Please post evidence of postini false positives here

[#1]

if we dont have a white list what route did this take? ! am on Postini

Quote

Envelope-to: mr@xxxxxxx.idps.co.uk Delivery-date: Mon, 04 Feb 2008 09:41:17 +0000 Received: from exprod5mx216.postini.com ([64.18.0.75] helo=psmtp.com)   by pih-sunmxcore17.plus.net with smtp (PlusNet MXCore v2.00) id 1JLxpF-0003YJ-34   for mr@xxxxxxxx.idps.co.uk; Mon, 04 Feb 2008 09:41:17 +0000 Received: from source ([132.185.240.143]) by exprod5mx216.postini.com ([64.18.4.11]) with SMTP; Mon, 04 Feb 2008 01:41:15 PST Received: from bbcxue501.national.core.bbc.co.uk ([10.72.136.6]) by mailgw3.thls.bbc.co.uk (8.13.7/8.13.7) with ESMTP id m149f3oa017457 for <mr@xxxxxxx.idps.co.uk>; Mon, 4 Feb 2008 09:41:03 GMT X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message Subject: RE: where in Essex Date: Mon, 4 Feb 2008 09:41:14 -0000 Message-ID: <F01496016DD32F439FFBC83143386AB4026C6796@bbcxue501.national.core.bbc.co.uk> In-Reply-To: <000b01c86701$8211ec20$0501a8c0@home> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: where in Essex Thread-Index: AchnAbCR9S2nkna4S8aKAv+sgFWNzwAEGC0Q References: <000b01c86701$8211ec20$0501a8c0@home> From: "Ray Clark" <ray.clark@bbc.co.uk> To: "xxxxxxxxx" <mr@xxxxxxx.idps.co.uk> X-Antivirus: AVG for E-mail 7.5.516 [269.19.19/1257] Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=US-ASCII Got it

[#2]

Quote from: jelv

Can I repeat a suggestion I made a while back. When you get the default settings right please make that SPAM 3 and make (by default) SPAM 1, 2 & 3 get tagged etc. That then gives room for two more lenient levels below - SPAM 1 could be S: 0.00000 only. The current SPAM 3, 4 and 5 are so strict they are worthless - to use them people would have to whitelist a colossal amount of addresses.

I can certainly suggest this. On a similarly related note, what are your thoughts regarding the category filtering. How do you think this should be handled, as it seems to be causing some dissatisfaction at the moment?

[#3]

From reading the Postini documentation it appears that for each of the triggers activated it should be used to change the threshold value from 0.15 to a higher figure. Something like one triggered use 0.3, two triggered use 0.6 I think. Also I'm not sure if by how much one of the categories fails should be taken in to account.

[#4]

I've just posted on the topic of category filters here:
http://community.plus.net/forum/index.php/topic,60348.msg491100.html#msg491100
(Sorry, can't get abbreviated links to work!)

[#5]

Today I got a bounced message with error '571 Message Refused' which I assume is because postini wouldn't even let it through to the [-SPAM-] tagging process.  I tried sending it twice and got a bounce both times.
I was sending an email to my Dad (who's computer is in the same house as mine, on the same plusnet account) - our family has a domain name NOT hosted by plusnet (but by UK2) which has referrals set up to send email on to the relevant plusnet mailboxes.  HOWEVER when I sent direct to his plusnet mailbox address, the email didn't bounce.

Quote

From - Wed Feb  6 10:43:48 2008 X-Account-Key: account4 X-UIDL: UID1224-1185651652 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: $label1                                                                        Envelope-to: <My PlusNet domain email address> Delivery-date: Wed, 06 Feb 2008 10:36:48 +0000 Received: from exprod5mx244.postini.com ([64.18.0.164] helo=psmtp.com)   by pih-sunmxcore19.plus.net with smtp (PlusNet MXCore v2.00) id 1JMhe3-0005Iz-KT   for <My PlusNet domain email address>; Wed, 06 Feb 2008 10:36:48 +0000 Received: from source ([83.170.81.142]) (using TLSv1) by exprod5mx244.postini.com ([64.18.4.10]) with SMTP; Wed, 06 Feb 2008 05:36:44 EST Received: from atmail by smtp2.uk2.net with local (Exim 4.60) id 1JMhe0-0000tz-GR for <My domain name email address>; Wed, 06 Feb 2008 10:36:44 +0000 X-Failed-Recipients: <Dad's PlusNet domain email address> Auto-Submitted: auto-replied From: Mail Delivery System <Mailer-Daemon@smtp2.uk2.net> To: <My domain name email address> Subject: Mail delivery failed: returning message to sender Message-Id: <E1JMhe0-0000tz-GR@smtp2.uk2.net> Date: Wed, 06 Feb 2008 10:36:44 +0000 X-pstn-neptune: 5/5/1.00/89 X-pstn-levels:    (S:23.60678/99.90000 CV:99.9000 R:95.9108 P:95.9108 M:97.0282 C:98.6951 ) X-pstn-settings: 1 (0.1500:0.1500) cv gt3 gt2 gt1 r p m c X-pstn-addresses: from <Mailer-Daemon@smtp2.uk2.net> [50/4] X-PN-VirusFiltered: by PlusNet MXCore (v4.00) This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:   <Dad's PlusNet domain email address>     (generated from <Dad's domain name email address>)     SMTP error from remote mail server after end of data:     host PlusNet_domain.co.uk.s5a1.psmtp.com [64.18.4.10]:     571 Message Refused ------ This is a copy of the message, including all the headers. ------ Return-path: <My domain name email address> Received: from ptb-relay03.plus.net ([212.159.14.214]) by smtp2.uk2.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.60) (envelope-from <My domain name email address>) id 1JMhdx-0000rP-9Z for <Dad's domain name email address>; Wed, 06 Feb 2008 10:36:41 +0000 Received: from [212.159.87.105] (helo=My machine name) by ptb-relay03.plus.net with esmtp (Exim) id 1JMhdw-000288-W7 for <Dad's domain name email address>; Wed, 06 Feb 2008 10:36:41 +0000 Message-ID: <47A98DB0.1020800@our_external_domain_name> Date: Wed, 06 Feb 2008 10:36:32 +0000 From: <My domain name email address> User-Agent: Thunderbird 2.0.0.9 (Macintosh/20071031) MIME-Version: 1.0 To: <Dad's domain name email address> Subject: print model kits website Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Plusnet-Relay: f62b3689c182328d764f8c50b993a9c6 X-Spam-Score: 0.0 X-Spam-Report: Content analysis details:  (0.0 points, 5.0 required) pts rule name              description ---- ---------------------- -------------------------------------------------- Just come across this, and thought of you! http://www.scalescenes.com/ Martin -- This email has been verified as Virus free. Virus Protection and more available at http://www.plus.net

Martin

[#6]

Hi Martin,
Can you PM me the full unsanitised headers of these emails please? I'll get a problem raised on it asap.

[#7]

Just gone over to Postini this evening. One false positive so far.
Headers:
From:  survey@ciao-uk.com
Subject: [-SPAM-] £0.17 survey on travelling 071130-20762
Date: 7 February 2008 15:53:27 GMT
To:  xxxx@xxxx.plus.com
Reply-To:  survey@ciao-uk.com
Envelope-To: xxxx@xxxx.plus.com
Delivery-Date: Thu, 07 Feb 2008 16:18:09 +0000
Received: from exprod5mx249.postini.com ([64.18.0.169] helo=psmtp.com) by pih-sunmxcore09.plus.net with smtp (PlusNet MXCore v2.00) id 1JN9Rw-0001oW-TN  for xxxx@xxxx.plus.com; Thu, 07 Feb 2008 16:18:09 +0000
Received: from source ([194.97.158.183]) (using TLSv1) by exprod5mx249.postini.com ([64.18.4.11]) with SMTP; Thu, 07 Feb 2008 09:18:06 MST
Received: from 10.1.1.245 (gateway.ciao.com [194.221.9.215]) by smtp.ciao.com (8.14.2/8.14.2) with SMTP id m17FrUTV040305 for <xxxx@xxxx.plus.com>; Thu, 7 Feb 2008 16:53:30 +0100 (CET) (envelope-from survey@ciao-uk.com)
Message-Id: <200802071553.m17FrUTV040305@smtp.ciao.com>
Sender: "Survey @ Ciao" <survey@ciao-uk.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Pstn-Neptune: 2/2/1.00/87
X-Pstn-Levels: (S: 0.00673/98.02479 CV:99.9000 )
X-Pstn-Status: off
X-Pn-Pstn: Spam 1
X-Pn-Virusfiltered: by PlusNet MXCore (v4.00)
Body of email (in case it's helpful):
Hello xxxx,
We'd like to offer you an interesting opportunity to express your point of
view. This time, our partner would like to know your opinions about
travelling. If you complete our easy 10-minutes survey, you can earn £0.17*
for sharing your thoughts and preferences.
You can find the survey here:
http://ciaosurveys.com/p/XXXXXXXXXXXXX
This survey will only stay open for a limited time, so please don't wait.
Thank you for your participation!
The Ciao Team

*---PAYMENT---
The survey begins with a few screening questions to make sure your profile
matches our client's needs for this study. If not, the questionnaire will
simply end after the first questions, and you will be sent new
opportunities soon. If you complete the whole 10-minutes questionnaire,
£0.17will be added to your Ciao Account within one month. Please note that
payment of the survey reward is dependent on thoughtful and truthful
responses to all questions.  Participants who give illogical combinations
of answers or who do not spend a minimum amount of time completing the
questionnaire will not qualify for the reward.
---WHY DID I RECEIVE THIS?---
The option to earn money with surveys is currently ticked in your Ciao
Account. This means that we may send you survey invitations from time to
time. If you no longer wish to participate in surveys, you can untick this
option here:
http://www.ciao.co.uk/account.php/TabId/8/subTabId/13
---PRIVACY---
It is our policy never to give your personal details to any third party
without your permission. You can find out more about data protection at
Ciao at
http://www.ciao.co.uk/privacy.php
---LINK DOESN'T WORK?---
Please try copying the link onto your browser:
1. Put your mouse over the link;
2. Press down on the left mouse button and move your mouse to highlight the
link exactly;
3. Click on "Control" and "C" on your keyboard at the same time;
4. Open your Internet browser (e.g. Internet Explorer, Netscape, etc.);
5. Move your mouse to place the cursor in the browser address line;
6. Click on "Control" and "V" to paste the link.
---QUESTIONS?---
Please click on the following link:
http://www.ciaosurveys.com/helpcenter.php
---COMPANY ADDRESS---
Ciao Surveys GmbH
Leopoldstrasse 236
80807 Munich, Germany
--
This email has been verified as Virus free.
Virus Protection and more available at http://www.plus.net

[#8]

Quote from: Chris

Can you PM me the full unsanitised headers of these emails please? I'll get a problem raised on it asap.

Chris. See 49529

[#9]

Quote from: Bob

Chris. See 49529

Yep, that's why I wanted the headers, to add to the problem

[#10]

Bob, a quick question: do you want us to only forward 'Spam 1' e-mails (i.e. ones that have actually been marked as [-SPAM-], or are you interested in 'Spam 2', 3, etc. too?

[#11]

Just those marked as spam 1 for the time being Thomas.

[#12]

Right, Ok (thankfully I actually haven't had any of those)... along similar lines, what about false negatives - do you want all ones not tagged as [-SPAM-], or just ones that don't have any kind of 'Spam x' categorisation in the headers at all?

[#13]

This, from a well known electronics/white goods company has been tagged Spam 1:
From:  direct@e.comet.co.uk
Subject: [-SPAM-] xxxx - Star buys this February at Comet
Date: 8 February 2008 18:15:51 GMT
To:  xxxx@xxxx.plus.com
Reply-To:  support-b099buya78s1rya08e7axb7df55cbf@e.comet.co.uk
Envelope-To: xxxx@xxxx.plus.com
Delivery-Date: Fri, 08 Feb 2008 18:15:35 +0000
Received: from exprod5mx222.postini.com ([64.18.0.81] helo=psmtp.com) by pih-sunmxcore19.plus.net with smtp (PlusNet MXCore v2.00) id 1JNXl7-0000as-TM  for xxxx@xxxx.plus.com; Fri, 08 Feb 2008 18:15:35 +0000
Received: from source ([206.132.204.147]) by exprod5mx222.postini.com ([64.18.4.11]) with SMTP; Fri, 08 Feb 2008 13:15:32 EST
Domainkey-Signature: a=rsa-sha1; q=dns; c=nofws; s=200505; d=e.comet.co.uk; b=NGi4pZdPQdvKvqhIn1UDhMhAOb5NprqQKLBY4ag6pvVTBhUuSvWpFpBScmfBUPsTEfG6ot7bIWxje1Mf5KeTIY8wTIiDYgNSApXrhSE6N+9/elBiWbz5AsViEvjkwS8lZvIyfuvVWJqT7FiGK+plicb6EiIQBJ+HShh63nYYZKM=; h=Date:Message-ID:List-Unsubscribe:From:To:Subject:MIME-Version:Reply-To:Content-type;
Message-Id: <b099buya78s1rya08e7axb7df55cbf.316109245.3582@mta302.e.comet.co.uk>
List-Unsubscribe: <mailto:rm-0b099buya78s1rya08e7axb7df55cbf@e.comet.co.uk>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="=b099buya78s1rya08e7axb7df55cbf"
X-Pstn-Neptune: 2/1/0.50/80
X-Pstn-Levels: (S: 0.00345/97.85352 CV:99.9000 )
X-Pstn-Status: off
X-Pn-Pstn: Spam 1
X-Pn-Virusfiltered: by PlusNet MXCore (v4.00)
And this from a reputable public opinion panel:
From:  ipsos@bp06.net
Subject: [-SPAM-]xxxx, Speak your mind. It could be worth pound 250!
Date: 8 February 2008 08:15:27 GMT
To:  xxxx@xxxx.plus.com
Reply-To:  donotreply@bp06.net
Envelope-To: xxxx@xxxx.plus.com
Delivery-Date: Fri, 08 Feb 2008 08:16:06 +0000
Received: from exprod5mx204.postini.com ([64.18.0.63] helo=psmtp.com) by pih-sunmxcore17.plus.net with smtp (PlusNet MXCore v2.00) id 1JNOOz-0000Ug-Gd  for xxxx@xxxx.plus.com; Fri, 08 Feb 2008 08:16:06 +0000
Received: from source ([86.64.211.68]) by exprod5mx204.postini.com ([64.18.4.13]) with SMTP; Fri, 08 Feb 2008 00:16:03 PST
Received: by mail.s68.211.bp06.net (PowerMTA(TM) v3.2r23) id hlg7s80g8nc4 for <xxxx@xxxx.plus.com>; Fri, 8 Feb 2008 09:15:27 +0100 (envelope-from <MperfBouncesTYOP0500002GU001T35GL@bp06.net>)
X-Mailer: MP6
X-Builder: NP6.Ironport.Mail 1.0.2937.19553
X-Priority: 3
X-Trid: 001T35GL
X-Caid: 0002GU
X-Cuid: 050
X-Aid: TYOP
X-Cat: 269
Message-Id: <TYOP050-0002GU001T35GL381564@bp06.net>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPartNP6AltUniqueBoundary633380589271225314--1"
X-Pstn-Levels: (S: 0.00000/77.20415 CV:99.9000 )
X-Pstn-Status: off
X-Pn-Pstn: Spam 1
X-Pn-Virusfiltered: by PlusNet MXCore (v4.00)

[#14]

Just on Postini, and first false positive:
Envelope-to: yyyyyy@xxxxxxxx.plus.com
Delivery-date: Sat, 09 Feb 2008 07:46:39 +0000
Received: from exprod5mx209.postini.com ([64.18.0.68] helo=psmtp.com)
    by pih-sunmxcore18.plus.net with smtp (PlusNet MXCore v2.00) id 1JNkQ2-0006Nr-Pn
    for yyyyyy@xxxxxxxx.plus.com; Sat, 09 Feb 2008 07:46:39 +0000
Received: from source ([65.115.210.86]) by exprod5mx209.postini.com ([64.18.4.14]) with SMTP;
    Sat, 09 Feb 2008 01:46:37 CST
Received: from imail71 ([172.16.10.104]) by imail21 with Microsoft SMTPSVC(6.0.3790.1830);
    Sat, 9 Feb 2008 01:47:05 -0600
Message-ID: <9259839.1202543196455.JavaMail.SYSTEM@imail71>
Date: Sat, 9 Feb 2008 01:46:36 -0600 (CST)
From: Benny Hinn Ministries <Partnership@imail.BennyHinn.org>
To: yyyy@xxxxxx.plus.com
Subject: [-SPAM-] Spirit-Driven Success...and You!
Mime-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Mailer: ColdFusion MX Application Server
X-OriginalArrivalTime: 09 Feb 2008 07:47:05.0870 (UTC) FILETIME=[F74B62E0:01C86AEF]
X-pstn-neptune: 4/3/0.75/79
X-pstn-levels: (S: 0.06189/99.00586 CV:99.9000 )
X-pstn-status: off
X-pn-pstn: Spam 1
X-PN-Spam-Filtered: by PlusNet MXCore (v4.00)

Well-known Christian organisation mailing list sent this. Have reported it as Not Spam

[#15]

Some more false positives:
Envelope-to: yyyy@xxxx.plus.com
Delivery-date: Sat, 09 Feb 2008 01:29:14 +0000
Received: from exprod5mx218.postini.com ([64.18.0.77] helo=psmtp.com)
    by pih-sunmxcore12.plus.net with smtp (PlusNet MXCore v2.00) id 1JNeWn-0005AC-Mg
    for yyyy@xxxx.plus.com; Sat, 09 Feb 2008 01:29:14 +0000
Received: from source ([216.127.40.137]) by exprod5mx218.postini.com ([64.18.4.10]) with SMTP;
    Fri, 08 Feb 2008 17:29:12 PST
From: GameHouse Newsletter <newsletter@gamehouse.com>
Subject: [-SPAM-] GameHouse Newsletter: Cate West - The Vanishing Files, Fishing Craze, & Around the World in 80 Days
To: <yyyy@xxxx.plus.com>
Message-Id: <M6757R63547.P0@gamehouse.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="--GWG345Boundary"
X-pstn-neptune: 3/1/0.33/69
X-pstn-levels: (S: 0.09656/99.25960 CV:99.9000 )
X-pstn-status: off
X-pn-pstn: Spam 1
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)

Envelope-to: xxxx@xxxx.plus.com
Delivery-date: Fri, 08 Feb 2008 22:20:36 +0000
Received: from exprod5mx251.postini.com ([64.18.0.171] helo=psmtp.com)
    by pih-sunmxcore14.plus.net with smtp (PlusNet MXCore v2.00) id 1JNbaE-0006TP-Kb
    for xxxx@xxxx.plus.com; Fri, 08 Feb 2008 22:20:35 +0000
Received: from source ([62.128.138.245]) (using TLSv1) by exprod5mx251.postini.com ([64.18.4.14]) with SMTP;
    Fri, 08 Feb 2008 16:20:31 CST
Received: from agent by mx1.pur3.net with local (Exim 4.67)
    (envelope-from <agent@ukex10.pur3.net>)
    id 1JNbaB-0003gM-9u
    for xxxx@xxxx.plus.com; Fri, 08 Feb 2008 22:20:31 +0000
To: xxxx@xxxx.plus.com
Subject: [-SPAM-] Valentines Day Gift Ideas
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="alternative_73a6e91978841789c37c31d5f78bd42b"
Content-Transfer-Encoding: 7bit
From: "Eurobatteries" <eurobatteries@spoton-email.com>
Reply-To: "Eurobatteries" <eurobatteries@spoton-email.com>
X-MailId: {~B83807454261852083813~}
Message-Id: <E1JNbaB-0003gM-9u@mx1.pur3.net>
Date: Fri, 08 Feb 2008 22:20:31 +0000
X-pstn-neptune: 4/2/0.50/82
X-pstn-levels: (S: 0.02692/98.56993 CV:99.9000 )
X-pstn-status: off
X-pn-pstn: Spam 1
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)

Envelope-to: xxxx@xxxx.plus.com
Delivery-date: Fri, 08 Feb 2008 19:07:37 +0000
Received: from exprod5mx212.postini.com ([64.18.0.71] helo=psmtp.com)
    by fhw-sunmxcore07.plus.net with smtp (PlusNet MXCore v2.00) id 1JNYZV-0005Jb-1z
    for xxxx@xxxx.plus.com; Fri, 08 Feb 2008 19:07:37 +0000
Received: from source ([81.255.72.210]) by exprod5mx212.postini.com ([64.18.4.11]) with SMTP;
    Fri, 08 Feb 2008 11:05:32 PST
Message-Id: <6fqpth$16hnbqk@mailer4.fotovista.com>
To: xxxx@xxxx.plus.com
Subject: [-SPAM-] =?ISO-8859-1?Q?A_250_GB_external_hard_drive_for_just_=A379!?=
From: PIXmania.com <promouk@pixmania.org>
Content-Transfer-Encoding: binary
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-----=2vD86jxXC12NYGe5J"
Errors-To: <promouk@pixmania.org>
X-Priority: 3
X-Mailer: FotoVista
Date: Fri, 8 Feb 2008 15:47:26 +0100
X-pstn-levels: (S: 0.00000/95.18024 CV:99.9000 )
X-pstn-status: off
X-pn-pstn: Spam 1
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)

I realise some people would regard these as spam but they're all reputable sources from which you can unsubscribe if you would rather not have emails from them.