Theo Van Dinter wrote:
DoS and Zmi: Can you check on these messages? If they're ham, can you send me
the Date header(s)?
ham-dos.log:.
/home/dos/Maildir/._Inbox_2007/cur/1169531451.M60074P23070V0000000000000302I001C062A_47.cyan.dostech.net,S=4293:2,S
ham-dos.log:.
/home/dos/Maildir/._Inbox_2007/cur/1169843551.M407878P32347V0000000000000302I001C062F_43.cyan.dostech.net,S=6757:2,S
ham-dos.log:Y
/home/dos/Maildir/._Inbox_2007/cur/1169585861.M196028P14841V0000000000000302I001C0629_27.cyan.dostech.net,S=8564:2,S
ham-zmi.log:Y /tmp/masslearn_ham.30309.mtu30823.mbox.53757520
ham-zmi.log:. /tmp/masslearn_ham.30309.mtu30823.mbox.53541506
I'm trying to fix up the INVALID_DATE rule to avoid the rather low FP rate.
Thanks. :)
All are Chapters/Indigo order acknowledgment/confirmation/shipping
emails. It looks like it's generated by the horrid MS AspMail 3.0
(which is also triggering MISSING_MIMEOLE).
Date: Mon, 22 Jan 2007 19:06:22 "GMT"
Date: Mon, 22 Jan 2007 19:31:25 "GMT"
Date: Tue, 23 Jan 2007 20:19:17 "GMT"
Received: from mailfinal1.indigo.ca ([216.220.60.6] helo=chex01.chapters.ca)
by scan1.netguardsolutions.ca with esmtp (Exim 4.63 (FreeBSD))
(envelope-from <[EMAIL PROTECTED]>)
id 1H9SCw-0004up-3t
for [EMAIL PROTECTED]; Tue, 23 Jan 2007 15:25:30 -0500
Received: from ECOM01 ([10.3.1.224]) by chex01.chapters.ca with SMTP
(Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
id ZP81A29X; Tue, 23 Jan 2007 15:31:07 -0500
From: "chapters.indigo.ca" <[EMAIL PROTECTED]>
To: "Daryl O'Shea" <[EMAIL PROTECTED]>
Date: Tue, 23 Jan 2007 20:19:17 "GMT"
X-MSMail-Priority: Normal
Reply-To: [EMAIL PROTECTED]
X-mailer: AspMail 3.0 (QSMT669D1C)
Subject: *****SPAM 05.2***** Shipping Confirmation: Your Chapters-Indigo
Order, OR12345678
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-ClamAV: 0 : No Virus Detected
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.8-r454679 (2006-10-10) on
screw.dostech.net
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.2 required=5.0
tests=BAYES_50,DK_POLICY_SIGNSOME,
FORGED_RCVD_HELO,FUZZY_CREDIT,INVALID_DATE,MISSING_MIMEOLE,SIQ_OI_100,
SIQ_OI_DOM_UNKNOWN,SIQ_OI_IP_05,SIQ_OI_REL_UNKNOWN,SIQ_OI_STAB_1_9
autolearn=disabled version=3.1.8-r454679
X-Spam-Prev-Subject: Shipping Confirmation: Your Chapters-Indigo Order,
OR12345678
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by
cyan.midland.dostech.net id l0NKUCiJ020145
