Re: Rule HK_SCAM is triggered by standard business email

2020-07-01 Thread Henrik K
On Wed, Jul 01, 2020 at 01:29:51PM -0700, John Hardin wrote: > > Agreed, that's why I want Henrik to comment. I don't have the corpus he used > to develop that rule. It's really old rules, I don't have either. ;-) __HK_SCAM_S7 seems to have regressed FP wise, just gonna drop it..

Re: Rule HK_SCAM is triggered by standard business email

2020-07-01 Thread Martin Gregorie
On Wed, 2020-07-01 at 16:20 -0400, Aner Perez wrote: > It looks like to me like the logic in __HK_SCAM_S7 is a little > > off... > > > > /(?:(?:investment|proposed|lucrative) > > (?:business|venture)|(?:business|venture) > > (?:enterprise|propos(?:al|ition)))/i > > > > seems like it should be:

Re: Rule HK_SCAM is triggered by standard business email

2020-07-01 Thread John Hardin
On Wed, 1 Jul 2020, Aner Perez wrote: On 7/1/20 3:52 PM, John Hardin wrote: On Wed, 1 Jul 2020, Aner Perez wrote: I opened a bug (7832) about this but was told to report on the SA users mailing list instead. The attached email is an example which triggers the HK_SCAM rule.  Looks like

Re: Rule HK_SCAM is triggered by standard business email

2020-07-01 Thread Aner Perez
On 7/1/20 3:52 PM, John Hardin wrote: On Wed, 1 Jul 2020, Aner Perez wrote: I opened a bug (7832) about this but was told to report on the SA users mailing list instead. The attached email is an example which triggers the HK_SCAM rule.  Looks like __HK_SCAM_S7 is the culprit here since it

Re: Rule HK_SCAM is triggered by standard business email

2020-07-01 Thread John Hardin
On Wed, 1 Jul 2020, Aner Perez wrote: I opened a bug (7832) about this but was told to report on the SA users mailing list instead. The attached email is an example which triggers the HK_SCAM rule. Looks like __HK_SCAM_S7 is the culprit here since it matches the words "business" and

Rule HK_SCAM is triggered by standard business email

2020-07-01 Thread Aner Perez
I opened a bug (7832) about this but was told to report on the SA users mailing list instead. The attached email is an example which triggers the HK_SCAM rule. Looks like __HK_SCAM_S7 is the culprit here since it matches the words "business" and "enterprise" when they are found one after the

Re: Frequency of SUSP_NTLD updates

2020-07-01 Thread John Hardin
On Wed, 1 Jul 2020, @lbutlr wrote: On 30 Jun 2020, at 09:31, RW wrote: On Tue, 30 Jun 2020 11:30:17 + Roald Stolte wrote: These mails were all using TLDs such as .site and .online and were getting marked because of it. Are others seeing a decrease in spam from .site and .online? All I

Re: Frequency of SUSP_NTLD updates

2020-07-01 Thread @lbutlr
On 30 Jun 2020, at 09:31, RW wrote: > On Tue, 30 Jun 2020 11:30:17 + > Roald Stolte wrote: > > >> These mails were all using TLDs such as .site and .online and were >> getting marked because of it. Are others seeing a decrease in spam from .site and .online? All I see from these TLD is

Re: Detection rate of msbl.org

2020-07-01 Thread RW
On Wed, 1 Jul 2020 10:49:03 +0200 Marc Roos wrote: > Jul 1 01:08:45 spam1 sendmail[19193]: 05UN8fHL019193: Milter: > from=, reject=550 5.7.1 Rejected > feedb...@service.alibaba.com SPAM (ebl.msbl.org) I don't know what this is, but I guess it's not a purely SA based milter as it gives a

RE: Detection rate of msbl.org

2020-07-01 Thread Marc Roos
Not much yet, I got this one[1]. But I am having this check as one of the last. Most connections are already failing with 'Possibly forged hostname' [1] Jul 1 01:08:45 spam1 sendmail[19193]: 05UN8fHL019193: Milter: from=, reject=550 5.7.1 Rejected feedb...@service.alibaba.com SPAM