some things get [mis-] labeled as Spam (was: Re: IPCOP)

[Mike Schwartz]

On 2/7/07, Craig White <craig at tobyhouse.com> wrote:
>
> On Wed, 2007-02-07 at 12:07 -0700, Mike Schwartz wrote:
> > On 2/7/07, ssjgolleta <ssjgolleta at anima-web.us> wrote:
> >         Anyone here has any experience with IPCOP?
> >
> >         I'm trying to set up a firewall using IPCOP and 3 network
> >         cards. I'm
> >         testing the firewall at the moment from inside the network so
> >         its
> >         plugged to a network switch instead of the modem (for the
> >         moment).
> >
> >         After configuring the firewall here is my set up:
> >         Green(eth0)-MailScanner warning: numerical links are often
> >         malicious:192.168.0.1 with dhcp server installed
> >         Orange(eth1) - MailScanner warning: numerical links are often
> >         malicious:192.168.1.1
> >         Red(eth2) - MailScanner warning: numerical links are often
> >         malicious:10.0.0.1
> >
> >         I have Red plugged in to my network switch, Green to a small
> >         switch, and
> >         Orange to another switch. So far, when I log into the server
> >         itself I
> >         can ping google.com fine. When I plug a computer to the switch
> >         on the
> >         green, I can't see the server or even get an IP. Do I need to
> >         have
> >         anything special like a crossover cable or anything?
> >         ---------------------------------------------------
> >         PLUG-discuss mailing list -[...]
> >
> > just FYI:
> > I read Craig's reply to this, before I ever saw this message.
> > (See above).
> > I was wondering why...;  now, I know.
> >
> > Within my mailbox on Google, the reply from Carig showed
> > up in my "INBOX", but for some reason
> > (I do not know why),
> > this original question [see above] got stored by gmail
> > in to my folder labeled for "Spam".
> >
> > I don't know whether there is anything you can / anything you
> > "need to" do about that, ssjgolleta;
> > so this is just "F Y I".
> >
> > [...]
> ----
> I don't know how Google scored it - there didn't seem to be anything
> amiss or that would cause it to score a big number with spamassassin but
> generally, spamassassin configuration would include the scoring
> information in the headers if it scored high enough to be flagged as
> spam. Thus if you want to contribute information back to the OP - you
> should include the spamassassin scores which will indicate which
> rulesets marked it as spam.
>
> Craig
> ---------------------------------------------------
> PLUG-discuss mailing list - [...]
>

another comment from Mike:
Maybe it had something to do with those "dotted quad"
IP addresses (which some e-mail systems,
including gmail apparently, turn in to clickable hyper
links, to a URL with  Prefix of "http://", and the IP
address instead of a domain name, and just a "/"
suffix).
    Some Spam messages probably tend to contain
URLs with a [numeric] IP address where the domain
name usually goes.  Maybe there is some robot "rule"
that "cries wolf" when it spots anything even remotely
like that.
    It might also be affected by the fact that, going to
the PLUG-Discuss list, it was probably seen many
times, that is, several copies of the message being
sent to different subscribers.
    Just a guess...
-- 
Mike Schwartz
Glendale  AZ
schwartz at acm.org
Mike.L.Schwartz at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss/attachments/20070207/53af3a17/attachment-0001.htm