{spam?} {definately spam?} {disarmed}

Tricky · 11-07-2005, 17:47

I've noticed some of these at the headers of emails I get ... mostly correctly identifying Spam etc.

What package is doing this (I think I only get it on mails via I-WEB)? but it seems to work very well

PS. What does Disarmed mean? - I got this on a receipt from PayPal and Tescos, I am guessing graphics in the mail?

Some header information shows on both SPAM and Disarmed?
X-IWebSolutions-MailScanner-Information: Please contact the ISP for more information
X-IWebSolutions-MailScanner: Found to be clean
X-IWebSolutions-MailScanner-SpamCheck: not spam, SpamAssassin

Raistlin · 11-07-2005, 17:54

I get this sometimes too.

Not sure what's causing it but it does appear to be I-web related.

There's a new icon in the I-web control panel thingy.

SMHarman · 11-07-2005, 17:54

it's the serverbased spam filter on i-webs pop3 mail server. Now what disarmed means I don't know. Spam seems to have been replaced with definatly spam, but disarmed is new. Looks like it applys to a lot of opt in bulk mail, I've seen it on say Expedia mails.

I had a look on the quieter iweb forums for this earlier today (mods take note).

So if KP wants to enlighten us.

Jon M · 11-07-2005, 17:54

this seems to indicate that it's a frontend to an independant package : http://www.configserver.com/cp/msfe.html

SMHarman · 11-07-2005, 18:01

Possibly this?

http://wiki.apache.org/spamassassin/NextRelease

New Release: On 2005-06-06, SpamAssassin 3.0.4 was released. Release Announcement, Download now. Instructions on UpgradingVersion and changes304 available.

greencreeper · 11-07-2005, 18:37

Those are X headers. I would guess disarmed means "rendered safe" - perhaps dodgy URLs and HTML content has been removed?

Spampal example:

Code:

X-RegEx-Score: 307.1                                                       
X-RegEx: [200.0] MULTIPLE NTL RECIPIENTS                                   
X-RegEx: [59.6] FROM_AND_RECEIVED_DO_NOT_MATCH FQDN in From and Received header do not match
X-RegEx: [47.3] VERY_SUSP_RECIPS Very similar addresses in recipient list  
X-RegEx: [50.0] SIMILAR_CC: similar domains in 'Cc:'                       
X-RegEx: [-49.8] USER_AGENT_MOZILLA_UA  User-Agent header indicates a non-spam MUA (Mozilla)
X-RegEx: [0.0] X_ACCEPT_LANG Has a X-Accept-Language header                
X-SpamPal: SPAM COUNTRY 80.102.166.60

KingPhoenix · 11-07-2005, 18:53

Hi All....

Yes, this is I-Web's latest tool to the crack down of spam

Inside your cPanel, you will see a new icon called Mail Scanner, this allows you to set a low score and high score threshold, and activate / de-activate scanning per domain etc......

Now then.... anything that is above your low score setting (scored by spamassassin) will be marked as {spam?} and anything above your high score setting will be marked as {definitely spam?}

The default settings of 5 and 20 seem to work VERY well, especially here....

You also have the opportunity to ditch the mail straight away gauged by scoring, rather than filtering it after you have downloaded it, which is quite nice

However i have setup outlook with a rule of anything with {definitely spam?} to go straight to the bin, and anything with {spam?} to goto the junk mail folder....

{disarmed} marks an e-mail that has been disarmed of potentially harmful mail, for instance some phishing mails (funny urls hidden into links etc?) any potential harmful html (form scripts etc.) is stripped out and the e-mail delivered....

There is also a full anti-virus system too, if the system detects a virus in your mail, it will strip it and send the message to you, and respond to the sender telling it that it has stripped the attachment because it found X virus in it.... this is updated by Sophos (and the alerts from sophos are getting rather annoying now

) these e-mails are also marked with {virus?}

HTH

philip.j.fry · 11-07-2005, 18:55

Quote:

Originally Posted by SMHarman

Possibly this?

http://wiki.apache.org/spamassassin/NextRelease

New Release: On 2005-06-06, SpamAssassin 3.0.4 was released. Release Announcement, Download now. Instructions on UpgradingVersion and changes304 available.

Yep, definately SpamAssassin. Looks like it needs to be explicitly enabled/disabled under the Mail Scanner option, the default setting on mine was 'not set' which I think equates to neither on nor off.

Tricky · 11-07-2005, 19:10

Excellent - Goes off to check config and potentially lower values
Great reply KP

KingPhoenix · 11-07-2005, 21:36

It was going to go out in a proper announcement mail, probably this weekend, were just teething some issues with it...

Gareth · 12-07-2005, 13:09

Disabling embedded graphics in HTML emails is a good strategy, if it's available with your provider. Spammers have taken to using cleverly embedded URLs to embedded graphics that point to the .gif but also identify that your email address is valid when you access it, since the particular url used would only have been accessed if you've opened your email.

For this reason, I have graphics switched off by default. In GMail you can choose to temporarily enable embedded graphics, and for all my other accounts that use SquirrelMail I can switch between plain text & HTML versions of emails.

Stuart · 12-07-2005, 13:20

Or use Thunderbird, which requires you to push a button to download any images in an email..

ntl customer · 12-07-2005, 13:25

Or use Outlook 2003. It has the blocking external graphics feature on by default which can be overriden on individual emails.

KingPhoenix · 12-07-2005, 15:43

Quote:

Originally Posted by Stuart C

Or use Thunderbird, which requires you to push a button to download any images in an email..

So Does Outlook 2003

philip.j.fry · 12-07-2005, 15:57

Bah, html mail should be outlawed