Addressee Filter does not consider BCC

Haben Sie einen Fehler in einem Plugin entdeckt?

Moderator: Forum-Team

Addressee Filter does not consider BCC

Beitragvon Dieter » 7. Dez 2004, 13:52

Hi,

I post this in English because the explanation concerning the Addressee Filter is in English, too. And I suppose that the author of the Filter does not understand German. :? Or should I have posted it in the English Forum?

I switched to the Addressee Filter from S3bast1ans Mandatory-String-Filter which exists since half a year only in a beta-version: http://www.spamihilator.com/forum/viewtopic.php?t=2922. But I have almost the same problems:
  • When I receive a mail via BCC this mail will be considered as spam, because the Addressee Filter does not check the "Envelope-To"-Entry :(
  • A lot of senders which send mails to many persons use with "To" the same entry as in "From". Therefore it should be checked if
    • From = To or
    • From = Return-Path
  • In addition a mail where "To" has the very common entry "undisclosed-recipients" should not be considered as spam

Regards
Dieter
Intel(R) Core(TM)2 Duo CPU E8500 3.16 GHz, 3.25 GB Ram, WinXP Home Edition SP3,
Outlook Express 6, Outlook 2007
Intel(R) Core(TM)2 Duo CPU T8100 2.10 GHz, 4.00 GB Ram, Windows 7 Ultimate,
Windows Live Mail, Outlook 2007
T-Online/1&1/Gmx/Strato, Call & Surf Comfort Plus, DSL 16000
Benutzeravatar
Dieter
Assistent
Assistent
 
Beiträge: 1545
Registriert: 14. Sep 2003, 10:16
Wohnort: München

Re: Addressee Filter does not consider BCC

Beitragvon Edy Hinzen » 7. Dez 2004, 22:16

Hi Dieter!

In fact, Carolyn, the author of the Adressee filter prefers the English language :wink:

I've discussed/tested with her some details of her filter in the latter time and think there should be no (more) problems in that direction.

Please, check out: Have you installed a plugin version from 2004-12-01 or later? If not, please update.

Regards
Edy
Benutzeravatar
Edy Hinzen
Spam-Massenmörder
Spam-Massenmörder
 
Beiträge: 187
Registriert: 21. Mai 2004, 23:02
Wohnort: Ihringen

Re: Addressee Filter does not consider BCC

Beitragvon carolyns » 7. Dez 2004, 23:39

Hi Dieter -

Thanks for the English (in German I only know a few important phrases, such as how to ask for a beer).

I looked at the source of a plain text message that I Bcc'd to myself. I do see how this is a problem. I thought there would be a Bcc header field accessible by my filter which would contain just the recipient's email address.

However, there appears to be no Bcc: line in the header.

I do not know how to solve this because...

1. I do not blindly want to accept mail addressed to Undisclosed-Recipient. However if YOU wish to receive mail addressed to Undisclosed-Recipient you can simple add that name to your Addressee Filter list of acceptable email addresses for you.

2. The real recipient email address in a plain text Bcc email seems to be in the Received from line(s) where is says:

for <yourname@emailaddress.com>

Unfortunately every piece of bulk-list spam mail I get has this same format. So I cannot search for that.

3. I sent two emails to myself only as Bcc, one to each of my two email accounts, and when I received them neither contained the text "Envelope-To" in them. One had an Envelope-From. So it seems I cannot check for "Envelope-To".

4. I do not understand the purpose of this suggestion of yours:

(quote)
A lot of senders which send mails to many persons use with "To" the same entry as in "From". Therefore it should be checked if

* From = To or
* From = Return-Path
(end quote)


NOTE - If you want to make sure mail from yourself always gets to you, you can add your own email addresses into the built-in Friends settings of Spamihilator and the mail should never reach my filter.


Carolyn
carolyns
Power-User
Power-User
 
Beiträge: 8
Registriert: 7. Dez 2004, 22:39

Re: Addressee Filter does not consider BCC

Beitragvon Dieter » 8. Dez 2004, 00:22

Edy Hinzen hat geschrieben:Please, check out: Have you installed a plugin version from 2004-12-01 or later?

The Addressee Filter I installed has the version 1.0.3, my download has the date 2004-12-03.

Regards
Dieter
Intel(R) Core(TM)2 Duo CPU E8500 3.16 GHz, 3.25 GB Ram, WinXP Home Edition SP3,
Outlook Express 6, Outlook 2007
Intel(R) Core(TM)2 Duo CPU T8100 2.10 GHz, 4.00 GB Ram, Windows 7 Ultimate,
Windows Live Mail, Outlook 2007
T-Online/1&1/Gmx/Strato, Call & Surf Comfort Plus, DSL 16000
Benutzeravatar
Dieter
Assistent
Assistent
 
Beiträge: 1545
Registriert: 14. Sep 2003, 10:16
Wohnort: München

Re: Addressee Filter does not consider BCC

Beitragvon Dieter » 8. Dez 2004, 00:49

Hi Carolyn.

here is just one response to the "Envelope-To". I got the following mail
Code: Alles auswählen
Return-Path: <###########@###########>
Delivery-Date: Tue, 07 Dec 2004 00:59:07 +0100
Received: from 194.25.134.82 (helo=mailout05.sul.t-online.com)
   by mx-b.kundenserver.de. with ESMTP (Nemesis),
   id 0MKpdM-1CbSl11vZB-0003LS; Tue, 07 Dec 2004 00:59:07 +0100
Received: from fwd02.aul.t-online.de
   by mailout05.sul.t-online.com with smtp
   id 1CbSl0-0007tj-00; Tue, 07 Dec 2004 00:59:06 +0100
Received: from 127.0.0.1 (GWWpViZOZebPQVm5SDA+8MC-98wQeTj7qbStEMYbD7RmK2MdiP4Y6k@[217.249.239.252]) by fwd02.sul.t-online.com
   with smtp id 1CbSkn-1luc1Q0; Tue, 7 Dec 2004 00:58:53 +0100
MIME-Version: 1.0
Subject: Re: Fw: Ori/Termin
From: ###########@######## (Kurt #########)
References: <##############################@florian>
In-Reply-To: <##############################@florian>
To: "Birgit ####" <birgit.####@###########>
Cc: "Marina #########" <marina.#####################>,
   "Astrid ######### <a.#####################>,
   "Roland #######" <Roland.#########################>,
   "Maren ########" <##########################>,
   "###### Hermann" <#######################>
X-Mailer: T-Online eMail 5.00.0031
Content-Type: Multipart/Alternative;
   Boundary="__Next_1102377340_Part59__"
Date: 06 Dec 2004 23:55 GMT
Message-ID: <1CbSkn-1luc1Q0@fwd02.sul.t-online.com>
X-ID: GWWpViZOZebPQVm5SDA+8MC-98wQeTj7qbStEMYbD7RmK2MdiP4Y6k
X-TOI-MSGID: 02541090-23bb-4dc1-85a0-6bf651c37938
Envelope-To: dieter@###########
X-SpamScore: 0.000


At the bottom you see "Envelope-To" and my address. But it seems to be in the X-part of the message. Therefore it could be correct, that this is not a standard message entry. :? :(

Tomorrow I am going to answer to your other hints. :wink:

Regards
Dieter
Intel(R) Core(TM)2 Duo CPU E8500 3.16 GHz, 3.25 GB Ram, WinXP Home Edition SP3,
Outlook Express 6, Outlook 2007
Intel(R) Core(TM)2 Duo CPU T8100 2.10 GHz, 4.00 GB Ram, Windows 7 Ultimate,
Windows Live Mail, Outlook 2007
T-Online/1&1/Gmx/Strato, Call & Surf Comfort Plus, DSL 16000
Benutzeravatar
Dieter
Assistent
Assistent
 
Beiträge: 1545
Registriert: 14. Sep 2003, 10:16
Wohnort: München

Re: Addressee Filter does not consider BCC

Beitragvon Bob Loeffler » 8. Dez 2004, 01:55

carolyns hat geschrieben:(in German I only know a few important phrases, such as how to ask for a beer).


I like how you think! :-)

I looked at the source of a plain text message that I Bcc'd to myself. I do see how this is a problem. I thought there would be a Bcc header field accessible by my filter which would contain just the recipient's email address.

However, there appears to be no Bcc: line in the header.


As far as I know, you should never be able to see any actual e-mail addresses in the BCC header field because it is always hidden. That is why it is called "Blind Carbon Copy". It is used for sending messages to people without anyone knowing who they were sent to.

2. The real recipient email address in a plain text Bcc email seems to be in the Received from line(s) where is says:

for <yourname@emailaddress.com>


The Received lines will have the mail servers' info, and probably not much in the way of e-mail addresses.

3. I sent two emails to myself only as Bcc, one to each of my two email accounts, and when I received them neither contained the text "Envelope-To" in them. One had an Envelope-From. So it seems I cannot check for "Envelope-To".


The "Envelope-To" header field is not standard, so your filter shouldn't look for it. :-)

NOTE - If you want to make sure mail from yourself always gets to you, you can add your own email addresses into the built-in Friends settings of Spamihilator and the mail should never reach my filter.


This is not a good idea because spammers often use this as one of their spamming tricks.

Regards,

Bob
English Spamihilator FAQ - Spamihilator questions and answers in English!
Author of these plugins and filters: Attachment Extensions Filter, Empty Mail Filter, HTML Links Filter, No Comment! Filter, Plain Text Links Filter, Scripts Filter, Unclassified Filter, Export Senders Plugin and Filter Statistics Plugin. See the details here!
Benutzeravatar
Bob Loeffler
 
Forum-Team
Plugin-Programmierer
 
Beiträge: 1132
Registriert: 5. Dez 2003, 20:20
Wohnort: Colorado, USA

Re: Addressee Filter does not filter Bcc

Beitragvon carolyns » 8. Dez 2004, 18:56

Since Addressee filter is mainly for people with hosted email addresses who get spam to the underlying address (like me), Addressee filter ONLY marks as definite spam any email which does NOT contain any of the user's correct email addresses. Anything detected as containing a correct email address is passed on to the next filter.

So what I need is a header line that will always contain the recipient's email address in mail they are Bcc'd on. What line would that be? It needs to be there regardless of message type (text,mime,etc) or mail program used. On my system that seems to be one or more of the "Received from" lines where it says "for user@address"

Carolyn

BTW - I used to visit Germany to speak at Amiga Developer's Conferences when it was Commodore Frankfurt's turn to host. Wonderful sightseeing - I especially liked the wine country, the castles, a small restaurant in Rohmer (hmm crusty bread and gulasch-suppe and a beer) and the Pharmacy Museum in Heidelberg. Good beer, good food, nice people.
carolyns
Power-User
Power-User
 
Beiträge: 8
Registriert: 7. Dez 2004, 22:39

Re: Addressee Filter does not consider BCC

Beitragvon michel » 8. Dez 2004, 19:47

Hi!

Sightseeing in Frankfurt? That's two irreconcilable words ;-) ;-)

Thank you, though!
Michel Krämer
Chuck Norris doesn't kill Spam. He uses Spamihilator! ;-)
Benutzeravatar
michel
Administrator
Administrator
 
Administration
Beta-Tester
Forum-Team
Plugin-Programmierer
 
Beiträge: 4335
Registriert: 22. Mär 2003, 01:16
Wohnort: Buseck

Re: Addressee Filter does not consider BCC

Beitragvon carolyns » 8. Dez 2004, 21:53

Off topic but...

In Frankfurt I enjoyed the Rohmer area, the zoo (especially the dark exhibit with night animals), the beer festival, the river, the shopping area, and a couple of nice restaurants in Sachsenhausen. We also took a two day trip from Frankfurt west along the Rhine and down the Moselle and stayed in a little hotel on the river across from a castle.

Carolyn
carolyns
Power-User
Power-User
 
Beiträge: 8
Registriert: 7. Dez 2004, 22:39

Re: Addressee Filter does not consider BCC

Beitragvon Dieter » 9. Dez 2004, 11:32

Hi Carolyn,

I have to apologize not having posted earlier. But I was very busy and didn't find the time for an answer!
  • Concerning BCC I see your problem. You don't have a solution, neither do I! :cry: Yesterday I got another BCC-message with no "Envelope-To"-entry and no hint to my address. I thought, at least the addressee of a BCC-message should have an entry with his address, but obviously there are no standard conventions. Perhaps you could check if there is the non-standard entry "Envelope-To" in order to have at least a few messages separated out as non-spam, but that will be your decision.
  • Of course I am able to add "undisclosed-recipients" to the addressee list - I did it already - but this addressee entry is very common and each new user of your filter will first stumble across this and switch again a "spam" to a "non-spam" if he happened to detect it in the trash.
  • Now, my suggestion "From = To". I am busy with work for a lot of institutions. Therefore I have many different addresses, more than ten at the moment. I get a lot of circular mails where one of my addresses is not mentioned at all. The consequence is, in order not to loose important mails, to check the training area exactly for false-positives and to transfer the "To"-addresses to the addressee list, and the list increases, increases, increases ... :cry: How the speed of your filter will be influenced by an addressee list with many, many entries? :? One common behaviour of those mailers is to use their own address as addressee, and the enlargement of the addressee list could be lessened by checking "From = To". Of course, spammers could do the same thing and fill the "To"-address with the "From"-entry, but I don't believe it and secondly it should be balanced: spam or false-positives in the trash. In addition I have some more filters to recognize spam mails. :wink:

Regards
Dieter
Intel(R) Core(TM)2 Duo CPU E8500 3.16 GHz, 3.25 GB Ram, WinXP Home Edition SP3,
Outlook Express 6, Outlook 2007
Intel(R) Core(TM)2 Duo CPU T8100 2.10 GHz, 4.00 GB Ram, Windows 7 Ultimate,
Windows Live Mail, Outlook 2007
T-Online/1&1/Gmx/Strato, Call & Surf Comfort Plus, DSL 16000
Benutzeravatar
Dieter
Assistent
Assistent
 
Beiträge: 1545
Registriert: 14. Sep 2003, 10:16
Wohnort: München

Re: Addressee Filter does not filter Bcc

Beitragvon Bob Loeffler » 9. Dez 2004, 19:22

carolyns hat geschrieben:So what I need is a header line that will always contain the recipient's email address in mail they are Bcc'd on. What line would that be? It needs to be there regardless of message type (text,mime,etc) or mail program used. On my system that seems to be one or more of the "Received from" lines where it says "for user@address"


Hi Carolyn,

Unfortunately, there isn't a header line that will always have the recipients e-mail address. I did some testing with my 2 e-mail accounts (which use different mail servers) yesterday and found that one of them does use the "for user@address" in the "Received" header field, but the other one doesn't. Maybe it's a setting on the mail server, so we can't assume that it will always be there.

If there is another way to do this, I don't know about it. :-(

Regards,

Bob
English Spamihilator FAQ - Spamihilator questions and answers in English!
Author of these plugins and filters: Attachment Extensions Filter, Empty Mail Filter, HTML Links Filter, No Comment! Filter, Plain Text Links Filter, Scripts Filter, Unclassified Filter, Export Senders Plugin and Filter Statistics Plugin. See the details here!
Benutzeravatar
Bob Loeffler
 
Forum-Team
Plugin-Programmierer
 
Beiträge: 1132
Registriert: 5. Dez 2003, 20:20
Wohnort: Colorado, USA

Re: Addressee Filter does not consider BCC

Beitragvon Bob Loeffler » 9. Dez 2004, 19:25

Hi Dieter,

Of course, spammers could do the same thing and fill the "To"-address with the "From"-entry


I see this all the time in Spam e-mails. :-(

Regards,

Bob
English Spamihilator FAQ - Spamihilator questions and answers in English!
Author of these plugins and filters: Attachment Extensions Filter, Empty Mail Filter, HTML Links Filter, No Comment! Filter, Plain Text Links Filter, Scripts Filter, Unclassified Filter, Export Senders Plugin and Filter Statistics Plugin. See the details here!
Benutzeravatar
Bob Loeffler
 
Forum-Team
Plugin-Programmierer
 
Beiträge: 1132
Registriert: 5. Dez 2003, 20:20
Wohnort: Colorado, USA

Re: Addressee Filter does not consider BCC

Beitragvon Dieter » 9. Dez 2004, 20:04

Hi Bob,

Bob Loeffler hat geschrieben:I see this all the time in Spam e-mails. :-(
I didn't deny this fact, but if the lot of false-positives cannot be lessened in some way I have to eliminate the addressee filter again or perhaps to move it behind the learning filter, I'm sorry, I'll not have another choice! :cry:

Regards
Dieter
Intel(R) Core(TM)2 Duo CPU E8500 3.16 GHz, 3.25 GB Ram, WinXP Home Edition SP3,
Outlook Express 6, Outlook 2007
Intel(R) Core(TM)2 Duo CPU T8100 2.10 GHz, 4.00 GB Ram, Windows 7 Ultimate,
Windows Live Mail, Outlook 2007
T-Online/1&1/Gmx/Strato, Call & Surf Comfort Plus, DSL 16000
Benutzeravatar
Dieter
Assistent
Assistent
 
Beiträge: 1545
Registriert: 14. Sep 2003, 10:16
Wohnort: München

Re: Addressee Filter does not filter Bcc

Beitragvon Dieter » 10. Dez 2004, 00:28

Bob Loeffler hat geschrieben:... and found that one of them does use the "for user@address" in the "Received" header field, but the other one doesn't. Maybe it's a setting on the mail server, so we can't assume that it will always be there.

"Envelope-To" is also set by the mail server. All mails I get via T-Online contain this entry. Another mail which I got via a different provider had my address in the "Received" field. I believe if these both entries are checked a good percentage of mails are affected.

Regards
Dieter
Intel(R) Core(TM)2 Duo CPU E8500 3.16 GHz, 3.25 GB Ram, WinXP Home Edition SP3,
Outlook Express 6, Outlook 2007
Intel(R) Core(TM)2 Duo CPU T8100 2.10 GHz, 4.00 GB Ram, Windows 7 Ultimate,
Windows Live Mail, Outlook 2007
T-Online/1&1/Gmx/Strato, Call & Surf Comfort Plus, DSL 16000
Benutzeravatar
Dieter
Assistent
Assistent
 
Beiträge: 1545
Registriert: 14. Sep 2003, 10:16
Wohnort: München

Re: Addressee Filter does not consider BCC

Beitragvon carolyns » 10. Dez 2004, 00:55

Dieter -

In the example mail you posted, would your correct email address have been in the regular Cc: (rather than a Bcc) ?

When you get a mail via Bcc do any of the Received lines include the word "for" followed by one of your correct email addresses?

All of the blind CC's so far that I have examined in my mailbox, somewhere in one of the Received lines, includes the word "for" followed by one of my email addresses.

Keeping in mind that the purpose of Addressee filter is to screen out mail sent to incorrect addresses (such as when your correct email address is a hosted alias and you get spam to the underlying @isp.com address)..

Here is what I would like to do, if all (or most) Bcc'd messages, somewhere in a Received line, contain "for email-address":

If one of your correct email addresses does not appear in any To, Cc, Received line, mark the message as spam.

I might make the Received check an option because people who receive few valid Bcc's and many spam ones to their correct email addresses may wish to have all non-friend Bcc's marked as spam (or high chance of spam) and add their friendly Bcc senders to their friends list.

I considered the possibility of an option checkbox to pass From-same-as-To-or-Cc messages, BUT it would really screw up the program logic which scans the header in order, using the linked list of header fields. If From always appeared above To, this would work and I could cache the From name and add it to my checks against To and CC. However, I looked at the source of several messages and found To before From in many of them. This would mean all mail headers would have to be scanned twice if I implemented such an option.

Carolyn
carolyns
Power-User
Power-User
 
Beiträge: 8
Registriert: 7. Dez 2004, 22:39

Nächste

Zurück zu Plugins: Bugs

Wer ist online?

Mitglieder in diesem Forum: 0 Mitglieder und 1 Gast

 industrious-southeast