If this type of spam is listed in the bombre.txt file and I've tried
using DoBombRE in mode 1 and 3, why does ASSP still catch and store
these emails? I am also using PB mode 3 for several things, but not all
of them.
ASSP is catching the emails under a DNSBL problem vs. a Bombre one. I
would think the bombre should catch it first right?
------------------------------------------------------------------------
----------------------
Microsoft Mail Internet Headers Version 2.0
Received: from MailServer ([10.0.50.150]) by MailServer with Microsoft
SMTPSVC(5.0.2195.6713);
Fri, 10 Aug 2007 08:38:03 -0400
Received: from ASSP [10.0.50.150] by MailServer - MailServer; Fri, 10
Aug 2007 08:38:03 -0400
Received: from 12-218-44-107.client.mchsi.com ([12.218.44.107]
helo=12-218-44-107.client.mchsi.com) by ASSP.nospam; 10 Aug 2007
08:38:02 -0400
Received: from rbbwx.jdsln ([174.51.132.173]) by
12-218-44-107.client.mchsi.com with Microsoft SMTPSVC(5.0.2195.5329);
Fri, 10 Aug 2007 07:30:13 -0500
Message-ID: <[EMAIL PROTECTED]>
From: "123Greetings.Com" <[EMAIL PROTECTED]>
To: <mailaddress>
Subject: Schoo mat sen you an ecar fro 123Greetings.Co!
Date: Fri, 10 Aug 2007 07:30:13 -0500
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="windows-1252";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
X-Assp-Delay: delayed for 10m 1s; 10 Aug 2007 08:38:02 -0400
X-Assp-Score: 100 (DNSBL-failed)
X-Assp-Received-DNSBL: fail (bl.spamcop.net->127.0.0.2;
dul.dnsbl.sorbs.net->127.0.0.10; )
X-Assp-Tag: DNSBL
X-Assp-Envelope-From: [EMAIL PROTECTED]
X-Assp-Version: 1.3.3.2()
X-Assp-Spam: YES
X-Assp-ID: id-9482c4217
X-Assp-Spam-Reason: Failed DNSBL: bl.spamcop.net dul.dnsbl.sorbs.net
X-Assp-Totalscore: 100
X-Assp-Intended-For: mailaddress
X-SEF-Processed: 5_5_0_210__2007_08_10_08_38_03
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 10 Aug 2007 12:38:03.0215 (UTC)
FILETIME=[4B1695F0:01C7DB4B]
------------------------------------------------------------------------
------------------------
What am I doing wrong?
Bomb settings from my config:
bombCharSets:=BIG5|CHINESEBIG|GB2312|KS_C_5601|KOI8-R|EUC-KR|ISO-2022-JP
|ISO-2022-KR|ISO-2022-CN|CP1251
bombDataRe:=file:files/bombre.txt
bombError:=554 5.7.1 Delivery not authorized, message refused -- send
report to mailto:[EMAIL PROTECTED]
bombErrorReason:=1
bombHeaderRe:=
bombRe:=file:files/bombre.txt
bombReLocal:=
bombReNP:=
bombReRelay:=
bombReWL:=
bombSenderRe:=
bombSpamLovers:=
bombSubjectRe:=
bombSuspiciousRe:=
bombSuspiciousValencePB:=20
bombTestMode:=
bombTestValencePB:=0
bombValencePB:=25
Thanks,
Brett
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user
