cancel
Showing results for 
Search instead for 
Did you mean: 

SPAM or Ham ?

Community Veteran
Posts: 1,139
Thanks: 4
Registered: 20-07-2007

SPAM or Ham ?

I've just been sending some test e-mails to myself. A couple of these weren't delivered and when I checked they had gone to my SPAM folder. I've forwarded these to notspam@despamchecker.plus.com however when I was copying the heeders I noticed that they had been assessed as 1 in 120 chance of being ham. I've pasted part of one of the headers below.

Is there a problem with the SPAM filter?

Bob

MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_000A_01C7B630.63013F20"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)
X-DSPAM-Result: Spam
X-DSPAM-Processed: Sun Jun 24 06:25:34 2007
X-DSPAM-Confidence: 0.5432
X-DSPAM-Improbability: 1 in 120 chance of being ham
X-DSPAM-Probability: 0.9999
X-DSPAM-Factors: 15,
4 REPLIES
lingbob
Grafter
Posts: 734
Registered: 05-04-2007

SPAM or Ham ?

From the short header snippet there's no way of telling why the spam filter thinks it's spam. If you can post the full headers that may give us a clue.
Community Veteran
Posts: 1,139
Thanks: 4
Registered: 20-07-2007

SPAM or Ham ?

I was more drawing attention to the fact that the SPAM filter was reporting ham rather than spam and was wondering if this was a fault. Thinking about this a bit more, surely all e-mail from PlusNet accounts should be trusted?

The full header is posted below.

Bob

Envelope-to: *******.co.uk
Delivery-date: Sun, 24 Jun 2007 06:25:34 +0000
Received: by pih-sunmxcore11.plus.net with spam-scanned (PlusNet MXCore v2.00) id 1I2LXS-0007UK-9C
for *******.co.uk; Sun, 24 Jun 2007 06:25:34 +0000
X-Daemon-Classification: SPAM
Received: from pih-relay04.plus.net ([212.159.14.131])
by pih-sunmxcore11.plus.net with esmtp (PlusNet MXCore v2.00) id 1I2LXS-0007UD-0I
for *******.co.uk; Sun, 24 Jun 2007 06:25:34 +0000
Received: from [87.114.0.145] (helo=youru2kzfib7pCool
by pih-relay04.plus.net with smtp (Exim) id 1I2LUF-0000Wy-3k
for *******.co.uk; Sun, 24 Jun 2007 07:22:15 +0100
Message-ID: <000d01c7b628$015e41d0$0201a8c0@youru2kzfib7p8>
From: "Bob Boulby" <*******.plus.com>
To: <*******.co.uk>
Subject: [-SPAM-] To Bob
Date: Sun, 24 Jun 2007 07:22:13 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_000A_01C7B630.63013F20"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)
X-DSPAM-Result: Spam
X-DSPAM-Processed: Sun Jun 24 06:25:34 2007
X-DSPAM-Confidence: 0.5432
X-DSPAM-Improbability: 1 in 120 chance of being ham
X-DSPAM-Probability: 0.9999
X-DSPAM-Factors: 15,
Received*bob, 0.99212,
Received*for+bob, 0.99212,
To*<bob, 0.99000,
Date*24+Jun, 0.02034,
Received*24+Jun, 0.09406,
Received*Sun+24, 0.87376,
X-PN-VirusFiltered*(v4.00), 0.83177,
X-PN-VirusFiltered*MXCore+(v4.00), 0.83177,
Subject*Bob, 0.19179,
Date*Jun, 0.22247,
Message-ID*youru2kzfib7p8>, 0.23749,
Received*(helo=youru2kzfib7pCool, 0.23749,
Received*2007+06, 0.74694,
Date*0100, 0.25450,
Received*smtp+(Exim), 0.26673
Community Veteran
Posts: 1,139
Thanks: 4
Registered: 20-07-2007

SPAM or Ham ?

This is ridiculous. I've just sent another e-mail to myself and that has gone in to the SPAM folder as well.

Envelope-to: *********.co.uk
Delivery-date: Sun, 24 Jun 2007 10:26:49 +0000
Received: by fhw-sunmxcore01.plus.net with spam-scanned (PlusNet MXCore v2.00) id 1I2PIv-0000lQ-C9
for *********.co.uk; Sun, 24 Jun 2007 10:26:49 +0000
X-Daemon-Classification: SPAM
Received: from pih-relay04.plus.net ([212.159.14.131])
by fhw-sunmxcore01.plus.net with esmtp (PlusNet MXCore v2.00) id 1I2PIv-0000lA-04
for *********.co.uk; Sun, 24 Jun 2007 10:26:49 +0000
Received: from [87.114.0.145] (helo=youru2kzfib7pCool
by pih-relay04.plus.net with smtp (Exim) id 1I2PIu-0007Ri-GH
for *********.co.uk; Sun, 24 Jun 2007 11:26:48 +0100
Message-ID: <001101c7b64a$2b93a540$0201a8c0@youru2kzfib7p8>
From: "Bob Boulby" <*********.plus.com>
To: <*********.co.uk>
Subject: [-SPAM-] Website Links
Date: Sun, 24 Jun 2007 11:26:47 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_000E_01C7B652.8D343190"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)
X-DSPAM-Result: Spam
X-DSPAM-Processed: Sun Jun 24 10:26:49 2007
X-DSPAM-Confidence: 0.5421
X-DSPAM-Improbability: 1 in 119 chance of being ham
X-DSPAM-Probability: 0.9998
X-DSPAM-Factors: 15,
Received*for+bob, 0.99216,
Received*bob, 0.99216,
To*<bob, 0.99000,
Date*24+Jun, 0.02658,
Received*Sun+24, 0.92771,
Received*24+Jun, 0.12013,
&nbsp+<A, 0.14942,
X-PN-VirusFiltered*(v4.00), 0.81445,
X-PN-VirusFiltered*MXCore+(v4.00), 0.81445,
Date*Jun, 0.19107,
Received*10, 0.19549,
Received*11, 0.21952,
Date*47+0100, 0.22932,
Date*0100, 0.23979,
Received*24, 0.24629
N/A

SPAM or Ham ?

Quote
I was more drawing attention to the fact that the SPAM filter was reporting ham rather than spam and was wondering if this was a fault.
The filter that does this classifies the emails based on the contents of the email more than the subject or from address. Words that are common in the contents of spam emails have a heavier weighting. So unfortunately the dSPAM seems to think your emails are more likely to be spam than ham (not spam) Sad

Quote
Thinking about this a bit more, surely all e-mail from PlusNet accounts should be trusted?
I'm afraid it's not possible:
1) A spammer could in theory have a PlusNet account(although PN would probably detect the tell-tale signs and kick them out).
2) Email addresses can be spoofed/faked - especially since many PN customer email addresses have now been harvested.
3) Some PN customer's PCs may be infected or part of botnets sending out emails without them knowing.