Re: [External] Paypal phishing?

On 2024-11-21 at 11:26:35 UTC-0500 (Thu, 21 Nov 2024 11:26:35 -0500)
AJ Weber <[email protected]>
is rumored to have said:

> Thanks Bill,
>
> I just went back to check and IDK when it started, but I have a perl 
> issue:
>
> spamassassin --lint
> Subroutine File::Spec::Unix::canonpath redefined at 
> /usr/share/perl5/XSLoader.pm line 111.
> Subroutine File::Spec::Unix::catdir redefined at 
> /usr/share/perl5/XSLoader.pm line 111.
> Subroutine File::Spec::Unix::catfile redefined at 
> /usr/share/perl5/XSLoader.pm line 111.
>
> (I do have the KAM channel separately on my sa-update.)
>
> I only see a response to this issue from 2016...anyone have a tidy way 
> for me to "fix" this perl issue???

I think those are just warnings, but it *may* indicate that you need to 
reinstall File::Spec::Unix, which is part of the PathTools distribution.


>
> Thanks again
>
>
> On 11/21/2024 11:23 AM, Bill Cole wrote:
>> On 2024-11-21 at 10:45:58 UTC-0500 (Thu, 21 Nov 2024 10:45:58 -0500)
>> AJ Weber <[email protected]>
>> is rumored to have said:
>>
>>> Thanks Kevin,
>>>
>>> Have trusted KAM rules for a long time.  I assume they're still now 
>>> in the main rules updates?
>> The KAM rules are an independent rules channel that you must 
>> explicitly set up.
>>
>> Unlike the rules maintained by the SpamAssassin Project, the KAM 
>> rules are not subjected to the RuleQA process which re-scores the 
>> default rules nightly and automatically avoids widespread FPs.
>>
>>> I'll double-check my logs to make sure I'm fetching the latest.
>> It is simple to set up the KAM rules channel alongside the default 
>> rules channel to assure that you get updates regularly.
>>
>>> -AJ
>>>
>>>
>>> On 11/21/2024 8:11 AM, Kevin A. McGrail wrote:
>>>> I can't provide a recap but I can tell you that the KAM Ruleset has 
>>>> been consistently looking at these, blocking phone numbers, looking 
>>>> at their techniques, adding rules, etc.  It's very frustrating 
>>>> though because they seem to be abusing PayPal's systems to send 
>>>> them.
>>>>
>>>> The key pattern that I've noticed is that they all contain a phone 
>>>> number to call.
>>>>
>>>> Side note: Any one got a good contact at the FCC? I've been wanting 
>>>> to talk to them so they can figure out what provider(s) are 
>>>> facilitating this.
>>>>
>>>> Regards,
>>>>
>>>> KAM
>>>>
>>>> On 11/21/2024 7:57 AM, AJ Weber wrote:
>>>>> I saw a "conversation" a few weeks ago regarding paypal phishing 
>>>>> emails that were not being caught.
>>>>>
>>>>> I can't recall if anyone found a reasonable solution (or new 
>>>>> rules).
>>>>>
>>>>> I just received one and it seems very well crafted.  Is anyone 
>>>>> still collecting samples and wants this one too?
>>>>>
>>>>> Thanks for any recap anyone can provide.
>>


-- 
Bill Cole
[email protected] or [email protected]
(AKA @[email protected] and many *@billmail.scconsult.com 
addresses)
Not Currently Available For Hire