rule is allowing spammy emails past through. Is there a way to disable in local.cf? The best way to disable it without breaking any meta-rules that may be using it is to set its score to 0.001 in your local config file. I

how to remove T_RP_MATCHES_RCVD

2018-04-05 Thread Motty Cruz
Hello, T_RP_MATCHES_RCVD  this rule is allowing spammy emails past through. Is there a way to disable in local.cf? Thanks, Motty

Re: FUZZY_XPILL FP hitting all Travelodge emails

2018-04-05 Thread John Hardin
On Thu, 5 Apr 2018, Kris Deugau wrote: Alex wrote: We're also seeing it hit mailer-daemon emails. https://pastebin.com/raw/UXnzEN8U This one also hit FUZZY_AMBIEN, POISEN_SPAM_PILL (spelling incorrect) and when I re-ran it here locally, FUZZY_DR_OZ. The problem is that it's hitting on the m

Re: FUZZY_XPILL FP hitting all Travelodge emails

2018-04-05 Thread Giles Coochey
It found "xon, OX" in "Aylesbury Road, Thame, Oxon, OX9 3AT" It's an aggressive rule that finds anything that might be an obfuscated Xanax. It only scores 0.8 points because it can produce FPs like this. Actually that is my private, custom score. I think the default is 2.8 or something like

Re: FUZZY_XPILL FP hitting all Travelodge emails

2018-04-05 Thread Kris Deugau
Alex wrote: We're also seeing it hit mailer-daemon emails. https://pastebin.com/raw/UXnzEN8U This one also hit FUZZY_AMBIEN, POISEN_SPAM_PILL (spelling incorrect) and when I re-ran it here locally, FUZZY_DR_OZ. The problem is that it's hitting on the mime attachments which are apparently trea

Re: FUZZY_XPILL FP hitting all Travelodge emails

2018-04-05 Thread Alex
Hi, On Mon, Apr 2, 2018 at 8:10 AM, Kevin A. McGrail wrote: > Pastebin a sample(s). We're also seeing it hit mailer-daemon emails. https://pastebin.com/raw/UXnzEN8U This one also hit FUZZY_AMBIEN, POISEN_SPAM_PILL (spelling incorrect) and when I re-ran it here locally, FUZZY_DR_OZ. The proble

Re: This sucks

2018-04-05 Thread RW
On Tue, 3 Apr 2018 14:58:39 +0200 Michael Brunnbauer wrote: > Hello Giovanni, > > On Tue, Apr 03, 2018 at 11:04:46AM +0200, Giovanni Bechis wrote: > > if you start spamd from /root and you use a perl module that is > > using "use lib 'lib';" or similar piece of code the relevant code > > will not

Re: FUZZY_XPILL FP hitting all Travelodge emails

2018-04-05 Thread Giles Coochey
It found "xon, OX" in "Aylesbury Road, Thame, Oxon, OX9 3AT" It's an aggressive rule that finds anything that might be an obfuscated Xanax. It only scores 0.8 points because it can produce FPs like this. Actually that is my private, custom score. I think the default is 2.8 or something like

Re: FUZZY_XPILL FP hitting all Travelodge emails

2018-04-05 Thread David Jones
On 04/02/2018 09:50 AM, Sebastian Arcus wrote: On 02/04/18 14:58, RW wrote: On Mon, 2 Apr 2018 08:26:27 -0500 David Jones wrote: On 04/02/2018 07:18 AM, Sebastian Arcus wrote: Thank you - one example here: https://pastebin.com/UGStfCys It found "xon, OX" in "Aylesbury Road, Thame, Oxon, OX