You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by Alex <my...@gmail.com> on 2013/02/26 18:41:12 UTC

PHISH_REPLY_E_OLD FP

Hi,

The __PHISH_REPLY_E_OLD_292 catches "admin@gmail.com", which
apparently also includes "abcadmin@gmail.com" and any other substring
matches.

Feb 26 12:38:10.955 [29457] dbg: rules: ran header rule
__PHISH_REPLY_E_OLD_292 ======> got hit: "admin@gmail.com"

This tacked on 6 pts creating an FP for me.

I believe these are Justin's rules? Is there someone that can correct
this for us?

Thanks,
Alex

Re: PHISH_REPLY_E_OLD FP

Posted by Axb <ax...@gmail.com>.

On 02/26/2013 06:41 PM, Alex wrote:
> Hi,
>
> The __PHISH_REPLY_E_OLD_292 catches "admin@gmail.com", which
> apparently also includes "abcadmin@gmail.com" and any other substring
> matches.
>
> Feb 26 12:38:10.955 [29457] dbg: rules: ran header rule
> __PHISH_REPLY_E_OLD_292 ======> got hit: "admin@gmail.com"
>
> This tacked on 6 pts creating an FP for me.
>
> I believe these are Justin's rules? Is there someone that can correct
> this for us?
>
> Thanks,
> Alex
>

Please show the full report

  __PHISH_REPLY_E_OLD_292 must be part of a meta and can't score 
anything by itself.
If possible,  pls pastebin a copy of the message.

Re: PHISH_REPLY_E_OLD FP

Posted by Alex <my...@gmail.com>.

Hi,

>> The __PHISH_REPLY_E_OLD_292 catches "admin@gmail.com", which
>> apparently also includes "abcadmin@gmail.com" and any other substring
>> matches.
>>
>> Feb 26 12:38:10.955 [29457] dbg: rules: ran header rule
>> __PHISH_REPLY_E_OLD_292 ======> got hit: "admin@gmail.com"
>>
>> This tacked on 6 pts creating an FP for me.
>>
>> I believe these are Justin's rules? Is there someone that can correct
>> this for us?
>
>
> I can't see PHISH_REPLY_E_OLD in any default or update/trunk rule file. (or
> am I blind?)

I've just realized it comes from here:

https://aper.svn.sourceforge.net/svnroot/aper/phishing_reply_addresses

There is then a script addresses2spamassassin.pl that converts the
addresses into SA rules. I guess I should take it up with them. It's
otherwise worked well for me, so perhaps others can take advantage of
it as well.

Thanks,
Alex

Re: PHISH_REPLY_E_OLD FP

Posted by Axb <ax...@gmail.com>.

On 02/26/2013 06:41 PM, Alex wrote:
> Hi,
>
> The __PHISH_REPLY_E_OLD_292 catches "admin@gmail.com", which
> apparently also includes "abcadmin@gmail.com" and any other substring
> matches.
>
> Feb 26 12:38:10.955 [29457] dbg: rules: ran header rule
> __PHISH_REPLY_E_OLD_292 ======> got hit: "admin@gmail.com"
>
> This tacked on 6 pts creating an FP for me.
>
> I believe these are Justin's rules? Is there someone that can correct
> this for us?

I can't see PHISH_REPLY_E_OLD in any default or update/trunk rule file. 
(or am I blind?)

Where does it come from?