You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2005/07/04 19:49:06 UTC
[Bug 4457] New: Paypal phishing rules.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4457
Summary: Paypal phishing rules.
Product: Spamassassin
Version: 3.0.3
Platform: All
OS/Version: All
Status: NEW
Severity: enhancement
Priority: P5
Component: Rules
AssignedTo: dev@spamassassin.apache.org
ReportedBy: craig@craig.dnsalias.com
Attached will be rules to catch paypal "update your account" phishing spam which
will need masschecking. The originals were posted to the SA users list and FP'd
quite badly, these new ones should be much more reliable. However, I do not have
a good ham corpus to check against, so can't tell if they still misfire.
Comments and suggestions for improvement solicited. Thanks!
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4457] Paypal phishing rules.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4457
Bob@Menschel.net changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords|triage |
Target Milestone|Undefined |3.2.0
------- Additional Comments From Bob@Menschel.net 2005-07-16 21:43 -------
Section 3 -- Frequencies Log
(First numeric frequencies, followed by percentage frequencies)
OVERALL% SPAM% HAM% S/O RANK SCORE NAME
297183 139449 157734 0.469 0.00 0.00 (all messages)
10 7 3 0.725 0.00 4.00 LOCAL_PP_UPD_BADADDR
202 198 4 0.982 0.00 4.00 LOCAL_PP_UPD_BADURL
OVERALL% SPAM% HAM% S/O RANK SCORE NAME
297183 139449 157734 0.469 0.00 0.00 (all messages)
100.000 46.9236 53.0764 0.469 0.00 0.00 (all messages as %)
0.003 0.0050 0.0019 0.725 0.00 4.00 LOCAL_PP_UPD_BADADDR
0.068 0.1420 0.0025 0.982 0.00 4.00 LOCAL_PP_UPD_BADURL
The BADURL ham hits were a Nov 2002 newsletter from paypal, Jan 2003, Jan 2004,
Mar 2004.
The BADADDR ham hits were all June 2005 mailing list administrative emails to
list owner to confirm a new subscription request, for lists at ibiblio.org.
You may want to work with Fred, who maintains
http://www.rulesemporium.com/rules.htm#spoof (email address inside the rules
file) -- merge your ideas and see if the two of you can improve the performance
of these rules.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4457] Paypal phishing rules.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4457
craig@craig.dnsalias.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #2981 is|0 |1
obsolete| |
------- Additional Comments From craig@craig.dnsalias.com 2005-07-06 04:11 -------
Created an attachment (id=2991)
--> (http://bugzilla.spamassassin.org/attachment.cgi?id=2991&action=view)
Updated paypal phishing rules
Updated to catch "update your identity" phrase in common paypal phishin spam.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4457] Paypal phishing rules.
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4457
felicity@apache.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
------- Additional Comments From felicity@apache.org 2006-03-07 05:03 -------
I put this in my sandbox for testing.
Committed revision 383781.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4457] Paypal phishing rules.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4457
Bob@Menschel.net changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |triage
------- Additional Comments From Bob@Menschel.net 2005-07-04 19:51 -------
Will schedule for mass-check as soon as the current pre-release scoring
mass-check runs are complete. (Justin -- any idea whether the n.e.e.d.s.m.c
system will work for me if I set that flag in a bug entry? Hasn't yet; don't
know whether you've been able to fix that.)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4457] Paypal phishing rules.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4457
------- Additional Comments From jm@jmason.org 2005-07-05 10:32 -------
hi Bob --
nope, the automc stuff is turned off until post-3.1.0 as it needs some work :(
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4457] Paypal phishing rules.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4457
------- Additional Comments From craig@craig.dnsalias.com 2005-07-04 10:51 -------
Created an attachment (id=2981)
--> (http://bugzilla.spamassassin.org/attachment.cgi?id=2981&action=view)
paypal phishing ruleset
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.