KAM_SOMETLD_ARE_BAD_TLD false positive

2021-04-12 Thread Bob Proulx
I was surprised to see KAM_SOMETLD_ARE_BAD_TLD hit as a false positive. The file was a DNS domain transfer file that someone emailed as part of a security bug report. To trigger the false positive include the following. In the real world case this was in a dns zone file that was sent as an attac

Re: Using spamassassin to thwart sharepoint phishing attacks

2021-04-12 Thread John Hardin
On Mon, 12 Apr 2021, jwmi...@gmail.com wrote: John Hardin writes: > From: John Hardin > Date: Mon, 12 Apr 2021 07:29:03 -0700 (PDT) > > On Sun, 11 Apr 2021, Loren Wilton wrote: > > >> 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% > >> [score:

ANNOUNCE: Apache SpamAssassin 3.4.6 available

2021-04-12 Thread Sidney Markowitz
On behalf of the Apache SpamAssassin Project, I am pleased to announce version 3.4.6 is available. Release Notes -- Apache SpamAssassin -- Version 3.4.6 Introduction Apache SpamAssassin 3.4.6 fixes two small but potentially annoying bugs in 3.4.5 *** On March 1, 2020, we stopped

Re: sa-learn, TXREP, network queries, documentation

2021-04-12 Thread RW
On Mon, 12 Apr 2021 09:40:47 -0400 Greg Troxel wrote: > 3) sa-learn does not document that it is no longer for BAYES, but a > general interface to mechanisms that learn. It always was in theory. > 4) There is a bonus of txrep_learn_penalty for learning spam, > default 20. If the user

Re: Is pyzor recommended by folks on this list?

2021-04-12 Thread Benny Pedersen
On 2021-04-12 18:21, John Capo wrote: On Sun, April 11, 2021 17:44, Antony Stone wrote: my point is valid as writed, remote pyzor servers dont know what is spam or not localy, but it could share results if wanted, but this was never implemented into pyzord or pyzor client I must be confused t

Re: Is pyzor recommended by folks on this list?

2021-04-12 Thread John Capo
On Sun, April 11, 2021 17:44, Antony Stone wrote: >> my point is valid as writed, remote pyzor servers dont know what is spam or >> not localy, but it >> could share results if wanted, but this was never implemented into pyzord or >> pyzor client > > I must be confused then - what do you believe

Re: Using spamassassin to thwart sharepoint phishing attacks

2021-04-12 Thread jwmincy
John Hardin writes: > From: John Hardin > Date: Mon, 12 Apr 2021 07:29:03 -0700 (PDT) > > On Sun, 11 Apr 2021, Loren Wilton wrote: > > >> 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% > >> [score: 1.] > >> 0.5 BAYES_999

Re: Using spamassassin to thwart sharepoint phishing attacks

2021-04-12 Thread Benny Pedersen
On 2021-04-12 16:29, John Hardin wrote: On Sun, 11 Apr 2021, Loren Wilton wrote: 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% [score: 1.] 0.5 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%

Re: Using spamassassin to thwart sharepoint phishing attacks

2021-04-12 Thread John Hardin
On Sun, 11 Apr 2021, Loren Wilton wrote: 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% [score: 1.] 0.5 BAYES_999 BODY: Bayes spam probability is 99.9 to 100% [score: 1.] I have 5.0 BAYES_99

Re: Sv: Re: LANSET, do they create anything but SPAM?

2021-04-12 Thread Matus UHLAR - fantomas
On 12.04.21 16:48, Anders Gustafsson wrote: I tried to send you exemples earlier, but your spam filter blocked my email. apparently my spam filter works better ;-) ...publishing them on own web, via pastebin or similar service should be better. Matus UHLAR - fantomas 12.04.2021 12:13 >>>

Sv: Re: LANSET, do they create anything but SPAM?

2021-04-12 Thread Anders Gustafsson
I tried to send you exemples earlier, but your spam filter blocked my email. -- Med vänlig hälsning Anders Gustafsson, ingenjör anders.gustafs...@pedago.fi | Support +358 18 12060 | Direkt +358 9 315 45 121 | Mobil +358 40506 7099 Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, Å

sa-learn, TXREP, network queries, documentation

2021-04-12 Thread Greg Troxel
This is a blend of a not-entirely-sure documentation bug report and questions. I am using 3.4.5. I used to use BAYES. To train it, I sorted ham that landed in spam folders back to where it should have gone, and sorted spam that landed in ham folders to "spam.manual". I had a cron job ran sa-le

Re: DNSWL overriding bayes_99 and bayes_999 rules

2021-04-12 Thread Steve Dondley
On 2021-04-12 03:11 AM, Matthias Leisi wrote: > -2.0 RCVD_IN_DNSWL_HI RBL: Sender listed at > https://www.dnswl.org/, > high trust > [203.160.71.180 listed in list.dnswl.org [1]] I looked up this, and the other > one, and didn't find them in dnswl. As > others said, if you are using publi

Re: Using spamassassin to thwart sharepoint phishing attacks

2021-04-12 Thread Matus UHLAR - fantomas
However, in 50_scores.cf, this line is commented out: #score RCVD_IN_SORBS_SPAM 0 0.5 0 0.5 Maybe that's the problem? no, there are other SORBS lists used: score RCVD_IN_SORBS_DUL 0 0.001 0 0.001 # n=0 n=2 score RCVD_IN_SORBS_HTTP 0 2.499 0 0.001 # n=0 n=2 score RCVD_IN_SORBS_MISC 0 # n=0 n=1

Re: Using spamassassin to thwart sharepoint phishing attacks

2021-04-12 Thread Steve Dondley
However, in 50_scores.cf, this line is commented out: #score RCVD_IN_SORBS_SPAM 0 0.5 0 0.5 Maybe that's the problem? no, there are other SORBS lists used: score RCVD_IN_SORBS_DUL 0 0.001 0 0.001 # n=0 n=2 score RCVD_IN_SORBS_HTTP 0 2.499 0 0.001 # n=0 n=2 score RCVD_IN_SORBS_MISC 0 # n=0

Re: Using spamassassin to thwart sharepoint phishing attacks

2021-04-12 Thread Matus UHLAR - fantomas
sorbs dnsbl missing, have you denied sorbs.net results ?, or is spamassassin not testing sorbs.net anymore ? On 11.04.21 18:22, Steve Dondley wrote: Best I can tell, my SA config should be testing for sorbs. I've got this line in /etc/spamassassin/v3220.pre: loadplugin Mail::SpamAssassin::Plu

Re: LANSET, do they create anything but SPAM?

2021-04-12 Thread Matus UHLAR - fantomas
On 12.04.21 11:41, Anders Gustafsson wrote: A LOT of the SPAM that is not blocked directly by RBLs seem to originate from LANSET Corporation. Are they a known spamsource? do you have examples? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receiv

LANSET, do they create anything but SPAM?

2021-04-12 Thread Anders Gustafsson
A LOT of the SPAM that is not blocked directly by RBLs seem to originate from LANSET Corporation. Are they a known spamsource? -- Med vänlig hälsning Anders Gustafsson, ingenjör anders.gustafs...@pedago.fi | Support +358 18 12060 | Direkt +358 9 315 45 121 | Mobil +358 40506 7099 Pedago

Re: DNSWL overriding bayes_99 and bayes_999 rules

2021-04-12 Thread Matthias Leisi
>> -2.0 RCVD_IN_DNSWL_HI RBL: Sender listed at >> https://www.dnswl.org/, >>high trust >>[203.160.71.180 listed in list.dnswl.org] > I looked up this, and the other one, and didn't find them in dnswl. As > others said, if you are usin