What are the actions you have configured for WEIGHT10 and WEIGHT14. Also,
are those configured as WEIGHT's or WEIGHTRANGE?
Darrell
-------------------------------------------------------------
DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus.
http://www.invariantsystems.com
Mike Hyslip writes:
I am having random emails it seems showing up in my inbox unmarked as spam, yet
the body of the message is containing all the headers showing it as spam. Not
sure if this is just a bug, or spam circumventing spam protection in some way.
Below is an example.
The email -
From sender
To me
subject: haunted by your past?
Hello,
Message-Id: <[EMAIL PROTECTED]>
Subject: **SPAM:
X-RBL-Warning: SORBS-DUHL: "Dynamic IP Addresses See:
http://www.sorbs.net/lookup.shtml?62.179.66.83";
X-RBL-Warning: FIVETENSRC: 83.66.179.62.blackholes.five-ten-sg.com.
X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command.
X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with
spam [2000010f].
X-Declude-Sender: [EMAIL PROTECTED] [62.179.66.83]
X-Declude-Spoolname: DD6A9018D00004C8F.SMD
X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm)
for spam.
X-Declude-Scan: Score [15] at 10:41:54 on 12 Jul 2005
X-Declude-Tests: SORBS-DUHL, FIVETENSRC, NOABUSE, CMDSPACE, ROUTING, WEIGHT10,
WEIGHT14
X-Country-Chain: [Unknown]->AUSTRIA->destination
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 371243910
X-IMail-ThreadID: d6a9018d00004c8f
You have been chosen to participate in an invitation only limited time event!
Are you currently paying over 3% for your mortgage? STOP! We can help you lower
that today!
Answer only a few questions and we can give you an approval in under 30 seconds
its that simple!
Stop fighting for lenders let them fight for you! Make them work for your
business by giving you the lowest rates around!
$230,000 loans are available for only $340/month! WERE PRACTICALLY GIVING AWAY
MONEY!
Think your credit is too bad to get a deal like this? THINK AGAIN! We will have
you saving your money in no time!
Are you ready to save your money?
http://p8t.the-h00d.com/p1.asp
Update records on site.
Regards,
Martin Christie
-----
Here is the declude log for this message -
07/12/2005 10:41:54 QD6A9018D00004C8F nNOLEGITCONTENT:-5 SORBS-DUHL:4
FIVETENSRC:4 NOABUSE:2 CMDSPACE:8 ROUTING:2 . Total weight = 15.
07/12/2005 10:41:54 QD6A9018D00004C8F L1 Message OK
07/12/2005 10:41:54 QD6A9018D00004C8F Subject: Haunted by your past?
07/12/2005 10:41:54 QD6A9018D00004C8F From: [EMAIL PROTECTED] To: [EMAIL
PROTECTED] IP: 62.179.66.83 ID: j980FEKr454861
07/12/2005 10:41:54 QD6A9018D00004C8F Tests failed [weight=15]:
CATCHALLMAILS=IGNORE IPNOTINMX=IGNORE SORBS-DUHL=WARN FIVETENSRC=WARN
NOABUSE=WARN CMDSPACE=WARN ROUTING=WARN WEIGHT10=SUBJECT WEIGHT14=SUBJECT
07/12/2005 10:41:54 QD6A9018D00004C8F Action(s) taken for [EMAIL PROTECTED] =
IGNORE WARN SUBJECT [LAST ACTION=SUBJECT]
07/12/2005 10:41:54 QD6A9018D00004C8F Cumulative action(s) taken on this email
= IGNORE WARN SUBJECT [LAST ACTION=SUBJECT]
Any ideas, or another piece of information I'm missing? I can see the subject
is marked in the headers stuck in the body of the email, but ideas on how this
is stuck in the body and not where it should be?
I am running Imail 8.20, and the declude version is in the email headers above.
Mike
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
------------------------------------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
