You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ragnar Paulson <ra...@wanware.com> on 2004/03/10 20:57:02 UTC
Spoofing, whitelist, whitelist_from_rcvd
There's been an lot of discussion lately about detection of forgeries ... however I wonder why the existing mechanisms don't work! In
the e-mail below this message apparently was "whitelisted" by the default "whitelist_from_rcvd" rules for amazon.com. I do not
have "amazon.com", nor "sun.com" in my personal whitelist. Yet from the 2nd line of the message it is apparent that this message
did not come "amazon.com" at all. It came from "va-hopewell2-15.adelphia.net". Why was this message given a -100 score?
Ragnar
Return-Path: <bd...@amazon.com>
Received: from amazon.com (va-hopewell2-15.adelphia.net [67.20.36.15] (may be forged))
by ns2.wanware.com (8.11.6p2/8.11.6) with SMTP id i2ABjFM15305
for <ra...@software.group.com>; Wed, 10 Mar 2004 06:45:15 -0500
Date: Wed, 10 Mar 2004 06:45:15 -0500
Message-Id: <20...@ns2.wanware.com>
From: WebMistress <iq...@sun.com>
To: ragnar <ra...@software.group.com>
Subject: Viewing & Interactive Participation
X-Priority: 3
X-MSMail-Priority: Normal
Reply-To: WebMistress <iq...@sun.com>
mime-version: 1.0
content-type: multipart/mixed;
boundary="qzsoft_directmail_seperator"
X-AntiVirus: checked by Vexira Milter 1.0.4; VAE 6.24.0.6; VDF 6.24.0.48
X-Spam-Status: No, hits=-90.0 required=3.0
tests=ADULT_SITE,BASE64_ENC_TEXT,BAYES_70,CLICK_BELOW,
COMPLETELY_FREE,HARDCORE_PORN,HTML_10_20,MIME_HTML_ONLY,
MISSING_MIMEOLE,OPT_IN_CAPS,PRIORITY_NO_NAME,TSG_WHITELIST,
USER_IN_WHITELIST
version=2.54-sentinet
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.54-sentinet (1.174.2.17-2003-05-11-exp)
X-Spam-Report: This mail is probably spam. The original message has been attached
along with this report, so you can recognize or block similar unwanted
mail in future. See http://spamassassin.org/tag/ for more details.
Content preview: Welcome to the Web's 2 most unique and talked about
Adult Content Sites designed for International Amateur Home Models and
Interactive Viewer Participation.
URI:http://www.als-amateurhomemodels.com/index.htm
ALS-AmateurHomeModels.com is Totally Free...No Cash...Checks...or
Credit Cards are ever needed to join the fun.
URI:http://www.alt-life-styles.com/alt_index.htm Alt-Life-Styles.com
offers Subscription Viewing & Interactive Viewer
Participation...featuring International HardCore Amateur Home Models
from around the world. Take a minute...stop by and see what all the
talk is about. You are receiving this Email based on a request to be
included on the Opt-In list. To Opt-Out and remove your address, please
URI:http://www.alt-life-styles.com/AHM Opt-Out Pg.htm Click here.
Thanks and have a great day! [...]
Content analysis details: (-90.00 points, 3 required)
HARDCORE_PORN (2.8 points) BODY: Possible porn - Hardcore Porn
ADULT_SITE (0.8 points) BODY: Possible porn - Adult Web Sites
OPT_IN_CAPS (0.4 points) BODY: Talks about opting in (capitalized version)
COMPLETELY_FREE (1.1 points) BODY: No such thing as a free lunch (2)
HTML_10_20 (1.2 points) BODY: Message is 10% to 20% HTML
BAYES_70 (2.3 points) BODY: Bayesian classifier says spam probability is 70 to 80%
[score: 0.7559]
BASE64_ENC_TEXT (1.8 points) RAW: Message text disguised using base-64 encoding
USER_IN_WHITELIST (-100.0 points)From: address is in the user's white-list
MIME_HTML_ONLY (0.1 points) Message only has text/html MIME parts
MISSING_MIMEOLE (0.1 points) Message has X-MSMail-Priority, but no X-MimeOLE
CLICK_BELOW (0.0 points) Asks you to click below
PRIORITY_NO_NAME (0.4 points) Message has priority setting, but no X-Mailer
TSG_WHITELIST (-1.0 points) Received headers do not indicate forgery, and USER_IN_WHITELIST
--qzsoft_directmail_seperator
Content-Type: text/html;
charset="DEFAULT"
Content-Transfer-Encoding: base64
V2VsY29tZSB0byB0aGUgV2ViJ3MgMiBtb3N0IHVuaXF1ZSBhbmQgdGFsa2VkIGFib3V0IEFkdWx0
IENvbnRlbnQgU2l0ZXMgZGVzaWduZWQgZm9yIEludGVybmF0aW9uYWwgQW1hdGV1ciBIb21lIE1v
ZGVscyBhbmQgSW50ZXJhY3RpdmUgVmlld2VyIFBhcnRpY2lwYXRpb24uICA8YSBocmVmPSJodHRw
Oi8vd3d3LmFscy1hbWF0ZXVyaG9tZW1vZGVscy5jb20vaW5kZXguaHRtIj5BTFMtQW1hdGV1ckhv
bWVNb2RlbHMuY29tPC9hPiBpcyBUb3RhbGx5IEZyZWUuLi5ObyBDYXNoLi4uQ2hlY2tzLi4ub3Ig
Q3JlZGl0IENhcmRzIGFyZSBldmVyIG5lZWRlZCB0byBqb2luIHRoZSBmdW4uICA8YSBocmVmPSJo
dHRwOi8vd3d3LmFsdC1saWZlLXN0eWxlcy5jb20vYWx0X2luZGV4Lmh0bSI+QWx0LUxpZmUtU3R5
bGVzLmNvbTwvYT4gb2ZmZXJzIFN1YnNjcmlwdGlvbiBWaWV3aW5nICYgSW50ZXJhY3RpdmUgVmll
d2VyIFBhcnRpY2lwYXRpb24uLi5mZWF0dXJpbmcgSW50ZXJuYXRpb25hbCBIYXJkQ29yZSBBbWF0
ZXVyIEhvbWUgTW9kZWxzIGZyb20gYXJvdW5kIHRoZSB3b3JsZC4gIFRha2UgYSBtaW51dGUuLi5z
dG9wIGJ5IGFuZCBzZWUgd2hhdCBhbGwgdGhlIHRhbGsgaXMgYWJvdXQuICBZb3UgYXJlIHJlY2Vp
dmluZyB0aGlzIEVtYWlsIGJhc2VkIG9uIGEgcmVxdWVzdCB0byBiZSBpbmNsdWRlZCBvbiB0aGUg
T3B0LUluIGxpc3QuICBUbyBPcHQtT3V0IGFuZCByZW1vdmUgeW91ciBhZGRyZXNzLCBwbGVhc2Ug
PGEgaHJlZj0iaHR0cDovL3d3dy5hbHQtbGlmZS1zdHlsZXMuY29tL0FITSBPcHQtT3V0IFBnLmh0
bSI+Q2xpY2s8L2E+IGhlcmUuICBUaGFua3MgYW5kIGhhdmUgYSBncmVhdCBkYXkh
--qzsoft_directmail_seperator--
Re: Spoofing, whitelist, whitelist_from_rcvd
Posted by Theo Van Dinter <fe...@kluge.net>.
On Wed, Mar 10, 2004 at 02:57:02PM -0500, Ragnar Paulson wrote:
> did not come "amazon.com" at all. It came from "va-hopewell2-15.adelphia.net". Why was this message given a -100 score?
> version=2.54-sentinet
First, upgrade to 2.63. :)
--
Randomly Generated Tagline:
And thank you most of all for nuclear power, which is yet to cause a
single proven fatality, at least in this country.
-- Homer Simpson
Oh Brother, Where Art Thou?
Re: {SPAM} Spoofing, whitelist, whitelist_from_rcvd
Posted by Matt Kettler <mk...@evi-inc.com>.
At 02:57 PM 3/10/2004, Ragnar Paulson wrote:
>There's been an lot of discussion lately about detection of forgeries ...
>however I wonder why the existing mechanisms don't work! In
>the e-mail below this message apparently was "whitelisted" by the default
>"whitelist_from_rcvd" rules for amazon.com. I do not
>have "amazon.com", nor "sun.com" in my personal whitelist. Yet from the
>2nd line of the message it is apparent that this message
>did not come "amazon.com" at all. It came from
>"va-hopewell2-15.adelphia.net". Why was this message given a -100 score?
>
>Ragnar
<snip>
>X-Spam-Status: No, hits=-90.0 required=3.0
> tests=ADULT_SITE,BASE64_ENC_TEXT,BAYES_70,CLICK_BELOW,
> COMPLETELY_FREE,HARDCORE_PORN,HTML_10_20,MIME_HTML_ONLY,
> MISSING_MIMEOLE,OPT_IN_CAPS,PRIORITY_NO_NAME,TSG_WHITELIST,
> USER_IN_WHITELIST
> version=2.54-sentinet
I hate to be blunt.. but you are running a seriously old version of SA, one
which has a well known bug in whitelist_from_rcvd that was fixed quite a
long time ago with the release of 2.60...
http://bugzilla.spamassassin.org/show_bug.cgi?id=846
Perhaps you should consider upgrading. After all, the SA-devs can fix bugs
all they want and it does you no good if you don't download current
versions of SA.