You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by R McGlue <r....@qub.ac.uk> on 2005/03/10 09:28:51 UTC

RCVD_IN_BSP_TRUSTED

Envelope-to: nursing@staffmail-b.qub.ac.uk
Delivery-date: Wed, 09 Mar 2005 11:59:11 +0000
h5rigo059m0f; Wed, 9 Mar 2005 11:59:06 +0000 (envelope-from 
<su...@hotmail.co.uk>)
Message-ID: <20...@win01>
Date: Wed, 9 Mar 2005 11:55:32 +0000 (GMT)
From: Alana Craig <su...@hotmail.co.uk>
To: nursing@qub.ac.uk
Subject: Updating my address book
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit


On 09/03/2005 11:55:32, Alana Craig (suggakisses@hotmail.co.uk) wrote:
 > Hello
 >
 >
 >
 > I would like to include your contact information in an address book I am
 > creating for myself. Please enter your particulars using the link you see
 > below:
 >
 >
 >
 > http://www.bebo.com/fr1/10076492a285606901b140803462c883765683d20


X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on baalam.qub.ac.uk
X-Spam-Level:
X-Spam-Status: No, score=-3.8 required=5.0 tests=BAYES_40,DNS_FROM_RFC_POST,
         RCVD_IN_BSP_TRUSTED autolearn=failed version=3.0.2

---- Start SpamAssassin results
SpamAssassin Version 3.0.2 on baalam.qub.ac.uk
-3.8 points, 5.0 required;
-1.1 BAYES_40               BODY: Bayesian spam probability is 20 to 40%
                             [score: 0.2605]
-4.3 RCVD_IN_BSP_TRUSTED    RBL: Sender is in Bonded Sender Program 
(trusted relay)
                       [IronPort Bonded Sender - 
<http://www.bondedsender.com>]
  1.6 DNS_FROM_RFC_POST      RBL: Envelope sender in 
postmaster.rfc-ignorant.org

---- End of SpamAssassin results


should this obvious spam be allowed in BSP??

Re: RCVD_IN_BSP_TRUSTED

Posted by Loren Wilton <lw...@earthlink.net>.

It looks to me like a probably legit birthday cards site, sending what is
supposed to be a legit request.

Now, from the name of the user, and the targeted address, it appears to be a
spammer/scammer misusing the site to try to harvest contact info.  Since the
sender (birthdayalarm.com) is bonded, the right thing to do would be to
notify them of the voilation so they can take appropriate action.

        Loren

RE: RCVD_IN_BSP_TRUSTED

Posted by Greg Allen <ga...@netrox.net>.

I have a fix for that....

score RCVD_IN_BSP_TRUSTED 0

I don't give big negative points to anyone. To each his own though.

-----Original Message-----
From: Robert Menschel [mailto:Robert@Menschel.net]
Sent: Thursday, March 10, 2005 8:29 PM
To: R McGlue
Cc: spamassassin-users@incubator.apache.org
Subject: Re: RCVD_IN_BSP_TRUSTED

Hello R,

Thursday, March 10, 2005, 12:28:51 AM, you wrote:

RM> From: Alana Craig <su...@hotmail.co.uk>
RM> Subject: Updating my address book

 >> I would like to include your contact information in an address book I am
 >> creating for myself. Please enter your particulars using the link you
see
 >> below:
 >> http://www.bebo.com/fr1/10076492a285606901b140803462c883765683d20

RM> X-Spam-Status: No, score=-3.8 required=5.0
RM> tests=BAYES_40,DNS_FROM_RFC_POST,
RM>          RCVD_IN_BSP_TRUSTED autolearn=failed version=3.0.2

RM> -4.3 RCVD_IN_BSP_TRUSTED    RBL: Sender is in Bonded Sender Program
RM> (trusted relay)
RM>                        [IronPort Bonded Sender -
RM> <http://www.bondedsender.com>]

RM> should this obvious spam be allowed in BSP??

Yes, since the sending site,
> Received: from mail01.birthdayalarm.com ([65.19.128.185])
is bonded.  However, because they're bonded, report it to
bondedsender, and let birthdayalarm.com pay the bonding penalty.

BTW, I'm collecting samples of this type of spam (we're getting a fair
amount of it here also), and hope to have rules ready for specific.cf
eventually.  It's tricky, since there ARE valid emails with almost
identical characteristics...

(As for is it spam -- chances are yes, from what I've seen. Identical
to non-spam, except non-spam often will have more personal content.
The purpose of the spam, as far as I can guess, is to obtain valid
email addresses from gullible suckers.)

Bob Menschel

Re: RCVD_IN_BSP_TRUSTED

Posted by Robert Menschel <Ro...@Menschel.net>.

Hello R,

Thursday, March 10, 2005, 12:28:51 AM, you wrote:

RM> From: Alana Craig <su...@hotmail.co.uk>
RM> Subject: Updating my address book

 >> I would like to include your contact information in an address book I am
 >> creating for myself. Please enter your particulars using the link you see
 >> below:
 >> http://www.bebo.com/fr1/10076492a285606901b140803462c883765683d20

RM> X-Spam-Status: No, score=-3.8 required=5.0
RM> tests=BAYES_40,DNS_FROM_RFC_POST,
RM>          RCVD_IN_BSP_TRUSTED autolearn=failed version=3.0.2

RM> -4.3 RCVD_IN_BSP_TRUSTED    RBL: Sender is in Bonded Sender Program
RM> (trusted relay)
RM>                        [IronPort Bonded Sender - 
RM> <http://www.bondedsender.com>]

RM> should this obvious spam be allowed in BSP??

Yes, since the sending site,
> Received: from mail01.birthdayalarm.com ([65.19.128.185])
is bonded.  However, because they're bonded, report it to
bondedsender, and let birthdayalarm.com pay the bonding penalty.

BTW, I'm collecting samples of this type of spam (we're getting a fair
amount of it here also), and hope to have rules ready for specific.cf
eventually.  It's tricky, since there ARE valid emails with almost
identical characteristics...

(As for is it spam -- chances are yes, from what I've seen. Identical
to non-spam, except non-spam often will have more personal content.
The purpose of the spam, as far as I can guess, is to obtain valid
email addresses from gullible suckers.)

Bob Menschel