https://www.logsat.com/spamfilter/forums/ Wed, 13 May 2026 17:57:21 +0000 Wed, 02 May 2007 20:12:05 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6051 https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10090&title=spam-tagging-issue-in-sfi-v35#10090 Author: LogSat
Subject: 6051
Posted: 02 May 2007 at 8:12pm

I'm afraid at first glance we only patched the problem that occurred when the same SMTP session sent multiple separate emails, and did not address the problem with the tagging. We thought they fell under the same category, but judging from your log this appears not to be the same. We'll post an update here after looking into this further.]]> Wed, 02 May 2007 20:12:05 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10090&title=spam-tagging-issue-in-sfi-v35#10090 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10083&title=spam-tagging-issue-in-sfi-v35#10083 Author: mikek
Subject: 6051
Posted: 02 May 2007 at 9:00am

Updated to 3.5.3.665 but am still seeing mails not split up correctly. This mail was sent to 111@xxx.com with cc: to 222@xxx.com, 333@xxx.com, 444@xxx.com and 555@xxx.com. 555@xxx.com has the :SPAM tag in unfiltered E-Mails, 222@xxx.com and 444@xxx.com do not exist (and therefore are not listed in the "Authorized E-Mails" list).

05.01.07 20:42:36:296 -- (1480) Connection from: 210.245.125.227  -  Originating country : Vietnam
05.01.07 20:42:38:437 -- (1480) Resolving 210.245.125.227 - digipower.vn
05.01.07 20:42:39:000 -- (1480) - SFDB filter match - relevance:85
05.01.07 20:42:39:000 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 111@xxx.com will be rejected
05.01.07 20:42:39:750 -- (1480) - EmailTO is not in AuthorizedTOEmail list...
05.01.07 20:42:39:750 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 222@xxx.com will be rejected
05.01.07 20:42:40:250 -- (1480) Mail from: uaaihmjbeq@digipower.vn
05.01.07 20:42:40:250 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 333@xxx.com will be rejected
05.01.07 20:42:40:765 -- (1480) - EmailTO is not in AuthorizedTOEmail list...
05.01.07 20:42:40:765 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 444@xxx.com will be rejected
05.01.07 20:42:41:265 -- (1480) 210.245.125.227 - Mail from: uaaihmjbeq@digipower.vn To: 555@xxx.com will be spam-tagged
05.01.07 20:42:41:265 -- (1480) Mail from: uaaihmjbeq@digipower.vn
05.01.07 20:42:54:812 -- (1480) EMail from uaaihmjbeq@digipower.vn to "111@xxx.com, 222@xxx.com, 333@xxx.com, 444@xxx.com, 555@xxx.com" was queued. Size: 28 KB, 28672 bytes
05.01.07 20:42:54:812 -- (7812) Sending email from uaaihmjbeq@digipower.vn to 111@xxx.com, 222@xxx.com, 333@xxx.com, 444@xxx.com, 555@xxx.com --
05.01.07 20:42:55:500 -- (7812) EMail from uaaihmjbeq@digipower.vn to 111@xxx.com, 222@xxx.com, 333@xxx.com, 444@xxx.com, 555@xxx.com --  was forwarded to xxx.xxx.xxx.xxx:25
05.01.07 20:42:55:500 -- (7812) EMail from: uaaihmjbeq@digipower.vn to: 222@xxx.com, 444@xxx.com was returned to sender - The following recipients are unknown: 222@xxx.com, 444@xxx.com
05.01.07 20:42:55:500 -- (7812) Some recipients do not exist, sending NDR bounce to sender


]]> Wed, 02 May 2007 09:00:20 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10083&title=spam-tagging-issue-in-sfi-v35#10083 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10073&title=spam-tagging-issue-in-sfi-v35#10073 Author: LogSat
Subject: 6051
Posted: 28 April 2007 at 4:34pm

Bug confirmed.

Nice catch Thermo, thanks a lot for reporting this. We'll have it fixed shortly, and will make the patch available within 24/48 hours.]]> Sat, 28 Apr 2007 16:34:44 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10073&title=spam-tagging-issue-in-sfi-v35#10073 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10071&title=spam-tagging-issue-in-sfi-v35#10071 Author: LogSat
Subject: 6051
Posted: 28 April 2007 at 11:20am

Thermo,

You posted the log just as were were typing in the forum requesting for it

What we see right away is that this is not a single email with multiple recipients, but rather several, separate emails sent in the same session.

The new SpamFilter 3.5 is able to "split" emails with multiple recipients, so that the email is delivered for the allowed recipients, but is blocked for the others.

As this is not apparently the case here, we'll need to look into it further, as you may indeed have found a bug, since this is not an issue of splitting the email, but rather of handling multiple emails in the same session.
]]> Sat, 28 Apr 2007 11:20:02 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10071&title=spam-tagging-issue-in-sfi-v35#10071 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10070&title=spam-tagging-issue-in-sfi-v35#10070 Author: Thermo
Subject: 6051
Posted: 28 April 2007 at 11:12am

This is a section of the log showing what happened, I changed our companies email addresses. It's thread 3992, jeff@company.com gets the message SPAM tagged as it should, but the email gets bypassed for frank, ed, carl and bob.

4/27/07 05:04:40:522 -- (3992) Connection from: 221.148.79.75  -  Originating country : Korea, Republic of
04/27/07 05:04:43:163 -- (3992) - IP address is from a blacklisted country...
04/27/07 05:04:43:163 -- (3992) 221.148.79.75 - Mail from: ramsey@gfagrow.org To: jeff@company.com will be spam-tagged
04/27/07 05:04:44:725 -- (3992) EMail from ramsey@gfagrow.org to jeff@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:44:741 -- (2668) Sending email from ramsey@gfagrow.org to jeff@company.com --
04/27/07 05:04:44:772 -- (2828) Time to add Msg to Bayes corpus:16
04/27/07 05:04:44:881 -- (2668) EMail from ramsey@gfagrow.org to jeff@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:46:069 -- (3992) Bypassed all rules for: frank@company.com from atiles@giciane.trix.net
04/27/07 05:04:47:631 -- (3992) EMail from atiles@giciane.trix.net to frank@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:47:631 -- (3092) Sending email from atiles@giciane.trix.net to frank@company.com --
04/27/07 05:04:47:663 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:47:788 -- (3092) EMail from atiles@giciane.trix.net to frank@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:49:163 -- (3992) Bypassed all rules for: ed@company.com from goldstein@globalhomeproducts.com
04/27/07 05:04:50:725 -- (3992) EMail from goldstein@globalhomeproducts.com to ed@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:50:725 -- (2180) Sending email from goldstein@globalhomeproducts.com to ed@company.com --
04/27/07 05:04:50:756 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:50:866 -- (2180) EMail from goldstein@globalhomeproducts.com to ed@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:52:069 -- (3992) Bypassed all rules for: carl@company.com from jsco@gintri.com
04/27/07 05:04:53:663 -- (3992) EMail from jsco@gintri.com to carl@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:53:663 -- (3204) Sending email from jsco@gintri.com to carl@company.com --
04/27/07 05:04:53:678 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:53:803 -- (3204) EMail from jsco@gintri.com to carl@company.com --  was forwarded to 127.0.0.1:26
4/27/07 05:04:54:397 -- (1756) Connection from: 82.179.199.194  -  Originating country : Russian Federation
04/27/07 05:04:54:944 -- (1756) - IP address is from a blacklisted country...
04/27/07 05:04:54:944 -- (1756) 82.179.199.194 - Mail from: barncaredsefexe@maine.rr.com To: peter@company.com will be rejected
04/27/07 05:04:55:225 -- (3992) Bypassed all rules for: bompane@company.com from sandra@gma-online.de
04/27/07 05:04:56:788 -- (3992) EMail from sandra@gma-online.de to bompane@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:56:788 -- (1732) Sending email from sandra@gma-online.de to bompane@company.com --
04/27/07 05:04:56:819 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:56:913 -- (1732) EMail from sandra@gma-online.de to bompane@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:04:56:913 -- (1732) Some recipients do not exist, sending NDR bounce to sender
04/27/07 05:04:56:913 -- (1732) EMail from: sandra@gma-online.de to: bompane@company.com was returned to sender - The following recipients are unknown:

bompane@company.com
04/27/07 05:04:57:069 -- (1732) Error-email from sandra@gma-online.de to bompane@company.com was forwarded to 127.0.0.1
04/27/07 05:04:57:866 -- (1756) Created thread (2904) to add email to quarantine
04/27/07 05:04:57:897 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:57:913 -- (2904) EMail from barncaredsefexe@maine.rr.com to peter@company.com was received and quarantined. Size: 29 KB, 29696 bytes
04/27/07 05:04:58:147 -- (3992) Bypassed all rules for: bob@company.com from extrimum@greatsoundpros.com
04/27/07 05:04:58:272 -- (1756) Blacklist cache - Added 82.179.199.194 to limbo
04/27/07 05:04:58:506 -- (1756) SFDB - Added 82.179.199.194 - Response: Error=0
04/27/07 05:04:58:506 -- (1756) Disconnect
04/27/07 05:04:59:725 -- (3992) EMail from extrimum@greatsoundpros.com to bob@company.com was queued. Size: 2 KB, 2048 bytes
04/27/07 05:04:59:725 -- (2564) Sending email from extrimum@greatsoundpros.com to bob@company.com --
04/27/07 05:04:59:741 -- (2828) Time to add Msg to Bayes corpus:0
04/27/07 05:04:59:866 -- (2564) EMail from extrimum@greatsoundpros.com to bob@company.com --  was forwarded to 127.0.0.1:26
04/27/07 05:05:00:413 -- (3992) Disconnect
]]> Sat, 28 Apr 2007 11:12:24 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10070&title=spam-tagging-issue-in-sfi-v35#10070 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10069&title=spam-tagging-issue-in-sfi-v35#10069 Author: Desperado
Subject: 6051
Posted: 28 April 2007 at 4:01am

The intended action in the new version is that the unfiltered message gets tagged and the rest quarantined.  I say intended because there seems to be times when the messages are, in fact, delivered.  I have not put this all together but it seems to depend on weather ot not the addresses are in the TO:, CC or BCC fields.  I started to look at this be then got sidetracted.  I think Thermo is on to something but as I stated, I am not clear on the exact issue yet.]]> Sat, 28 Apr 2007 04:01:42 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10069&title=spam-tagging-issue-in-sfi-v35#10069 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10068&title=spam-tagging-issue-in-sfi-v35#10068 Author: Thermo
Subject: 6051
Posted: 27 April 2007 at 4:37pm

I have one email address in the "Unfiltered Emails" whitelist with the :tag option so the email header gets the SPAM tag. The way it worked in SFI v3.1.3.615, SPAM sent to the unfiltered email address got tagged as did all email addresses included in the email. In v3.5.. the unfiltered email address is the only one that gets the SPAM header tag, the other email addresses included in the email now bypass all filtering and end up in the users Inboxes.

I have had to remove the email address from the unfiltered emails whitelist.

Can you make the tagging in v3.5.. function the same as it did in v3.1.3?

Michael
]]> Fri, 27 Apr 2007 16:37:37 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6051&PID=10068&title=spam-tagging-issue-in-sfi-v35#10068