Mailing List Archive: kam channel excess spamscore gives false possitive on valid mail from microsoft store

kam channel excess spamscore gives false possitive on valid mail from microsoft store

Aug 9, 2023, 3:51 AM

Post #1 of 5 (207 views)

Yes, score=17.228 tagged_above=-999 required=5 tests=[.DKIM_SIGNED=0.1,
DKIM_VALID=-0.1, HTML_IMAGE_RATIO_04=0.001, HTML_MESSAGE=0.001,
KAM_BODY_URIBL_PCCC=9, KAM_FROM_URIBL_PCCC=9, KAM_HUGEIMGSRC=0.2,
KAM_SHORT=0.001, MIME_HTML_MOSTLY=0.1, MPART_ALT_DIFF=0.724,
RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-3,
RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=1.3, SPF_PASS=-0.1] autolearn=no
autolearn_force=no

RE: kam channel excess spamscore gives false possitive on valid mail from microsoft store [ In reply to ]

Marc at f1-outsourcing

Aug 9, 2023, 3:59 AM

Post #2 of 5 (207 views)

Permalink

>
> Yes, score=17.228 tagged_above=-999 required=5 tests=[.DKIM_SIGNED=0.1,
> DKIM_VALID=-0.1, HTML_IMAGE_RATIO_04=0.001, HTML_MESSAGE=0.001,
> KAM_BODY_URIBL_PCCC=9, KAM_FROM_URIBL_PCCC=9, KAM_HUGEIMGSRC=0.2,
> KAM_SHORT=0.001, MIME_HTML_MOSTLY=0.1, MPART_ALT_DIFF=0.724,
> RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-3,
> RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=1.3, SPF_PASS=-0.1] autolearn=no
> autolearn_force=no

They are just in a black list, that is normal not? Maybe better tell the sender not to use shared resources that are being used for abuse.

KAM_BODY_URIBL_PCCC=9, KAM_FROM_URIBL_PCCC=9

Re: kam channel excess spamscore gives false possitive on valid mail from microsoft store [ In reply to ]

jared at jaredsec

Aug 9, 2023, 4:06 AM

Post #3 of 5 (207 views)

Permalink

On 8/9/2023 6:59 AM, Marc wrote:
>> Yes, score=17.228 tagged_above=-999 required=5 tests=[.DKIM_SIGNED=0.1,
>> DKIM_VALID=-0.1, HTML_IMAGE_RATIO_04=0.001, HTML_MESSAGE=0.001,
>> KAM_BODY_URIBL_PCCC=9, KAM_FROM_URIBL_PCCC=9, KAM_HUGEIMGSRC=0.2,
>> KAM_SHORT=0.001, MIME_HTML_MOSTLY=0.1, MPART_ALT_DIFF=0.724,
>> RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-3,
>> RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=1.3, SPF_PASS=-0.1] autolearn=no
>> autolearn_force=no
> They are just in a black list, that is normal not? Maybe better tell the sender not to use shared resources that are being used for abuse.
>
> KAM_BODY_URIBL_PCCC=9, KAM_FROM_URIBL_PCCC=9
>
>
Still, anything blocking MS Store is pretty egregious, especially since
it's both Address and Body URL. A score of 9 for each?

-- Jared Hall

Re: kam channel excess spamscore gives false possitive on valid mail from microsoft store [ In reply to ]

jared at jaredsec

Aug 9, 2023, 4:08 AM

Post #4 of 5 (207 views)

Permalink

RE: kam channel excess spamscore gives false possitive on valid mail from microsoft store [ In reply to ]

Marc at f1-outsourcing

Aug 9, 2023, 4:15 AM

Post #5 of 5 (207 views)

Permalink

> >> Yes, score=17.228 tagged_above=-999 required=5 tests=[.DKIM_SIGNED=0.1,
> >> DKIM_VALID=-0.1, HTML_IMAGE_RATIO_04=0.001, HTML_MESSAGE=0.001,
> >> KAM_BODY_URIBL_PCCC=9, KAM_FROM_URIBL_PCCC=9, KAM_HUGEIMGSRC=0.2,
> >> KAM_SHORT=0.001, MIME_HTML_MOSTLY=0.1, MPART_ALT_DIFF=0.724,
> >> RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-3,
> >> RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=1.3, SPF_PASS=-0.1] autolearn=no
> >> autolearn_force=no
> > They are just in a black list, that is normal not? Maybe better tell the
> sender not to use shared resources that are being used for abuse.
> >
> > KAM_BODY_URIBL_PCCC=9, KAM_FROM_URIBL_PCCC=9
> >
> >
> Still, anything blocking MS Store is pretty egregious, especially since
> it's both Address and Body URL. A score of 9 for each?
>

But this is how google/microsoft/sendgrid etc are forcing their networks to be accepted. I can remember the 'idiots' at opensrs were (still are?) sending password recovery/reminders over their clients network that was blacklisted for spamming. How dumb you need to be to put your important/app emails on such a network that is sending out unsolicited email?