https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5874

           Summary: FORGED_HOTMAIL_RCVD false positive with mail sent from
                    live.jp (msn japan)
           Product: Spamassassin
           Version: 3.1.9
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Rules
        AssignedTo: [email protected]
        ReportedBy: [EMAIL PROTECTED]


legitimate email sent from the msn japan website (live.jp) trigger a false
positive on FORGED_HOTMAIL_RCVD.

sample header below.

-tristan

-----------------------------------------------------
Return-Path: <[EMAIL PROTECTED]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.9 (2007-02-13) on koala.bok.net
X-Spam-Status: Yes, score=7.1 required=3.0 tests=BAYES_50,
        CHARSET_FARAWAY_HEADER,FORGED_HOTMAIL_RCVD,HTML_50_60,HTML_MESSAGE,
        T_MULTIPLE_RECIPIENTS autolearn=no version=3.1.9
X-Spam-Level: *******
X-Spam-Report: 
        *  0.5 T_MULTIPLE_RECIPIENTS Header: no "for <recipient>" (multiple
local
        *      recipients)
        *  2.3 FORGED_HOTMAIL_RCVD Forged hotmail.com 'Received:' header found
        *  3.2 CHARSET_FARAWAY_HEADER A foreign language charset used in
headers
        *  0.1 HTML_50_60 BODY: Message is 50% to 60% HTML
        *  1.0 HTML_MESSAGE BODY: HTML included in message
        *  0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
        *      [score: 0.4851]
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 6538 invoked by uid 110); 3 Apr 2008 18:24:55 -0400
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 6533 invoked from network); 3 Apr 2008 18:24:55 -0400
Received: from blu139-omc1-s14.blu139.hotmail.com (65.55.175.154)
  by tristansf.com with SMTP; 3 Apr 2008 18:24:55 -0400
Received-SPF: pass (tristansf.com: SPF record at spf-a.hotmail.com designates
65.55.175.154 as permitted sender)
Received: from BLU113-W2 ([65.55.162.183]) by
blu139-omc1-s14.blu139.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
         Thu, 3 Apr 2008 15:24:54 -0700
Message-ID: <[EMAIL PROTECTED]>
Return-Path: [EMAIL PROTECTED]
Content-Type: multipart/alternative;
        boundary="_37559fca-6063-49c2-a126-f9ba14fdcd4c_"
X-Originating-IP: [75.36.144.135]
From: =?iso-2022-jp?B?GyRCQ2ZCPBsoQiAbJEI3Q019GyhC?= <[EMAIL PROTECTED]>
To: Tristan <[EMAIL PROTECTED]>
Subject: [07.1] Hi!
Date: Fri, 4 Apr 2008 07:24:54 +0900
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 03 Apr 2008 22:24:54.0144 (UTC)
FILETIME=[8A56B800:01C895D9]
-------------------------------------------------


-- 
Configure bugmail: 
https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

Reply via email to