Re: PHP eval()'d code

2016-05-30 Thread John Hardin
On Mon, 30 May 2016, Reindl Harald wrote: Am 30.05.2016 um 01:20 schrieb John Hardin: On Sun, 29 May 2016, Reindl Harald wrote: > Am 29.05.2016 um 23:38 schrieb John Hardin: > > On Thu, 26 May 2016, RW wrote: > > > > > I noticed that Bayes is picking-up on very strong tokens from > >

Re: PHP eval()'d code

2016-05-30 Thread Reindl Harald
Am 30.05.2016 um 01:20 schrieb John Hardin: On Sun, 29 May 2016, Reindl Harald wrote: Am 29.05.2016 um 23:38 schrieb John Hardin: On Thu, 26 May 2016, RW wrote: > I noticed that Bayes is picking-up on very strong tokens from "eval" and > "code" in headers like this: > >X-PHP-Originati

Re: PHP eval()'d code

2016-05-29 Thread John Hardin
ript" Here is the basic "header exists" rule for that same masscheck run: http://ruleqa.spamassassin.org/20160528-r1745852-n/__HAS_PHP_ORIG_SCRIPT/detail It hits 1595 spam and 1972 ham. Where are you getting only 250 hits for that header? (with and without PHP eval()'d cod

Re: PHP eval()'d code

2016-05-29 Thread Reindl Harald
ant amount of ham while we see 250 sampls *at all* with a "X-PHP-Originating-Script" (with and without PHP eval()'d code" masscheck is *serious broken* not only about all the FSL_ rules making nothing more than troubles the last months signature.asc Description: OpenPGP digital signature

Re: PHP eval()'d code

2016-05-29 Thread John Hardin
On Thu, 26 May 2016, RW wrote: I noticed that Bayes is picking-up on very strong tokens from "eval" and "code" in headers like this: X-PHP-Originating-Script: 1013:global.php(1938) : eval()'d code The "eval()'d code" part is in just over 2% of my spam, but it's never occurred in a single ham

Re: PHP eval()'d code

2016-05-27 Thread RW
On Thu, 26 May 2016 17:23:21 -0500 (CDT) David B Funk wrote: > FWIW, > There's a varient of that in the "KAM.cf" ruleset from March of this > year. (Look for __KAM_BADPHP1, which is meta'ed into KAM_BADPHP) > > It doesn't hit a lot of stuff (only 0.08% ) but does have a high S/O > (0.9984) in my

Re: PHP eval()'d code

2016-05-26 Thread David B Funk
On Thu, 26 May 2016, John Hardin wrote: On Thu, 26 May 2016, Reindl Harald wrote: Am 26.05.2016 um 20:50 schrieb RW: I noticed that Bayes is picking-up on very strong tokens from "eval" and "code" in headers like this: X-PHP-Originating-Script: 1013:global.php(1938) : eval()'d code

Re: PHP eval()'d code

2016-05-26 Thread John Hardin
On Thu, 26 May 2016, Reindl Harald wrote: Am 26.05.2016 um 20:50 schrieb RW: I noticed that Bayes is picking-up on very strong tokens from "eval" and "code" in headers like this: X-PHP-Originating-Script: 1013:global.php(1938) : eval()'d code The "eval()'d code" part is in just ov

Re: PHP eval()'d code

2016-05-26 Thread Reindl Harald
Am 26.05.2016 um 20:50 schrieb RW: I noticed that Bayes is picking-up on very strong tokens from "eval" and "code" in headers like this: X-PHP-Originating-Script: 1013:global.php(1938) : eval()'d code The "eval()'d code" part is in just over 2% of my spam, but it's never occurred in a s

Re: PHP eval()'d code

2016-05-26 Thread Reindl Harald
Am 26.05.2016 um 20:50 schrieb RW: I noticed that Bayes is picking-up on very strong tokens from "eval" and "code" in headers like this: X-PHP-Originating-Script: 1013:global.php(1938) : eval()'d code The "eval()'d code" part is in just over 2% of my spam, but it's never occurred in a s

PHP eval()'d code

2016-05-26 Thread RW
I noticed that Bayes is picking-up on very strong tokens from "eval" and "code" in headers like this: X-PHP-Originating-Script: 1013:global.php(1938) : eval()'d code The "eval()'d code" part is in just over 2% of my spam, but it's never occurred in a single ham in my corpus. The spams see