Re: moderately personalized spam sneaking past my SA. general approaches to fix it?
pgnd <[email protected]>
| Newsgroups | gmane.mail.spam.spamassassin.general |
|---|---|
| Message-ID | <[email protected]> |
You've missed the *already* tweaked/included KAM & DCC scores * 1.5 KAM_MXURI URI: URI begins with a mail exchange prefix, i.e. * 3.0 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net) where, 'out of the box', /var/lib/spamassassin/4.000001/updates_spamassassin_org/50_scores.cf:score DCC_CHECK 0 1.1 0 1.1 and, of course, KAM's an (very useful!) add-on. In any case, that's not the question ... I get lots of these. Scores/test are low and all over the map. It's clear I can tweak scores and add tests, whether in SA, KAM, or elsewhere. I'm looking for a general approach that's less 'leaky' using SA. -------- Original Message -------- From: [email protected] Sent: at Thursday, Nov 21, 2024, 13:24 PM EST To: [email protected] Subject: Re: moderately personalized spam sneaking past my SA. general approaches to fix it? > On 11/21/24 18:42, pgnd wrote: >> Starting about 2 weeks ago, I've been playing whack-a-mole with waves of 'your mail box is full' phish, e.g. >> >> "Subject: The storage on your Webmail account is about full. You've used up all of the storage." >> >> , sneaking past my SA protections. Whether to call it snowshoe, I dunno :-/ But my usually well fed Bayes isn't getting noticeably better with 'em. >> >> There's a modicum of badly-done personalization attempted in them. It's usually laughably obvious spam to the eye. >> >> I'd like to make it go away with my filters. >> >> I can certainly do a bit of custom tweaking of SA scores, add header/ content exlcusions @ Postfix, etc. >> I'm not beyond dropping the entire spammy ASN at my edges ... >> >> But, first, wondering what, if any, better 'standard' SA options for dealing with it are? >> >> So as not to spam the list, here's a gist with headers/content from one today, >> >> https://gist.github.com/pgnd/5ab934d921939f4c62a4c978a30b9e6f >> >> Any general approaches to getting rid of this class of noise in SA? >> > > X-Spam-Status: NO, score=6.6 required=8.0 > > Using SA's default score of required 5.0 would have caught it