The test appears to be set up correctly. I checked my declude log - there are entries for the spamtext.txt file (which contains the below) triggering on line 12 (one line below this particular block) and entries for the base64 test being triggered. I pulled a random message out of my delete box that should have been flagged and checked the headers. This is what I got:
Received: from mx3.finehost.net [66.205.220.31] by staffingtech.com (SMTPD32-7.13) id AB80F410120; Wed, 16 Oct 2002 01:39:12 -0400 X-Priority: 3 Return-Path: [EMAIL PROTECTED] From: "Cash Online" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Received: from mx3.finehost.net by 2ER93A05EK4L1M.mx3.finehost.net with SMTP for [EMAIL PROTECTED]; Tue, 15 Oct 2002 13:40:42 -0500 Date: Tue, 15 Oct 2002 13:40:42 -0500 Subject: Get up to $500 today! Message-Id: <5CU72GH.BCTT9X79."Cash Online" <[EMAIL PROTECTED]>> X-Mailer: YDH_optin_v1.2 X-Encoding: MIME MIME-Version: 1.0 X-MSMail-Priority: Normal Content-Type: multipart/alternative; boundary="----=_NextPart_24_30472442" X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?66.205.220.31 X-Declude-Sender: [EMAIL PROTECTED] [66.205.220.31] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SPAMCOP X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 300488074 So, the message does not appear to be base64. It does contain some html code, but in the clear portion at the bottom, there is the usual unsubscribe junk: While visiting a partner website, you opted-in to receive special online offers. To end your membership, click reply and send this email or click http://66.163.246.29/unsubscribe.php?[EMAIL PROTECTED] This is the same as what appears if you open the message (which also then displays their ad in living color). This is the entry in the global.cfg: SPAMTEXT filter c:\imail\declude\spamtext.txt x 0 0 and the entry for the above msg and one that did fail the spamtext rule in the declog: 10/16/2002 01:39:16 Qfb800f410120c136 Msg failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?66.205.220.31). 10/16/2002 14:27:18 Qaf8311c10120f2ab Msg failed SPAMTEXT (Message failed SPAMTEXT test (12)). I also cut and pasted the raw html sourc into a program to count characters -- a total of 2438, including all spaces. Karen > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry > Sent: Wednesday, October 16, 2002 2:26 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Filter Help > > > > >I included the rules below, but they never seem to trigger: > > > >BODY 10 CONTAINS http://1 > >BODY 10 CONTAINS http://2 > >BODY 10 CONTAINS http://3 > >BODY 10 CONTAINS http://4 > >BODY 10 CONTAINS http://5 > >BODY 10 CONTAINS http://6 > >BODY 10 CONTAINS http://7 > >BODY 10 CONTAINS http://8 > >BODY 10 CONTAINS http://9 > >BODY 10 CONTAINS http://0 > > Are you sure that the filter is set up properly (are other > filters working > properly)? That's the most likely problem. > > The other possibility would be if the E-mail is base64 encoded, in which > case filtering won't work (but the E-mail will fail the BASE64 test). > -Scott > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
