Re: {SPAM?} Re: [SLUG] {SPAM?} The spam tag

From: Ian Blenke (icblenke@nks.net)
Date: Tue Jun 08 2004 - 23:32:49 EDT


Robert Snyder wrote:

> Brian Coyle wrote:
>
>> It might be NKS rewriting the subject based on the SA score...
>
All mail through NKS is filtered through our MailAssistants to tag spam,
block viruses, and otherwise pre-treat email for ourselves and our
customers (we quite happily eat our own dogfood ;) The SpamAssassin
score is but once piece in the overall weighting and identification of
potential spam.

> Yeah but all my mail sent into the slug list....
>
> Could it be that NKS system flagging my email address maybe as it is
> a wierd one that I would personally think was a spoofed email if did
> not know verizon.
>
> I mean res03q8w@gte.net does seem a little wierd looking but that my
> isp email address.
>
>>> X-NKS-MailAssistant-SpamCheck: spam, SpamAssassin (score=11.488,
>>> required
>>> 6, FROM_HAS_MIXED_NUMS 0.26, FROM_HAS_MIXED_NUMS3 3.25,
>>> RATWR10_MESSID 0.65, RCVD_IN_DYNABLOCK 2.60, RCVD_IN_MAPS_DUL
>>> 1.00,
>>> RCVD_IN_NJABL 0.10, RCVD_IN_NJABL_DIALUP 3.54, RCVD_IN_SORBS
>>> 0.10)
>>>
>>
The weighting threshold is 6, the message had a score of 11.488. The one
you are really questioning is the following default SpamAssassin rule:

    # idea from Robert Menschel <RMSA@Menschel.net>
    header FROM_HAS_MIXED_NUMS3 From:addr =~
    /^[a-z]+\d+[a-z]+\d+[a-z]+\w*\@/i
    describe FROM_HAS_MIXED_NUMS3 From: contains numbers mixed in
    with letters

While this does add 3.25 to your potential score, it doesn't top a score
of 6 from this alone.

If you look closer, you will see the various RCVD_IN matches as well.
Apparently, your IP netblock is listed in various spam blacklists -
particularly the various public dialup lists. These lists are maintained
for transient IP blocks (typically DHCP blocks or PPP dialup banks) that
rotate through customers on an ongoing basis, causing much headache as
spammers come and go using those IP addresses.

Most of the weighting here is due to your ISP's netblock being
blacklisted on these lists.

- Ian

-----------------------------------------------------------------------
This list is provided as an unmoderated internet service by Networked
Knowledge Systems (NKS). Views and opinions expressed in messages
posted are those of the author and do not necessarily reflect the
official policy or position of NKS or any of its employees.



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 20:15:21 EDT