You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Michael Scheidell <mi...@secnap.com> on 2011/02/11 01:30:15 UTC
mx1.res.cisco.com a dynamic ip?
host mx1.res.cisco.com
mx1.res.cisco.com has address 208.90.57.13
$ host 208.90.57.13
13.57.90.208.in-addr.arpa domain name pointer mx1.res.cisco.com.
looks fine to me, why does this look to SA like a dynamic ip?
(TRIGGERED RDNS_DYNAMIC.)
what, because of 'res' in it? yes, they SHOUTED AT THE RECIPIENT, AND I
EXPLAINED DON'T DO THAT IN SUBJECT LINE, its rude.
sorry, sender, receiver are all confidential, but here is a debug:
(network and bayes tests pushed it past 5.0)
__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__CT,__CTYPE_HAS_BOUNDARY,
__CTYPE_MULTIPART,__CTYPE_MULTIPART_ANY,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,
__DOS_LINK,__DOS_RCVD_THU,__DOS_RELAYED_EXT,__ENV_AND_HDR_FROM_MATCH,__FORGED_RCVD_TRAIL,
__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_DATE,__HAS_MESSAGE_ID,__HAS_MSGID,__HAS_RCVD,__HAS_SUBJECT,
__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LOCAL_PP_NONPPURL,__MANY_RECIPS
,__MIME_ATTACHMENT,__MIME_BASE64,__MIME_CTYPE_TEXT,__MIME_HTML,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY
__MSGID_JAVAMAIL,__MSGID_OK_DIGITS,__NONEMPTY_BODY,__NO_REAL_NAME,__PART_STOCK_CD_F,
*__RCD_RDNS_MX_MESSY,__RDNS_INDICATOR_RES,*__SANE_MSGID,
__SENDER_BOT,__SUBSCRIPTION_INFO,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,
__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS,__TO_EQ_FROM_DOM,
__TO_EQ_FROM_DOM_1,__TO_NO_ARROWS_R,__TVD_MIME_ATT_TP
Content analysis details: (3.0 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.0 RELAY_COUNTRY_US Relayed through United States
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 HTML_MESSAGE BODY: HTML included in message
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
1.0 NO_REAL_NAME NO_REAL_NAME
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best in Email Security,2010: Network Products Guide
* King of Spam Filters, SC Magazine 2008
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
Re: mx1.res.cisco.com a dynamic ip?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Thu, 2011-02-10 at 19:30 -0500, Michael Scheidell wrote:
> host mx1.res.cisco.com
> mx1.res.cisco.com has address 208.90.57.13
> $ host 208.90.57.13
> 13.57.90.208.in-addr.arpa domain name pointer mx1.res.cisco.com.
>
> looks fine to me, why does this look to SA like a dynamic ip?
Kind of... irrelevant. In this context. Or rather, terribly confusing.
In your snippet, RDNS_DYNAMIC accounts for a score of 0.4 (score-set 1),
but you said that network tests and Bayes pushed it above the threshold.
That would be score-set 4, and this one rule scoring just shy of 1.0.
So, what are the real rules hit, the real scores? What weight did the
network rules and Bayes have? More than that 1.0? Which rule really
caused the FP here?
> sorry, sender, receiver are all confidential, but here is a debug:
> (network and bayes tests pushed it past 5.0)
> Content analysis details: (3.0 points, 5.0 required)
> 0.0 RELAY_COUNTRY_US Relayed through United States
> 1.6 SUBJ_ALL_CAPS Subject is all capitals
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 0.4 RDNS_DYNAMIC Delivered to internal network by host with
> dynamic-looking rDNS
> 1.0 NO_REAL_NAME NO_REAL_NAME
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: mx1.res.cisco.com a dynamic ip?
Posted by "Warren Togami Jr." <wt...@gmail.com>.
On 2/10/2011 2:30 PM, Michael Scheidell wrote:
> host mx1.res.cisco.com
> mx1.res.cisco.com has address 208.90.57.13
> $ host 208.90.57.13
> 13.57.90.208.in-addr.arpa domain name pointer mx1.res.cisco.com.
>
>
> looks fine to me, why does this look to SA like a dynamic ip?
>
> (TRIGGERED RDNS_DYNAMIC.)
>
> what, because of 'res' in it? yes, they SHOUTED AT THE RECIPIENT, AND I
> EXPLAINED DON'T DO THAT IN SUBJECT LINE, its rude.
>
The RDNS_DYNAMIC rule might be better to be replaced by the more precise
S25R-based patterns in KHOP_DYNAMIC. Care enough? Please file a bug
and look into the relative results of the masschecks to start an analysis.
Warren
Re: mx1.res.cisco.com a dynamic ip?
Posted by Sahil Tandon <sa...@FreeBSD.org>.
On Thu, 2011-02-10 at 19:30:15 -0500, Michael Scheidell wrote:
> host mx1.res.cisco.com
> mx1.res.cisco.com has address 208.90.57.13
> $ host 208.90.57.13
> 13.57.90.208.in-addr.arpa domain name pointer mx1.res.cisco.com.
>
> looks fine to me, why does this look to SA like a dynamic ip?
>
> (TRIGGERED RDNS_DYNAMIC.)
Probably __RDNS_INDICATOR_RES, which is included in the RDNS_DYNAMIC
meta rule definition.
> what, because of 'res' in it?
Apparently... from 20_dynrdns.cf:
# this hits a little ham, not too much though
header __RDNS_INDICATOR_RES X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:res|resnet|client)[\-\.]/i
--
Sahil Tandon <sa...@FreeBSD.org>