On Mon, 27 Nov 2006, Rob Mangiafico wrote:
> Great, thanks for confirming. Didn't want to score it that high until I
> knew we'd be avoiding our own users. Been running it for a few hours, got
> a few 1000 hits so far, sorted by score, and have not found a false
> positive yet. So far so good!
>
> I think I'll score it at 3 instead of 5 for now.
Spoke too soon on the false positives. Had it hit an ebay and amazon email
for a user. Headers below:
---
X-Spam-Status: No, score=1.3 required=2.0 tests=AWL,BOTNET,BOTNET_CLIENT,
BOTNET_CLIENTWORDS,HTML_MESSAGE,SARE_MLB_Stock1 autolearn=no
version=3.1.7
Received: from mx29.sjc.ebay.com (mxpool14.ebay.com [66.135.197.20])
by XXX (8.11.6/8.11.6) with ESMTP id kAS2PGV00414
for <XXX>; Mon, 27 Nov 2006 21:25:16 -0500
Received: from sj-besreco005 (sj-besreco005.sjc.ebay.com [10.6.173.26])
by mx29.sjc.ebay.com (8.13.5/8.13.5) with ESMTP id kAS2Osc2008401
for <XXX>; Mon, 27 Nov 2006 19:25:10 -0700
DomainKey-Signature: a=rsa-sha1; s=dk; d=ebay.com; c=nofws; q=dns;
h=message-id:from:to:subject:mime-version:content-type:x-ebay-mailtracker;
b=q1DrZV4UR2bgq/PC6kcApV2x0JAGRxJP01yYnDopXUQ04IscKir1u23dejHaoHqtU
k/GytJw9BHgzHZyNCdVSVzFFLKyUQ+tRn41WQa98NKnqBOAMxZehJiqr6M95lxgrq99
HAJjn4nueU5JS8XV36+AIRnPS85SAbe85xx9vY8=
---
---
X-Spam-Report:
* 0.6 NO_REAL_NAME From: does not include a real name
* 0.0 BOTNET_IPINHOSTNAME Hostname contains its own IP address
* 0.0 BOTNET_CLIENT Hostname looks like a client hostname
* 2.0 BOTNET Any Botnet rule hit
Received: from smtp-out-4101.amazon.com (207-171-180-184.amazon.com
[207.171.180.184])
by XXX (8.11.6/8.11.6) with ESMTP id kAS2XrV04185
for <XXX>; Mon, 27 Nov 2006 21:33:53 -0500
X-Amazon-Corporate-Relay: smtp-out-4101.sea5.amazon.com
X-AMAZON-TRACK: <XXX>
Received: from smtp-in-1001.vdc.amazon.com by smtp-out-4101.amazon.com
with ESMTP
(peer crosscheck: smtp-in-1001.vdc.amazon.com)
Received: from ors-pots-na-1101.vdc.amazon.com
(ors-pots-na-1101.vdc.amazon.com [10.130.42.37])
by smtp-in-1001.vdc.amazon.com (8.12.10/8.12.10) with ESMTP id
kAS2Xii0009995;
Tue, 28 Nov 2006 02:33:44 GMT
Received: by ors-pots-na-1101.vdc.amazon.com
---
Thoughts?
Rob
