Sv: Re: ChatGPT > Spamassassin? :)

[Anders Gustafsson]

That is the way some email clients, say GroupWise does it. There is an option 
to put all mail from new
receivers in the junk folder for perusal. OTOH should simple graylisting do the 
same thing. But yes, an option
to deduct points from previously unseen senders would be useful.

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND



>>> Mark London  2024-06-26 00:38 >>>
Bill - Thanks for the response.  As an aside, it would be nice (though 
impossible?) for a spam filter to be more suspicious of emails coming 
from a new email address, that is not in my Sent folder or my Inbox. 
FWIW. - Mark

On 6/25/2024 11:21 AM, Bill Cole wrote:
> Mark London 
> is rumored to have said:
>
>> I received a spam email with the text below, that wasn't caught by 
>> Spamassasin (at least mine).   The text actually looks like something 
>> that was generated using ChatGPT.  In any event,  I put the text 
>> through ChatGPT, and asked if it looked like spam.  At the bottom of 
>> this email , is it's analysis.  I've not been fully reading this 
>> group.  Has there been any work to allow Spamassassin to use AI?
>
> "Artificial intelligence" does not exist. It is a misnomer.
>
> Large language models like ChatGPT have a provenance problem. There's 
> no way to know why exactly the model "says" anything. In a single 
> paragraph, ChatGPT is capable of making completely and directly 
> inconsistent assertions. The only way to explain that is that despite 
> appearances, a request to answer the ham/spasm question generates text 
> with no semantic connection to the original, but which seems like an 
> explanation.
>
> SpamAssassin's code and rules all come from ASF committers, and the 
> scores are determined by examining the scan results from contributors 
> and optimizing them to a threshold of 5.0. Every scan of a message 
> results in a list of hits against documented rules. The results can be 
> analyzed and understood.
>
> We know that ChatGPT and other LLMs that are publicly available have 
> been trained on data to which they had no license. There is no way to 
> remove any particular ingested data. There's no way to know where any 
> particular LLM will have problems and no way to fix those problems. 
> This all puts them outside of the boundaries we have as an ASF 
> project. However, we do have a plugin architecture, so it is possible 
> for 3rd parties to create a plugin for LLM integration.
>
>

Sv: Re: Question about a rule

[Anders Gustafsson]

Sure:

body LOCAL_PORN_RULE   
/kiimainen|naida|sexikäs|nussikas|nussia|pillu|pano|kinky|bdsm|pillua|x69-JOOGA/i
score LOCAL_PORN_RULE 8
describe LOCAL_PORN_RULE   This catches peter's porn spam

Sorry again for mailing directly. No idea why it suggests the user and not 
users@

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND



>>> Matus UHLAR - fantomas  2024-06-18 14:00 >>>
On 18.06.24 13:50, Anders Gustafsson wrote:
>body LOCAL_PORN_RULE   /word1|word2.|x69-JOOGA/i
>score LOCAL_PORN_RULE 8
>describe LOCAL_PORN_RULE   This catches peter's porn spam
>
>Funny thing is that it seems to trigger on messages that contain none of those 
>words. I have removed the
>actual words so that my message will not be regarded ass spam ??
>
>Wonder if it is that last word that matches some regexp??

This can happen in case of incorrect regular expression.
Maybe uf you posted it here, we could see the error.

run spamassassin -D < mail 2>/tmp/mail.err
and you should be able to see which string matched

Finally, SA recommends using multiple rules with small scores instead of 
single rule with huge score.


-- 
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ 
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"They say when you play that M$ CD backward you can hear satanic messages."
"That's nothing. If you play it forward it will install Windows."

Question about a rule

[Anders Gustafsson]

We have a rule that is supposed to catch various porn-related stuff:

body LOCAL_PORN_RULE   /word1|word2.|x69-JOOGA/i
score LOCAL_PORN_RULE 8
describe LOCAL_PORN_RULE   This catches peter's porn spam

Funny thing is that it seems to trigger on messages that contain none of those 
words. I have removed the
actual words so that my message will not be regarded ass spam ��

Wonder if it is that last word that matches some regexp??


-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND

Sv: Re: Need some help decoding an SA analysis

[Anders Gustafsson]

Read the document. Upgraded. Ran sa-update (always forget that)


We really have a very simple setup, except for our homegrown integration wiith 
our email system. So I added
enable_compat  welcomelist_blocklist" to init.pre

Then did a search/replace of local.cf for all whitelist_from and 
blacklist_from, then just for good measure
egrep -l '(whitelist|blacklist)' /etc/mail/spamassassin/*.cf which caught a few 
in comments.

Now off to read how to implement the new goodies

I apologise for mailing you directly Benny.


-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND



>>> Benny Pedersen  2024-06-16 16:09 >>>
Anders Gustafsson skrev den 2024-06-16 13:42:
> This one:
> 
> Return-path: 
> X-Spam-Checker-Version: SpamAssassin 3.4.5 (2021-03-20) on xx
> X-Spam-Level:
> X-Spam-Status: No, score=-95.6 required=5.0 
> tests=BAYES_00,HTML_MESSAGE,
>   MIME_HTML_ONLY,RCVD_IN_MSPIKE_BL,RCVD_IN_MSPIKE_L5,RDNS_NONE,
>   TO_EQ_FM_DIRECT_MX,TO_NO_BRKTS_NORDNS_HTML,T_SCC_BODY_TEXT_LINE,
>   URIBL_BLACK,URIBL_DBL_SPAM,USER_IN_WELCOMELIST,USER_IN_WHITELIST
>   autolearn=no autolearn_force=no version=3.4.5
> Received: from hosted-by.csrdp.host ([195.10.205.97])
>   by x with ESMTP (TLS encrypted); Sun, 16 Jun 2024 11:52:11 +0300
> Reply-To: Email Mailbox Notification xx  #9698 
> 
> It was a phishing email and the provider has since shut it down. Now we 
> do not have that adress in our
> whitelist. Should I interpret this that some of the entries we do have 
> in our whitelist uses this adress or
> provider?

time to upgrade

https://multirbl.valli.org/lookup/195.10.205.97.html 

remove localy whitelist

change score for whitelist to non default -100

phishing links goes to phishtank.com

train bayes on phishing emails

Need some help decoding an SA analysis

[Anders Gustafsson]

This one:

Return-path: 
X-Spam-Checker-Version: SpamAssassin 3.4.5 (2021-03-20) on xx
X-Spam-Level: 
X-Spam-Status: No, score=-95.6 required=5.0 tests=BAYES_00,HTML_MESSAGE,
MIME_HTML_ONLY,RCVD_IN_MSPIKE_BL,RCVD_IN_MSPIKE_L5,RDNS_NONE,
TO_EQ_FM_DIRECT_MX,TO_NO_BRKTS_NORDNS_HTML,T_SCC_BODY_TEXT_LINE,
URIBL_BLACK,URIBL_DBL_SPAM,USER_IN_WELCOMELIST,USER_IN_WHITELIST
autolearn=no autolearn_force=no version=3.4.5
Received: from hosted-by.csrdp.host ([195.10.205.97])
by x with ESMTP (TLS encrypted); Sun, 16 Jun 2024 11:52:11 +0300
Reply-To: Email Mailbox Notification xx  #9698  

It was a phishing email and the provider has since shut it down. Now we do not 
have that adress in our
whitelist. Should I interpret this that some of the entries we do have in our 
whitelist uses this adress or
provider?


-- 
Med vänlig hälsning

Anders Gustafsson

Sv: whast is ncv.microsoft.com for?

[Anders Gustafsson]

See: 
https://www.darkreading.com/cloud/unusual-microsoft-365-phishing-efax-compromised-dynamic-voice-account

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND



>>> "Pedro David Marco via users"  2023-06-02 
>>> 14:07 >>>
Hi all,
We are receiving tons of Phishing pointing to ncv.microsoft.com/
I have found no MS documentation about what "ncv" is used for???  does anyone 
know it, please?  what is it?

Pete.

Sv: Re: LANSET, do they create anything but SPAM?

[Anders Gustafsson]

Examples: https://pastebin.com/pF6Nmquc

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND



>>> Matus UHLAR - fantomas  2021-04-12 12:13 >>>
On 12.04.21 11:41, Anders Gustafsson wrote:
>A LOT of the SPAM that is not blocked directly by RBLs seem to originate from 
>LANSET Corporation. Are they
a
>known spamsource?

do you have examples?

‑‑ 
Matus UHLAR ‑ fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ 
Warning: I wish NOT to receive e‑mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Your mouse has moved. Windows NT will now restart for changes to take
to take effect. [OK]

Sv: Re: LANSET, do they create anything but SPAM?

[Anders Gustafsson]

I tried to send you exemples earlier, but your spam filter blocked my email.

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND



>>> Matus UHLAR - fantomas  12.04.2021 12:13 >>>
On 12.04.21 11:41, Anders Gustafsson wrote:
>A LOT of the SPAM that is not blocked directly by RBLs seem to originate from 
>LANSET Corporation. Are they
a
>known spamsource?

do you have examples?

‑‑ 
Matus UHLAR ‑ fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ 
Warning: I wish NOT to receive e‑mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Your mouse has moved. Windows NT will now restart for changes to take
to take effect. [OK]

LANSET, do they create anything but SPAM?

[Anders Gustafsson]

A LOT of the SPAM that is not blocked directly by RBLs seem to originate from 
LANSET Corporation. Are they a
known spamsource?

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND

Re: Sv: Re: Legitimate message being flagged as spam

[Anders Gustafsson]

True. Thanks for pointing that out.

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND



>>> Benny Pedersen  2020-11-30 16:17 >>>
spamassassin ‑t test‑mail.eml | less always works no matter how 
spamassassin is integrated

Sv: Re: Legitimate message being flagged as spam

[Anders Gustafsson]

It depends on how you have it set up. With what email system are you using it?

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND



>>> Daryl Rose  2020-11-30 15:27 >>>
How do I get the SA headers?

Thank you.

Daryl

On Sun, Nov 29, 2020 at 10:32 AM Martin Gregorie 
wrote:

> Showing us the SA headers and hits would be a good idea: without them we
> don't know why SA rejected the mail.
>
> I notice that domain in the Message-ID is ficticious may not be
> significant, but I usually think this is suspicious.
>
> Martin
>
>
> On Sun, 2020-11-29 at 09:40 -0600, Daryl Rose wrote:
> > I get an email/receipt from a vendor on a payment made.  This message
> > continuously gets flagged as spam even though I've added it to the
> > whitelist_from.cf list.
> >
> > Received: (qmail 26946 invoked by uid 30297); 27 Nov 2020 20:52:17
> > -
> > > Received: from unknown (HELO p3plibsmtp02-
> > > 04.prod.phx3.secureserver.net)
> > >  ([68.178.213.4])
> > >   (envelope-sender
> > >  @sendgrid.net>)
> > >   by p3plsmtp23-04-26.prod.phx3.secureserver.net (qmail-
> > > 1.03) with
> > >  SMTP
> > >   for ; 27 Nov 2020 20:52:17 -
> > > Received: from o1.3nn.shared.sendgrid.net ([167.89.100.129])
> > > (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 256/256 bits)
> > > (Client did not present a certificate)
> > > by CMGW with ESMTP
> > > id ikj3kLwOeFeQXikj3kiQrL; Fri, 27 Nov 2020 13:52:17 -0700
> > > X-CMAE-Analysis: v=2.4 cv=SdYyytdu c=1 sm=1 tr=0 ts=5fc16701 b=1
> > > cx=a_idp_nop
> > >  a=d87GDerR7hnUjA61tTL9RQ==:117 a=d87GDerR7hnUjA61tTL9RQ==:17
> > >  a=kj9zAlcOel0A:10 a=zPYWiABU:8 a=5-f5ixlAKy49-4MjWEkA:9
> > >  a=O-7aY5Sf57aUu7p3:21 a=_W_S_7VecoQA:10 a=CjuIK1q_8ugA:10
> > > a=5LfDJFqq-uUA:10
> > >  a=AWL3az150N33eOPX4RKm:22 a=Z5ABNNGmrOfJ6cZ5bIyy:22
> > > a=UDnyf2zBuKT2w-IlGP_r:22
> > > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
> > > d=sendgrid.net;
> > > h=from:subject:mime-version:to:content-type:content-transfer-
> > > encoding;
> > > s=smtpapi; bh=5/eVCwWUZDl73ybzUYFmyMNdYNgvUvrvS9S5NJHu8QU=;
> > > b=kDKnSU9Bb2Mi5khPiwjinzdlOorchkBuNfEWHSiqVeWqCaZPHmztDB3ZeQXPLVkVbL
> > > uH
> > > 6NgvFXajs2aidTnh9bSKSMn4RaTPC+nvQU4DxFoXj0dL9yy9rjBGsdmS0BBD6+qzBl6g
> > > Si
> > > i2UwAMxRGXKbODjK5T5Ll1us3XKXKt9cI=
> > > Received: by filterdrecv-p3iad2-5dc87598f5-8bxxp with SMTP id
> > >  filterdrecv-p3iad2-5dc87598f5-8bxxp-19-5FC16700-AD
> > > 2020-11-27 20:52:16.878084415 + UTC m=+951689.287978429
> > > Received: from spiderdoor.com (unknown)
> > > by ismtpd0118p1mdw1.sendgrid.net (SG) with ESMTP
> > > id ceyKf2F5QpyH7v63ZKS3nA
> > > Fri, 27 Nov 2020 20:52:16.783 + (UTC)
> > > Date: Fri, 27 Nov 2020 20:52:16 + (UTC)
> > > From: no-re...@spiderdoor.com 
> > > Message-ID: <5fc1670079f34_26fd3171828...@api1.mail>
> > > Subject: Payment Receipt for Unit G030 - paid from SpiderApp
> > > Mime-Version: 1.0
> > > X-SG-EID:
> > >
> > >  =?us-
> > > ascii?Q?nNFctdm0BWd6iTjLSzehWYRyQOg6=2FUycD+ddLrh9vGVcvZBTHPJYDTCViD
> > > qyYQ?=
> > >  =?us-ascii?Q?Li3bEIOOksE35=2FhSgezGSc37DN46Fkbxk1TO9E8?=
> > >  =?us-ascii?Q?MGQPgTWt6k58DhiRQTG0=2F+79xc=2FO7jtyaG0XkLO?=
> > >  =?us-ascii?Q?1DjUXyElg+pd9Ry=2Fm1Wy7CmJWR0I1zJgLk=2FUjTC?=
> > >  =?us-ascii?Q?=2F7EUOycJlpjn1eLS5JSN9MBpwsXNk7EKGYPvDxO?=
> > >  =?us-ascii?Q?duJHjPbILEuJJjx1g=3D?=
> > > To: i...@myspace.rent, 
> > > X-Entity-ID: eEuAPys4acQ9ere1FZlp6A==
> > > Content-Type: text/html; charset=us-ascii
> > > Content-Transfer-Encoding: 7bit
> > > X-CMAE-Envelope:
> > >
> > >  MS4xfLrAfEKlWNG6dcz1a05VWlMXnGyOE7soLGjybMz1QFzvpZ8a8cRDyTGNbMY9ezX
> > > 311xKb9zb5aWg3AtH7xkCUlT7kaAYASl+bOfJ3EEdSfKKIoPXjO+i
> > >
> > >  gjrerNiIxiRiWOcLF0BuxQKyIc/5BN0U4rxx20N0k1kPbaXyR06Ty99IgAWy9imxFxs
> > > ms0GP03MmGWur7XyGwMcP6r/JKJ3ntGwGN1Diolw7WC+ywjp9VBM5
> > >  X6m7dicNVVVO+LUx/qLWyQ==
> > > X-Nonspam: None
> > >
> > >
> > >
> > Any idea why it gets flagged and what rule I need to put in place to
> > prevent it from happening?
> >
> > Thank you.
> >
> > Daryl
>
>

Am I being paranoid? Postcard?

[Anders Gustafsson]

I know it is a bit off-topic, but has anyone seen something like this:

"Greetings,

My daughter collects printed postal cards from different countries. We are from 
Russia.
I hesitate to ask, but could you send a printed postcard from Finland?
I would like send you the postcard from our county if you like !
Await for your kind response.
In deepest sympathy,
Elena.
"

This could naturally be completely legit, but it was sent to the company info 
adress which is not advertised
anywhere. It is also a bit odd that it does not mention where to send it. Had 
it been me, had I written where
to send this postcard. Could it be some type of probe?

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND

Spam from Turkey?

[Anders Gustafsson]

Hi!

Over the last months the real egregious spammers have all been from Turkish 
ISPs. Had 15+ of them during this
morning from Meric Internet Teknolojileri A.S. anyone seen this as well?

-- 
Med vänlig hälsning

Anders Gustafsson, ingenjör
anders.gustafs...@pedago.fi  |  Support +358 18 12060  |  Direkt +358 9 315 45 
121  |  Mobil +358 40506 7099

Pedago interaktiv ab, Nygatan 7 B , AX-22100 MARIEHAMN, ÅLAND, FINLAND

What am I dping wrong as my whitelit does not seem to work?

[Anders Gustafsson]

Hi!

In /etc/mail/spamassassin/local.cf I have, among other things:

whitelist_from *.powersystemsdesign.com

Still mails from them are flagged as SPAM:

Content analysis details:   (5.3 points, 5.0 required)

 pts rule name  description
 -- --
-1.9 BAYES_00   BODY: Bayes spam probability is 0 to 1%
[score: 0.]
 1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
   [Blocked - see ]
 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
 2.8 UNWANTED_LANGUAGE_BODY BODY: Message written in an undesired language
 0.0 HTML_MESSAGE   BODY: HTML included in message
 0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
background
 0.8 RDNS_NONE  Delivered to internal network by a host with no rDNS
 0.1 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only
 2.1 NORDNS_LOW_CONTRASTNo rDNS + hidden text

sender is: newslet...@powersystemsdesign.com 

Rule to catch a certain email adress?

[Anders Gustafsson]

Assume I want to give extra points to e-p...@pedago.fi? This is our
adress as given on our wesite so many spammers harvest that. I waht to
bump it sligtly, but have been unable to write a regexp that catches it.
Can anyone help?


>>> RW  2019-11-28 03:30 >>>
On Wed, 27 Nov 2019 12:59:47 +0100
Tobi  wrote:

> Hi,
> 
> is there any specific reason why the two tags mentioned in subject
are
> not set in SA? It took me a while to find out why an askdns test was
> not running. The test relies on _LASTEXTERNALRDNS_ but after running
> with ‑‑debug I found that those tags are not set by SA.


What version are you running? I just tried adding _LASTEXTERNALRDNS_ 
in
a header on 3.4.2 and it worked.

Can someone explain how to read Bayes stats?

[Anders Gustafsson]

Ie:


pamir:~ # sa-learn --dump magic
0.000  0  3  0  non-token data: bayes db version
0.000  0   3184  0  non-token data: nspam
0.000  0  17298  0  non-token data: nham
0.000  0 164549  0  non-token data: ntokens
0.000  0 1553643652  0  non-token data: oldest atime
0.000  0 1574862537  0  non-token data: newest atime
0.000  0 1574856320  0  non-token data: last journal sync atime
0.000  0 1574848041  0  non-token data: last expiry atime
0.000  0  0  0  non-token data: last expire atime delta
0.000  0  0  0  non-token data: last expire reduction 
count

I had SA running before, but hd to take a break because of upgrades. I have not 
had the chance yet to collect over 200 SPAM/HAM messages for training.

-- 
Anders Gustafsson
Engineer, CNI, CNE6, ASE
Pedago, The Aaland Islands (N60 E20)
www.pedago.fi
phone +358 18 12060
mobile +358 40506 7099

Calling SA from a C program?

[Anders Gustafsson]

Excuse me if this is off-topic, but I want to call SA to process email 
messages. I have written a C-program that receives messages from our mail 
system which has the ability to put received emails i a "third-party" directory 
for processing.

Right now am I calling SA by making a simple system() call, but I thought it 
might be more efficient to run spamd and call it.

I have not been able to find any docs for this though?

Any ideas?

-- 
Anders Gustafsson
Engineer, CNI, CNE6, ASE
Pedago, The Aaland Islands (N60 E20)
www.pedago.fi
phone +358 18 12060
mobile +358 40506 7099

Sv: Re: Rule for a link with an numeric IP in body?

[Anders Gustafsson]

Thanks. I hd some issues installing 3.4, libc conflict IIRC so I Installed 3.3, 
but I have been planning to upgrade. I guess I will jut download the source 
tarball and build it on the system.


FWIW this system is not facing the internet. The MTA deposits incoming main 
into a folder where sa picks it up, processes and dumps into another, where the 
MTA picks it up.

Thanks for the ponters. I will have a peek.


>>> "Bill Cole"  2018-10-29 19:08 >>>
Do not run SpamAssassin 3.3.x. It is not safe. There have been multiple 
serious security bugs fixed in the 3.4.x series.

Rule for a link with an numeric IP in body?

[Anders Gustafsson]

Is there such a rule already in 3.3.x? I would ideally want a version of that 
that adds to the spam score if it sees a x.x.x.x/unsubscribe link, possibly 
translated.

Asking here as regexps are not really my strong side.

-- 
Anders Gustafsson
Engineer, CNI, CNE6, ASE
Pedago, The Aaland Islands (N60 E20)
www.pedago.fi
phone +358 18 12060
mobile +358 40506 7099