Hi Patrick I've only just installed ASSP but based on my understanding of other mail systems the HELO message is checked against the reverse DNS of the IP address connecting, so in almost all cases it is a valid check as this should match.
Dave > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:assp-user- > [EMAIL PROTECTED] On Behalf Of Patrick Butts > Sent: Monday, 26 February 2007 5:22 a.m. > To: ASSP > Subject: [Assp-user] Frustrated - Forged Helo > > Please forgive the long email. I got this email and it says it was spam > and it is.... So it works, but I'm still not understanding the > mechanics. So if you can, please answer my questions and forgive my not > understanding please. I'm trying to wrap my head around this stuff. I > don't think it is calling it spam for the right reasons. > > From - Sun Feb 25 08:37:57 2007 > X-Account-Key: account3 > X-UIDL: 145721 > X-Mozilla-Status: 0001 > X-Mozilla-Status2: 00000000 > Return-Path: <[EMAIL PROTECTED]> > Received: from ASSP.nospam ([127.0.0.1]) > by fait.homeip.net > with hMailServer ; Sun, 25 Feb 2007 08:35:56 -0500 > Received: from 67.106.80.124 ([67.106.80.124] > helo=m7.dailydealwirenews.com) > by ASSP.nospam; 25 Feb 2007 08:35:49 -0500 > Message-ID: <[EMAIL PROTECTED]> > From: "Dept Store Extravaganza" > <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: [spam] Shop Macy's with a FREE $500 gift card - good in stores > or online! > Date: Sun, 25 Feb 2007 07:35:38 -0600 > Reply-To: "Dept Store Extravaganza" > <[EMAIL PROTECTED]> > MIME-Version: 1.0 > Content-Type: text/html; charset="iso-8859-1" > Content-Transfer-Encoding: 7bit > X-Assp-Spam-Prob: 1.00000 > X-Assp-Envelope-From: [EMAIL PROTECTED] > X-Assp-Intended-For: [EMAIL PROTECTED] > X-Assp-Spam: YES > X-Assp-Spam-Reason: Helo invalid(forged):'m7.dailydealwirenews.com' > X-Intended-For: [EMAIL PROTECTED] > > It says that it got a hit on a forged helo. The helo is > m7.dailydealwirenews.com. Is it checking against the "from" or > "reply-to" address which is dailydealwirenews.com? If the answer is > yes, > I imagine that there are legitimate senders who's helo's might not > exactly match their from or return address. > > These are my settings for that section. > denySenderRe:= > DoDomainCheck:=3 > DoFakedLocalHelo:=1 > DoFakedNP:= > DoFakedWL:= > DoInvalidFormatHelo:=3 > DoInvalidPTR:=3 > DoNoSpoofing:= > DoNoValidLocalSender:=3 > DoReversed:=3 > DoValidFormatHelo:=3 > heloBlacklistIgnore:=hermes.buddyshare.org > HeloMismatch:= > invalidFormatHeloRe:=\d+[_.-]\d+[_.-]|^[^.]+\.?$|dynamic|ddns|dns\.org$ > invalidPTRRe:=^\d+\.\d+\.\d+\.\d+$|^[^\.]+\.?$ > myServerRe:=jackson|fait.homeip.net|192.168.| > SenderInvalidError:=554 5.7.7 REASON . > useHeloBlacklist:=0 > ValidateSenderLog:=1 > validFormatHeloRe:=^(([a-z\d][a-z\d\-]*)?[a-z\d]\.)+[a-z]{2,6}$ > > Is there anything wrong with them? I thought I shouldn't be getting > heloforged errors since I turned off everything but check local. Well > not off, but score only. But these aren't PB failures, so it's not a > score problem. Can you tell me what I need to change so that Helo > checking works for me or how to turn it off so it's not checking and > failing on just the helo? I would even settle for a "it's working fine > and this particular one was a forged helo". However, if that is the > answer, can you tell me why it is still checking? > > This is what Mail Analyzer said when I ran the source. > It did hit on the ASSP tag but Kevin had said that it ignores the X- > Assp > headers. Also, why is not saying it's forged here? > > *Feature Matching:* > > ** Red RE <http://192.168.1.10:55555/#redRe>*: 'X-Assp-Spam: YES' > ** Valid Format of HELO > <http://192.168.1.10:55555/#DoValidFormatHelo>*: > 'm7.dailydealwirenews.com' > ** 67.106.80 has a greylist value of *: (adds ) > > Classification Influences: *** positive, *** negative, *** subjective, > *** neutral > ----------------------------------------------------------------------- > - > > *Bayesian Analysis:* > > *Bad Words* *Bad Prob * *Good Words* *Good Prob* > > > ssub spam 0.0000 > > > spam ssub 0.0000 > href 102 1.0000 > > href uns 1.0000 > > uns href 1.0000 > > href 17939678 1.0000 > > 102 atxt 1.0000 > > atxt offer 0.9999 > > offer atxt 0.9999 > > fait.homeip.net from 0.9998 > > atxt mta 0.9997 > > mta atxt 0.9997 > > ssub rrp 0.9992 > > rrp ssub 0.9992 > > good ssub 0.9991 > > > > x-mozilla-status2 00000000 0.0014 > > > 2007 x-mozilla-status2 0.0014 > > > 08 37 0.0025 > > > 00000000 ssub 0.0055 > > > feb 25 0.0055 > > > 0 href 0.0129 > 101 atxt 0.9823 > > > > Totals: 0.0000 0.0000 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000 0.9999 > 0.9999 0.9998 0.9997 0.9997 0.9992 0.9992 0.9991 0.0014 0.0014 0.0025 > 0.0055 0.0055 0.0129 0.9823 0.9804 0.9804 0.0213 0.9737 0.9737 0.9442 > 0.9442 0.9442 > ----------------------------------------------------------------------- > - > > *Spam/Ham Probabilities:* > > *spamprobability*: 0.0000000000000000000000000000165661695984 > *hamprobability*: 0.0000000000000000000000000000000000000000 > *combined probability*: > 1.0000000000000000000000000000000000000000 > *bayesian confidence*: 0.0000000000000000000000000000165661695984 > > > > > > ----------------------------------------------------------------------- > -- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance to share > your > opinions on IT & business topics through brief surveys-and earn cash > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVD > EV > _______________________________________________ > Assp-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/assp-user ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
