Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread Bill Cole
And in addition... On 17 Jul 2018, at 20:00 (-0400), Chip M. wrote: > 3. Pure numeric TLDs appear to be non existent (so far!) I expect that this will hold true for a long time. -- Bill Cole b...@scconsult.com or billc...@apache.org (AKA @grumpybozo and many *@billmail.scconsult.com addresses

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread Bill Cole
On 17 Jul 2018, at 20:00 (-0400), Chip M. wrote: There's a new morph of the porn extortion campaign, with some interesting under-the-hood changes. The previous ones were always: - two "quoted-printable" parts (plain text, html) - "From" Outlook accounts - sent via Outlook/Hotmail/MS IPs (no oth

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread John Hardin
On Tue, 17 Jul 2018, John Hardin wrote: On Tue, 18 Jul 2018, Chip M. wrote: Here's the SA test stats for 13 of this new morph: FORGED_MUA_MOZILLA 1 HTML_MESSAGE 13 HTML_MIME_NO_HTML_TAG 13 LOCALPART_IN_SUBJECT 13 MIME_BASE64_TEXT9 MIME_HTML_O

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread John Hardin
On Tue, 18 Jul 2018, Chip M. wrote: Here's the SA test stats for 13 of this new morph: FORGED_MUA_MOZILLA 1 HTML_MESSAGE 13 HTML_MIME_NO_HTML_TAG 13 LOCALPART_IN_SUBJECT 13 MIME_BASE64_TEXT9 MIME_HTML_ONLY 13 RCVD_IN_SORBS_DUL

Re: spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread John Hardin
On Tue, 18 Jul 2018, Chip M. wrote: Here's the SA test stats for 13 of this new morph: FORGED_MUA_MOZILLA 1 HTML_MESSAGE 13 HTML_MIME_NO_HTML_TAG 13 LOCALPART_IN_SUBJECT 13 MIME_BASE64_TEXT9 MIME_HTML_ONLY 13 RCVD_IN_SORBS_DUL

spample: porn extortion with pure numeric From domain and base64 body

2018-07-17 Thread Chip M.
There's a new morph of the porn extortion campaign, with some interesting under-the-hood changes. The previous ones were always: - two "quoted-printable" parts (plain text, html) - "From" Outlook accounts - sent via Outlook/Hotmail/MS IPs (no other IPs in route) - passed both DKIM and SPF The new

Re: SA MySQL DB maintenance

2018-07-17 Thread RW
On Wed, 18 Jul 2018 10:49:16 +1200 Michael Hallager (personal) wrote: > On 2018-07-18 01:11, Giovanni Bechis wrote: > > Txrep does not have autocleaning support, bayes have it if > > auto_bayes_expire is set. > > Giovanni > > I have looked into this here: > https://spamassassin.apache.org/full

Re: SA MySQL DB maintenance

2018-07-17 Thread Michael Hallager (personal)
On 2018-07-18 01:11, Giovanni Bechis wrote: Txrep does not have autocleaning support, bayes have it if auto_bayes_expire is set. Giovanni I have looked into this here: https://spamassassin.apache.org/full/3.1.x/doc/sa-learn.html#expiration Our Bayes DB is over 5Gb which seems at odds with the

Re: SA MySQL DB maintenance

2018-07-17 Thread Michael Hallager (personal)
On 2018-07-18 01:11, Giovanni Bechis wrote: Txrep does not have autocleaning support, bayes have it if auto_bayes_expire is set. Giovanni Hi Giovanni, I have looked into this here: https://spamassassin.apache.org/full/3.1.x/doc/sa-learn.html#expiration Our Bayes DB is over 5Gb which seems at

Re: SA MySQL DB maintenance

2018-07-17 Thread Michael Hallager (personal)
On 2018-07-18 00:35, Kevin A. McGrail wrote: What are you using in a db? Regards, KAM -- Kevin A. McGrail Hi Kevin, awl, bayes_* and userpref. Thanks, Michael

Re: SA MySQL DB maintenance

2018-07-17 Thread Kevin A. McGrail
I'll defer that question to Alex Broens. He can do it more justice than I ever could. AXB? -- Kevin A. McGrail VP Fundraising, Apache Software Foundation Chair Emeritus Apache SpamAssassin Project https://www.linkedin.com/in/kmcgrail - 703.798.0171 On Tue, Jul 17, 2018 at 1:55 PM, micah anderso

Re: SA MySQL DB maintenance

2018-07-17 Thread micah anderson
"Kevin A. McGrail" writes: > I think Bayes should be in redis though not SQL. Curious to know why you think that?

Re: SA MySQL DB maintenance

2018-07-17 Thread Benny Pedersen
Kevin A. McGrail skrev den 2018-07-17 18:40: RW is right. Don't use auto_bayes_expire use sa-learn --force-expire in a cron. It's another bayes option I've wondered "why does this exist"? it was usefull to keep all bayes digest before ? my bayes_seen is bigger then my bayes_digest auto_baye

Re: SA MySQL DB maintenance

2018-07-17 Thread Kevin A. McGrail
RW is right. Don't use auto_bayes_expire use sa-learn --force-expire in a cron. It's another bayes option I've wondered "why does this exist"? -- Kevin A. McGrail VP Fundraising, Apache Software Foundation Chair Emeritus Apache SpamAssassin Project https://www.linkedin.com/in/kmcgrail - 703.79

Re: SA MySQL DB maintenance

2018-07-17 Thread RW
On Tue, 17 Jul 2018 15:11:10 +0200 Giovanni Bechis wrote: > Txrep does not have autocleaning support, bayes have it It's not complete as there is no way of ageing-out the entries that record whether a particular email was trained as spam or ham. > if auto_bayes_expire is set. It's safer to tu

Re: SA MySQL DB maintenance

2018-07-17 Thread Giovanni Bechis
Txrep does not have autocleaning support, bayes have it if auto_bayes_expire is set. Giovanni On 07/17/18 14:35, Kevin A. McGrail wrote: > To me, no, it doesn't. > > For example, I clean out txrep stuff with crons like this -e 'DELETE FROM > txrep WHERE last_hit <= (now() - INTERVAL 90 day);'

Re: SA MySQL DB maintenance

2018-07-17 Thread Kevin A. McGrail
To me, no, it doesn't. For example, I clean out txrep stuff with crons like this -e 'DELETE FROM txrep WHERE last_hit <= (now() - INTERVAL 90 day);' I also don't use autolearning bayes but some people like to cull there bayes. I think Bayes should be in redis though not SQL. What are you using