Unmarked SPAM - very obvious

fishter · ‎26-06-2007

I got the following in an email header which was marked as "innocent"
My own SpamAssassin rated it as a score of 27, where under 5 is not spam.

Envelope-to: xx@xx
Delivery-date: Fri, 31 Aug 2007 18:35:58 +0000
Message-ID: <002f01c7ebff$0edc3990$e0405ad4@lsbjg.on>
From: <yy@yy>
To: <xx@xx>
Subject: dude this is not even on MTV yet
Date: Fri, 31 Aug 2007 13:45:10 -0500
MIME-Version: 1.0
Content-Type: text/plain;
        format=flowed;
        charset="windows-1252";
        reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
x-open-relay: 74.135.102.144 is in a black list at bl.spamcop.net
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)
X-DSPAM-Result: Innocent
X-DSPAM-Processed: Fri Aug 31 19:35:58 2007
X-DSPAM-Confidence: 0.5697
X-DSPAM-Improbability: 1 in 133 chance of being spam
X-DSPAM-Probability: 0.0000
X-DSPAM-Factors: 27,
	Delivery-date*31+Aug, 0.00759,
	Date*Fri+31, 0.00863,
	To*fishter.org.uk>, 0.99000,
	Received*fishter.org.uk, 0.99000,
	Received*45+10, 0.01000,
	Received*10+0500, 0.01000,
	Envelope-to*fishter.org.uk, 0.99000,
	my+server, 0.01000,
	Date*31+Aug, 0.01169,
	Received*0500, 0.01761,
	Received*31+Aug, 0.02679,
	Received*31+Aug, 0.02679,
	Received*45, 0.03809,
	server+This, 0.03832,
	Received*13+45, 0.04430,
	Received*31, 0.07800,
	Received*31, 0.07800,
	Click+on, 0.08310,
	server, 0.08790,
	x-open-relay*is, 0.91095,
	x-open-relay*a, 0.91095,
	x-open-relay*black+list, 0.91095,
	x-open-relay*list, 0.91095,
	x-open-relay*bl.spamcop.net, 0.91095,
	x-open-relay*at, 0.91095,
	x-open-relay*at+bl.spamcop.net, 0.91095,
	x-open-relay*black, 0.91095

linux · ‎23-08-2007

Spam filters are not 100% reliable. Nor will they ever be. Nor can they ever be. Deal with it.

fishter · ‎26-06-2007

I'm not complaining, I'm hoping that someone more knowledgeable than me can look at the information and determine whether or not the particular mail server that handled it was working properly.
To my mind, any spam detection solution that notes that the mail came from an open relay and is still only 1 in 133 chance of being spam is broken.
I've already forwarded the mail to the training address and it's been "learnt" by my own spam solution. I'm just trying to do as much as possible to stop the ever-rising tide of rubbish that we seem to collect in our inboxes, whether it's our own careless fault or the result of malicious attacks like the one PlusNet suffered.

carrot63 · ‎12-07-2007

Quote from: linux
Spam filters are not 100% reliable. Nor will they ever be. Nor can they ever be.

No, but they certainly can do considerably better than the PN spam system, which barely scrapes 60% accuracy. The OPs query seems quite fair to me.

Quote from: linux
Deal with it.

Bit harsh perhaps? We do all deal with it on a daily basis, usually more than once a day. Which tends to reinforce the opinion that spam filtering of PN mail is very much less accurate than the average, particularly in regard to false positives.

dave · ‎04-04-2007

Hi,
The open relay tag isn't actually used as part of the determination, it's in the mail header as a piece of legacy information from when it was used. Dspam will pick up on it and use it as one or more of the factors.
It's always difficult running spam filtering on userbase where there's this many users, we have in excess of a million mailboxes. Spam filtering will often work better on a local level because it will base the spam detection and learn from just the mail that you get whereas the filtering we do is based on learning from mail sent in by a limited selection of customers so there are no guarantees that it will learn that the spam you are getting is spam (or not spam as the case may be) as quick. A local filter you can stick three spams in and it will pick up straight away any more are spam, but three out of the thousands that are sent to the spam address may not be learnt.
I sometimes think that the best way of filtering spam is for everyone to run a local spam filter, maybe something that reminds me of how the TV ratings are calculated. A sub-section of customers all run local spam filtering using Spamassassin or similar and train their local clients with the spam/not spam and their results are collated hourly/daily to use on the customer base as a whole. I've no idea if that could work, but what do you think? You're determining the spam of a million customers based on the spam of say 500, you can still have the spam/not spam addresses for everyone to use.

Dave Tomlinson
Enterprise Architect - Network & OSS
Plusnet Technology

Strat · ‎14-04-2007

In our company I run a network of some 20 users.
I enabled f9 spam filtering a few weeks ago and my 'customers' are really noticing the difference.
I could have taken all the glory for easing their lives but I confessed.
It makes more work for me checking for false positives cleaning the spam box two or three times a day but that's life.
I did have reservations about it when first announced but now I find it well worth while.
Dick

Windows 10 Firefox 109.0 (64-bit)
To argue with someone who has renounced the use of reason is like administering medicine to the dead - Thomas Paine

fishter · ‎26-06-2007

@Dave
I think it sounds like a good idea. However, I think it's already been implemented in Razor. It's a collaborative database of spam.

dave · ‎04-04-2007

Interesting, that's worth a look at.

Dave Tomlinson
Enterprise Architect - Network & OSS
Plusnet Technology

zubel · ‎08-06-2007

As is DCC. I mentioned it before.
Plusnet could even run their own DCC server to allow flooding of checksums to other servers and help the worldwide spam problem - I'm sure you guys process enough messages to qualify

Maybe two suggestions for PugIT?
B.

spraxyt · ‎06-04-2007

Quote from: Barry
Maybe two suggestions for PugIT?

Thanks for this suggestion. I've noted the two filtering suggestions in the PUG forums (here) with a view to adding this as a PUGIT issue.
David

David

MrToast · ‎31-07-2007

But if these check sum schemes started to have effect the SPAMers would just use the ever increasing botnet processing power to generate more diverse content.... wouldn't they.
Better to work on reputations for legitimate email sources?

zubel · ‎08-06-2007

Quote from: MrToast
But if these check sum schemes started to have effect the SPAMers would just use the ever increasing botnet processing power to generate more diverse content.... wouldn't they.

Spammers are already working on generating more diverse content. I would suggest this would be "one more string to the fiddle" in the anti-spam solution

Quote from: MrToast
Better to work on reputations for legitimate email sources?

Again - the "one more string" theory

B.

pdavidson · ‎08-06-2007

Quote from: fishter
@Dave
I think it sounds like a good idea. However, I think it's already been implemented in Razor. It's a collaborative database of spam.

I'm glad Razor has already come up. I use a webmail client that has fantastic spam filtering - had a look at some of the headers yesterday and noticed that the filtering was from Razor. I hadn't got around to mentioning it to anyone yet.
/slaps own wrist
It's definitely one to look at.

Unmarked SPAM - very obvious

Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious

Re: Unmarked SPAM - very obvious