cancel
Showing results for 
Search instead for 
Did you mean: 

Please post evidence of postini false positives here

Not applicable

Re: Please post evidence of postini false positives here

Yes, it's www.postini.com/tutorials/ms_outlook.php
It says something about drag the e-mail into a new one but I found it easier to just forward it as an attachment.
I tend to use webmail and this only has 'Forward' so I had to download it to WM in order to do the above (unless there is another method that I haven't discovered). 
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: Please post evidence of postini false positives here

if you must send it to Postini instead of posting it here do exactly as they say
i.e.  open a new mail, click on the suspect email in your list without opening it, right mouse button held down slide the highlighted title over to the body of the new mail and then let go of the right mouse button

Q>E>D
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: Please post evidence of postini false positives here

there is also a Plus.net process instruction somewhere on how to get the e.mail heading on outlook, copy them and paste them somewhere else, no need to retransmit to web mail.
Basically  highlight e.mail in index.  Right click and go down to properties
this will open another window, at the top click details to open yet another window.  at the bottom click on message source to open yet another window,
Then drag your cursor down to high light the lot push Ctl C or right mouse copy to copy highlighted, go to where you want it and paste
Give it a try
Midnight_Caller
Rising Star
Posts: 4,167
Thanks: 15
Fixes: 1
Registered: ‎15-04-2007

Re: Please post evidence of postini false positives here

I have just Received this False positive identified as spam by Postini from My Call Alert servis!
Envelope-to: ****@****.org.uk
Delivery-date: Thu, 17 Jan 2008 12:00:04 +0000
Received: from exprod5mx239.postini.com ([64.18.0.125] helo=psmtp.com)
    by pih-sunmxcore15.plus.net with smtp (PlusNet MXCore v2.00) id 1JFTPf-0004N5-OV
    for ****@****.org.uk; Thu, 17 Jan 2008 12:00:04 +0000
Received: from source ([85.233.160.19]) (using TLSv1) by exprod5mx239.postini.com ([64.18.4.10]) with SMTP;
    Thu, 17 Jan 2008 06:00:01 CST
Received: from [81.23.214.82] (helo=ut001.liquid11.local)
    by smtp.hosts.co.uk with esmtpa (Exim 4.63)
    (envelope-from <info@switchboard-support.co.uk>)
    id 1JFTPa-0007MZ-Eb
    for ****@****.org.uk; Thu, 17 Jan 2008 11:59:58 +0000
MIME-Version: 1.0
Date: Thu, 17 Jan 2008 12:00:00 +0000
X-Mailer: Chilkat Software Inc (http://www.chilkatsoft.com)
X-Priority: 3 (Normal)
To: ****@****.org.uk
subject: [-SPAM-] A missed Call Alert
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html
From: info@switchboard-support.co.uk
Reply-To: support@switchboard-support.co.uk
Message-ID: <CHILKAT-MID-9a0ac586-535e-4caa-b29d-a5e1f3553236@ut001.liquid11.local>
X-pstn-neptune: 0/0/0.00/0
X-pstn-levels: (S: 0.04837/98.89499 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-settings: 1 (0.1500:0.1500) gt3 gt2 gt1 r p m c
X-pstn-addresses: from <info@switchboard-support.co.uk> [db-null]
X-pn-pstn: Spam 1
X-PN-Spam-Filtered: by PlusNet MXCore (v4.00)
jelv
Seasoned Hero
Posts: 26,785
Thanks: 971
Fixes: 10
Registered: ‎10-04-2007

Re: Please post evidence of postini false positives here

Quote from: pierre_pierre
there is also a Plus.net process instruction somewhere on how to get the e.mail heading on outlook, copy them and paste them somewhere else, no need to retransmit to web mail.
Basically  highlight e.mail in index.  Right click and go down to properties
this will open another window, at the top click details to open yet another window.  at the bottom click on message source to open yet another window,
Then drag your cursor down to high light the lot push Ctl C or right mouse copy to copy highlighted, go to where you want it and paste
Give it a try

No!
Those instructions were because for DSPAM training the headers had to be in the body of the email, and specifically NOT as an attachment.
The Postini page says they should be as an attachment.
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£14.40/month)
Mobile: iD mobile (£4/month)
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: Please post evidence of postini false positives here

yes but
There were two postings, one to tell poppy how to follow the Postini rout, the other how to copy the heading, for the not sure who have not got a spam folder on web mail and have down loaded it, they can use this copy and paste to get it back into this thread
godsell4
Rising Star
Posts: 3,366
Thanks: 15
Registered: ‎06-04-2007

Re: Please post evidence of postini false positives here

Quote from: poppy
Yes, it's www.postini.com/tutorials/ms_outlook.php ...

The spam at postini.com address, is for reporting SPAM that was not tagged as [-SPAM-].  Sad
Quote from the link above:
Quote
How to ... submit spam messages which get through Postini's filtering services ...

SW.
--
3Mb FTTC
https://portal.plus.net/my.html?action=data_transfer_speed
godsell4
Rising Star
Posts: 3,366
Thanks: 15
Registered: ‎06-04-2007

Re: Please post evidence of postini false positives here

Another false positive, this the last I will post I guess since this seems be a known and accepted problem.
How are PN going to fix this? Do we have a plan and a timeline discussed on this forum?
Quote
Envelope-to: xxx@yyy.plus.com
Delivery-date: Thu, 17 Jan 2008 11:09:13 +0000
Received: from exprod5mx205.postini.com ([64.18.0.64] helo=psmtp.com)
    by pih-sunmxcore09.plus.net with smtp (PlusNet MXCore v2.00) id 1JFScS-0002qc-V2
    for xxx@yyy.plus.com; Thu, 17 Jan 2008 11:09:13 +0000
Received: from source ([216.92.127.19]) by exprod5mx205.postini.com ([64.18.4.10]) with SMTP;
    Thu, 17 Jan 2008 04:09:11 MST
Received: (qmail 84688 invoked by uid 3002); 17 Jan 2008 11:07:41 -0000
Date: 17 Jan 2008 11:07:41 -0000
Message-ID: <20080117110741.84687.qmail@qs759.pair.com>
MIME-Version: 1.0
Content-Type: text/html
Reply-to: travelmole-wire@travelmole.net
From: TravelMole Daily UK Newswire <travelmole-wire@travelmole.net>
To: xxx@yyy.plus.com
Subject: [-SPAM-] 'Bumper' year forecast for UK holidays
X-pstn-neptune: 14/1/0.07/52
X-pstn-levels: (S: 0.07375/99.07690 R:95.9108 P:95.9108 M:94.5022 C:99.5902 )
X-pstn-settings: 1 (0.1500:0.1500) gt3 gt2 gt1 r p m c
X-pstn-addresses: from <travelmole-wire@travelmole.net> [18/1]
X-pn-pstn: Spam 1
X-PN-Spam-Filtered: by PlusNet MXCore (v4.00)
--
3Mb FTTC
https://portal.plus.net/my.html?action=data_transfer_speed
ChrisL
Rising Star
Posts: 760
Thanks: 4
Fixes: 1
Registered: ‎13-12-2007

Re: Please post evidence of postini false positives here

Quote from: pierre_pierre
It is not for the individual user to add to a white list but apparently the ISP
are you suggesting that PN compile a white list for the thousand of its users?

Within an organisation affiliated to Postini there is a facility for individual users to white/blacklist senders. I don't know whether Plusnet's arrangement with them will allow this, but we are told that pn are looking at some way for us to have this facility. Given the problem we've got, and the fact that Postini is unlikely to solve it by changing its scoring system, then I'd say it's urgent that pn implement this.
btw -- I'm sure the arrangement between Plusnet and Postini doesn't allow for us to send false-scoring email direct to postini, so we also need urgent implementation of a system to report errors to plusnet.
gbzrope
Newbie
Posts: 1
Registered: ‎17-01-2008

Re: Please post evidence of postini false positives here

I have no evidence to post, because we know we are definitely loosing genuine messages - and it is potentially costing us £,000's
One customer sent 4 emails yesterday, none arrived.
I asked him to re-send to our F9 account and also to one of my external accounts - the f9 mail still hasn't appeared, but the external cc arrived within miinutes.
We collect all our mails via a Spamcop account, and scan all the quarantined mails for false-positives, of which there are usually 2 or 3 a week - but the volume of spam actually reaching our Spamcop account has droipped this week from hundreds to tens per day.
Not a copnsolatioin for loosing a lot of genuine commercial emails.
ChrisL
Rising Star
Posts: 760
Thanks: 4
Fixes: 1
Registered: ‎13-12-2007

Re: Please post evidence of postini false positives here

Are the senders you know about getting an error message to say their mail is not being delivered?
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: Please post evidence of postini false positives here

Better Teach Postini Russian
Envelope-to: mr@xxxxxxx.idps.co.uk
Delivery-date: Thu, 17 Jan 2008 14:37:44 +0000
Received: from exprod5mx214.postini.com ([64.18.0.73] helo=psmtp.com)
    by pih-sunmxcore17.plus.net with smtp (PlusNet MXCore v2.00) id 1JFVsF-0004Ke-Lm
    for mr@xxxxxxxx.idps.co.uk; Thu, 17 Jan 2008 14:37:44 +0000
Received: from source ([213.35.211.70]) by exprod5mx214.postini.com ([64.18.4.13]) with SMTP;
    Thu, 17 Jan 2008 06:37:39 PST
X-SpamTest-Categories: Formal Messages > Postcards; Internal-LGS > EL; Internal-LGS > RL
X-SpamTest-Envelope-From: www@hillary.hit.ru
X-SpamTest-Formal: yes
X-SpamTest-Group-ID: 00000000
X-SpamTest-Info: Profiles 1020 [May 03 2007]
X-SpamTest-Info: helo_type=3
X-SpamTest-Method: none
X-SpamTest-Rate: 0
X-SpamTest-Status: Not detected
X-SpamTest-Status-Extended: formal
X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0255], KAS30/Release
Received: from hillary.hit.ru (localhost [127.0.0.1])
    by hillary.hit.ru (8.13.4/8.13.4) with ESMTP id F546ackahffo16965
    for <mr@xxxxxxxxxx.idps.co.uk>; Thu, 17 Jan 2008 16:37:38 +0200 (MSD)
    (envelope-from www@hillary.hit.ru)
Received: (from www@localhost)
    by hillary.hit.ru (8.13.4/8.13.4/Submit) id TT878zswmwkdi6392;
    Thu, 17 Jan 2008 16:37:38 +0200 (MSD)
    (envelope-from www)
Date: Thu, 17 Jan 2008 16:37:38 +0200 (MSD)
Message-Id: <20070507288.ZL32byth10261@hillary.hit.ru>
Reply-To: mr@xxxxxxx.idps.co.uk
Errors-To: mr@xxxxxxx.idps.co.uk
From: "POSTCARD.RU" <www@postcard.ru>
To: mr@xxxxxxxx.idps.co.uk
Subject: =?Windows-1251?Q?=5Bpostcard=2Eru=5D_=E2=E0=EC_=EF=F0=E8=F8=EB=E0_=EE=F2?=
    =?Windows-1251?Q?=EA=F0=FB=F2=EA=E0!?=
Precedence: special-delivery
Content-Type: text/html; charset=Windows-1251
Content-Transfer-Encoding: 8bit
X-pstn-neptune: 10/10/1.00/90
X-pstn-levels: (S: 0.51644/99.75420 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-settings: 1 (0.1500:0.1500) gt3 gt2 gt1 r p m c
X-pstn-addresses: from <www@postcard.ru> [22/1]
X-pn-pstn: Spam 3
X-PN-Spam-Filtered: by PlusNet MXCore (v4.00)
<html><!-- áóëàâêà --><!-- øàãàþùèé ýêñêàâàòîð ìàññèðîâàòü èññÿêíóòü çàñòåæêà-ìîëíèÿ
--><body>
Âàì ïðèøëà âèðòóàëüíàÿ îòêðûòêà.<!-- ÿêîðü õðèïîòà --><Br>
Äëÿ åå ïîëó÷åíèÿ çàéäèòå íà ñàéò <a
href="http://www.postcard.ru/card.php?8045137531"><table><tr><td><a
href="http://www.leorex-super.net/img/card.php?s=1&fr=MeadMarietta&n=mr@xxxxxxxx.idps.co.uk">www.postcard.ru/card.php?9955404773</td></tr></table></a>
è íàæìèòå íà ññûëêó 'ïîëó÷èòü îòêðûòêó'<!-- ñàíè êàäêà àðòèëëåðèñò øàãè --><BR>
       
ChrisL
Rising Star
Posts: 760
Thanks: 4
Fixes: 1
Registered: ‎13-12-2007

Re: Please post evidence of postini false positives here

There are some interesting things about this besides the spam score (postini doesn't seem to like foreign languages so I'm surprised it doesn't score lower) ....
Is SpamTest something you've added to your system this afternoon? Or are these spoof headers added by the sender?
X-pstn-addresses: from <www@postcard.ru> [22/1]
-- this shows that the ostensible sender's address doesn't appear on a whitelist or blacklist (no surprise) BUT it also shows that the "user" HAS a list with one entry of 22 bytes. I wonder if Plusnet is the user in this case, and it's their list?
Received: (from www@localhost)
    by hillary.hit.ru (8.13.4/8.13.4/Submit) id TT878zswmwkdi6392;
    Thu, 17 Jan 2008 16:37:38 +0200 (MSD)
    (envelope-from www)
I'm surprised it didn't get a "X-pstn-neptune-rslt: qtine", given its apparent behaviour and the fact that neptune has given it a score ....
Spam 3 is quite spammy -- after all, you might have actually been looking for a Russian bride?  Wink
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: Please post evidence of postini false positives here

I have added nothing, I wondered what the spam test bit was as well
For some reason on my machine I have the Crylic alphabet active, I looks even nicer then.
I am happily married with five rather old Kids
Oldjim
Resting Legend
Posts: 38,460
Thanks: 787
Fixes: 63
Registered: ‎15-06-2007

Re: Please post evidence of postini false positives here

Another one to add to all the forum notifications
Quote
Envelope-to: ***.plus.com
Delivery-date: Thu, 17 Jan 2008 19:40:52 +0000
Received: from exprod5mx250.postini.com ([64.18.0.170] helo=psmtp.com)
    by pih-sunmxcore16.plus.net with smtp (PlusNet MXCore v2.00) id 1JFabb-0003ui-FV
    for***.plus.com; Thu, 17 Jan 2008 19:40:52 +0000
Received: from source ([195.140.185.210]) by exprod5mx250.postini.com ([64.18.4.14]) with SMTP;
    Thu, 17 Jan 2008 14:40:49 EST
Received: from app05.muc.ec-messenger.com (app05.muc.ec-messenger.com [172.16.8.35])
    by aps46.muc.ec-messenger.com (READY) with ESMTP id 0715522AF75
    for <****.plus.com>; Thu, 17 Jan 2008 20:40:49 +0100 (CET)
Date: Thu, 17 Jan 2008 20:40:49 +0100 (CET)
From: Principles Online <newsletter@principles.co.uk>
Reply-To: "newsletter@principles.co.uk" <newsletter@principles.co.uk>
To: ****.plus.com
Message-ID: <3505025.1200598849026.ecMessenger@fresca.cust-mta.com>
Subject: [-SPAM-] SHOP NEW COLLECTIONS
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-eC-messenger-mid: 900152733
X-eC-messenger-cid: 9161
X-eC-messenger-sender-domain: bounce.fresca.cust-mta.com
X-eC-messenger-email: *****.plus.com
X-pstn-neptune: 0/0/0.00/0
X-pstn-levels: (S: 0.04318/98.87746 R:95.9108 P:95.9108 M:95.5423 C:98.6951 )
X-pstn-settings: 1 (0.1500:0.1500) gt3 gt2 gt1 r p m c
X-pstn-addresses: from <newsletter@principles.co.uk> [18/1]
X-pn-pstn: Spam 1
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)