Re: How is this phishing attack called?

2023-02-15 Thread Jared Hall
On 2/15/2023 2:50 PM, hg user wrote: And how to intercept? From time to time we receive a message that is a reply-to to an old message, sometimes after months, with just several lines added at the top inviting to open a url or attachment. Has this kind of phishing a name? QakBot and Emotet

How is this phishing attack called?

2023-02-15 Thread hg user
And how to intercept? >From time to time we receive a message that is a reply-to to an old message, sometimes after months, with just several lines added at the top inviting to open a url or attachment. Has this kind of phishing a name? How can I prevent it or at least flag it for review? Thank

Re: BAYES_00 BODY. Negative score?

2023-02-15 Thread hg user
he should not compare all the tokens but a rapid survey on the tokens derived from headers can tell him how the bayes result was formed. A couple of weeks ago some phishing reached our inboxes. Our custom rule gave the message 5 points but I was surprised that the message was categorized BAYES_00

Re: BAYES_00 BODY. Negative score?

2023-02-15 Thread Matus UHLAR - fantomas
However, many of tokens in even Forbes and WP newsletters may occure in different spamy newsletters, so be careful when traning even these. On 15.02.23 09:51, Alex wrote: This is exactly what I was thinking. When going through the quarantine, it's also very difficult to always not only identify

Re: BAYES_00 BODY. Negative score?

2023-02-15 Thread Alex
Hi, > > However, many of tokens in even Forbes and WP newsletters may occure in > different spamy newsletters, so be careful when traning even these. > This is exactly what I was thinking. When going through the quarantine, it's also very difficult to always not only identify which newsletters ma

Re: BAYES_00 BODY. Negative score?

2023-02-15 Thread Matus UHLAR - fantomas
On 15.02.23 14:53, hg user wrote: If you run spamassasin with -D bayes -t xxx 2>debug.log in debug.log you will see all the "tokens" the bayes system extracts from the headers and you will probably find a lot of them related to mailing lists. If you teach SA that those tokens are spam and they

Re: BAYES_00 BODY. Negative score?

2023-02-15 Thread hg user
If you run spamassasin with -D bayes -t xxx 2>debug.log in debug.log you will see all the "tokens" the bayes system extracts from the headers and you will probably find a lot of them related to mailing lists. If you teach SA that those tokens are spam and they are present both in WP or Forbes, t

Re: BAYES_00 BODY. Negative score?

2023-02-15 Thread Matus UHLAR - fantomas
*-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% >* [score: 0.] This indicates a mistrained database, which means you have trained too many spams or spam-like messages (commercial messages) as ham. Proper training of spams should help. Just keep your spam (and optionally ham) corp

Re: BAYES_00 BODY. Negative score?

2023-02-15 Thread Matus UHLAR - fantomas
On 13.02.23 17:42, joe a wrote: Have some annoying SPAM that consistently shows a negative score on BAYES.  Is the default scoring or influenced by BAYES in some way? *-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% *  [score: 0.] On 2/14/2023 2:56 AM, Matus UHLAR - fantomas w