some things get [mis-] labeled as Spam (was: Re: IPCOP)

Thu Feb 8 18:21:12 MST 2007

On 2/7/07, Craig White <craigwhite at azapple.com> wrote:
>
> On Wed, 2007-02-07 at 19:55 -0700, Mike Schwartz wrote:
>
> >         ----
> >         I don't know how Google scored it - there didn't seem to be
> >         anything
> >         amiss or that would cause it to score a big number with
> >         spamassassin but
> >         generally, spamassassin configuration would include the
> >         scoring
> >         information in the headers if it scored high enough to be
> >         flagged as
> >         spam. Thus if you want to contribute information back to the
> >         OP - you
> >         should include the spamassassin scores which will indicate
> >         which
> >         rulesets marked it as spam.
> >
> >         Craig
> >         ---------------------------------------------------
> >         PLUG-discuss mailing list - [...]
> >
> > another comment from Mike:
> > Maybe it had something to do with those "dotted quad"
> > IP addresses (which some e-mail systems,
> > including gmail apparently, turn in to clickable hyper
> > links, to a URL with  Prefix of "http://", and the IP
> > address instead of a domain name, and just a "/"
> > suffix).
> >     Some Spam messages probably tend to contain
> > URLs with a [numeric] IP address where the domain
> > name usually goes.  Maybe there is some robot "rule"
> > that "cries wolf" when it spots anything even remotely
> > like that.
> >     It might also be affected by the fact that, going to
> > the PLUG-Discuss list, it was probably seen many
> > times, that is, several copies of the message being
> > sent to different subscribers.
> >     Just a guess...
> ----
> Mike - you missed my point.
>
> There is no need/reason to guess at all.
>
> Unless someone takes extra measures to prevent this (and it would be
> foolish to do so), the actual scoring of an e-mail that is scored
> sufficiently to register as spam will include the actual rules and the
> score values for triggering those rules in the header and I know that
> gmail has an option to view all of the header information (like all
> other programs, the headers are minimized by default). If you choose to
> view all of the headers, you will see the spamassassin scoring and can
> report back specifically.
>
> Why indulge in speculation when the reality is in front of you?
>
> Craig
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change  you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>

OK, I may have misunderstood.
I am not familiar with Spamassassin and the only
way I know of to get the "full headers" for a message
in my gmail mailbox, is to use the feature called
"show original" - - which I do not do very often.
 /// ======= start of "show original" ======== ///

[68.14.243.59])
        by mx.google.com with ESMTP id 3si1712779aga.2007.02.07.10.20.59;
        Wed, 07 Feb 2007 10:21:13 -0800 (PST)
Received-SPF: neutral (google.com: 68.14.243.59 is neither permitted
nor denied by best guess record for domain of
plug-discuss-bounces at lists.plug.phoenix.az.us)
Received: from lists.plug.phoenix.az.us (lists [127.0.0.1])
	by pluglist.macrosift.com (Postfix) with ESMTP id 9ABA51475E9;
	Wed,  7 Feb 2007 09:55:55 -0700 (MST)
X-Original-To: plug-discuss at lists.plug.phoenix.az.us
Delivered-To: plug-discuss at lists.plug.phoenix.az.us
Received: from mout.perfora.net (mout.perfora.net [217.160.230.41])
	by pluglist.macrosift.com (Postfix) with ESMTP id 41CA31475C7
	for <plug-discuss at lists.plug.phoenix.az.us>;
	Wed,  7 Feb 2007 09:55:53 -0700 (MST)
Received: from [68.110.173.194] (helo=[10.0.0.102])
	by mrelay.perfora.net (node=mrelayus0) with ESMTP (Nemesis),
	id 0MKoyl-1HErPR2B77-0007bT; Wed, 07 Feb 2007 13:20:47 -0500
Subject: IPCOP
From: ssjgolleta <ssjgolleta at anima-web.us>
To: Main PLUG discussion list <plug-discuss at lists.plug.phoenix.az.us>
In-Reply-To: <64260277-E3BF-46C6-9E98-A94CDC5D100A at garfias.org>
References: <64260277-E3BF-46C6-9E98-A94CDC5D100A at garfias.org>
Date: Wed, 07 Feb 2007 11:22:01 -0700
Message-Id: <1170872521.5258.14.camel at APANB102>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.1
X-Provags-ID: perfora.net abuse at perfora.net
	login:cf1dc9ed7ee1e09bc6211c4f099c02a4
X-Provags-ID2: V01U2FsdGVkX18ssCSldlOYuqpQL5rJuScZRgjcd6yuT6/Ox48Qe/BqueDnJ1FHNK+ADeG6aY/S9PWCiHB/fGkd/xePSi6Xp6WZY0YBqD2eryp2eKG/CCDnExtEclmOBBHhISqLKVyM5jc=
X-BeenThere: plug-discuss at lists.plug.phoenix.az.us
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ssjgolleta at anima-web.us,
	Main PLUG discussion list <plug-discuss at lists.plug.phoenix.az.us>
List-Id: Main PLUG discussion list <plug-discuss.lists.plug.phoenix.az.us>
List-Unsubscribe:
<http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss>,
	<mailto:plug-discuss-request at lists.plug.phoenix.az.us?subject=unsubscribe>
List-Archive: <http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss>
List-Post: <mailto:plug-discuss at lists.plug.phoenix.az.us>
List-Help: <mailto:plug-discuss-request at lists.plug.phoenix.az.us?subject=help>
List-Subscribe: <http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss>,
	<mailto:plug-discuss-request at lists.plug.phoenix.az.us?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: plug-discuss-bounces at lists.plug.phoenix.az.us
Errors-To: plug-discuss-bounces at lists.plug.phoenix.az.us

  /// =======  end  of "show original" ======== ///
This may not be exactly what you meant.
(perhaps I would have have to ask it to
 "show original", before clicking on "Not Spam"
  to move it to my INBOX?)
(if so, is it too late now?)
(just wondering...)
Could this stuff be the key important lines? :

X-Provags-ID: perfora.net abuse at perfora.net
	login:cf1dc9ed7ee1e09bc6211c4f099c02a4
X-Provags-ID2: V01U2FsdGVkX18ssCSldlOYuqpQL5rJuScZRgjcd6yuT6/Ox48Qe/BqueDnJ1FHNK+ADeG6aY/S9PWCiHB/fGkd/xePSi6Xp6WZY0YBqD2eryp2eKG/CCDnExtEclmOBBHhISqLKVyM5jc=

I have seen some "scoring" info, in the "full headers",
for a message sent to my "acm.org" account, which
is a "forwarding" address.
The acm.org folks use postini.com to do their spam
detection.  I currently have it set up to "forward" only
if (it thinks) a given message should go to my INBOX.
If it thinks it is junk, then it puts it in a "quarantine"
place, where I can still get to it (I do occasionally find
a real e-mail there, like one about 2 weeks ago from
my first cousin in CHIcago who was notifying about
200 of her closest friends / relatives, about some
change of address...)
The messages that get processed by postini.com have
some detailed scoring information in their [full] headers,
but I usually do not delve in to it too deeply;  I just
click on "deliver"
(which is like saying, [this message is] "Not Spam" - so
   please "deliver" it now, that is, forward it);
and then there is a little checkbox to white-list the
sender, which I typically do, if I am asking them to
"deliver" a certain message, ie, get it out of quarantine.
    Anyway, if the stuff I included above is what you
meant, then please proceed to explain what it is saying
and/or, use your powers for good "in some way".
   Thanks,
-- 
Mike Schwartz
Glendale  AZ
schwartz at acm.org
Mike.L.Schwartz at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss/attachments/20070208/e1f1fa31/attachment-0001.htm 