WEIGHT10 weight x x 10 0 WEIGHT14 weight x x 14 0 WEIGHT20 weight x x 20 0
Note - this only happens here and there. 99% of the messages are flagged and show up correctly, just a couple a day seem to be showing up like these where the headers are somehow stuck inside the body of the message. Mike ---------- Original Message ---------------------------------- From: "Darrell \([EMAIL PROTECTED])" <[EMAIL PROTECTED]> Reply-To: [email protected] Date: Tue, 12 Jul 2005 14:35:18 -0400 >In your global config how is it configured? > >Darrell > -------------------------------------------- >invURIBL - Intelligent URI filtering. Stops 85%+ of SPAM with the default >configuration... http://www.invariantsystems.com > >Mike Hyslip writes: > >> >> WEIGHT10 SUBJECT **SPAM: >> WEIGHT14 SUBJECT **SPAM: >> WEIGHT20 SUBJECT **SPAM: >> >> There's not weightrange option configured far as I can tell. >> The headers that get stuck in the body show it is marked - >> >>>> Hello, >>>> Message-Id: <[EMAIL PROTECTED]> >>>> Subject: **SPAM: >> >> So not sure where else to look. >> Thanks for your reply :-) >> >> Mike >> >> ---------- Original Message ---------------------------------- >> From: "Darrell \([EMAIL PROTECTED])" <[EMAIL PROTECTED]> >> Reply-To: [email protected] >> Date: Tue, 12 Jul 2005 13:07:49 -0400 >> >>>What are the actions you have configured for WEIGHT10 and WEIGHT14. Also, >>>are those configured as WEIGHT's or WEIGHTRANGE? >>> >>>Darrell >>> ------------------------------------------------------------- >>>DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus. >>>http://www.invariantsystems.com >>> >>>Mike Hyslip writes: >>> >>>> >>>> I am having random emails it seems showing up in my inbox unmarked as >>>> spam, yet the body of the message is containing all the headers showing it >>>> as spam. Not sure if this is just a bug, or spam circumventing spam >>>> protection in some way. Below is an example. >>>> >>>> The email - >>>> >>>>>From sender >>>> To me >>>> subject: haunted by your past? >>>> >>>> Hello, >>>> Message-Id: <[EMAIL PROTECTED]> >>>> Subject: **SPAM: >>>> X-RBL-Warning: SORBS-DUHL: "Dynamic IP Addresses See: >>>> http://www.sorbs.net/lookup.shtml?62.179.66.83"; >>>> X-RBL-Warning: FIVETENSRC: 83.66.179.62.blackholes.five-ten-sg.com. >>>> X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" >>>> X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. >>>> X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent >>>> with spam [2000010f]. >>>> X-Declude-Sender: [EMAIL PROTECTED] [62.179.66.83] >>>> X-Declude-Spoolname: DD6A9018D00004C8F.SMD >>>> X-Declude-Note: Scanned by Declude 2.0.6 >>>> (http://www.declude.com/x-note.htm) for spam. >>>> X-Declude-Scan: Score [15] at 10:41:54 on 12 Jul 2005 >>>> X-Declude-Tests: SORBS-DUHL, FIVETENSRC, NOABUSE, CMDSPACE, ROUTING, >>>> WEIGHT10, WEIGHT14 >>>> X-Country-Chain: [Unknown]->AUSTRIA->destination >>>> X-RCPT-TO: <[EMAIL PROTECTED]> >>>> Status: U >>>> X-UIDL: 371243910 >>>> X-IMail-ThreadID: d6a9018d00004c8f >>>> >>>> You have been chosen to participate in an invitation only limited time >>>> event! >>>> Are you currently paying over 3% for your mortgage? STOP! We can help you >>>> lower that today! >>>> Answer only a few questions and we can give you an approval in under 30 >>>> seconds ÃÂ itÃÂs that simple! >>>> >>>> Stop fighting for lenders ÃÂ let them fight for you! Make them work for >>>> your business by giving you the lowest rates around! >>>> $230,000 loans are available for only $340/month! WEÃÂRE PRACTICALLY >>>> GIVING AWAY MONEY! >>>> >>>> Think your credit is too bad to get a deal like this? THINK AGAIN! We will >>>> have you saving your money in no time! >>>> Are you ready to save your money? >>>> >>>> http://p8t.the-h00d.com/p1.asp >>>> >>>> Update records on site. >>>> >>>> Regards, >>>> Martin Christie >>>> >>>> >>>> ----- >>>> Here is the declude log for this message - >>>> >>>> 07/12/2005 10:41:54 QD6A9018D00004C8F nNOLEGITCONTENT:-5 SORBS-DUHL:4 >>>> FIVETENSRC:4 NOABUSE:2 CMDSPACE:8 ROUTING:2 . Total weight = 15. >>>> 07/12/2005 10:41:54 QD6A9018D00004C8F L1 Message OK >>>> 07/12/2005 10:41:54 QD6A9018D00004C8F Subject: Haunted by your past? >>>> 07/12/2005 10:41:54 QD6A9018D00004C8F From: [EMAIL PROTECTED] To: [EMAIL >>>> PROTECTED] IP: 62.179.66.83 ID: j980FEKr454861 >>>> 07/12/2005 10:41:54 QD6A9018D00004C8F Tests failed [weight=15]: >>>> CATCHALLMAILS=IGNORE IPNOTINMX=IGNORE SORBS-DUHL=WARN FIVETENSRC=WARN >>>> NOABUSE=WARN CMDSPACE=WARN ROUTING=WARN WEIGHT10=SUBJECT WEIGHT14=SUBJECT >>>> 07/12/2005 10:41:54 QD6A9018D00004C8F Action(s) taken for [EMAIL >>>> PROTECTED] = IGNORE WARN SUBJECT [LAST ACTION=SUBJECT] >>>> 07/12/2005 10:41:54 QD6A9018D00004C8F Cumulative action(s) taken on this >>>> email = IGNORE WARN SUBJECT [LAST ACTION=SUBJECT] >>>> >>>> >>>> Any ideas, or another piece of information I'm missing? I can see the >>>> subject is marked in the headers stuck in the body of the email, but ideas >>>> on how this is stuck in the body and not where it should be? >>>> >>>> I am running Imail 8.20, and the declude version is in the email headers >>>> above. >>>> >>>> Mike >>>> >>>> --- >>>> This E-mail came from the Declude.JunkMail mailing list. To >>>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>> type "unsubscribe Declude.JunkMail". The archives can be found >>>> at http://www.mail-archive.com. >>> >>> >>> >>> ------------------------------------------------------------------------ >>>Check out http://www.invariantsystems.com for utilities for Declude And >>>Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG >>>Integration, and Log Parsers. >>> >>> >>>--- >>>This E-mail came from the Declude.JunkMail mailing list. To >>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>>type "unsubscribe Declude.JunkMail". The archives can be found >>>at http://www.mail-archive.com. >>> >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. > > > > ------------------------------------------------------------------------ >Check out http://www.invariantsystems.com for utilities for Declude And >Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG >Integration, and Log Parsers. > > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
