Question on TO_MALFORMED

[Ma...@atcoitek.com]

Hi All,

I had a client receive an email which was marked as a spam email.  The
big hit on this was from the TO_MALFORMED.  This seems to be a away that
some of these vendors/lists send out messages.  I can add them to a
whitelist, but I thought I would just see if there is something better
than that I can do (sorry don't use bayes here)

Thanks

Microsoft Mail Internet Headers Version 2.0
Received: from atcoinss.atco.ca ([192.210.9.70]) by xxxx.atco.com with
Microsoft SMTPSVC(5.0.2195.6797);
	 Thu, 8 Sep 2005 08:35:53 -0600
Received: from atcoinss.atco.ca ([192.210.5.122])
 by atcoinss.atco.ca (SMSSMTP 4.0.0.59) with SMTP id
M2005090808354707874
 ; Thu, 08 Sep 2005 08:35:47 -0600
Received: from [206.71.72.15] (helo=weccmail.wecc.biz)
	by atcoinss.atco.ca with esmtp (Exim )
	id 1EDNVD-0004Qu-0j; Thu, 08 Sep 2005 08:35:47 -0600
Received: from [192.168.1.206] ([192.168.1.206]) by weccmail.wecc.biz
with Microsoft SMTPSVC(6.0.3790.211);
	 Thu, 8 Sep 2005 08:34:45 -0600
Mime-Version: 1.0 (Apple Message framework v734)
Content-Type: multipart/alternative; boundary=Apple-Mail-7--293489716
Message-Id: <53...@wecc.biz>
Cc: WECC Staff
From: WECC Weekly <we...@wecc.biz>
Subject: Possible Spam: WECC Weekly E-Newsletter
Date: Thu, 8 Sep 2005 08:34:41 -0600
To: Newsletter Subscribers,
 Newsletter list
X-Mailer: Apple Mail (2.734)
X-OriginalArrivalTime: 08 Sep 2005 14:34:45.0161 (UTC)
FILETIME=[75000190:01C5B482]
X-Spam-Prev-Subject: WECC Weekly E-Newsletter
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on
atcoinss.atco.ca
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.2 required=5.0
tests=BIZ_TLD,CLICK_BELOW_CAPS,
	HTML_50_60,HTML_MESSAGE,HTML_TAG_EXIST_TBODY,TO_MALFORMED 
	autolearn=disabled version=3.0.4
X-Spam-Report: 
	*  2.3 TO_MALFORMED To: has a malformed address
	*  0.7 CLICK_BELOW_CAPS BODY: Asks you to click below (in
capital letters)
	*  1.3 BIZ_TLD URI: Contains an URL in the BIZ top-level domain
	*  0.2 HTML_TAG_EXIST_TBODY BODY: HTML has "tbody" tag
	*  0.5 HTML_50_60 BODY: Message is 50% to 60% HTML
	*  0.2 HTML_MESSAGE BODY: HTML included in message
Return-Path: weekly@wecc.biz

--Apple-Mail-7--293489716
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=WINDOWS-1252;
	delsp=yes;
	format=flowed

--Apple-Mail-7--293489716
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=WINDOWS-1252


--Apple-Mail-7--293489716--

Re: Question on TO_MALFORMED

[Kris Deugau <kd...@vianet.ca>]

Martin.Carnegie@atcoitek.com wrote:
> I had a client receive an email which was marked as a spam email.  The
> big hit on this was from the TO_MALFORMED.  This seems to be a away
> that some of these vendors/lists send out messages.  I can add them to
> a whitelist, but I thought I would just see if there is something
> better than that I can do (sorry don't use bayes here)

> To: Newsletter Subscribers,
>  Newsletter list

Short of convincing the senders to fix their To: field, there's not much
you can do to actually fix the problem.

As workarounds, you can whitelist the senders or drop the score for
TO_MALFORMED, or (if you're more ambitious) some meta rules and subrules
to reduce the score for this sender hitting TO_MALFORMED.

Given the real problem, however, I'd guess that you may occasionally see
other problems with this/these sender(s).

(For instance, you can't use whitelist_to with them, which is one
"proper" way to whitelist a mailing list.)

>         *  2.3 TO_MALFORMED To: has a malformed address

Wow.  That's a big change from 2.64:

score TO_MALFORMED 0.345 0.274 0.907 0.640

-kgd
-- 
Get your mouse off of there!  You don't know where that email has been!