cancel
Showing results for 
Search instead for 
Did you mean: 

Blacklisted spam not being marked

Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Blacklisted spam not being marked

I've started a new thread on this topic as it's getting buried under all the angry discussion the "Very dodgy spam email situation [Part 6]" thread (which I'd rather not be associated with). Hope that's OK with the mods.

I have spam protection switched on but several emails from blacklisted IP addresses have come through to me without being marked [-SPAM-].
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
123 REPLIES
Mand
Grafter
Posts: 5,560
Thanks: 1
Registered: 05-04-2007

Blacklisted spam not being marked

Hi there,

Do you get other emails which are marked as spam?
Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Blacklisted spam not being marked

Yes, the majority of spam is marked as such. There are a few others besides those from blacklisted IPs that fall through the net but there always will be some that do.

Most that don't get marked, whether from blacklisted IPs or not, are the sort that talk about stocks and shares and stuff like that.
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Blacklisted spam not being marked

Had a look through my Trash folder and see that it's not all the spam from blacklisted IPs that isn't being marked either, just some of it. Seems a bit random.
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
MrToast
Grafter
Posts: 550
Registered: 31-07-2007

Blacklisted spam not being marked

I don't know how the PN filter works (so I choose not to use it)

However, you shouldn't use an IP block list as a certain indicator of SPAM. Other factors should also be considered when 'scoring' the probability that an Email is SPAM. Otherwise you will get a lot of false positives.

For example look out for the messages we see on the forum from time to time where people are complaining that their genuine mail doesn't get through because the PN relay is on someones list.
Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Blacklisted spam not being marked

But these are definitely spam (ie totally unsolicited and including 'nonsense' text) and anyway I thought PlusNet were now marking emails from blacklisted IPs as such.

Yes, we've had emails to friends in Australia blocked by BigPond.net at times but it eventually gets through.
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
holdtight
Grafter
Posts: 1,634
Registered: 15-06-2007

Blacklisted spam not being marked

Yes im getting a lot of spam thats not been tagged going into my inbox too that like you is very clearly unsolicited spam with nonsense text included

I would say its probably on a ratio of about 70/30, 30 being the untagged spam mail which is quite a lot for the filter to be missing
Community Veteran
Posts: 14,469
Registered: 30-07-2007

Blacklisted spam not being marked

No spam filter is 100% reliable and the spammers are always finding ways to get around current spam detection technology.
holdtight
Grafter
Posts: 1,634
Registered: 15-06-2007

Blacklisted spam not being marked

Yeah i know its just that the untagged mail seems to have increased by a fair amount recently

Its still manageable though and i keep forwarding all untagged to spam@despamchecker.plus.com so hopefully it will reduce a bit
br1anstorm
Grafter
Posts: 113
Registered: 24-06-2007

Blacklisted spam not being marked

I have the PN spam filter on, but I'm still getting a few spam emails not tagged by PN as [-SPAM-]. Two out of five today sneaked through untagged.

I'm not too upset. Filters have to learn, and I have forwarded both to spam@despamchecker.plus.com.

My query is about forwarding. Is it better to forward spam which arrives untagged (as the PN guidance seems to suggest) - or is it better to copy the spam message header and paste that in or send it on as a Notepad attachment?

Can PN confirm that the latter action (copying and sending the header) is acceptable? I'd prefer it, as it means I don't have to open the spam message, whereas forwarding it means I have to open it first.

holmside33
Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Blacklisted spam not being marked

Quote
No spam filter is 100% reliable and the spammers are always finding ways to get around current spam detection technology.

But isn't the PlusNet filter supposed to be marking anything from a blacklisted IP address?

Personally, since this recent influx of spam, I've set my Mail filter to dump anything with 'X-Open-Relay' containing 'black list' into my Spam folder from where I can delete it along with the rest, but when anything marked spam starts being left on the mail server, these will still get downloaded if they're not marked.

As a matter of course, I forward any unmarked spam to the PlusNet despamchecker address, complete with expanded headers.
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Blacklisted spam not being marked

This is the latest to get through unmarked

X-Open-Relay: 81.200.1.130 is in a black list at bl.spamcop.net
X-Pn-Virusfiltered: by PlusNet MXCore (v4.00)
X-Dspam-Result: Innocent
X-Dspam-Processed: Tue May 22 01:28:04 2007
X-Dspam-Confidence: 0.5127
X-Dspam-Improbability: 1 in 106 chance of being spam
X-Dspam-Probability: 0.0000

It has the subject line "Best medications from the best suppliers here." and is just a jpg linking to a website (which I have not clicked on!)

It purports to come from Mexico (ie the spoofed email address) but is actually from Russia.
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
Stuart22
Grafter
Posts: 37
Registered: 10-10-2007

Blacklisted spam not being marked

That is strange the X-Open line saying it is on a blacklist but then the X-DSPAM decides there is a 1:106 chance it is spam.

Looking at the headers of recently received spam, two very similar emails were classified very differently by DSPAM, one with a 1:105 chance of being spam and the other a 1:113 chance of being ham (I assume non-spam). Again the first of the two mails the one not classified as spam had the X-open blacklist line in it
Community Veteran
Posts: 1,160
Thanks: 1
Registered: 01-08-2007

Blacklisted spam not being marked

I've had quite a few like that, which is why I decided to post about it. Does seem very strange to me.
Plusnet user since November 2003
Currently on Unlimited Fibre Extra and Unlimited UK & Mobile Calls
Community Veteran
Posts: 1,012
Registered: 01-08-2007

Blacklisted spam not being marked

How did this one get through the Filter then?

Subject: My girl now loves to perform o s (I've left out the actual words used)

Date: Tue, 22 May 2007 16:17:38 +0800
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2462.1409
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2462.0000
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)
X-DSPAM-Result: Innocent
X-DSPAM-Processed: Tue May 22 08:13:49 2007
X-DSPAM-Confidence: 0.5102
X-DSPAM-Improbability: 1 in 105 chance of being spam


1 in 105 chance of being spam - I don't think so. I forward it on to despamchecker though.

Also this morning I received 2 SPAM tagged emails to a mail box I deleted last week. My catch all is turned off so how can that happen? Can someone from PlusNet please respond.