[AccessD] Repeat Emails

John Colby jcolby at colbyconsulting.com
Wed Jun 11 18:24:55 CDT 2003


Uhhh... standard disclaimers are more and more prevalent.  Thus EVERY valid
email will end up being viewed as spam.  I use Cloudmark and SpamAssasin.
SpamAssasin puts a "[Spam]" in the subject as well as a lengthy discord on
why it seems to think it is spam.

Content analysis details:   (12.50 points, 8 required)
EXCUSE_3           (0.1 points)  BODY: Claims you can be removed from the
list
BANG_MORE          (0.5 points)  BODY: Talks about more with an exclamation!
RECEIVE_OFFER      (0.5 points)  BODY: Receive a special offer
EXCUSE_19          (0.9 points)  BODY: Claims you opted-in or registered
EXCUSE_1           (0.1 points)  BODY: Gives a lame excuse about why you
were sent this spam
OFFER              (0.1 points)  BODY: Free Offer
OFFERS_ETC         (0.6 points)  BODY: Stop with the offers, coupons,
discounts etc!
HTML_LINK_CLICK_HERE (0.1 points)  BODY: HTML link text says "click here"
HTML_60_70         (0.1 points)  BODY: Message is 60% to 70% HTML
HTML_WEB_BUGS      (0.1 points)  BODY: Image tag with an ID code to identify
you
HTML_MESSAGE       (0.1 points)  BODY: HTML included in message
HTML_IMAGE_ONLY_08 (0.9 points)  BODY: HTML has images with 600-800 bytes of
words
HTML_FONT_BIG      (0.1 points)  BODY: FONT Size +2 and up or 3 and up
HTML_IMAGE_RATIO_08 (0.3 points)  BODY: HTML has a low ratio of text to
image area
HTML_FONT_COLOR_BLUE (0.1 points)  BODY: HTML font color is blue
NORMAL_HTTP_TO_IP  (0.5 points)  URI: Uses a dotted-decimal IP address in
URL
RCVD_IN_NJABL      (1.0 points)  RBL: Received via a relay in
dnsbl.njabl.org
                   [RBL check: found 139.200.119.64.dnsbl.njabl.org., type:
127.0.0.4]
RCVD_IN_SBL        (0.6 points)  RBL: Received via SBLed relay, see
http://www.spamhaus.org/sbl/
                   [RBL check: found 139.200.119.64.sbl.spamhaus.org.]
RCVD_IN_OSIRUSOFT_COM (0.6 points)  RBL: Received via a relay in
relays.osirusoft.com
                   [RBL check: found 139.200.119.64.relays.osirusoft.com.,
type: 127.0.0.6]
X_OSIRU_SPAMWARE_SITE (1.1 points)  RBL: DNSBL: sender is a Spamware site or
vendor
FORGED_MUA_MOZILLA (2.5 points)  Forged mail pretending to be from Mozilla
MIME_HEADER_CTYPE_ONLY (1.4 points)  'Content-Type' found without required
MIME headers
CLICK_BELOW        (0.1 points)  Asks you to click below
MIME_HTML_ONLY     (0.1 points)  Message only has text/html MIME parts

SpamAssasin NEVER gives a false positive.  In fact the only false positives
I get out of Cloudmark is an occasional newsletter that it seems to think is
spam.

Between the two systems I get about 140 messages a day sent to the spam
folder.  It is so reliable that I simply go to the spam folder and delete
them all once daily.  I do occasionally just scan down them to make sure
nothing I want is there.  As I said, something like .5% false positives.

I end up with about 5-10 spams that don't get caught.  Cloudmark allows me
to "report" those to a database they use to decide what is spam (probably
why the occasional newsletter gets marked as spam).

AccessD got reported once by someone (to Cloudmark).  I "unreported it"
which allows them to get through to me.  Other than that, no AccessD
messages ever get sent to spam.

John W. Colby
www.colbyconsulting.com

-----Original Message-----
From: accessd-bounces at databaseadvisors.com
[mailto:accessd-bounces at databaseadvisors.com]On Behalf Of Stuart
McLachlan
Sent: Wednesday, June 11, 2003 6:34 PM
To: accessd at databaseadvisors.com
Subject: RE: [AccessD] Repeat Emails


If spam checkers start ignoring "standard disclaimers", spammers will
start sending messages with nothing but a "standard disclaimer"
containing their message  :-(

On 11 Jun 2003 at 10:25, John Colby wrote:

> Doesn't it seem we have the cart before the horse here?  If this is a
> standard disclaimer for businesses to use, shouldn't spam checkers ignore
> it?  I know my two spam checkers don't shove these messages into my spam
> folder.
>
> Not that I mind getting rid of this crap from the messages we see...
>
> John W. Colby
> www.colbyconsulting.com
>
> -----Original Message-----
> From: accessd-bounces at databaseadvisors.com
> [mailto:accessd-bounces at databaseadvisors.com]On Behalf Of Bryan
> Carbonnell
> Sent: Wednesday, June 11, 2003 10:11 AM
> To: accessd at databaseadvisors.com
> Subject: RE: [AccessD] Repeat Emails
>
>
> If they postmasters that add them follow standards, they should start with
> '--' or '-- ' (that's two dashes possibly followed by a space, I don't
> remeber which one it is) that may give our lovely list admins a
possibility
> of stripping them that way.
>
> Bryan Carbonnell
> bryan_carbonnell at cbc.ca
>
> >>> CWortz at tea.state.tx.us 11-Jun-03 9:49:59 AM >>>
> Jim,
>
> As Debbie states, those disclaimers are added by their e-mail servers.
> Many organizations require them to "Cover Their A**es" so their admins
> have automatically added them to all e-mails sent by their e-mail
> servers.
>
> I'm sure our List Administrator would be glad if you could come up with
> a way to discover and strip off those disclaimers on incoming e-mails to
> the List.
>
>
> _______________________________________________
> AccessD mailing list
> AccessD at databaseadvisors.com
> http://databaseadvisors.com/mailman/listinfo/accessd
> Website: http://www.databaseadvisors.com
>
>
>
> _______________________________________________
> AccessD mailing list
> AccessD at databaseadvisors.com
> http://databaseadvisors.com/mailman/listinfo/accessd
> Website: http://www.databaseadvisors.com


--
Lexacorp Ltd
http://www.lexacorp.com.pg
Information Technology Consultancy, Software Development,System Support.



_______________________________________________
AccessD mailing list
AccessD at databaseadvisors.com
http://databaseadvisors.com/mailman/listinfo/accessd
Website: http://www.databaseadvisors.com





More information about the AccessD mailing list