Striphtml VS attachment and related issues

[William Curley]

Lol, by leaving the Nigerian information in there many people probably won't
see this email. Scored 7.3 points on my spamassassin system.

----- Original Message -----
From: "Quentin Campbell" <Q.G.Campbell at NEWCASTLE.AC.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Friday, August 01, 2003 6:36 AM
Subject: FW: Striphtml VS attachment and related issues


Julian

QUESTION: If you have "deliver attachment" set for spam, what determines
when the message body of a tagged message is placed in an attachment and
when it is not?

BACKGROUND: Until I installed MS 4.22-5 we had been using "deliver
striphtml" as the action to take for messages tagged as spam.

Some users were unhappy with this when they received false positives
because they lost most of the original (HTML) message. However
recipients of real spam messages are universally happy with "deliver
striphtml".

To address the problems with some false positive messages I am trying
"deliver attachment" as an alternative, initially for a small group of
our 20,000+ users. This works fine for the few false positives they
receive which also happen to be HTML. However it is not very nice nor
necessary when the false positive contains no HTML. In this case the
message should be delivered as-is and not in an attachment.

I notice that some of my tagged messages are not put in an attachment
before delivery. That is fine since they contain no HTML. This is my
preferred behaviour in that situation. However I have examples of spam
(see appended message) which although not appearing to contain any HTML
*are* put in an attachment before delivery. Why?

I cannot see what the essential difference is between the two sorts of
tagged messages!

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."

-----Original Message-----
From: Denis Russell [mailto:Denis.Russell at ncl.ac.uk]
Sent: 01 August 2003 10:43
To: Quentin Campbell
>Subject: Fwd: SP? BUSINESS PROPOSAL


Quentin,
        I'm still getting spam messages put into an attachment, even
though I can see no hint of HTML in the message.

        Denis.

>Received: from cheviot2.ncl.ac.uk (cheviot2.ncl.ac.uk [128.240.229.35])
>       by burnmoor.ncl.ac.uk (8.9.3/8.9.3) with ESMTP id KAA23866
>       for <ndmr at burnmoor.ncl.ac.uk>; Fri, 1 Aug 2003 10:19:25 +0100
(BST)
>From: mbanakaka at send-mail.co.uk
>Received: from netmail01.eng.net (netmail01.eng.net [213.130.128.38])
>       by cheviot2.ncl.ac.uk (8.10.1/8.10.1) with ESMTP id
h719J9B27765;
>       Fri, 1 Aug 2003 10:19:09 +0100
>Received: from send-mail.co.uk (netmail01.eng.net [127.0.0.1])
>       by netmail01.eng.net (8.11.3/8.11.3) with SMTP id h719DEx03690;
>       Fri, 1 Aug 2003 10:13:14 +0100
>Received: from 192.116.107.67
>         (SquirrelMail authenticated user mbanakakasendmail)
>         by mail.send-mail.co.uk with HTTP;
>         Fri, 1 Aug 2003 10:14:08 +0100 (BST)
>Message-ID:
><1308.192.116.107.67.1059729248.squirrel at mail.send-mail.co.uk>
>Date: Fri, 1 Aug 2003 10:14:08 +0100 (BST)
>Subject: SP? BUSINESS PROPOSAL
>To: <mbanakaka at send-mail.co.uk>
>X-Mailer: SquirrelMail (version 1.1.1)
>MIME-Version: 1.0
>Content-type: multipart/digest; boundary="======24934==61103======"
>X-Newcastle-MailScanner-Information: Please contact
>Postmaster at newcastle.ac.uk for more information
>X-Newcastle-MailScanner: Found to be clean
>X-Newcastle-MailScanner-SpamCheck: spam, SpamAssassin (score=15.5,
>       required 5, BAYES_90 3.00, FROM_AND_TO_SAME 1.70, NIGERIAN_BODY
2.69,
>       NO_REAL_NAME 1.15, SUBJ_ALL_CAPS 0.49, UPPERCASE_75_100 0.00,
>       US_DOLLARS 1.14, US_DOLLARS_3 0.92, US_DOLLAR_6 4.50)
>X-Newcastle-MailScanner-SpamScore: sssssssssssssss
>X-UIDL: ed9a1cce8f31e51ff8261f1a6425c1a7
>
>--======24934==61103======
>Our MailScanner believes that the attachment to this message sent to
>you
>
>     From: mbanakaka at send-mail.co.uk
>  Subject: BUSINESS PROPOSAL
>
>is Unsolicited Commercial Email (spam). Unless you are sure that this
>message is incorrectly thought to be spam, please delete this message
>without opening it. Opening spam messages might allow the spammer to
>verify your email address and thus result in even more spam being
>received.
>
>If you believe that this message has been incorrectly marked as spam,
>please forward this email to Postmaster at newcastle.ac.uk.
>
>
>--======24934==61103======
>Return-Path: <g>
>Received: from netmail01.eng.net (netmail01.eng.net [213.130.128.38])
>       by cheviot2.ncl.ac.uk (8.10.1/8.10.1) with ESMTP id
h719J9B27765;
>       Fri, 1 Aug 2003 10:19:09 +0100
>Received: from send-mail.co.uk (netmail01.eng.net [127.0.0.1])
>       by netmail01.eng.net (8.11.3/8.11.3) with SMTP id h719DEx03690;
>       Fri, 1 Aug 2003 10:13:14 +0100
>From: mbanakaka at send-mail.co.uk
>Received: from 192.116.107.67
>         (SquirrelMail authenticated user mbanakakasendmail)
>         by mail.send-mail.co.uk with HTTP;
>         Fri, 1 Aug 2003 10:14:08 +0100 (BST)
>Message-ID:
><1308.192.116.107.67.1059729248.squirrel at mail.send-mail.co.uk>
>Date: Fri, 1 Aug 2003 10:14:08 +0100 (BST)
>Subject: BUSINESS PROPOSAL
>To: <mbanakaka at send-mail.co.uk>
>X-Mailer: SquirrelMail (version 1.1.1)
>MIME-Version: 1.0
>Content-Type: text/plain
>Content-Transfer-Encoding: 8bit