Hi,
I've seen this before but it slipped my mind. This is an example of a
message where after a few lines every line of a message gets corrupted.
It looks like a regex has replaced from the first alphanumeric up until
the first whitespace with X.
This message was blocked dut to having no from header. The header is
there but corrupted in the corpus. It must have been corrupted before
message processing for ASSP to not see the from header.
X-Assp-Envelope-From: sen...@domain.tld
X-Assp-Intended-For: recipi...@domain.tld
X-Assp-Delay: not delayed (whitelisted); 1 Mar 2015 21:14:59 +0000
X-Assp-Message-Score: 50 (From missing)
X-Assp-IP-Score: 50 (From missing)
X-Assp-Whitelisted: Yes (whiteListedIPs '1.1.1.0/18')
X-Assp-Tag: MessageLimit
X-Spam-Status:yes
X-Assp-Spam-Reason: MessageScore 50, limit 50
X-Assp-Message-Totalscore: 50
Received: from host.tld.com ([1.1.1..5]
helo=host.tld.com) by mail.smtphost.co.uk with SMTP
(2.4.4); 1 Mar 2015 21:14:52 +0000
XXXXXXXXXXXXXXX v=1; a=rsa-sha1; c=relaxed/relaxed; s=mandrill;
d=recipientdomain.tld;
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
i=i...@recipientdomain.tld;
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXX a=rsa-sha1; c=nofws; q=dns; s=mandrill;
d=recipientdomain.tld;
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXX
XXXXXXXXX from pmta03.mandrill.prod.atl01.rsglab.com (127.0.0.1) by
host.tld.com id hue0la1sau8v for <recipi...@domain.tld>; Sun, 1 Mar 2015
21:12:41 +0000 (envelope-from <sen...@domain.tld>)
XXXXXXXXXXXXXXX v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandrillapp.com;
XXXXXXXXXXXXXXXXXXX q=dns/txt; s=mandrill; t=1425244361; h=From :
XXXXXXX : To : Message-Id : Date : MIME-Version : Content-Type :
XXXXXXXXXXXXXXXXXXXXXXXXX : From : Subject : Date : X-Mandrill-User :
XXXXXXXXXXXXXXXXX bh=GcgOa6X59ZJsf0KFehKYcucCDDWWvCnVHXPUrNIVBBI=;
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXX Recipient Name <i...@recipientdomain.tld>
XXXXXXXX Trade Account Registration
XXXXXXXXXXXX <sen...@domain.tld>
XXXXXXXXX from [92.63.138.71] by mandrillapp.com id
1d4e8afcc1264b0ca1ed9f0675fc3f42; Sun, 01 Mar 2015 21:12:41 +0000
XXX <recipi...@domain.tld>
XXXXXXXXXXXXXXX Please forward a copy of this message, including all
headers, to ab...@mandrill.com
XXXXXXXXXXXXXXX You can also report abuse here:
http://mandrillapp.com/contact/abuse?id=idnumber
XXXXXXXXXXXXXXXX md_30007454
XXXXXXXXXXX <30007454.20150301211241.54f380c91a9320.22340...@host.tld.com>
XXXXX Sun, 01 Mar 2015 21:12:41 +0000
XXXXXXXXXXXXX 1.0
XXXXXXXXXXXXX text/html; charset=utf-8
XXXXXXXXXXXXXXXXXXXXXXXXXX 7bit
XXXXXX type="text/css">
XXXXXXXXXXXXX table, #email-format tr, #email-format td,
#email-format p{margin:0; padding:0; border:0; font-family:Arial;
font-size:12px;}
XXXXXXXXXXXXX table td img { border: 0 none; }
XXXXXXXX
XXXXXXXX
XXXXXX width="760" cellspacing="0" cellpadding="0" border="0"
style="text-align: left; border: 1px solid #d4d4d4; border-radiXXX 5px;"
id="email-format">
XXXXXXX
XXXX
------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now. http://goparallel.sourceforge.net/
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
