[SoCoSA/discuss] wierd emails to postmaster

[Trevor Benson]

Does spamassassin take its whitelist (for the local domain) and  
basically pass all spam if someone says its from the company?  I just  
noticed the -86.2 score and it seems pretty tough to reach a positive  
5 to mark spam, and then noticed the only reason i could think of is  
that spamassassin doesnt check the corporate-image.com local domain  
against a list of smtp or DNS to see that lakefrontwebhosting.com  
(probably) doesnt host it and shouldnt be applied the whitelist.

These are all basic assumptions by looking at the headers however.


Trevor Benson
A1 Networks
(707)570-2021 x201
tbenson at a-1networks.com



On Feb 11, 2009, at 1:21 PM, gandalf at sonic.net wrote:

> I got two of these this morning from different non existent but  
> possible email addresses. They have an odd feeling about them. The  
> bodies were the same to cursory inspection, just a list of email  
> addresses.
>
> Return-Path: <hdt at corporate-image.com>
> X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on
> 	coco.lakefrontwebhosting.com
> X-Spam-Level:
> X-Spam-Status: No, score=-86.2 required=5.0 tests=BAYES_50,
> 	 
> DNS_FROM_RFC_BOGUSMX 
> ,FH_HELO_ALMOST_IP,HELO_DYNAMIC_SPLIT_IP,MISSING_HEADERS,
> 	MISSING_SUBJECT,TVD_SPACE_RATIO,USER_IN_WHITELIST autolearn=no  
> version=3.2.4
> Received: from 243.Red-79-156-145.staticIP.rima-tde.net  
> (243.Red-79-156-145.staticIP.rima-tde.net [79.156.145.243])
> 	by coco.lakefrontwebhosting.com (8.13.8/8.13.8) with SMTP id  
> n1BJLclZ021724
> 	for <postmaster at corporate-image.com>; Wed, 11 Feb 2009 11:21:52 -0800
> Date: Wed, 11 Feb 2009 11:21:38 -0800
> From: hdt at corporate-image.com
> Message-Id: <200902111921.n1BJLclZ021724 at coco.lakefrontwebhosting.com>
>
> lornahelton at ff.com
> poe at westlandinc.com
> fitz at cableone.net
> fitz at cei.net
> fitz at cpdns.net
> jgammon at wal-mart.com
> sutton at serramontehonda.dealerspace.com
> sutton at setcap.com
> sutton at sppg.com
> sutton at sxnhcxc.die.net
> wmyzzbhpbf at zeg.com
> matnymeyer at gci.net
> mato-y at jesc.or.jp
> fsrap-cc at panaceabiotec.com
> fsrape at agiliti.com
> fsrationale at norsoft.com
> dammann at cpdns.net
> damnous at promobility.net
> dammjp at pionet.net
> dammrich at promobility.net
> fsrealxmf at p-h-s.com
> fsreceiver at hwelectric.com
> manfred.hinterlechner at partner.bmw.com
> darius_harris at irco.com
> info at venturesintl.com
> dallas at nanniesandmore.com
> dallas at embroidme.co
>
> _______________________________________________
> SoCoSA discuss mailing list
> discuss at socosa.org
> Your address: tbenson at a-1networks.com
> http://socosa.org/mailman/listinfo/discuss
> http://socosa.org/mailman/options/discuss/tbenson%40a-1networks.com