Re: some things get [mis-] labeled as Spam (was: Re: IPCOP)

Top Page
Attachments:
Message as email
+ (text/plain)
+ (text/html)
+ (text/plain)
Delete this message
Reply to this message
Author: Mike Schwartz
Date:  
To: Main PLUG discussion list
CC: Craig White, Mike L Schwartz
Subject: Re: some things get [mis-] labeled as Spam (was: Re: IPCOP)
On 2/7/07, Craig White <> wrote:
>
> On Wed, 2007-02-07 at 19:55 -0700, Mike Schwartz wrote:
>
> >         ----
> >         I don't know how Google scored it - there didn't seem to be
> >         anything
> >         amiss or that would cause it to score a big number with
> >         spamassassin but
> >         generally, spamassassin configuration would include the
> >         scoring
> >         information in the headers if it scored high enough to be
> >         flagged as
> >         spam. Thus if you want to contribute information back to the
> >         OP - you
> >         should include the spamassassin scores which will indicate
> >         which
> >         rulesets marked it as spam.

> >
> >         Craig
> >         ---------------------------------------------------
> >         PLUG-discuss mailing list - [...]

> >
> > another comment from Mike:
> > Maybe it had something to do with those "dotted quad"
> > IP addresses (which some e-mail systems,
> > including gmail apparently, turn in to clickable hyper
> > links, to a URL with  Prefix of "http://", and the IP
> > address instead of a domain name, and just a "/"
> > suffix).
> >     Some Spam messages probably tend to contain
> > URLs with a [numeric] IP address where the domain
> > name usually goes.  Maybe there is some robot "rule"
> > that "cries wolf" when it spots anything even remotely
> > like that.
> >     It might also be affected by the fact that, going to
> > the PLUG-Discuss list, it was probably seen many
> > times, that is, several copies of the message being
> > sent to different subscribers.
> >     Just a guess...
> ----
> Mike - you missed my point.

>
> There is no need/reason to guess at all.
>
> Unless someone takes extra measures to prevent this (and it would be
> foolish to do so), the actual scoring of an e-mail that is scored
> sufficiently to register as spam will include the actual rules and the
> score values for triggering those rules in the header and I know that
> gmail has an option to view all of the header information (like all
> other programs, the headers are minimized by default). If you choose to
> view all of the headers, you will see the spamassassin scoring and can
> report back specifically.
>
> Why indulge in speculation when the reality is in front of you?
>
> Craig
>
> ---------------------------------------------------
> PLUG-discuss mailing list -
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>


OK, I may have misunderstood.
I am not familiar with Spamassassin and the only
way I know of to get the "full headers" for a message
in my gmail mailbox, is to use the feature called
"show original" - - which I do not do very often.
/// ======= start of "show original" ======== ///

Delivered-To: 
Received: by 10.78.148.13 with SMTP id v13cs24699hud;
        Wed, 7 Feb 2007 10:21:14 -0800 (PST)
Received: by 10.70.113.13 with SMTP id l13mr16027635wxc.1170872473906;
        Wed, 07 Feb 2007 10:21:13 -0800 (PST)
Return-Path: <>
Received: from pluglist.macrosift.com (wsip-68-14-243-59.ph.ph.cox.net
[68.14.243.59])
        by mx.google.com with ESMTP id 3si1712779aga.2007.02.07.10.20.59;
        Wed, 07 Feb 2007 10:21:13 -0800 (PST)
Received-SPF: neutral (google.com: 68.14.243.59 is neither permitted
nor denied by best guess record for domain of
)
Received: from lists.plug.phoenix.az.us (lists [127.0.0.1])
    by pluglist.macrosift.com (Postfix) with ESMTP id 9ABA51475E9;
    Wed,  7 Feb 2007 09:55:55 -0700 (MST)
X-Original-To: 
Delivered-To: 
Received: from mout.perfora.net (mout.perfora.net [217.160.230.41])
    by pluglist.macrosift.com (Postfix) with ESMTP id 41CA31475C7
    for <>;
    Wed,  7 Feb 2007 09:55:53 -0700 (MST)
Received: from [68.110.173.194] (helo=[10.0.0.102])
    by mrelay.perfora.net (node=mrelayus0) with ESMTP (Nemesis),
    id 0MKoyl-1HErPR2B77-0007bT; Wed, 07 Feb 2007 13:20:47 -0500
Subject: IPCOP
From: ssjgolleta <>
To: Main PLUG discussion list <>
In-Reply-To: <>
References: <>
Date: Wed, 07 Feb 2007 11:22:01 -0700
Message-Id: <1170872521.5258.14.camel@APANB102>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.1
X-Provags-ID: perfora.net 
    login:cf1dc9ed7ee1e09bc6211c4f099c02a4
X-Provags-ID2: V01U2FsdGVkX18ssCSldlOYuqpQL5rJuScZRgjcd6yuT6/Ox48Qe/BqueDnJ1FHNK+ADeG6aY/S9PWCiHB/fGkd/xePSi6Xp6WZY0YBqD2eryp2eKG/CCDnExtEclmOBBHhISqLKVyM5jc=
X-BeenThere: 
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ,
    Main PLUG discussion list <>
List-Id: Main PLUG discussion list <plug-discuss.lists.plug.phoenix.az.us>
List-Unsubscribe:
<http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss>,
    <mailto:plug-discuss-request@lists.plug.phoenix.az.us?subject=unsubscribe>
List-Archive: <http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss>
List-Post: <mailto:plug-discuss@lists.plug.phoenix.az.us>
List-Help: <mailto:plug-discuss-request@lists.plug.phoenix.az.us?subject=help>
List-Subscribe: <http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss>,
    <mailto:plug-discuss-request@lists.plug.phoenix.az.us?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: 
Errors-To: 


/// ======= end of "show original" ======== ///
This may not be exactly what you meant.
(perhaps I would have have to ask it to
"show original", before clicking on "Not Spam"
to move it to my INBOX?)
(if so, is it too late now?)
(just wondering...)
Could this stuff be the key important lines? :

X-Provags-ID: perfora.net 
    login:cf1dc9ed7ee1e09bc6211c4f099c02a4
X-Provags-ID2: V01U2FsdGVkX18ssCSldlOYuqpQL5rJuScZRgjcd6yuT6/Ox48Qe/BqueDnJ1FHNK+ADeG6aY/S9PWCiHB/fGkd/xePSi6Xp6WZY0YBqD2eryp2eKG/CCDnExtEclmOBBHhISqLKVyM5jc=


I have seen some "scoring" info, in the "full headers",
for a message sent to my "acm.org" account, which
is a "forwarding" address.
The acm.org folks use postini.com to do their spam
detection.  I currently have it set up to "forward" only
if (it thinks) a given message should go to my INBOX.
If it thinks it is junk, then it puts it in a "quarantine"
place, where I can still get to it (I do occasionally find
a real e-mail there, like one about 2 weeks ago from
my first cousin in CHIcago who was notifying about
200 of her closest friends / relatives, about some
change of address...)
The messages that get processed by postini.com have
some detailed scoring information in their [full] headers,
but I usually do not delve in to it too deeply;  I just
click on "deliver"
(which is like saying, [this message is] "Not Spam" - so
   please "deliver" it now, that is, forward it);
and then there is a little checkbox to white-list the
sender, which I typically do, if I am asking them to
"deliver" a certain message, ie, get it out of quarantine.
    Anyway, if the stuff I included above is what you
meant, then please proceed to explain what it is saying
and/or, use your powers for good "in some way".
   Thanks,
-- 
Mike Schwartz
Glendale  AZ


---------------------------------------------------
PLUG-discuss mailing list -
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss