From users-return-117781-archive-asf-public=cust-asf.ponee.io@spamassassin.apache.org Mon Mar 19 00:24:54 2018 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx-eu-01.ponee.io (Postfix) with SMTP id 99C30180645 for ; Mon, 19 Mar 2018 00:24:53 +0100 (CET) Received: (qmail 7622 invoked by uid 500); 18 Mar 2018 23:24:52 -0000 Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list users@spamassassin.apache.org Received: (qmail 7612 invoked by uid 99); 18 Mar 2018 23:24:51 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd1-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 18 Mar 2018 23:24:51 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd1-us-west.apache.org (ASF Mail Server at spamd1-us-west.apache.org) with ESMTP id 2DF97C0A63 for ; Sun, 18 Mar 2018 23:24:51 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd1-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: -0.802 X-Spam-Level: X-Spam-Status: No, score=-0.802 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=disabled Authentication-Results: spamd1-us-west.apache.org (amavisd-new); dkim=pass (1024-bit key) header.d=ena.com Received: from mx1-lw-eu.apache.org ([10.40.0.8]) by localhost (spamd1-us-west.apache.org [10.40.0.7]) (amavisd-new, port 10024) with ESMTP id AE3MCqGZGlPW for ; Sun, 18 Mar 2018 23:24:49 +0000 (UTC) Received: from smtp2i.ena.net (smtp2i.ena.net [96.5.1.10]) by mx1-lw-eu.apache.org (ASF Mail Server at mx1-lw-eu.apache.org) with ESMTPS id 1AAD25F175 for ; Sun, 18 Mar 2018 23:24:48 +0000 (UTC) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02lp0021.outbound.protection.outlook.com [216.32.180.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by smtp2i.ena.net (Postfix) with ESMTPS id 6A175148068E; Sun, 18 Mar 2018 18:24:41 -0500 (CDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ena.com; s=default; t=1521415481; bh=DNLs+rN+FDzuJ2ZR6iE0ZE5hzhqYFho8okz8OwqvJcc=; h=Subject:To:References:From:Date:In-Reply-To; b=0DEg3bB2JNf7lvXeD8a1p5rVK5WHLxzmo5xJZLpyKN3m6wj3E3TlZ8QxZoa3f9WfM gpiaqLw8Uu9SPCzrqZHtz9TYDeg7jI8JnKUEKkaYx0+kcrjjfjyMjfhrw+/+GA5bte Fw5H+h9y29VhVH0CG9xwjjtm8c2G9DXx8WsRcj/I= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=djones@ena.com; Received: from djones13.ena.com (76.187.193.151) by CY1PR02MB1285.namprd02.prod.outlook.com (2a01:111:e400:50f1::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.588.14; Sun, 18 Mar 2018 23:24:39 +0000 Subject: Re: The "goo.gl" shortner is OUT OF CONTROL (+ invaluement's response) To: users@spamassassin.apache.org References: <1519561506937-0.post@n5.nabble.com> <1008DD80-60A0-46DD-BE52-5283814B5292@kreme.com> <20180310082056.GD31165@fantomas.sk> <444b8ec1-2083-652b-76de-c0d934eab4c9@invaluement.com> <20180310162212.GA11605@fantomas.sk> <20180310164309.GA11896@fantomas.sk> <8e91892c-85b4-049e-ac7d-f3a6e4d62292@invaluement.com> <23079815-a541-6da6-c171-f34790122963@ena.com> <1521414112.28326.6.camel@lists.simkin.ca> From: David Jones Message-ID: <9d6c4358-5a03-ad95-28c2-92ab8dc86845@ena.com> Date: Sun, 18 Mar 2018 18:24:36 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <1521414112.28326.6.camel@lists.simkin.ca> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [76.187.193.151] X-ClientProxiedBy: SN4PR0401CA0018.namprd04.prod.outlook.com (2603:10b6:803:21::28) To CY1PR02MB1285.namprd02.prod.outlook.com (2a01:111:e400:50f1::25) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: aad3192e-fe9c-45ad-6a60-08d58d276c27 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(5600026)(4604075)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020);SRVR:CY1PR02MB1285; X-Microsoft-Exchange-Diagnostics: 1;CY1PR02MB1285;3:eQLFiN8B0YSNRWBcbkwcKkvR20hCpKGAcEOspJLF5RMfnCqSv9rP4zjiHQy5eurrtFLtomA6XVpdkUFEgRSM3Ah7P8QKnEqaeJcxktlDM8HbkGAq+LFgkNBzZ8lOJM1fzgRYb0IHud5wmLzvWxwDvEXYP6EyAftMllj2KyP6HP0L9tW1RSvPqDwgCtbjyf4Z7puZtZpzOntvzfTCQJncL/yJMRzP+FqHR6tXNrEWRXaBweRl9mDZBIwSp+KdKTgd;25:wIkSY7GYinG85+4fqclvDUNi3aWDuslGcg01L4irV5lucGH8k8epeil4WhabPhfvvz8W6n675f0FyOGvwVFR9zbGnKDhxmXeTLSi9ApOSWHTwP5YVsLq/CjSdhziaFybHazmsQr/400g+u81Ua+lP+EgfyjwhLAAHDFmR8NKkN2WaoipK0fANU6yUtKeeqxRqisJQUsj7LHLehrWTVAr172YOj2hifO6fMdvZT9m4KoJjLI25uO1KWaxMqWBMGznKZHWi/KmKcQS7G7AiVJ3FsHy8IxDi6E+1Yoj5yHvYL4cv/gZNUh1DhxrvaykgZRiF4m8j7nu0qp4hqapFFB6NA==;31:v0AaiRAwvpBK8f5Jx5hgK0yaTNKJ2Hwx7dYbGaTMdeDtdhXKIGbOUOiu0Lhb4tbold1xY6mVChc2rhHkWWE0qpUXfTJ9ZgYiLgHhGnR3RrCslBPlP9YPbp5Dho6ot/eR0MkAaEX3gjwDcIqTW1DyLMdVOq6hq71gNxcIWgAbtEROoOU9MJnRqJPirgzxgCmebeAZfXwSgHxMhO9YAL9Q6QXTNN/nKOVEiAag0wZo48s= X-MS-TrafficTypeDiagnostic: CY1PR02MB1285:|CY1PR02MB1285: X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(158342451672863)(148501403981450); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(3231221)(944501300)(52105095)(10201501046)(6041310)(20161123560045)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123558120)(6072148)(201708071742011);SRVR:CY1PR02MB1285;BCL:0;PCL:0;RULEID:;SRVR:CY1PR02MB1285; X-Microsoft-Exchange-Diagnostics: 1;CY1PR02MB1285;4:MuArE8JCX4kA2xALZPF9MDc4VahxcvQgmwlOcNM5ULAl60PQzZqHvIrY/GaSXrMlGTnBYQVrJuZ3U25scsqXucOZFlXcgMpJ5402De1ugRzuGCTPsnrgLveud5xb2DBhZJ3R0iqp7zLjU60WpaKClEIouhKKq4EZkZgGTWYrD3pJVaBa4gQN+1RzMTFDzMR4TQcd+/YXFs+8i/u/VzOEi701Tb1b08lo1mzEEHz2obY4H4I8ciC23vqvsspvu3uv8LP/MBcGHo+rVpy4zddI/EIE4u+itdMPlTezjm4pn6MaOkcUc7n0rdC3KV/d0YX8x+Qr2PIddJxTeRMRYnXUlz8zNSVdh7WEe/fcjfRcOcE= X-Forefront-PRVS: 06157D541C X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(39850400004)(346002)(396003)(39380400002)(376002)(366004)(189003)(377424004)(199004)(50466002)(81156014)(31696002)(5660300001)(64126003)(316002)(105586002)(6486002)(7736002)(305945005)(6306002)(8676002)(2906002)(68736007)(229853002)(478600001)(6666003)(53936002)(2351001)(106356001)(966005)(6916009)(230700001)(2950100002)(2361001)(16526019)(186003)(93886005)(31686004)(53416004)(65956001)(65806001)(66066001)(53546011)(386003)(59450400001)(47776003)(23676004)(2486003)(52116002)(97736004)(7696005)(36756003)(86362001)(575784001)(65826007)(81166006)(52146003)(3846002)(8936002)(6246003)(25786009)(26005)(58126008)(76176011)(6116002)(67846002)(10126625002);DIR:OUT;SFP:1101;SCL:1;SRVR:CY1PR02MB1285;H:djones13.ena.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; Received-SPF: None (protection.outlook.com: ena.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtDWTFQUjAyTUIxMjg1OzIzOnl4eThWQk14dENjTE9uU3NBVGtTZ3UzNGY3?= =?utf-8?B?bnFuRC9oMWF6Sm1peUpOblVvV0NHaENvOGRLMUdQMHJQMmxnRWU1Uzdob21W?= =?utf-8?B?aVYwYnEyYkhLRXkwSG1yYW5PTXZHVWFxOWppbVduNjRhREFGNWk2Wk1MaUwz?= =?utf-8?B?dlk2UGNPazIzbFMwQ3FHdytGT0NHdEo4MHkxcEVDN2FwSjZKZE43dEc4MEJo?= =?utf-8?B?dGpKMUNCSldXalRjWndRNnNBN1dCWWFDVVp5WUFuUlJrck9nb1p3aFhmbTJ0?= =?utf-8?B?a2VuaTlkWGhBRUNTSzEzZ3p0cW0xNXhoV2JqbGFRenNwcDBLd2lWOXhkMFdL?= =?utf-8?B?SEpHRWY0cmxackxnS3dtT0RjV1FTV0JyaUZUVUl6TjFGQU5QMTRYMGR1UTRS?= =?utf-8?B?TWtLaklTb3Boa1BGNElBZHFhTUgyRXh3dm1pTjRvMGYwTWVqSWlJazhuZ3d0?= =?utf-8?B?RkxCVEFqTGNDSFhJUHRBdmgvdUlFa0hEbVBmK3U0K1ZnVWdwT2w0Qkh5eHBL?= =?utf-8?B?SHFKaXhZS2RWNWtKejhNY3RaR3NnM3l6Mnk5b21CVEEydlkyVjgyUHlPV090?= =?utf-8?B?RVlyVnpIZzBsUVl5UFdrK0ZGeTNQOTRqaVF1WWQ4SVd4dDJ0Y3ROTEY0QzVi?= =?utf-8?B?OGNCM0YwQTBBbFk0OXhia3dqSWxLV3hyOWR4eisrOW5UMndRNG1vaFFGdDVk?= =?utf-8?B?REI4TVl0cWRRK2NPWEg3cjZLbnRrL2tJeEpQUFpZbHJZREJUVmZsNVcxd3Rz?= =?utf-8?B?R1ZXeGQvRmhDTWFMaDBMOFliWVgzaklUZ2dQMnU5OHREWVBtZGkyR211bFhD?= =?utf-8?B?VE1NendxM1FhampxdWhyZkZKcisyMkRBRGZqVkMyTkQrWmtLRFVTSXRkTmZP?= =?utf-8?B?L2VmNHBwcnc3cTIvSUpKUlZKeUdHVDhlbDhDWktzbFh5bDlrbFN3VXZ1Vm9l?= =?utf-8?B?YStlblpRQWZLQ3lVWTlSVVBZT3FOZEJuYU1tM2RMRll3QzBYK0ZQdUFZQTcr?= =?utf-8?B?dTFjWVVpZUMrZ2lKNlRJOWZtS1gxdzQ5TG5JT2lORzBtcUgxeWFVY0p6b2Rt?= =?utf-8?B?WUt5S1lvSkxFTjc1dU8xYWRFNzJlWUt3bUFOMU1DMVFGRlRpbEUzU1hkWS92?= =?utf-8?B?OXZQS3EzVWNOTXkrQktHYVZLLzlDenAxK2dnWWRVaGJUb1FjN1lKUnFPVmFJ?= =?utf-8?B?UlRycXBoU1ZmamFIdjJTZGR0ZWFiOUpBbUVPNFRqZjIrWU91Yis1Q1RxdDdt?= =?utf-8?B?am81RkRnRUhhY1pIbGFrdHhnRkhUelpvMHcwc21zaW80QUloc3lDdi9zVS9C?= =?utf-8?B?ekJKLzM1aERNckZ5R0x6MGpCaGZuV3NEZmhaS3h5SWNxSzdjd1NyR2l2WXBQ?= =?utf-8?B?enROaXhrbm56S0dldklXMTdDWVpCd0dEbWZENHJGa1JpbmlVQmVDU2trcElS?= =?utf-8?B?VlFUSStXdms1ZVcrQmVkQzFtMVFBdzhuUXc4am5WSllMQ2ZXTlVEQnNZQlJv?= =?utf-8?B?ZWUyVmtnK1kyNlppeW5IcEpnYlJYQ1JhR1R1QnNqNDNweUxqOWVXZW12ZW1W?= =?utf-8?B?UE1oOG82aUJyN052bW0rOTJHMUNEUkQ2a2tBVkwzRjJtaitZYWVGZ3BiZ0g3?= =?utf-8?B?OUNpRVlaczIzNUdXdHNOeklPKyt3WVBTRUFkdUhNOVE5cDRqaThIMGszcU5T?= =?utf-8?B?U3BaTlVPUThKVjB3Uy80b09XZDllVnFKdWF1SHZOYTNzWDFtZFNxTnBpTm05?= =?utf-8?B?bzROY0thbTRQTnBsbWMybkE0TUc1VGw3ZU0yeGdPck4vL0RZZUtEMkRadGx3?= =?utf-8?B?K2xKTUc5eHdJaW9aZFhEYU4ydG1DNDVZdGR2MWJRYmNjdSthN3gvT05mNEo1?= =?utf-8?B?MXdaUzZqWEZCTXRnUkVseFcrYklDZDc0R2c4VXVDdmsvclRmbG96ZWRpOWIw?= =?utf-8?B?L0xTTmhpL2k4RmlNTjlQZGVVV2c2T0FyQ3JnYWk2cEkySG9wd3hoVHJPdEc4?= =?utf-8?B?YVZxbEVqWElwdmdjaUN4L3M5ZEc4RFVGOGZwQTEydTFRbzNmVTdrNXk5cDBv?= =?utf-8?Q?jTo8=3D?= X-Microsoft-Antispam-Message-Info: IpVKl4XWIi8hvpVerFFhSL/h1wstWiFJrjiz3EkUBTx1f9PS2cOYmMN7Y+Osi5PxKa3hEuPa4IW/ABiDEhBqJOmDhJsTDqeIDPlPku1u3H6UCpEeCptbgB6aljYsn+6/P45l7IwPB6mZim6tbhmpSATIfQTRf7xDsy7a+W/64ZNfI+sCccUI4sbtgY20/0yI X-Microsoft-Exchange-Diagnostics: 1;CY1PR02MB1285;6:CatXsGSCtO2gs16DFjQUHc8sWRZDwVuRHBWcPn6KZhfYZav34ULCJEgPIuSZBIP6R1MByN1RQJWuQHBoe3S9aOs0n+0FG9wcOBlTPWhMljfVJVzFXT3sSUMYdYWKw1j8+59QBgWBNMsPG6ILTCE2dq+CKr68S4z/R2mT3N7j7/AYIHinKVnWpvJaOXMSXwAQjPkhittgTp/f6DCqBVVJhgKwYpPK/5H1zwoAJkiUKgA2KUOir1zGYkuT9eZyWiI9EM39u3Yc5DaZNc7gz6fglXfmGFtShh+uW6I8p2bSyR1tip7C239xRbwkusCOwJKzrvj4fRze+pmtQU/RHc8xr7ui0ZQRUDKIwNSYNI9whBc=;5:cyzoslGBoIroFZS3bhFgtUPX+p8N80uWmL2BNh6GjW3hQy12tBK+DdxpXRnjy003IOWkLeCpIVDA2IHFVeeXQdM8xFXk+4GaqBl2+DlebuzZ9pXwYr9rVO8ny88fc6f3fB7RjfJibDVNmnoXZ3T41NKFq5lnItX5+KTS0uQPbbQ=;24:hn97vKvvoMmOZ2fQgIOr4i8VORor4NhEz9LPQ7sbGpjgowfpUqxVrsd/kS5KPzHT9roYCFS8J1cyxHg+6Di3Bq7lDM4/G3ne0geoihAIxe4=;7:rnKwbIlYKOzfs2WnBU5rdp67VmeVqsiDxuLLWermCJtifTt+R86EYy3VnxzcebD8GA4xDAgNOplGWfX1S1+BQsNeYO+2vEss1IRSaJFhe+vAt4Z5iqCMpTOZRPxnZY6F+VMA5YXRn+v+kwEi1vU3tR+MrSaUr80cA756pKncVQ1gCoj7thsFUB5f0tFCnNul37NZ95tlb8Y7cJLBm8mkcBXyvl9REgwjE5zcJCIfDwXQrCtXoTpeblqNWlKlpNR4 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: ena.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Mar 2018 23:24:39.8837 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: aad3192e-fe9c-45ad-6a60-08d58d276c27 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 6dc38cd4-4d4f-4826-9649-17854289d170 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR02MB1285 X-ENA-MailScanner-Information: Report abuse to abuse@ena.com and include the next header value X-ENA-MailScanner-ID: 6A175148068E.A0E40 X-ENA-MailScanner: No viruses found X-ENA-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=1.198, required 4, BAYES_00 -3.20, DKIM_SIGNED 0.10, DKIM_VALID -0.10, DKIM_VALID_AU -0.10, DNSWL_DWL_NONE -0.10, ENA_FREEMAIL 0.80, ENA_FREEMAIL_HOSTKARMA_OFFSET 2.50, ENA_FREEMAIL_MSPIKE_H2_OFFSET 1.20, ENA_RCVD_O365_PROXY 4.20, RCVD_IN_DNSWL_NONE -0.20, RCVD_IN_HOSTKARMA_W -2.50, RCVD_IN_MSPIKE_H2 -1.20, RCVD_IN_SENDERSCORE_80_89 -0.20, SPF_HELO_PASS -0.00, SPF_PASS -0.00) X-ENA-MailScanner-SpamScore: s X-ENA-MailScanner-From: djones@ena.com X-ENA-MailScanner-Watermark: 1522020282.34843@CcGJdl4+QbKXmxbkZTkrwA On 03/18/2018 06:01 PM, Alan Hodgson wrote: > On Sun, 2018-03-18 at 17:14 -0500, David Jones wrote: >> I have Steve Freegard's DecodeShortURLs.pm installed but didn't get any >> HAS_SHORT_URL hits on this one: >> >> https://pastebin.com/t85b0Bns > > Is it getting any hits? It definitely hits on that one in a test here. > > Note it needs Perl's LWP::UserAgent and DBD::SQLite to get it to work at > all. > I am getting other HAS_SHORT_URL hits. My 8 SA boxes are setup identically with those 2 perl modules. The original server that received this message does have other hits on HAS_SHORT_URL but this message still is not hitting. Now it's scoring a 10.4 and would be blocked because of DCC_CHECK and other things have caught up to it. -- David Jones