Please forgive the long email. I got this email and it says it was spam
and it is.... So it works, but I'm still not understanding the
mechanics. So if you can, please answer my questions and forgive my not
understanding please. I'm trying to wrap my head around this stuff. I
don't think it is calling it spam for the right reasons.
From - Sun Feb 25 08:37:57 2007
X-Account-Key: account3
X-UIDL: 145721
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <[EMAIL PROTECTED]>
Received: from ASSP.nospam ([127.0.0.1])
by fait.homeip.net
with hMailServer ; Sun, 25 Feb 2007 08:35:56 -0500
Received: from 67.106.80.124 ([67.106.80.124] helo=m7.dailydealwirenews.com)
by ASSP.nospam; 25 Feb 2007 08:35:49 -0500
Message-ID: <[EMAIL PROTECTED]>
From: "Dept Store Extravaganza"
<[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: [spam] Shop Macy’s with a FREE $500 gift card – good in stores
or online!
Date: Sun, 25 Feb 2007 07:35:38 -0600
Reply-To: "Dept Store Extravaganza"
<[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Assp-Spam-Prob: 1.00000
X-Assp-Envelope-From: [EMAIL PROTECTED]
X-Assp-Intended-For: [EMAIL PROTECTED]
X-Assp-Spam: YES
X-Assp-Spam-Reason: Helo invalid(forged):'m7.dailydealwirenews.com'
X-Intended-For: [EMAIL PROTECTED]
It says that it got a hit on a forged helo. The helo is
m7.dailydealwirenews.com. Is it checking against the "from" or
"reply-to" address which is dailydealwirenews.com? If the answer is yes,
I imagine that there are legitimate senders who's helo's might not
exactly match their from or return address.
These are my settings for that section.
denySenderRe:=
DoDomainCheck:=3
DoFakedLocalHelo:=1
DoFakedNP:=
DoFakedWL:=
DoInvalidFormatHelo:=3
DoInvalidPTR:=3
DoNoSpoofing:=
DoNoValidLocalSender:=3
DoReversed:=3
DoValidFormatHelo:=3
heloBlacklistIgnore:=hermes.buddyshare.org
HeloMismatch:=
invalidFormatHeloRe:=\d+[_.-]\d+[_.-]|^[^.]+\.?$|dynamic|ddns|dns\.org$
invalidPTRRe:=^\d+\.\d+\.\d+\.\d+$|^[^\.]+\.?$
myServerRe:=jackson|fait.homeip.net|192.168.|
SenderInvalidError:=554 5.7.7 REASON .
useHeloBlacklist:=0
ValidateSenderLog:=1
validFormatHeloRe:=^(([a-z\d][a-z\d\-]*)?[a-z\d]\.)+[a-z]{2,6}$
Is there anything wrong with them? I thought I shouldn't be getting
heloforged errors since I turned off everything but check local. Well
not off, but score only. But these aren't PB failures, so it's not a
score problem. Can you tell me what I need to change so that Helo
checking works for me or how to turn it off so it's not checking and
failing on just the helo? I would even settle for a "it's working fine
and this particular one was a forged helo". However, if that is the
answer, can you tell me why it is still checking?
This is what Mail Analyzer said when I ran the source.
It did hit on the ASSP tag but Kevin had said that it ignores the X-Assp
headers. Also, why is not saying it's forged here?
*Feature Matching:*
*• Red RE <http://192.168.1.10:55555/#redRe>*: 'X-Assp-Spam: YES'
*• Valid Format of HELO <http://192.168.1.10:55555/#DoValidFormatHelo>*:
'm7.dailydealwirenews.com'
*• 67.106.80 has a greylist value of *: (adds )
Classification Influences: *•* positive, *•* negative, *•* subjective,
*•* neutral
------------------------------------------------------------------------
*Bayesian Analysis:*
*Bad Words* *Bad Prob * *Good Words* *Good Prob*
ssub spam 0.0000
spam ssub 0.0000
href 102 1.0000
href uns 1.0000
uns href 1.0000
href 17939678 1.0000
102 atxt 1.0000
atxt offer 0.9999
offer atxt 0.9999
fait.homeip.net from 0.9998
atxt mta 0.9997
mta atxt 0.9997
ssub rrp 0.9992
rrp ssub 0.9992
good ssub 0.9991
x-mozilla-status2 00000000 0.0014
2007 x-mozilla-status2 0.0014
08 37 0.0025
00000000 ssub 0.0055
feb 25 0.0055
0 href 0.0129
101 atxt 0.9823
Totals: 0.0000 0.0000 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000 0.9999
0.9999 0.9998 0.9997 0.9997 0.9992 0.9992 0.9991 0.0014 0.0014 0.0025
0.0055 0.0055 0.0129 0.9823 0.9804 0.9804 0.0213 0.9737 0.9737 0.9442
0.9442 0.9442
------------------------------------------------------------------------
*Spam/Ham Probabilities:*
*spamprobability*: 0.0000000000000000000000000000165661695984
*hamprobability*: 0.0000000000000000000000000000000000000000
*combined probability*: 1.0000000000000000000000000000000000000000
*bayesian confidence*: 0.0000000000000000000000000000165661695984
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user
