| Newsgroups |
gmane.mail.spam.razor.user,gmane.spam.detected |
| Message-ID |
<325206.1144405496835.JavaMail.root@ps23> |
I run this command: razor-check -H < htmlmail
"hmtlmail" is mbox format file which contains HTML email with empty body
Output is:
prep_mail: orig=1727
boundary: 0----=_NextPart_000_0134_01C65A34.F85A8940
split_mime: no blank lines
split_mime: returning total_len=129; hdrs=, body=93
boundary: 0----=_NextPart_000_0134_01C65A34.F85A8940
split_mime: valid_mime_hdr [len=90], but no nested mime
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
split_mime: returning total=419; hdrs=124, body=294
Saweeet!!! Boundary (2): ----=_NextPart_000_0134_01C65A34.F85A8940
**** prep_mail done: headers=1064
**** mail 0 [129] X-Razor2-Agent: Razor-Agents v2.81
Cont
**** mail 1 [419] X-Razor2-Agent: Razor-Agents v2.81
Conte
1.0 e4: 6mwGGCehAoy6J57LS20bXi-NlUkA, ep4: 7542-10
1.1 e4: 9r-TlG1ogR9eZ1qJDtnxIqXw39kA, ep4: 7542-10
THIS IS "HTMLMAIL" FILE:
From [email protected] Fri Apr 7 10:19:24 2006
Return-Path: <[email protected]>
Received: from maili.nord.usl6.toscana.it ([192.168.1.40])
by spam.test.usl6.toscana.it (8.13.4/8.13.4) with ESMTP id k378JONe014397
for <[email protected]>; Fri, 7 Apr 2006 10:19:24 +0200
Received: from Ric (rcastellani [192.168.1.31])
by maili.nord.usl6.toscana.it (8.12.10/8.12.10) with SMTP id k379B8eC011246
for <[email protected]>; Fri, 7 Apr 2006 11:11:08 +0200
Message-ID: <013701c65a24$34d8e530$1f01a8c0@Ric>
From: "Riccardo Castellani" <[email protected]>
To: <[email protected]>
Subject: HTML email sent by Outlook Express with empty body
Date: Fri, 7 Apr 2006 11:18:17 +0200
Organization: Azienda USL 6 - Livorno
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0134_01C65A34.F85A8940"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2527
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
X-Razor2-Warning: SPAM.
This is a multi-part message in MIME format.
------=_NextPart_000_0134_01C65A34.F85A8940
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_000_0134_01C65A34.F85A8940
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.2802" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV>&nbsp;</DIV></BODY></HTML>
------=_NextPart_000_0134_01C65A34.F85A8940--
instead with this command I obtained
razor-check -d < htmlmail
Razor-Log: read_file: 17 items read from /etc/razor//razor-agent.conf
Apr 07 11:16:59.161161 check[14743]: [ 2] [bootup] Logging initiated LogDebugLevel=20 to stdout
Apr 07 11:16:59.161971 check[14743]: [15] cmd-line options:
HASH - HASH(0x9755940),2 keys
debug => 1
razorhome => /etc/razor/
Apr 07 11:16:59.162490 check[14743]: [ 5] computed
razorhome=/etc/razor/, conf=/etc/razor//razor-agent.conf,
ident=/etc/razor//[email protected]
Apr 07 11:16:59.162651 check[14743]: [ 2] Razor-Agents v2.81 starting razor-check -d -home=/etc/razor/
Apr 07 11:16:59.166334 check[14743]: [ 9] uname -a: Linux
spam.test.usl6.toscana.it 2.6.15-1.1833_FC4 #1 Wed Mar 1 23:41:37 EST
2006 i686 i686 i386 GNU/Linux
Apr 07 11:16:59.167009 check[14743]: [ 8] reading mbox formatted mail from <stdin>
Apr 07 11:16:59.167586 check[14743]: [ 6] read 1 mail
Apr 07 11:16:59.168007 check[14743]: [ 8] Client supported_engines: 4 8
Apr 07 11:16:59.168601 check[14743]: [16] log2file: wrote message len=1727 to file: /tmp/razor.14743.1.orig_mail
prep_mail: orig=1727
boundary: 0----=_NextPart_000_0134_01C65A34.F85A8940
split_mime: no blank lines
split_mime: returning total_len=129; hdrs=, body=93
boundary: 0----=_NextPart_000_0134_01C65A34.F85A8940
split_mime: valid_mime_hdr [len=90], but no nested mime
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
split_mime: returning total=419; hdrs=124, body=294
Saweeet!!! Boundary (2): ----=_NextPart_000_0134_01C65A34.F85A8940
**** prep_mail done: headers=1064
**** mail 0 [129] X-Razor2-Agent: Razor-Agents v2.81
Cont
**** mail 1 [419] X-Razor2-Agent: Razor-Agents v2.81
Conte
Apr 07 11:16:59.170538 check[14743]: [ 8] prep_mail done: mail 1 headers=1064, mime0=129, mime1=419
Apr 07 11:16:59.171786 check[14743]: [14] prepared objs:
ARRAY - ARRAY(0x953bbe0),1 items
HASH - HASH(0x979be58),4 keys
headers => SCALAR - SCALAR(0x948d218)
[length=1064] From [email protected] Fri Apr 7
10:19:24
id => 1
orig_mail => SCALAR - SCALAR(0x92984dc)
[length=1727] From [email protected] Fri Apr 7
10:19:24
p => ARRAY - ARRAY(0x979be7c),2 items
HASH - HASH(0x979c0ec),2 keys
body => SCALAR - SCALAR(0x9297448)
[length=129] X-Razor2-Agent: Razor-Agents v2.81
id => 1.0
HASH - HASH(0x979c110),2 keys
body => SCALAR - SCALAR(0x92985fc)
[length=419] X-Razor2-Agent: Razor-Agents v2.81
id => 1.1
Apr 07 11:16:59.172181 check[14743]: [ 6] skipping whitelist file (empty?): /etc/razor//razor-whitelist
Apr 07 11:16:59.172829 check[14743]: [ 5] read_file: 1 items read from /etc/razor//servers.discovery.lst
Apr 07 11:16:59.173098 check[14743]: [11] Read 1 from server listfile: /etc/razor//servers.discovery.lst
Apr 07 11:16:59.173512 check[14743]: [ 5] read_file: 2 items read from /etc/razor//servers.nomination.lst
Apr 07 11:16:59.173750 check[14743]: [11] Read 2 from server listfile: /etc/razor//servers.nomination.lst
Apr 07 11:16:59.174100 check[14743]: [ 5] read_file: 1 items read from /etc/razor//servers.catalogue.lst
Apr 07 11:16:59.174320 check[14743]: [11] Read 1 from server listfile: /etc/razor//servers.catalogue.lst
Apr 07 11:16:59.175027 check[14743]: [ 9] Assigning defaults to folly.cloudmark.com
Apr 07 11:16:59.175344 check[14743]: [ 9] Assigning defaults to joy.cloudmark.com
Apr 07 11:16:59.175639 check[14743]: [ 9] Assigning defaults to shock.cloudmark.com
Apr 07 11:16:59.177132 check[14743]: [ 5] read_file: 16 items read from /etc/razor//server.joy.cloudmark.com.conf
Apr 07 11:16:59.178138 check[14743]: [ 5] read_file: 16 items read from /etc/razor//server.joy.cloudmark.com.conf
Apr 07 11:16:59.179126 check[14743]: [ 5] read_file: 16 items read from /etc/razor//server.shock.cloudmark.com.conf
Apr 07 11:16:59.180065 check[14743]: [ 5] read_file: 16 items read from /etc/razor//server.shock.cloudmark.com.conf
Apr 07 11:16:59.180295 check[14743]: [16] entered nextserver
Apr 07 11:16:59.180426 check[14743]: [16] entered discover
Apr 07 11:16:59.180667 check[14743]: [ 5] 152655 seconds before closest server discovery
Apr 07 11:16:59.181017 check[14743]: [ 6] shock.cloudmark.com is a Catalogue Server srl 5092; computed min_cf=21, Server se: C8
Apr 07 11:16:59.181350 check[14743]: [ 8] Computed supported_engines: 4 8
Apr 07 11:16:59.181518 check[14743]: [11] No bootstrap_discovery (DNS) recently, not recording .lst files
Apr 07 11:16:59.181762 check[14743]: [ 8] Using next closest server shock.cloudmark.com:2703, cached info srl 5092
Apr 07 11:16:59.182163 check[14743]: [ 8] mail 1 Subject: HTML email sent by Outlook Express with empty body
Apr 07 11:16:59.183149 check[14743]: [15] log2file: wrote message
len=129 to file: /tmp/razor.14743.1.0.before_preproc.as_reported
Apr 07 11:16:59.183546 check[14743]: [15] log2file: wrote message len=91 to file: /tmp/razor.14743.1.0.after_preproc
Apr 07 11:16:59.183788 check[14743]: [ 6] preproc: mail 1.0 went from 129 bytes to 91
Apr 07 11:16:59.185004 check[14743]: [15] log2file: wrote message
len=419 to file: /tmp/razor.14743.1.1.before_preproc.as_reported
Apr 07 11:16:59.185382 check[14743]: [15] log2file: wrote message len=8 to file: /tmp/razor.14743.1.1.after_preproc
Apr 07 11:16:59.185567 check[14743]: [ 6] preproc: mail 1.1 went from 419 bytes to 279
Apr 07 11:16:59.185745 check[14743]: [15] mail part is [Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable]
Apr 07 11:16:59.185889 check[14743]: [ 6] computing sigs for mail 1.0, len 91
Apr 07 11:16:59.188179 check[14743]: [11] engine 4 computing on 91, sig=6mwGGCehAoy6J57LS20bXi-NlUkA
Apr 07 11:16:59.190378 check[14743]: [ 6] Engine (8) didn't produce a signature for mail 1.0
Apr 07 11:16:59.190611 check[14743]: [15] mail part is [
]
Apr 07 11:16:59.190742 check[14743]: [ 6] mail 1.1 is whitespace only; skipping!
Apr 07 11:16:59.190860 check[14743]: [ 6] computing sigs for mail 1.1, len 8
Apr 07 11:16:59.192665 check[14743]: [11] engine 4 computing on 8, sig=9r-TlG1ogR9eZ1qJDtnxIqXw39kA
Apr 07 11:16:59.194462 check[14743]: [ 6] Engine (8) didn't produce a signature for mail 1.1
Apr 07 11:16:59.195822 check[14743]: [14] computed sigs for obj:
HASH - HASH(0x979be58),5 keys
ep4 => 7542-10
headers => SCALAR - SCALAR(0x948d218)
[length=1064] From [email protected] Fri Apr 7 10:19:24 200
id => 1
orig_mail => SCALAR - SCALAR(0x92984dc)
[length=1727] From [email protected] Fri Apr 7 10:19:24 200
p => ARRAY - ARRAY(0x979be7c),2 items
HASH - HASH(0x979c0ec),5 keys
body => SCALAR - SCALAR(0x9297448)
[length=129] X-Razor2-Agent: Razor-Agents v2.81
cleaned => SCALAR - SCALAR(0x967f2f8)
[length=91] Content-Type: text/plain;
cleaned_vr8 => SCALAR - SCALAR(0x967f328)
[length=91] Content-Type: text/plain;
e4 => 6mwGGCehAoy6J57LS20bXi-NlUkA
id => 1.0
HASH - HASH(0x979c110),5 keys
body => SCALAR - SCALAR(0x92985fc)
[length=419] X-Razor2-Agent: Razor-Agents v2.81
cleaned => SCALAR - SCALAR(0x97b1e9c)
[length=8]
cleaned_vr8 => SCALAR - SCALAR(0x97b1e78)
[length=279] <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transi
e4 => 9r-TlG1ogR9eZ1qJDtnxIqXw39kA
id => 1.1
Apr 07 11:16:59.196153 check[14743]: [16] entered nextserver
Apr 07 11:16:59.196317 check[14743]: [16] entered discover
Apr 07 11:16:59.196533 check[14743]: [ 5] 166609 seconds before closest server discovery
Apr 07 11:16:59.196741 check[14743]: [16] entered nextserver
Apr 07 11:16:59.196850 check[14743]: [16] entered discover
Apr 07 11:16:59.197014 check[14743]: [ 5] 153832 seconds before closest server discovery
Apr 07 11:16:59.197122 check[14743]: [ 5] forcing discovery
Apr 07 11:16:59.197259 check[14743]: [16] entered bootstrap_discovery
Apr 07 11:16:59.197391 check[14743]: [ 8] already have 1 discovery servers
Apr 07 11:16:59.197538 check[14743]: [ 8] Checking with Razor Discovery Server discovery.spamnet.com
Apr 07 11:16:59.197683 check[14743]: [16] entered connect
Apr 07 11:16:59.197838 check[14743]: [ 5] Connecting to discovery.spamnet.com ...
Apr 07 11:16:59.684391 check[14743]: [ 8] Connection established
Apr 07 11:16:59.684724 check[14743]: [ 4] discovery.spamnet.com
>> 35 server greeting:
sn=D&srl=512&a=l&a=cg&ep4=7542-10
Apr 07 11:16:59.684940 check[14743]: [16] entered _send
Apr 07 11:16:59.685212 check[14743]: [ 4] discovery.spamnet.com << 12
Apr 07 11:16:59.685338 check[14743]: [ 6] a=g&pm=csl
Apr 07 11:16:59.917813 check[14743]: [ 4] discovery.spamnet.com >> 32
Apr 07 11:16:59.918007 check[14743]: [ 6] response to sent.1
-csl=?
shock.cloudmark.com
.
Apr 07 11:16:59.918357 check[14743]: [ 8] Discovery Server discovery.spamnet.com replying with csl=shock.cloudmark.com
Apr 07 11:16:59.918522 check[14743]: [16] entered _send
Apr 07 11:16:59.918772 check[14743]: [ 4] discovery.spamnet.com << 12
Apr 07 11:16:59.918889 check[14743]: [ 6] a=g&pm=nsl
Apr 07 11:17:00.149387 check[14743]: [ 4] discovery.spamnet.com >> 51
Apr 07 11:17:00.149555 check[14743]: [ 6] response to sent.2
-nsl=?
folly.cloudmark.com
joy.cloudmark.com
.
Apr 07 11:17:00.149860 check[14743]: [ 8] Discovery Server discovery.spamnet.com replying with nsl=folly.cloudmark.com
Apr 07 11:17:00.149985 check[14743]: [ 8] Discovery Server discovery.spamnet.com replying with nsl=joy.cloudmark.com
Apr 07 11:17:00.151009 check[14743]: [ 5] wrote 1 ARRAY items to file: /etc/razor//servers.catalogue.lst
Apr 07 11:17:00.151643 check[14743]: [ 5] wrote 2 ARRAY items to file: /etc/razor//servers.nomination.lst
Apr 07 11:17:00.152141 check[14743]: [ 6] shock.cloudmark.com is a Catalogue Server srl 5092; computed min_cf=21, Server se: C8
Apr 07 11:17:00.152561 check[14743]: [ 8] Computed supported_engines: 4 8
Apr 07 11:17:00.152730 check[14743]: [11] No bootstrap_discovery (DNS) recently, not recording .lst files
Apr 07 11:17:00.152878 check[14743]: [ 8] Using next closest server shock.cloudmark.com:2703, cached info srl 5092
Apr 07 11:17:00.153011 check[14743]: [16] entered connect
Apr 07 11:17:00.153161 check[14743]: [ 6] losing old server connection,
discovery.spamnet.com, for new server, shock.cloudmark.com
Apr 07 11:17:00.153296 check[14743]: [ 5] disconnecting from server discovery.spamnet.com
Apr 07 11:17:00.153420 check[14743]: [16] entered _send
Apr 07 11:17:00.153688 check[14743]: [ 4] discovery.spamnet.com << 5
Apr 07 11:17:00.153805 check[14743]: [ 6] a=q
Apr 07 11:17:00.154094 check[14743]: [ 5] Connecting to shock.cloudmark.com ...
Apr 07 11:17:00.617315 check[14743]: [ 8] Connection established
Apr 07 11:17:00.617828 check[14743]: [ 4] shock.cloudmark.com >>
36 server greeting: sn=C&srl=5092&a=l&a=cg&ep4=7542-10
Apr 07 11:17:00.618043 check[14743]: [16] entered parse_greeting(sn=C&srl=5092&a=l&a=cg&ep4=7542-10
)
Apr 07 11:17:00.618411 check[14743]: [16] entered _send
Apr 07 11:17:00.618685 check[14743]: [ 4] shock.cloudmark.com << 25
Apr 07 11:17:00.618804 check[14743]: [ 6] cn=razor-agents&cv=2.81
Apr 07 11:17:00.619219 check[14743]: [ 6] shock.cloudmark.com is a Catalogue Server srl 5092; computed min_cf=21, Server se: C8
Apr 07 11:17:00.619587 check[14743]: [ 8] Computed supported_engines: 4 8
Apr 07 11:17:00.619874 check[14743]: [ 8] mail 1.0 e4 sig: 6mwGGCehAoy6J57LS20bXi-NlUkA
Apr 07 11:17:00.620125 check[14743]: [ 5] mail 1.0 e8 got no sig
Apr 07 11:17:00.620282 check[14743]: [ 8] mail 1.1 e4 sig: 9r-TlG1ogR9eZ1qJDtnxIqXw39kA
Apr 07 11:17:00.620481 check[14743]: [ 5] mail 1.1 e8 got no sig
Apr 07 11:17:00.620679 check[14743]: [ 8] preparing 2 queries
Apr 07 11:17:00.621188 check[14743]: [ 8] sending 1 batches
Apr 07 11:17:00.621325 check[14743]: [16] entered _send
Apr 07 11:17:00.621566 check[14743]: [ 4] shock.cloudmark.com << 108
Apr 07 11:17:00.621681 check[14743]: [ 6] -a=c&e=4&ep4=7542-10&s=6mwGGCehAoy6J57LS20bXi-NlUkA
a=c&e=4&ep4=7542-10&s=9r-TlG1ogR9eZ1qJDtnxIqXw39kA
.
Apr 07 11:17:02.049164 check[14743]: [ 4] shock.cloudmark.com >> 29
Apr 07 11:17:02.049385 check[14743]: [ 6] response to sent.5
-p=1&cf=100
p=1&cf=-100
.
Apr 07 11:17:02.049903 check[14743]: [12] processing 2 responses
Apr 07 11:17:02.050421 check[14743]: [14] from_batched_query:
ARRAY - ARRAY(0x9696984),2 items
HASH - HASH(0x9472fc8),2 keys
cf => 100
p => 1
HASH - HASH(0x94781f0),2 keys
cf => -100
p => 1
Apr 07 11:17:02.050626 check[14743]: [12] adding a resp to mail 1.0
Apr 07 11:17:02.050746 check[14743]: [12] adding a resp to mail 1.1
Apr 07 11:17:02.051073 check[14743]: [ 6] mail 1.0 e=4 sig=6mwGGCehAoy6J57LS20bXi-NlUkA: Is spam: cf 100 >= min_cf 21
Apr 07 11:17:02.051439 check[14743]: [ 6] mail 1.1 e=4 sig=9r-TlG1ogR9eZ1qJDtnxIqXw39kA: Not spam: cf -100 < min_cf 21
Apr 07 11:17:02.051631 check[14743]: [ 7] method 4: mail 1.0: no-contention part, spam=1
Apr 07 11:17:02.051750 check[14743]: [ 7] method 4: mail 1.1: no-contention part, spam=0
Apr 07 11:17:02.051865 check[14743]: [ 7] method 4: mail 1: a non-contention part was spam, mail spam
Apr 07 11:17:02.051985 check[14743]: [ 3] mail 1 is known spam.
Apr 07 11:17:02.052118 check[14743]: [ 5] disconnecting from server shock.cloudmark.com
Apr 07 11:17:02.052242 check[14743]: [16] entered _send
Apr 07 11:17:02.052534 check[14743]: [ 4] shock.cloudmark.com << 5
Apr 07 11:17:02.052653 check[14743]: [ 6] a=q
Apr 07 11:17:02.053062 check[14743]: [ 8] razor-check finished successfully.
N.B.
I need to send HTML email with empty body with attachment file but they
are detected as spam only if they have been sent by Outlook Express.
Thanks again for your suggestions
Solo per te TISCALI ADSL con 2 mesi GRATIS + 30 euro di sconto!
Dalla 4 MEGA alla 24 MEGA, scopri l'Adsl Tiscali adatta a te. Con Tiscali Adsl senza limiti hai GRATIS 2 mesi di canone. E oggi in più, solo per pochi giorni, 30 euro di sconto. Non perdere questa straordinaria occasione. L'offerta è valida solo da questa mail. Scopri ora!
http://promozioni.tiscali.it/webmail0406/