cancel
Showing results for 
Search instead for 
Did you mean: 

How did this arrive in my in box

pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

How did this arrive in my in box

marked as spam but in my inbox, and a weird time stamp - 18:52
Return-path: <onlineservices@co-operativebank.co.uk>
Envelope-to: cen@pierre.me.uk
Delivery-date: Sat, 07 Apr 2012 10:48:20 +0100
Received: from [212.159.8.109] (helo=avasin07.plus.net)
  by inmx01.plus.net with esmtp (PlusNet MXCore v2.00) id 1SGSFo-0002JK-GF
  for cen@pierre.me.uk; Sat, 07 Apr 2012 10:48:20 +0100
Received: from mail02.svc.cra.dublin.eircom.net ([159.134.118.18])
by avasin07.plus.net with Plusnet Cloudmark Gateway
id uxoJ1i0040Pu3mf01xoLAf; Sat, 07 Apr 2012 10:48:20 +0100
X-IPAS: Level4
X-CM-Score: 97.00
X-CNFS-Analysis: v=2.0 cv=d7l3OGfE c=1 sm=1 p=Pj7gaEMl/YKsLTWFy4EaZg==:17
p=Rh2UUiecki8A:10 a=gZo9cep4GH0A:10 a=yoQq94fuahoA:10 a=8EU9Q7FnrCoA:10
a=fAOtvBsNuICCvvfJdcIA:9 a=aoG5OoygrOB0LpyCa-IA:7 a=Ft8UYL4EG9YA:10
a=W6tnMkiJkaCI5LoI:21 a=_vzeRkncnx86wls8:21 a=gM8dZm07e9nNU9S3ITEA:9
a=IKIoO-ieCDEA:10 a=HDkPY6iSF9vpRgQ0UMYq9g==:117
Received: (qmail 37706 messnum 13431750 invoked from network[213.94.190.11/avas00.vendorsvc.cra.dublin.eircom.net]); 7 Apr 2012 09:48:18 -0000
Received: from avas00.vendorsvc.cra.dublin.eircom.net (213.94.190.11)
  by mail02.svc.cra.dublin.eircom.net (qp 37706) with SMTP; 7 Apr 2012 09:48:18 -0000
Received: from User ([86.43.80.181])
by avas00.vendorsvc.cra.dublin.eircom.net with Cloudmark Gateway
id uxo81i00R3uj0aW01xoBzS; Sat, 07 Apr 2012 10:48:18 +0100
From: "co-operativebank.co.uk"<onlineservices@co-operativebank.co.uk>
Date: Sat, 7 Apr 2012 10:52:11 -0700
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_00A8_01C2A9A6.2C4D7D04"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <E1SGSFo-0002JK-GF@inmx01.plus.net>
X-pn-pstn: Spam 4
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: [-SPAM-] New Co-operative Bank Account Review.
X-Antivirus: AVG for E-mail 2012.0.1913 [2409/4919]
X-AVG-ID: ID188DF8FE-7B1C2DE9
14 REPLIES 14
spraxyt
Resting Legend
Posts: 10,063
Thanks: 674
Fixes: 75
Registered: ‎06-04-2007

Re: How did this arrive in my in box

It looks like the message originated from a computer based on USA west coast (PDT timezone) but with the time set to look like Republic of Ireland time. That computer is logged on to an eircom IP (bot?), but, surprisingly the outgoing message appears to have been allowed by eircom's Cloudmark appliances since (Plusnet) incoming tagged it as spam.
The incoming Plusnet Cloudmark appliances have flagged it at spam with a score of 97.0. With the original implementation scores were either 0.0 (for not spam) or 100.0 (for spam), additional filters needed for in-between scores. So it looks like additional filtering has been introduced.
If your spam filter settings for that domain are set to move tagged messages to the Spam folder, it's not obvious why that didn't happen.
David
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: How did this arrive in my in box

I had a nearly identical one 38 minutes later to another of my mailboxes .
Normally any marked as spam end up in my Spam box

Return-path: <onlineservices@co-operativebank.co.uk>
Envelope-to: craft@pierre.idps.co.uk
Delivery-date: Sat, 07 Apr 2012 11:26:15 +0100
Received: from [212.159.8.109] (helo=avasin13.plus.net)
  by inmx03.plus.net with esmtp (PlusNet MXCore v2.00) id 1SGSqV-0002D2-NM
  for craft@pierre.idps.co.uk; Sat, 07 Apr 2012 11:26:15 +0100
Received: from mail20.svc.cra.dublin.eircom.net ([159.134.118.221])
by avasin13.plus.net with Plusnet Cloudmark Gateway
id uySD1i0094mhYLn01ySFM2; Sat, 07 Apr 2012 11:26:15 +0100
X-IPAS: Level4
X-CM-Score: 97.00
X-CNFS-Analysis: v=2.0 cv=BpgfMPr5 c=1 sm=1 p=Pj7gaEMl/YKsLTWFy4EaZg==:17
p=Rh2UUiecki8A:10 a=gZo9cep4GH0A:10 a=yoQq94fuahoA:10 a=8EU9Q7FnrCoA:10
a=fAOtvBsNuICCvvfJdcIA:9 a=aoG5OoygrOB0LpyCa-IA:7 a=Ft8UYL4EG9YA:10
a=W6tnMkiJkaCI5LoI:21 a=_vzeRkncnx86wls8:21 a=gM8dZm07e9nNU9S3ITEA:9
a=IKIoO-ieCDEA:10 a=//VeZUGbHF9PaEyW54c6eQ==:117
Received: (qmail 6285 messnum 122295 invoked from network[213.94.190.12/avas01.vendorsvc.cra.dublin.eircom.net]); 7 Apr 2012 10:26:13 -0000
Received: from avas01.vendorsvc.cra.dublin.eircom.net (213.94.190.12)
  by mail20.svc.cra.dublin.eircom.net (qp 6285) with SMTP; 7 Apr 2012 10:26:13 -0000
Received: from User ([86.43.80.181])
by avas01.vendorsvc.cra.dublin.eircom.net with Cloudmark Gateway
id uyS31i00Z3uj0aW01yS7Dd; Sat, 07 Apr 2012 11:26:13 +0100
From: "co-operativebank.co.uk"<onlineservices@co-operativebank.co.uk>
Date: Sat, 7 Apr 2012 11:30:06 -0700
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0039_01C2A9A6.5027BAE4"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <E1SGSqV-0002D2-NM@inmx03.plus.net>
X-pn-pstn: Spam 4
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: [-SPAM-] New Co-operative Bank Account Review.
X-Antivirus: AVG for E-mail 2012.0.1913 [2409/4920]
X-AVG-ID: ID489F170B-1AE556D7
spraxyt
Resting Legend
Posts: 10,063
Thanks: 674
Fixes: 75
Registered: ‎06-04-2007

Re: How did this arrive in my in box

Same origin, but as you said to different addresses. Did the second one also end up in that mailbox's inbox.
David
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: How did this arrive in my in box

Yes
five other the same day got to the spam box correctly
had some others previously from CoopBank, got 100% score, not via Dublin and they correctly went to the spam box  - strange
spraxyt
Resting Legend
Posts: 10,063
Thanks: 674
Fixes: 75
Registered: ‎06-04-2007

Re: How did this arrive in my in box

Have tagged messages correctly ending up in the spam folder always had a score of 100.0, whereas those going to inbox always had a score other than 100.0?
David
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: How did this arrive in my in box

this odd one with a spoofed address didnt gat spam tagged , but the CM score was 100  only got 20 tagged spam left and the are all 100
Return-path: <craft@pierre.me.uk>
Envelope-to: craft@pierre.me.uk
Delivery-date: Fri, 06 Apr 2012 10:27:52 +0100
Received: from [212.159.8.109] (helo=avasin15.plus.net)
  by inmx19.plus.net with esmtp (PlusNet MXCore v2.00) id 1SG5SS-0002Vz-ON
  for craft@pierre.me.uk; Fri, 06 Apr 2012 10:27:52 +0100
Received: from MAY17 ([113.162.138.104])
by avasin15.plus.net with Plusnet Cloudmark Gateway
id uZTo1i00G2FKytd01ZTrFC; Fri, 06 Apr 2012 10:27:52 +0100
X-BV-Spam-Flag: Yes
X-CM-Score: 100.00
X-CNFS-Analysis: v=2.0 cv=IK2A+3TG c=1 sm=1 p=mb5VgBaS9WDeBMVWK5WQTA==:17
p=iuNM4tOHAAAA:8 a=h4YAYXw6oJAA:10 a=8nJEP1OIZ-IA:10 a=YlZF8DRWAAAA:8
a=SSmOFEACAAAA:8 a=cR1LK3UMAAAA:8 a=c6u345Nel1p8Np1ilrUA:9
a=NVWw7tf9kSebEI6DG2EA:7 a=wPNLvfGTeEIA:10 a=_W_S_7VecoQA:10
a=mb5VgBaS9WDeBMVWK5WQTA==:117
To: <craft@pierre.me.uk>
From: <craft@pierre.me.uk>
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Message-ID: <E1SG5SS-0002Vz-ON@inmx19.plus.net>
Subject: craft@pierre.me.uk © Pf|zer Inc ® Discount-25575
X-Antivirus: AVG for E-mail 2012.0.1913 [2409/4917]
X-AVG-ID: ID1B45C4BE-1679E0DF
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: How did this arrive in my in box

just got another via Dublin, but this time scored 100 and ended in my spam box
Return-path: <online@co-operative.co.uk>
Envelope-to: craft@pierre.idps.co.uk
Delivery-date: Sun, 08 Apr 2012 18:31:27 +0100
Received: from [212.159.9.108] (helo=avasin08.plus.net)
  by inmx16.plus.net with esmtp (PlusNet MXCore v2.00) id 1SGvxX-00054k-RO
  for craft@pierre.idps.co.uk; Sun, 08 Apr 2012 18:31:27 +0100
Received: from mail00.svc.cra.dublin.eircom.net ([159.134.118.16])
by avasin08.plus.net with Plusnet Cloudmark Gateway
id vVXR1i0060MJj6701VXTbG; Sun, 08 Apr 2012 18:31:27 +0100
X-BV-Spam-Flag: Yes
X-IPAS: Level1
X-CM-Score: 100.00
X-CNFS-Analysis: v=2.0 cv=SY11h4tu c=1 sm=1 p=-4L7fI6f9ngA:10
a=rfhU4DurpSBCu75N5p4QCw==:17 a=oRRf1DvA7j8A:10 a=Eeb08FW8mmMA:10
a=8EU9Q7FnrCoA:10 a=AMCYFevvsJQitSneuxAA:9 a=8v5gJmWcqkI6G9qdFWgA:7
a=Ft8UYL4EG9YA:10 a=GrbKh9I2y4_tcoAi:21 a=Eo0f6b3Dw0GzMzIG:21
a=I-x7wUsyDbWeqMMDKmcA:9 a=IKIoO-ieCDEA:10 a=oEL4D5XDoZ3u2zDTU9r1HA==:117
Received: (qmail 44521 messnum 3874817 invoked from network[213.94.190.11/avas00.vendorsvc.cra.dublin.eircom.net]); 8 Apr 2012 17:31:25 -0000
Received: from avas00.vendorsvc.cra.dublin.eircom.net (213.94.190.11)
  by mail00.svc.cra.dublin.eircom.net (qp 44521) with SMTP; 8 Apr 2012 17:31:25 -0000
Received: from User ([86.43.78.61])
by avas00.vendorsvc.cra.dublin.eircom.net with Cloudmark Gateway
id vVX21i00B1KMjdy01VX53o; Sun, 08 Apr 2012 18:31:25 +0100
From: "co-operative.co.uk"<online@co-operative.co.uk>
Date: Sun, 8 Apr 2012 18:32:36 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_00BE_01C2A9A6.0F11F7F6"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <E1SGvxX-00054k-RO@inmx16.plus.net>
X-pn-pstn: Spam 1
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: [-SPAM-] New Changes To Your Internet Banking
X-Antivirus: AVG for E-mail 2012.0.1913 [2411/4922]
X-AVG-ID: ID5D624EB3-5433103F
ChrisL
Rising Star
Posts: 760
Thanks: 4
Fixes: 1
Registered: ‎13-12-2007

Re: How did this arrive in my in box

The first example, showing X-CM-Score: 97.00, was marked as X-pn-pstn: Spam 4.
What level do you have your spam sensitivity set to?  Spam 1 seems to be going to your spam folder, whereas Spam 4 seems to be going to your inbox.
Chris
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: How did this arrive in my in box

its currently set to 1, and even at that I have been having false positives
Anotherone
Champion
Posts: 19,107
Thanks: 457
Fixes: 21
Registered: ‎31-08-2007

Re: How did this arrive in my in box

Pierre, whilst you continue to publish email addresses in a public forum, surely you are asking for problems  Roll_eyes
pierre_pierre
Grafter
Posts: 19,757
Thanks: 3
Registered: ‎30-07-2007

Re: How did this arrive in my in box

I dont care, its not mine
Anotherone
Champion
Posts: 19,107
Thanks: 457
Fixes: 21
Registered: ‎31-08-2007

Re: How did this arrive in my in box

Huh Maybe I'm not fully awake, but perhaps I'm just losing the will to ,,,,,, If you've substituted a dummy address for the real one, why not say so, or make it obvious by using xxxxxx etc, otherwise what is the point of this thread, if it's not arriving in your Inox  Crazy
ChrisL
Rising Star
Posts: 760
Thanks: 4
Fixes: 1
Registered: ‎13-12-2007

Re: How did this arrive in my in box

Quote from: pierre_pierre
its currently set to 1, and even at that I have been having false positives

I think this explains why Spam 4 emails are going to your inbox. The question becomes: why are the subject-lines being marked as [-SPAM-]?
Chris
bobpullen
Community Gaffer
Community Gaffer
Posts: 16,869
Thanks: 4,950
Fixes: 315
Registered: ‎04-04-2007

Re: How did this arrive in my in box

I've refreshed the spam settings on your account Pierre so would be interested to know if this happens again ..?

Bob Pullen
Plusnet Product Team
If I've been helpful then please give thanks ⤵