Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 1410 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Many false positives suddenly

hagman_01
After publishing some job vacancies on the web, a *lot* of mails get quarantined that should not. My suspicion is that they get quarantined as "bulk" because

* they all have the same or almost the same subject line "Bewerbung (=application) als "
* many come from the same mailservers for private mail accounts (googlemail, yahoo, gmx, web.de)

While many many such mails get quarantined, there are still more than enough applications getting through to choose from, so we might still be happy. But since "deliberately" ignoring a job application might even have legal consequences, our happiness remains limited.

My problem is: Is not possibly e.g. to white-list subject keywords such as "Bewerbung" to prevent the Bulk classification?


I assume this is the relevant log line from smtp.log:

 2014-10-22 09:16:25 1Xgq9f-000424-1S ctasd reports 'Bulk' RefID:str=0001.0A0C0207.544759C9.0092,ss=3,re=0.000,recu=0.000,reip=0.000,cl=3,cld=1,fgs=0


Here's an example of headers of such a quarantined mail:

 Received: from dub004-omc4s35.hotmail.com ([157.55.2.110]:56529) by %MYASTARO% with esmtps (TLSv1.2:AES256-SHA256:256) (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1Xgq9f-000424-1S for %USER%@%MYDOMAIN%; Wed, 22 Oct 2014 09:16:25 +0200
Received: from DUB128-W1 ([157.55.2.71]) by DUB004-OMC4S35.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22751); Wed, 22 Oct 2014 00:16:22 -0700
X-CTCH-RefID: str=0001.0A0C0207.544759C9.0092,ss=3,re=0.000,recu=0.000,reip=0.000,cl=3,cld=1,fgs=0
X-TMN: [xtMV30RhDjv4SbC/cM8TvmFCVk4Wx+cS]
X-Originating-Email: [%SENDERNAME%@hotmail.de]
Message-ID: 
Return-Path: %SENDERNAME%@hotmail.de
Content-Type: multipart/mixed; boundary="_59b7dbc3-d142-48f4-b45f-68593abc4c56_"
From: %NAME% 
To: "%USER%@%MYDOMAIN%" 
Subject: Bewerbung als Empfangskraft
Date: Wed, 22 Oct 2014 09:16:22 +0200
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 22 Oct 2014 07:16:22.0928 (UTC) FILETIME=[15A30100:01CFEDC8]


This thread was automatically locked due to age.
Parents
  • 0
    There's no way to create an Exception based on content, but that might be an interesting Feature suggestion.  Instead of releasing from the Quarantine Report, "Release and report as false positive" from the User Portal or Mail Manager.  After a week or two, those Bewerbungen will not be seen as spam.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    There's no way to create an Exception based on content, but that might be an interesting Feature suggestion.  Instead of releasing from the Quarantine Report, "Release and report as false positive" from the User Portal or Mail Manager.  After a week or two, those Bewerbungen will not be seen as spam.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML