3

My wife runs a small website (in Japanese) selling vintage products online. She's sending out emails to customers with details about their order, together with images of the products and links to the item page(s).

All emails go via postmark (a credible 3rd party email delivery service). We also use SPF and DKIM to make sure emails are not flagged as spam. Most emails arrive without a problem, with a very low bounce-rate. As far as my wife and her customers are concerned, the emails are totally legit.

Occasionally however, when customers reply to one of those emails, we see a subject line that looks something like this: RE: [***Spam***](Suspicious Urls) ご注文ありがとうございます。 - Frau Vintage

From looking at the email headers, I believe this is emailed from MS Outlook (X-Mailer: Microsoft Office Outlook 12.0). Is this something done by Outlook's embedded junk e-mail filter, or perhaps third-party software?

Does anyone know which spam filter or tool marks those emails as spam and perhaps which method it uses to classify URLs as "suspicious"? Is there a way for my wife to report these as false-positives to the vendor?

Note: unfortunately it is not an option to contact the email recipient directly or ask them to take any action. This will most likely scare them or cause unnecessary confusion, so I would like to investigate this without any customer assistance.

Improve this question

3 Answers 3

Reset to default
3

The product may be "Virus Security ZERO" by Sourcenext, a Japanese software company. They have FAQ pages for it that contains the [***Spam***](Suspicious Urls) text.

If you use Google Chrome to view that page, it should detect that it is in Japanese, and offer to translate it to English. The English version of the Sourcenext website is much more basic, and doesn't seem to contain the same FAQ entries.

I haven't checked out how to report false positives, although with Chrome translating the pages, you should be able to do that yourself (or maybe work out how to prevent your emails from triggering the detection).

Improve this answer
2
  • Thanks! this looks promising. My wife speaks japanese (as her customers), so I'll ask her to take a look, and maybe try to contact this company. We don't want to trouble the customers with this, and they are usually not very computer-savvy.
    – Yoav Aner
    Jan 23, 2013 at 8:50
  • 1
    a quick update: we contacted the vendor and submitted the url. Oddly they said that it is because the url are percent-encoded. Given that the products and the entire site are in japanese, the urls are encoded so that the name appears on the url... Strange heuristics to block suspicious urls if you ask me.
    – Yoav Aner
    Feb 9, 2013 at 10:11
1

It is pretty common practice to make that kind of header update in most spam filtering systems. I know ASSP does the same exact thing.

As for the reason why it is finding URLs suspect, without seeing the URLs from the e-mail it's hard to make a guess. Some SPAM filters see URLS for any foreign language from the user's primary language as suspicious. It is also possible that some domain you are linking to in the e-mail has found its way on to a blacklist of some type. It is also possible that something about the formatting of the URL looks like it could be cross site scripting(XSS) related.

These are just some of the possible reasons. The best bet is to work with the customer that is having the issue to determine the filter and then work with their mail host to determine the problem.

Improve this answer
1
  • Thanks. Unfortunately the customers are not very computer-savvy to say the least, and we don't want to inconvenience them in any way. The URLs contain some japanese text, but are sent to japanese people, and are pretty simple. Taking a closer look, I see that the image links have some params such as height/width, so we can simplify those with a server rewrite rule. Unfortunately it's hard to verify that this was the trigger... Thanks for the tip though! +1
    – Yoav Aner
    Jan 23, 2013 at 20:10
0

An entire header may provide a clue. If "postmarkapp.com" (Postmark) is used, they already integrated spam filters and they are providing the service. By closely examining the reply, it is possible to identify whether the reply has something to trigger the filters. Including links, attachments, language issues etc.

There is a possibility of using Spam Assassin in order to filter the emails. They have mentioned it. The header may include some extra information regarding that. However, there is no clear picture of the email flow from/to your end mentioned.

Improve this answer
5
  • the emails get delivered, and I also checked them with spamassassin already, and see nothing in particular to worry about. The majority of emails get delivered and we know customers receive them. Only in a minority of cases we get reports of spam, as in this case. I'm particularly interested in this particular case : how to find which product/company misclassifies our emails, and hopefully how to report this false-positive to them.
    – Yoav Aner
    Jan 23, 2013 at 8:54
  • If that is the issue, you need to contact the specific users and work with them to identify possibilities. However, by checking the headers, it is possible to identify the forwarding servers. Thank you!
    – Lasith
    Jan 23, 2013 at 20:05
  • Working with the customers is not an option unfortunately. The forwarding servers are also pretty irrelevant in this case in my opinion. In any case, please read the question. This is not what I was asking.
    – Yoav Aner
    Jan 23, 2013 at 20:12
  • My point is that there are possibilities. This does not happen without a reason. This specific message indicates that this was due to shortened URLs. However, what I mentioned was about the forwarding (mail flow) path. There could be 2 forms of filters who do this. One is a server side product (i.e. Forefront/Barracuda) or a client Anti Virus solution. If the emails sent to Japan, there is a good possibility that Sourcenext products marking these as spam. However, this can be mitigated (by the end user). Avast and other client security software could do a similar thing (configurable).
    – Lasith
    Jan 23, 2013 at 22:13
  • Its not outlook. However, it has options to block Japanese and other content. But no such tag attached. And this error specifically say that it is a URL which is not trusted. It is also possible to examine the complete header to check for the specific endpoints (except client endpoints). By examining it is possible to find out which service and integrated systems have caused this. If not, this is an end point product (client software).
    – Lasith
    Jan 23, 2013 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.