unresolved_template?

[Michael Scheidell]

SA 3.25, running sa-update daily.
got a fp on 'unresolved_template'.  describe says 'unresolved_template
in headers'

here are headers.  where is the unresolved_template?

From - Tue Jul 22 07:46:12 2008
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Received: from mail.secnap.net (mail.secnap.net [204.89.241.29]) by secnap3.secnap.com with Microsoft SMTPSVC(6.0.3790.3959);
         Mon, 21 Jul 2008 21:49:19 -0400
Received: by mail.secnap.net (Postfix, from userid 1001)
        id DCBDF16483A; Mon, 21 Jul 2008 21:49:18 -0400 (EDT)
Received: from fl.us.spammertrap.net (fl.us.spammertrap.net [204.89.241.173])
        by mail.secnap.net (Postfix) with ESMTP id 7C4AB164838
        for <SCHEIDELL@...>; Mon, 21 Jul 2008 21:49:18 -0400 (EDT)
Received: from localhost (localhost [127.0.0.1])
        by fl.us.spammertrap.net (Postfix) with ESMTP id 2662AE6031
        for <SCHEIDELL@...>; Mon, 21 Jul 2008 21:49:18 -0400 (EDT)
X-Virus-Scanned: SpammerTrap(r) SME-250 1.81 at secnap.com
X-Spam-Flag: YES
X-Spam-Score: 9.01
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.01 tagged_above=-999 required=5
        tests=[BAYES_00=-2.599, DCC_CHECK=2.17, DCC_REPUT_95_98=1.2,
        HTML_IMAGE_ONLY_24=1.552, HTML_MESSAGE=0.001,
        HTML_MIME_NO_HTML_TAG=0.097, INLINE_IMAGE=1, MIME_HTML_ONLY=1.457,
        NO_REAL_NAME=1, UNRESOLVED_TEMPLATE=3.132]
Received: from pegasus.verizonwireless.com (pegasus.verizonwireless.com [162.115.228.34])
        (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
        (No client certificate requested)
        by fl.us.spammertrap.net (Postfix) with ESMTPS id 0480DE6013
        for <SCHEIDELL@...>; Mon, 21 Jul 2008 21:49:15 -0400 (EDT)
Received: from sprod1.odc.vzwcorp.com ([10.170.28.117])
  by pegasus.verizonwireless.com with SMTP; 21 Jul 2008 21:49:11 -0400
Date: Mon, 21 Jul 2008 21:49:10 -0400 (EDT)
Message-Id: <08072121491088_20E7F623@...>
From: Shipments@...
To: SCHEIDELL@...
Subject: [SPAM] Your Verizon Wireless Shipment Notification (Order #436231)
X-VMS-To: smtp%SCHEIDELL@...
X-VMS-True-From: decq_admin@...
Mime-Version: 1.0
Content-Type: multipart/related;
 boundary="----=_Part_PROD_1434901_436231"
Return-Path: decq_admin@...
X-OriginalArrivalTime: 22 Jul 2008 01:49:19.0527 (UTC) FILETIME=[281A6370:01C8EB9D]


------=_Part_PROD_1434901_436231
Content-Type: text/html; charset=US-ASCII

(snip html email)

------=_Part_PROD_1434901_436231
Content-Type: image/gif
Content-Transfer-Encoding: base64
(snip image)

------=_Part_PROD_1434901_436231--

Content-ID: memememe



--
Michael Scheidell, President
Main: 561-999-5000, Office: 561-939-7259
 > *| *SECNAP Network Security Corporation
Winner 2008 Technosium hot company award.
www.technosium.com/hotcompanies/ <http://www.technosium.com/hotcompanies/>

_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.spammertrap.com
_________________________________________________________________________

[Karsten Bräckelmann-2]

On Tue, 2008-07-22 at 07:57 -0400, Michael Scheidell wrote:
> SA 3.25, running sa-update daily.
> got a fp on 'unresolved_template'.  describe says 'unresolved_template
> in headers'
>
> here are headers.  where is the unresolved_template?

Oh, come on, Michael, I know you could have tracked this down yourself
easily.  20_head_tests.cf, HeaderEval.pm

    if ($header =~ /%[A-Z][A-Z_-]/ &&


> X-Spam-Score: 9.01
> X-Spam-Level: *********
> X-Spam-Status: Yes, score=9.01 tagged_above=-999 required=5
> tests=[BAYES_00=-2.599, DCC_CHECK=2.17, DCC_REPUT_95_98=1.2,
> HTML_IMAGE_ONLY_24=1.552, HTML_MESSAGE=0.001,
> HTML_MIME_NO_HTML_TAG=0.097, INLINE_IMAGE=1, MIME_HTML_ONLY=1.457,
> NO_REAL_NAME=1, UNRESOLVED_TEMPLATE=3.132]

> To: SCHEIDELL@...
> Subject: [SPAM] Your Verizon Wireless Shipment Notification (Order #436231)
> X-VMS-To: smtp%SCHEIDELL@...
                ^^^
> X-VMS-True-From: decq_admin@...

There's what looks like an "unresolved template".

FWIW, even without the UNRESOLVED_TEMPLATE hit, this would have scored
above your threshold of 5.

  guenther


--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

[Michael Scheidell]

> From: Karsten Bräckelmann <guenther@...>
> Date: Tue, 22 Jul 2008 14:30:29 +0200
> To: <users@...>
> Subject: Re: unresolved_template?
>
> On Tue, 2008-07-22 at 07:57 -0400, Michael Scheidell wrote:
>> SA 3.25, running sa-update daily.
>> got a fp on 'unresolved_template'.  describe says 'unresolved_template
>> in headers'
>>
>> here are headers.  where is the unresolved_template?
>
> Oh, come on, Michael, I know you could have tracked this down yourself
> easily.  20_head_tests.cf, HeaderEval.pm
>

No coffee yet ;-)
Ok, I'll report it on bugs.

Others I knew about, dcc (using the commercial dcc plugin, not free one)
gives me that 1.2 points, and.. I should have whitelisted them in
/etc/dcc/whitecommon.  They are now, just didn't catch the
unresolved_template bug.

_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.spammertrap.com
_________________________________________________________________________