Re: (Re-)emergence of UTF based obfuscation in phishing/spam

2023-08-30 Thread Ricky Boone
Typo, I meant to say I was on SA 3.4.6. On Wed, Aug 30, 2023, 3:22 PM Ricky Boone wrote: > Something I noticed on a set of emails that were reported to me. > > I have custom rules to look out for certain names in From:name. The > messages should have been caught by them, however upon

Re: Scoring Explanation Please

2023-08-30 Thread Bill Cole
On 2023-08-30 at 15:14:15 UTC-0400 (Wed, 30 Aug 2023 19:14:15 + (UTC)) Denny Jones via users is rumored to have said: Hello, I have looked high and low and can't find an explanation for multi-level scoring: score SCC_CANSPAM_2    3.799    0.001    3.799    0.00 What does this mean? In

Re: Scoring Explanation Please

2023-08-30 Thread David B Funk
Denny, If you read the fine manual for the spamassassin configuration file, in section for 'score SYMBOLIC_TEST_NAME n.nn [ n.nn n.nn n.nn ]' You'll see: If only one valid score is listed, then that score is always used for a test. If four valid scores are listed, then the score that

(Re-)emergence of UTF based obfuscation in phishing/spam

2023-08-30 Thread Ricky Boone
Something I noticed on a set of emails that were reported to me. I have custom rules to look out for certain names in From:name. The messages should have been caught by them, however upon inspection the name was UTF-8 encoded, and included a character that doesn't seem to render, but interferes

Scoring Explanation Please

2023-08-30 Thread Denny Jones via users
Hello, I have looked high and low and can't find an explanation for multi-level scoring: score SCC_CANSPAM_2    3.799    0.001    3.799    0.00 What does this mean? In my simplistic way of doing things I would write this as: score SCC_CANSPAM_2 3.799 Thanks for helping clear the mud in my