Brett,
Bringing this to the dev list for SA as well. My reaction is that I
checked and those two tab rules haven't hit on my servers in over 60
days so it doesn't warrant much of a score.
I recommend you consider locally scoring these two rules lower such as
0.5 in the meantime.
Henrik, I'm adding a score 0.5 to your TAB_IN_FROM rule. I believe that
will limit it to that score as the highest possibility during mass checks.
Karsten, same thing for your KB_DATE_CONTAINS_TAB.
However, perhaps we want to add another meta such as the mailing list
portion of the existing rules?
Regards,
KAM
NOTE: Sample removed in case of privacy concerns.
On 12/9/2012 7:37 PM, Brett Porter wrote:
A further reply from the author, and a small number of other posts in our
mail-archives, seems to indicate that the MTA being used (zmailer) was
responsible for putting the tabs in those two fields.
- Brett
On 08/12/2012, at 8:00 AM, Kevin A. McGrail <[email protected]> wrote:
I had to look up the rule TAB_IN_FROM because I've never seen it. This is very
odd with these Tabs in the headers for From and Date apparently. Checking logs
and I have no hits on this rule.
The User-Agent is a bit confusing. Is this some sort of web-based mail client
form or something the person is using to try and subscribe?
Regards,
KAM
On 12/6/2012 10:17 PM, Brett Porter wrote:
It seems this user's client triggered a spam score due to tabs:
Date: Fri, 07 Dec 2012 01:11:33 +0000
From: Darryl Miles <[email protected]>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20121016
Firefox/16.0 SeaMonkey/2.13.1
MIME-Version: 1.0
I wasn't sure what to suggest other than using a different client. Any other
suggestions, or is this something we should adjust?
Thanks,
Brett
