Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My wife runs a small website (in Japanese) selling vintage products online. She's sending out emails to customers with details about their order, together with images of the products and links to the item page(s).

All emails go via postmark (a credible 3rd party email delivery service). We also use SPF and DKIM to make sure emails are not flagged as spam. Most emails arrive without a problem, with a very low bounce-rate. As far as my wife and her customers are concerned, the emails are totally legit.

Occasionally however, when customers reply to one of those emails, we see a subject line that looks something like this: RE: [***Spam***](Suspicious Urls) ご注文ありがとうございます。 - Frau Vintage

From looking at the email headers, I believe this is emailed from MS Outlook (X-Mailer: Microsoft Office Outlook 12.0). Is this something done by Outlook's embedded junk e-mail filter, or perhaps third-party software?

Does anyone know which spam filter or tool marks those emails as spam and perhaps which method it uses to classify URLs as "suspicious"? Is there a way for my wife to report these as false-positives to the vendor?

Note: unfortunately it is not an option to contact the email recipient directly or ask them to take any action. This will most likely scare them or cause unnecessary confusion, so I would like to investigate this without any customer assistance.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

The product may be "Virus Security ZERO" by Sourcenext, a Japanese software company. They have FAQ pages for it that contains the [***Spam***](Suspicious Urls) text.

If you use Google Chrome to view that page, it should detect that it is in Japanese, and offer to translate it to English. The English version of the Sourcenext website is much more basic, and doesn't seem to contain the same FAQ entries.

I haven't checked out how to report false positives, although with Chrome translating the pages, you should be able to do that yourself (or maybe work out how to prevent your emails from triggering the detection).

share|improve this answer
    
Thanks! this looks promising. My wife speaks japanese (as her customers), so I'll ask her to take a look, and maybe try to contact this company. We don't want to trouble the customers with this, and they are usually not very computer-savvy. –  Yoav Aner Jan 23 '13 at 8:50
1  
a quick update: we contacted the vendor and submitted the url. Oddly they said that it is because the url are percent-encoded. Given that the products and the entire site are in japanese, the urls are encoded so that the name appears on the url... Strange heuristics to block suspicious urls if you ask me. –  Yoav Aner Feb 9 '13 at 10:11
add comment

An entire header may provide a clue. If "postmarkapp.com" (Postmark) is used, they already integrated spam filters and they are providing the service. By closely examining the reply, it is possible to identify whether the reply has something to trigger the filters. Including links, attachments, language issues etc.

There is a possibility of using Spam Assassin in order to filter the emails. They have mentioned it. The header may include some extra information regarding that. However, there is no clear picture of the email flow from/to your end mentioned.

share|improve this answer
    
the emails get delivered, and I also checked them with spamassassin already, and see nothing in particular to worry about. The majority of emails get delivered and we know customers receive them. Only in a minority of cases we get reports of spam, as in this case. I'm particularly interested in this particular case : how to find which product/company misclassifies our emails, and hopefully how to report this false-positive to them. –  Yoav Aner Jan 23 '13 at 8:54
    
If that is the issue, you need to contact the specific users and work with them to identify possibilities. However, by checking the headers, it is possible to identify the forwarding servers. Thank you! –  Lasith Jan 23 '13 at 20:05
    
Working with the customers is not an option unfortunately. The forwarding servers are also pretty irrelevant in this case in my opinion. In any case, please read the question. This is not what I was asking. –  Yoav Aner Jan 23 '13 at 20:12
    
My point is that there are possibilities. This does not happen without a reason. This specific message indicates that this was due to shortened URLs. However, what I mentioned was about the forwarding (mail flow) path. There could be 2 forms of filters who do this. One is a server side product (i.e. Forefront/Barracuda) or a client Anti Virus solution. If the emails sent to Japan, there is a good possibility that Sourcenext products marking these as spam. However, this can be mitigated (by the end user). Avast and other client security software could do a similar thing (configurable). –  Lasith Jan 23 '13 at 22:13
    
Its not outlook. However, it has options to block Japanese and other content. But no such tag attached. And this error specifically say that it is a URL which is not trusted. It is also possible to examine the complete header to check for the specific endpoints (except client endpoints). By examining it is possible to find out which service and integrated systems have caused this. If not, this is an end point product (client software). –  Lasith Jan 23 '13 at 22:16
add comment

It is pretty common practice to make that kind of header update in most spam filtering systems. I know ASSP does the same exact thing.

As for the reason why it is finding URLs suspect, without seeing the URLs from the e-mail it's hard to make a guess. Some SPAM filters see URLS for any foreign language from the user's primary language as suspicious. It is also possible that some domain you are linking to in the e-mail has found its way on to a blacklist of some type. It is also possible that something about the formatting of the URL looks like it could be cross site scripting(XSS) related.

These are just some of the possible reasons. The best bet is to work with the customer that is having the issue to determine the filter and then work with their mail host to determine the problem.

share|improve this answer
    
Thanks. Unfortunately the customers are not very computer-savvy to say the least, and we don't want to inconvenience them in any way. The URLs contain some japanese text, but are sent to japanese people, and are pretty simple. Taking a closer look, I see that the image links have some params such as height/width, so we can simplify those with a server rewrite rule. Unfortunately it's hard to verify that this was the trigger... Thanks for the tip though! +1 –  Yoav Aner Jan 23 '13 at 20:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.