I cannot understand why this is reported as BombSrcipt spam, because @klein-klein-verlag.de is a whitelisted domain and therefore should not be checked against Regex/Bombs
NotGreedyWhitelist, bombReWL, bombReNP, bombReLocal are all OFF! bombReISPIP is ON but the sender ip 85.114.141.202 is not in ISPIP list I could list 85.114.141.202 in noProcessingIPs but this would be just a workaround. From: "klein-klein-verlag Newsletter" <[email protected]> Reply-To: <[email protected]> Date: Sun, 21 Feb 2010 01:14:16 +0100 Message-ID: <e29f55cb576e9296cf192d6a037b8...@localhost> Status: N X-SWM-BOUNCE: 01_02_04_0D Content-Type: multipart/related; boundary="----=_NextPart_000_DADF_2BAB04A3.4A3F0B47" X-Assp-Delay: "[email protected]" was delayed for 7m 22s; 21 Feb 2010 01:14:52 +0100 X-Assp-Score: 10 (Message-ID not valid: '<e29f55cb576e9296cf192d6a037b8...@localhost>') X-Assp-Re-scriptRe: <script X-Assp-Score: 20 (BombScript '<script') X-Assp-Envelope-From: [email protected] X-Assp-Version: 1.6.5.0(1.0.02) X-Assp-ID: "assp.ourdomain.com" (id-11292-24973) X-Assp-Spam: Yes X-Assp-Spam-Reason: BombScript '<script' X-Assp-Message-Totalscore: 30 X-Assp-Intended-For: "[email protected]" X-Assp-Copy-Spam: Yes Return-Path: [email protected] The logs for that mail (ASSP 1.6.5.0(1.0.02)) Jan-21-10 19:26:22 id-98381-02419 [BombHeader] 85.114.141.202 <[email protected]> to: [email protected] Whitelisted Domain: @klein-klein-verlag.de; Jan-21-10 19:26:22 id-98381-02419 85.114.141.202 <[email protected]> to: [email protected] score 20 Regex:scriptRe '<script'; Jan-21-10 19:26:22 id-98381-02419 [BombScript] 85.114.141.202 <[email protected]> to: u...@ourdoamin [spam found] -- BombScript '<script' -- [.....subject.....] -> discarded/2419.eml; The logs for such a mail from an elder ASSP 1.6.1.4(0.0.06) Jan-12-10 18:28:02 id-17282-27738 85.114.141.202 <[email protected]> Regex:whiteListedDomains '@klein-klein-verlag.de'; Jan-12-10 18:28:02 LDAP - found [email protected] in LDAPlist; Jan-12-10 18:28:03 id-17282-27738 [SuspiciousHeloRe] 85.114.141.202 <[email protected]> to: [email protected] Whitelisted Domain: @klein-klein-verlag.de; Jan-12-10 18:28:03 id-17282-27738 85.114.141.202 <[email protected]> to: [email protected] ClamAV: scanned 21260 bytes in whitelisted message - OK ; Jan-12-10 18:28:03 id-17282-27738 [Whitelisted] 85.114.141.202 <[email protected]> to: [email protected] whitelisted -- Whitelisted Domain: @klein-klein-verlag.de -- [.....subject.....] -> notspam/27738.eml; Th. Klein Admin ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Assp-test mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-test
