spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Kris Deugau <kdeu...@vianet.ca>
Subject Re: FROM_MISSP_* causing FPs
Date Fri, 30 Nov 2012 15:17:04 GMT
John Hardin wrote:
> On Thu, 29 Nov 2012, Kris Deugau wrote:
> 
>> I've just had another couple of reports of false positives due to hits
>> on one or more of the FROM_MISSP_* rules.
>>
>> Curious coincidence:  Almost all of the reports to date have involved
>> webform email for real estate companies.  Most of the rest have involved
>> scan-to-email multifunction devices - mostly Xerox.... used by real
>> estate companies.  O_o
> 
> Is there any possibility of getting user agent headers for these FPs? If
> a particular piece of legit software always does this then obviously
> those rules should ignore such messages.

The most recent scan-to-email had:

X-Mailer: WorkCentre 7428

and another couple of older ones showed:

X-Mailer: WorkCentre 7435

Walking Xerox's list of scan-to-email-capable devices will probably turn
up another couple of possible model numbers.

Digging back in the FP archive, there are a handful of webform messages
with "X-Mailer: PHP4", and none of the rest have even that much.

None of the ones I've had reported are from desktop or mobile MUAs.

Two are from airlines - one an ezine from Air Canada, the other a
receipt/itinerary from Air Creebec.

-kgd

Mime
View raw message