http://bugzilla.spamassassin.org/show_bug.cgi?id=4505
------- Additional Comments From [EMAIL PROTECTED] 2005-07-30 17:08 -------
> I'll be reviewing the BSP-other and HABEAS_ACCREDITED_COI spam hits
> later today.
> BSP-other misclassified ham: 11
Message-ID: <[EMAIL PROTECTED]> -- no idea
how this obvious ham got into the corpus as spam.
Message-ID:
<[EMAIL PROTECTED]>
Ditto.
Message-ID: <[EMAIL PROTECTED]>
From [EMAIL PROTECTED], pure advertising/marketing newsletter to a
%%%
user (Godaddy customer) who sa-learned this as spam, apparently
wanting only domain registration data and not sales fluff. Only have
the one godaddy.com email in the "sa-learned as spam" corpus. have 7
others that were classified as spam, obvious marketing newsletters.
Well over 90% of all godaddy newsletters are in the ham corpus (or
unclassified), and none of their functional emails dealing with
registrations and specific domains are flagged as spam (about 40% of
all godaddy emails are unclassified, the remainder ham, except for
these 8).
Message-ID: <[EMAIL PROTECTED]>
From: PayPal <[EMAIL PROTECTED]>
Subject: Annual Privacy and Electronic Fund Transfer Rights Notice
X-Header-CompanyDBUserName: paypal
Errors-To: [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
X-Header-MasterId: 900764
X-Header-Versions: [EMAIL PROTECTED]
X-Originating-IP: [206.165.246.83]
X-Sender-Nameserver: ns3.yahoo.com ns4.yahoo.com ns5.yahoo.com ns1.yahoo.com
ns2.yahoo.com em
X-Spam-Status: Yes, score=106.1 required=5.0 tests=BAYES_00,DCC_CHECK,
DIGEST_MULTIPLE,HTML_20_30,HTML_MESSAGE,MIME_HTML_ONLY,OPT_IN,
PYZOR_CHECK,RCVD_IN_BSP_OTHER,SARE_FORGED_PAYPAL,SARE_FORGED_PAYPAL_C,
SP_HAM_VERY autolearn=no version=3.0.4
Content looks like it came from PayPal, and I don't see any phishing
links within, but the received header trail has nothing to do with
any paypal or ebay system -- the only servers listed in the received
chain are yahoo.com (starting at milter101.store.sc5.yahoo.com). I'm
guessing this was sent to an email address within the yahoo store
system, which auto-forwarded to the owner's address on our system,
and the Yahoo system *stripped* all evidence that this actually came
from paypal, causing our phish alarms to go off. 64 identical emails
came through, most as ham, some unclassified, this was the only one
flagged as spam.
> BSP-other questionable entries: 4
Message-ID: <[EMAIL PROTECTED]>
From [EMAIL PROTECTED], associated with democracyinaction.org
Fed to sa-learn as spam by user RI. Religious/Political newsletter,
of 7 emails in my corpus, 4 have been sa-learned by this user as
spam, one to this user is unclassified, one to this user is
classified as ham (not sa-learned), and one is classified as ham to
a different user.
> BSP-other definite spam: 1
Message-ID: <[EMAIL PROTECTED]> --
guaranteed phish. Internal link to <a
href="http://www.paypallk.com:680/paypal.php"; style="font-family:
monospace; font-size: 10pt;">Click here to confirm your account</a>
> HABEAS_ACCREDITED_COI misclassified ham: 12
Message-ID: <[EMAIL PROTECTED]>
From: FreeCreditProfile <[EMAIL PROTECTED]> count: 12
> HABEAS_ACCREDITED_COI questionable entries: 32
Message-Id: [EMAIL PROTECTED]
southbeachdiet.com email mentioned previously. Count: 1
Message-ID: <[EMAIL PROTECTED]>
In general, @ientrynetwork.net newsletters are very spammy. One user
religiously places his newsletters flagged as spam into sa-learn as
ham, but no others do so. Count: 8
Message-Id: <[EMAIL PROTECTED]>
No message id from sender. Count: 22
From [EMAIL PROTECTED],
Subject: Your future, revealed!
"The Tickle Newsletter is an email service designed with you in mind
— it's the only email all about you. We think you're going to
love it." Sure sounds like an introduction to spam. Contents look
very spammy as well.
Message-ID: <[EMAIL PROTECTED]>
FROM: Reservation Rewards Customer Service
<[EMAIL PROTECTED]>
SUBJECT: As requested, your Membership Kit for Reservation Rewards, please
login today
X-Spam-Status: Yes, score=12.5 required=5.0 tests=BANG_GUARANTEE,BAYES_00,
CALL_FREE,CT_ACT_NOW,CT_DO_IT_TODAY,CT_OFFERS_ETC,CT_OFFER_3,
CT_PERCENT,DNS_FROM_AHBL_RHSBL,FORGED_RCVD_HELO,HABEAS_USER,
HTML_50_60,HTML_MESSAGE,LINK_PHRASE,MAILTO_LINK,
MIME_HEADER_CTYPE_ONLY,NO_COST,ORDER_NOW,SARE_BOUNDARY_LC,SAVE_MONEY,
SAVE_UP_TO,SP_SPAM_VERY,URI_OFFERS autolearn=no version=3.0.4
User CR; If she signed up, then this membership confirmation was not
spam. However, this confirmation dated July 3 is followed by a
billing notice dated July 17, and then confirmation of the user's
cancellation dated July 17. Cannot tell whether the original was
spam, but user seems to have no interest in the service.
> HABEAS_ACCREDITED_COI definite spam: 0
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
