[SFOS 18.5MR3] Poor spam detection after update to Sophos Anti-Spam Interface

I am curious.

Are only Home Users seeing this issue? Because it looks like, only Home Appliance are affected by this potential issue. Or does somebody with a Appliance (SG/XG/XGS) have the same issue? 

Hi LuCar Toni,

I've got a few customers upgraded to MR3, one off them has this problem and so am I with my LAB/Home version. Customer is xg210 with paid license. The thing that's the same is we both do IPv6 on the in and outside.

Opened case Nr: 05143473

Bart.

Hi Karlos,

New case ID is 05307033 and has been created today few minutes ago.

Old case has been 05249138 and has been closed today because patch has been applied.

Hi Markus & DejanBukovec, a new development case ID has been assigned to investigate this further: NC-94529

Karlos Thanks for this informations.

The root cause was identified and remediated on June 8th, could you confirm?

Hi Karlos,

We are still in contact with GES. Yesterday they check FW and reply that NC-90702 is installed and pattern also successfully updated, but we still receive spam/phishing emails from "cpanel" and something like "email server" ... Case ID is still 05307033 and there is also upladed some of spam/phishing emails...

Edit: Karlos I'm receive confirmation that we have NC-90702 and NC-94529 patch applied on our appliance, but we still receive spam&phishing emails(I know that one of our user receive 1-2/day)... I didn't analyze how many we receive them on other users...

Hi DejanBukovec thank you for the update. Now that you've submitted false negative samples, please allow our Labs team some time to analyze.

Hi Karlos

I hope that they will fix issue ASAP because we receive phishing emails(We right now do not receive spam emails) at daily basis and I send them to Sophos Labs ...

Ticket has been closed because both pathes has been applied and this is now "problem" of Sophos Labs... Do you know if patteren is in SASI engine new and do not include database from 18.5 MR1 or older? Or why we in MR1 didn't receive that phishing emails but now(Same/Next day after update) we start receiving them?

Hi DejanBukovec,

Sorry to hear that you are still experiencing issues. Could you confirm you are using MTA mode? If so, you will need to open a new ticket with Support so we can investigate further. 

If anyone else on this thread is still experiencing SPAM issues post hotfixes and are on MTA mode/upgraded to 18.5.4  - please reply back to this or send me a DM. Please note that the hotfixes only fixed the issue for MTA mode.

Hi Karlos Yes we use MTA mode(From beginning when it has been implemented in XG)  :

Do I need write something "special" in new ticket or just mention that we have patch NC-90702 and NC-94529 and still receiving phishing emails...

All received emails are scanned but score is to low(Around 10%)... I report all mails to sophos lab...

Hi,

im having this issue too, on v19 in MTA mode hotfixes are installed automatically.

Restarting services via service antispam:restart -ds nosync doesn't fix the issue.

My /log/sasi.log is full of range ckeck errors: DNS/Request.cpp:246] vector::_M_range_check

Same as DejanBukovecmy X-SASI-SpamProbability is all around 10%

any suggestions?

Hi,

im having this issue too, on v19 in MTA mode hotfixes are installed automatically.

Restarting services via service antispam:restart -ds nosync doesn't fix the issue.

My /log/sasi.log is full of range ckeck errors: DNS/Request.cpp:246] vector::_M_range_check

Same as DejanBukovecmy X-SASI-SpamProbability is all around 10%

any suggestions?

Hi RedTunnel97, could you also confirm that your anti-spam pattern update was last updated less than 2 weeks ago?

Hi Karlos i can confirm the AntiSpam Version 10.219 from 21.06.2022 is installed, and still receiving lots of spammails

Do you have an open Support case? Have you submitted false negative samples to our Labs?

Hi Karlos is there some progress about spam detection?

I have opened case 05671011 but there is no progress... I also report to Sophos Labs around 4 spam/phishing emails per day and nothing change...

We're working on a solution that'll enable admins to handle 'bulk' messages and define an action for them to improve the detection rate.

JanosRapcsak thanks for fast reply. I don't talk about bulk(spam) emails. We mostly(95%) receive phishing emails which looks like bank emails, post email, police emails, cpanel&webmail emails ...