[prev in list] [next in list] [prev in thread] [next in thread] 

List:       spamassassin-users
Subject:    RE: [SAtalk] False Positive: Delivery Status Notification (Failure)
From:       "Dan Tappin" <dan.tappin () orourke-eng ! com>
Date:       2003-09-30 21:00:49
[Download RAW message or body]

Here is what I found running spamc on the full message (including
attachments).

It does not look like a forged hotmail message.  Should I just lower the
FAILURE_NOTICE_2 score?

Dan

Content analysis details:   (10.90 points, 5 required)
NO_REAL_NAME       (0.8 points)  From: does not include a real name
FAILURE_NOTICE_1   (-0.3 points) Mailer daemon failure notice (1)
VBOUNCE_POSTMASTER (1.0 points)  Message from the postmaster
MLM                (0.8 points)  BODY: Multi Level Marketing mentioned
WEIRD_QUOTING      (1.5 points)  BODY: Weird repeated double-quotation
marks in body
FAILURE_NOTICE_2   (-0.4 points) BODY: Mailer daemon failure notice (2)
HTML_COMMENT_8BITS (2.9 points)  BODY: HTML comment has 3 consecutive
8-bit characters
HTML_10_20         (1.4 points)  BODY: Message is 10% to 20% HTML
HTML_SHOUTING4     (0.5 points)  BODY: HTML has very strong "shouting"
markup
MAILTO_TO_SPAM_ADDR (0.4 points)  URI: Includes a link to a likely
spammer email address
FORGED_HOTMAIL_RCVD (1.1 points)  Forged hotmail.com 'Received:' header
found
UPPERCASE_25_50    (1.2 points)  message body is 25-50% uppercase

> -----Original Message-----
> From: spamassassin-talk-admin@lists.sourceforge.net
> [mailto:spamassassin-talk-admin@lists.sourceforge.net]On Behalf Of Evan
> Platt
> Sent: Tuesday, September 30, 2003 12:05 PM
> To: SpamAssassin
> Subject: Re: [SAtalk] False Positive: Delivery Status Notification
> (Failure)
>
>
> --On Tuesday, September 30, 2003 11:28 AM -0600 Dan Tappin
> <dan.tappin@orourke-eng.com> wrote:
>
> > I have a bunch of these hotmail failure notices being tagged as SPAM.
> > Does any one have a quick fix for this?
> >
> > I am guessing a rule to give a low score to the <> return path combined
> > with a 'postmaster@*' from header.
> >
> > I am pretty new to SA so any help on creating a rule would be great.  I
> > searched the archives but I could not find much on this.
>
> What scores is it hitting, and what version of SpamAssassin?
>
> Running just the headers through 2.55 (yeah we need to upgrade) scores a
> whopping 2.4:
>
> Return-Path: <>
> Received: from mc2-s18.hotmail.com ([65.54.237.67]) by firewall.orourke.ca
>           (Post.Office MTA v3.5.3 release 720 ID# 1001-62929U100L10S0V35)
>           with ESMTP id ca for <xxxx.xxxx@orourke-eng.com>;
>           Tue, 30 Sep 2003 04:39:14 -0600
> Received: from mc2-f10.hotmail.com ([65.54.237.17]) by mc2-s18.hotmail.com
> X-Mail-Format-Warning: Bad RFC2822 header formatting in with Microsoft
> SMTPSVC(5.0.2195.5600);
>          Mon, 29 Sep 2003 16:25:10 -0700
> From: postmaster@mail.hotmail.com
> To: xxxx.xxxx@orourke-eng.com
> Date: Mon, 29 Sep 2003 16:25:06 -0700
> MIME-Version: 1.0
> Content-Type: multipart/report; report-type=delivery-status;
>         boundary="9B095B5ADSN=_01C3868B939607480000A928mc2?f10.hotmail."
> Message-ID: <58SwFKzah0000840b@mc2-f10.hotmail.com>
> Subject: Delivery Status Notification (Failure)
> Return-Path: <>
> X-OriginalArrivalTime: 29 Sep 2003 23:25:10.0143 (UTC)
> FILETIME=[ECE060F0: 01C386E0]t
> X-Spam-Status: No, hits=2.4 required=5.0
>         tests=DATE_IN_PAST_06_12,FAILURE_NOTICE_1,FORGED_HOTMAIL_RCVD,
>               NO_REAL_NAME
>         version=2.55
> X-Spam-Level: **
> X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
>
>
> Evan
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Spamassassin-talk mailing list
> Spamassassin-talk@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/spamassassin-talk



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
Spamassassin-talk@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[prev in list] [next in list] [prev in thread] [next in thread]