You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by Michael Peddemors <mi...@linuxmagic.com> on 2025/01/14 23:07:08 UTC
[FALSE POSITIVE] Paypal legitimate emails.. LONG_IMG_URI
LONG_IMG_URI is a very high scoring rule..
And notice that I said 'legitimate' paypal messages, given all the
problems they have had of late..
They also trigger __45_ALNUM_IM
<img src=3D"https://www.paypal.com/webapps/mch/cmd/=3Fv=3D3.0&t=3D=
1736878541&fdata=3DOBcGAzRHBBYcHAQeSFRMKk90PRgwNE9jVWhoGjAsS0gtRmZqagJ6=
Z0ZUZA1kX3tVZFJRUnoATEdaUUwTRBFMSy50aF1xYV1zRn5xW257XFxdUnNoaAVpdFdGdFcnAS9=
HcCRJR3QDXVVNQV5HH0BVXVpmeVN1Z15jV2poTjYhDkhMJ2Z5bwZ4ZkBWZg9jXXNRZVdYX3MBXU=
dYU0xRTlRMKk90BiQWGDoHV2hqTng4BAgAAmZ5GBNpLRs4IUowBjgHMhABCS1oHwMaFQQAWVRMS=
U90OQYsNU9jNmhoGyspCQIyFyY7M1MvMCsLPFY6Ny4LMA0EOS5YCRMVFUxRDlRMCQY0aEsFcE8N=
OBoAOxxpS0pMRiQ5KBNpFVVGZRlwS2pHNAoMAjcWTCZYUV1RDFZMSw00IA5kcC5jV359X2p8W1p=
aVXBhYANxY0RQbQtwSWhHcBAYCipTTEc5UUxHHkdbWl9ieVNyaFpxRH1-Xm59S0hORmYueRMIdFVUewhwSWhHcBAbR2J3TEdIR15GFUJVX1pkaEtmcE8rGD0.CgYhDkhMJ2Z5bgd-Y0JTZAxjXH5WZFRZUnIPWUdYU0xRRBsZHAsKKgUhNE9jNmhoKBwGLzskJGZ5exNpOAcAClMhAWpHEUVJLw5nPyMq=
IyQ.YyZMS010aAsmJQctGBYgC3hpKkhMUHZpbAZ9Y0RUYQpgX35QZl1QXmIWTkdYEQ4ERBoDNQ0=
6LQ9kcC5jVwcmGwYJGhkBDiQ5Ol4tdFVEdBk4Bj8DIzsbAzJoHwMKFRlRDDVMSwg0JRkgcE9hV2=
ggAS0pCR0eAjZ5eXJpdERJZRlwS2pHMgsdCDdFFEdYMExReCZMS010aB82NAodEzE9CismCwUBH=
mZ5GBNpMxULJl1wSWhHcC07OQB7JCUyJCUieFRMKk90PRgwNE9jVWhoHystGQwDBjMxN1wXIQ0X=
MBlwKGpHZldaUHMGWlZARlpBGENUWFltcEtkck9jAi47Bj1pSylMRnBsaAF5ZUxXZwloWnxVZlx=
QXnUWTEVYUQAbWRIfDx88LUtkEU9jR3ssWDt4XAxVBXA-ORNpdlVGOFMlDzkDNw0MR2J3TEdIQg=
hHT0VbD1Y3fgwkcE9hV2g.HC0hDkhMJ2Z5aQAtYhZXY11pCnwAMEVJRWIWHwcXG0xRbVRMW090a=
ktkIhsgKSohAXhpKkhMNB4LDHcFCjEqFHEdSWpFcEUdFSZFMgEMGQlRDDVMSwAgJQZkcE1jVzw6=
CisXGQweFC43Nm0vIB0DdBkRSWoIJAgER2IUTEcLFQsZSVRMKk90fl51YlpzRX57WmF.XlpdXnd=
uaBNpdlVGLV1wSQtHcFVZVncHWEpVXEFRDFZMSxYhaEsFcE9zQ3l8WWFkRkVBRmZ7eRM4IBYOMR=
lwKGpHEzcwIBQFKj4yIClDYVRMSU90LBI1OBw7KT06TngIS0hcUHRuYAVxYUBWdBlySWoDJUVJJ=
mIWLiowNSMkcjwgOjwQGjkMHiA&cks=3DMTFjODE5MDJjNjAxYTgyOGZjY2IxODk2Mjk3OT=
E3M2M&e=3D1.0"
Wondering if a score of 3.0 is a little bit much for this rule..
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada
Re: [FALSE POSITIVE] Paypal legitimate emails.. LONG_IMG_URI
Posted by John Hardin <jh...@impsec.org>.
On Tue, 14 Jan 2025, Michael Peddemors wrote:
> LONG_IMG_URI is a very high scoring rule..
>
> And notice that I said 'legitimate' paypal messages, given all the problems
> they have had of late..
>
> Wondering if a score of 3.0 is a little bit much for this rule..
That's based on the masscheck corpora. Apparently they are a bit thin on
legit paypal ham.
I'll add an exclusion for paypal images tonight.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Making good people helpless does not make bad people harmless.
-----------------------------------------------------------------------
2 days until Benjamin Franklin's 319th Birthday