MozillaZine


Suspect spam in subject line

User Help for Mozilla Thunderbird
Johnr749
Guest
 

Post Posted November 27th, 2008, 3:12 pm

Suddenly when sending e-mails the words "SUSPECT SPAM" appears in subject line when it reaches its destination. I have tried sending messages to myself using Hotmail and outlook express and it is OK. It only happens when using thunderbird. I am on 1.5.0.14. Looking at message source it seems to be something to do with ironport. Any suggestions. John

tanstaafl
Moderator

User avatar
 
Posts: 48782
Joined: July 30th, 2003, 5:06 pm

Post Posted November 27th, 2008, 6:41 pm

Thunderbird never uses the word spam. I'd assume its due to whatever smtp server you're using, a security suite or a router/security appliance. See if outlook express uses the same smtp server etc.

Whats a ironport?

Guest
Guest
 

Post Posted November 27th, 2008, 6:46 pm

you never heard of it? me either

http://www.gcn.com/print/25_14/40915-1.html#

Johnr749
Guest
 

Post Posted November 28th, 2008, 2:15 am

Ironport.com is an anti spam product (part of Cisco). I think that Tiscali must use it as part of their filtering. However this problem only occurs when I send using Thunderbird not with Hotmail or Outlook Express.

tanstaafl
Moderator

User avatar
 
Posts: 48782
Joined: July 30th, 2003, 5:06 pm

Post Posted November 28th, 2008, 5:01 am

I suspect you're not using the same SMTP servers, or somehow sending a message thats formatted differently. See if there are some headers beginning with an X that IronPort added that might have some information about the spam score and what tests were run. For example, my email provider uses SpamAssassin so it added to one spam message:

X-Spam-score: 7.3
X-Spam-hits: BAYES_99 3.5, SUBJECT_NEEDS_ENCODING 0.001, SUBJ_ILLEGAL_CHARS 1.586, TVD_SPACE_RATIO 2.219, BAYES_USED global

and I can look up in http://spamassassin.apache.org/tests_3_2_x.html what the strings in X-Spam-hits mean.

Johnr749
Guest
 

Post Posted November 28th, 2008, 5:23 am

This is what it says
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgfQALdpL0lYai5w/2dsb2JhbACCLwSEWohQwXCCfQ
Subject: [POSSIBLE SPAM] (no subject)
X-IP-Spam-Verdict: SUSPECTEDSPAM
X-IronPort-AV: E=Sophos;i="4.33,680,1220223600";
d="scan'208";a="112709863"

Dont really know what all this means.

tanstaafl
Moderator

User avatar
 
Posts: 48782
Joined: July 30th, 2003, 5:06 pm

Post Posted November 28th, 2008, 5:29 am

It looks like its using Sophos anti-virus. Other than that its gibberish. Talk to somebody at Tiscali and see if they can decrypt the value of the X-IronPort-Anti-Spam-Result: header, and whether its possible for them to disable anti-spam testing for your account.

Johnr749
Guest
 

Post Posted November 28th, 2008, 11:44 am

One other thing I have checked with Spamhaus and my IP is listed on the PBL database. They say that the problem might be that the smpt authentication is turned off. Can you advise how I check that it is on. All this is a bit technical for me. :cry:

tanstaafl
Moderator

User avatar
 
Posts: 48782
Joined: July 30th, 2003, 5:06 pm

Post Posted November 28th, 2008, 4:01 pm

SMTP authentication means that you need to provide a username and password when sending. You could modify the SMTP server entry by unchecking the username field and see if you can't send any more to somebody in a different domain. If it needs it you will probably get a 5.7.1 Unable to relay error message.

You said your IP address is listed in thier policy block list database. I found some text at thier web site that said "The Spamhaus PBL is a DNSBL database of end-user IP address ranges which should not be delivering unauthenticated SMTP email to any Internet mail server except those provided for specifically by an ISP for that customer's use."

All that really means is that you're not somebody working in a company who uses a SMTP server on thier LAN, so you need to prove who you are when trying to use the SMTP server over the Internet.

While a security appliance might increase your spam score a little because you're not using SMTP authentication it would have to be paranoid to label your mail as spam just due to that.

Johnr749
Guest
 

Post Posted December 3rd, 2008, 9:21 am

The latest. None of the suggestions that Tiscali support gave worked, and now no e-mails send via Thunderbird are getting through at all. They are just dissapearing onto a black hole!

tanstaafl
Moderator

User avatar
 
Posts: 48782
Joined: July 30th, 2003, 5:06 pm

Post Posted December 3rd, 2008, 4:11 pm

Do you have another account that provides a SMTP server? Typically you can use a SMTP server with any account as long as it requires its own username/password.

Johnr749
Guest
 

Post Posted December 5th, 2008, 10:45 am

A call from Tiscali today to say that the problem is not with them. They blame Thunderbird which they say they do not support. The only suggestion is to completely uninstall T/B and reinstall. The only problem with that is losing my address book and all the message in the inbox, is there any way round this? Looking at various forums it seems that I am not the only one with this problem, it is just that Tiscali do not want to know and say that I should use Outlook Express or Tiscali webmail.

Daifne
Moderator

User avatar
 
Posts: 123071
Joined: July 31st, 2005, 9:17 pm
Location: Where the Waters Meet, Wisconsin

Post Posted December 5th, 2008, 11:04 am

You should say that you are using Outlook Express. Uninstalling Thunderbird won't do anything. If there was a problem with Thunderbird, which this isn't, the problem would be in your profile folder, not the program. The profile is separate from the program which is why you also wouldn't lose anything by reinstalling.

mikeymike

User avatar
 
Posts: 2827
Joined: April 24th, 2003, 6:00 am
Location: UK

Post Posted December 7th, 2008, 10:38 am

One of my customers is having this problem as well (mails sent by Thunderbird get "POSSIBLE SPAM" in the subject line, ones from OE don't). I've been checking over their machine today and there is no sign of anything dodgy-malware-ish.

Daifne
Moderator

User avatar
 
Posts: 123071
Joined: July 31st, 2005, 9:17 pm
Location: Where the Waters Meet, Wisconsin

Post Posted December 7th, 2008, 4:25 pm

It's probably on a server somewhere.

Return to Thunderbird Support


Who is online

Users browsing this forum: Bing [Bot] and 1 guest