Re: Remove SA tagging when learning as ham

2018-06-19 Thread RW
On Tue, 19 Jun 2018 10:41:51 +0200 Matus UHLAR - fantomas wrote: > >> > On Mon, 18 Jun 2018 06:13:06 -0600 @lbutlr wrote: > >> >> I have a script that runs when a mail is moved out of the Junk > >> >> folder to pass the mail through sa-learn --ham, > > >You can work around the plugin's

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread RW
On Tue, 19 Jun 2018 16:39:09 +0200 Andy Smith wrote: > Hi all, > > the last week or so we are having a lot of problems with emails > either with subjects like "New Approach Contractors Ltd wants to > share Scan" or "Invoice INV-03056 from Encompass Environmental Ltd" > which contian an HREF

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread David Jones
On 06/19/2018 10:38 AM, Andy Smith wrote: This has literally just come through to me, zero BAYES and got passed my custom rule as the HREF URL has changed: thanks, Andy. On 19-06-2018 17:33, Kevin A. McGrail wrote: Well you are welcome to send me new Spamples to look at.  As I noted, I've

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread David Jones
On 06/19/2018 10:38 AM, Andy Smith wrote: This has literally just come through to me, zero BAYES and got passed my custom rule as the HREF URL has changed: https://pastebin.com/pBfhXd6B thanks, Andy. On 19-06-2018 17:33, Kevin A. McGrail wrote: Well you are welcome to send me new

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread Kevin A. McGrail
To me, it looks like a compromised network and it's whack a mole to list them as fast as possible. -- Kevin A. McGrail VP Fundraising, Apache Software Foundation Chair Emeritus Apache SpamAssassin Project https://www.linkedin.com/in/kmcgrail - 703.798.0171 On Tue, Jun 19, 2018 at 11:38 AM, Andy

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread Andy Smith
This has literally just come through to me, zero BAYES and got passed my custom rule as the HREF URL has changed: https://pastebin.com/pBfhXd6B thanks, Andy. On 19-06-2018 17:33, Kevin A. McGrail wrote: > Well you are welcome to send me new Spamples to look at. As I noted, I've > never

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread Kevin A. McGrail
Well you are welcome to send me new Spamples to look at. As I noted, I've never seen these variants and RBLs aren't hitting them which ALSO means you have some new variants. Regards, KAM -- Kevin A. McGrail VP Fundraising, Apache Software Foundation Chair Emeritus Apache SpamAssassin Project

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread Andy Smith
Hi Kevin, I'm not really getting any joy with the RBLs. I have, for example, a sample from the 14th and, taking away my custom rule, Bayes and KAM scores, the default score would be "0" :( Content here: https://pastebin.com/dthDn8yb thanks, Andy. On 19-06-2018 17:12, Kevin A. McGrail

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread Kevin A. McGrail
The warnings are OK though make sure you have the nonKAMrules.cf as well. I'm not seeing really any of these spamples for us and agree. It's scoring in the 1.2 range for me. Clearly seems to be compromised url so RBLs are you likely bet but you might be a patient 0 for a new engine. -- Kevin

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread Andy Smith
Hi Kevin, No I wasn't. I just added it, I get a lot of errors like "meta test KAM_WARRANTY3 has dependency 'CBJ_GiveMeABreak' with a zero score", is this normal? Testing despite these errors the only rule I'm getting a hit on from KAM is JMQ_SPF_NEUTRAL_ALL thanks, Andy. On 19-06-2018

Re: Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread Kevin A. McGrail
Are you using the KAM.cf ruleset? -- Kevin A. McGrail VP Fundraising, Apache Software Foundation Chair Emeritus Apache SpamAssassin Project https://www.linkedin.com/in/kmcgrail - 703.798.0171 On Tue, Jun 19, 2018 at 10:39 AM, Andy Smith wrote: > Hi all, > > > the last week or so we are

Scans and Invoice spam containg HREF to something bad

2018-06-19 Thread Andy Smith
Hi all, the last week or so we are having a lot of problems with emails either with subjects like "New Approach Contractors Ltd wants to share Scan" or "Invoice INV-03056 from Encompass Environmental Ltd" which contian an HREF to see your "scan" or "invoice" at a URL ending /share or

Re: Remove SA tagging when learning as ham

2018-06-19 Thread Matus UHLAR - fantomas
> On Mon, 18 Jun 2018 06:13:06 -0600 @lbutlr wrote: >> I have a script that runs when a mail is moved out of the Junk >> folder to pass the mail through sa-learn --ham, I think this is what the dovecot's Antispam plugin does: https://wiki2.dovecot.org/Plugins/Antispam and maybe ImapSieve: