Re: [External] Paypal phishing?

Hi AJ, thanks for the kind words.  The KAM ruleset is NOT included with 
the main rules update.  See https://mcgrail.com/template/kam.cf_channel

As for why, the rulset doesn't go through the same ASF voting process or 
the Apache SpamAssassin QA process.  This is because it been difficult 
to figure out how to meet my main goal (super fast updates), and still 
meet the Apache Software Foundation release standards.  So it's under 
the McGrail Foundation which makes it easier to do it well but differently.

<donation request>For the McGrail Foundation, Linode donates the servers 
for the RBL, and PCCC donates all the labor to maintain the list.  
Otherwise we are very thrifty with volunteers-only!  We just celebrated 
20 years of the KAM ruleset in May of this Year.  If you can help, we 
are looking for donors for our 2025 planned expenses.  If your company 
uses our ruleset, we'd love to discuss a sponsorship opportunity and any 
donations are appreciated. https://mcgrail.com/template/donate 
</donation request>

Regards,

KAM

On 11/21/2024 10:45 AM, AJ Weber wrote:
> Thanks Kevin,
>
> Have trusted KAM rules for a long time.  I assume they're still now in 
> the main rules updates?  I'll double-check my logs to make sure I'm 
> fetching the latest.
>
> -AJ
>
>
> On 11/21/2024 8:11 AM, Kevin A. McGrail wrote:
>> I can't provide a recap but I can tell you that the KAM Ruleset has 
>> been consistently looking at these, blocking phone numbers, looking 
>> at their techniques, adding rules, etc.  It's very frustrating though 
>> because they seem to be abusing PayPal's systems to send them.
>>
>> The key pattern that I've noticed is that they all contain a phone 
>> number to call.
>>
>> Side note: Any one got a good contact at the FCC? I've been wanting 
>> to talk to them so they can figure out what provider(s) are 
>> facilitating this.
>>
>> Regards,
>>
>> KAM
>>
>> On 11/21/2024 7:57 AM, AJ Weber wrote:
>>> I saw a "conversation" a few weeks ago regarding paypal phishing 
>>> emails that were not being caught.
>>>
>>> I can't recall if anyone found a reasonable solution (or new rules).
>>>
>>> I just received one and it seems very well crafted.  Is anyone still 
>>> collecting samples and wants this one too?
>>>
>>> Thanks for any recap anyone can provide.
>>
-- 
Kevin A. McGrail
[email protected]

Member, Apache Software Foundation
Chair Emeritus Apache SpamAssassin Project
https://www.linkedin.com/in/kmcgrail - 703.798.0171