Is this something new(er)? In the very least I have never noticed this before. My traffic patterns have changed significantly over the last couple of months though and this might be contributing to my confusion. BTW, sorry about the linking code, Netscape pasted that in as HTML instead of as plain text like I usually try to do it.
I'm now also seeing errors related to a "bad Subject: header"??? In this case it is seemingly related to multiple spaces that appear at the end or near the end of the subject. This is essentially causing a double hit for this as I am already using SUBJECTSPACES to progressively add more and more points. Then again, I might have never noticed this before.
Please advise if you in fact have made these changes and possibly others to either test.
Thanks,
Matt
(Note that the Subject in the first example is word-wrapping, but in the source all sits on one line)
From <[EMAIL PROTECTED]> Fri May 07 11:17:13 2004
Received: from monteverdi.iii.org [68.236.224.100] by mx1.mailpure.com with ESMTP
(SMTPD32-8.05) id A8662D000080; Fri, 07 May 2004 11:16:54 -0400
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----_=_NextPart_001_01C43446.52AA320B"
Subject: [13] NYIA CALLS FOR RENEWAL OF FEDERAL TERRORISM PROGRAM 1
Content-class: urn:content-classes:message
X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0
Date: Fri, 7 May 2004 11:16:51 -0400
Message-ID: <[EMAIL PROTECTED]>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Topic: NYIA CALLS FOR RENEWAL OF FEDERAL TERRORISM PROGRAM 1
Thread-Index: AcQ0RlKSI3Tlo57ASVmbDz1/uv/3Pw==
From: "I.I.I. INSURANCE NEWS" <[EMAIL PROTECTED]>
To: "I.I.I. INSURANCE NEWS" <[EMAIL PROTECTED]>
X-MailPure: ================================================================
X-MailPure: HELOBOGUS: Failed, bogus connecting server name (weight 3).
X-MailPure: BRINKPATTERN: Failed, BRINK pattern found (weight 1).
X-MailPure: SUBSPACE-15: Failed, 15 or more spaces in the subject (weight 1).
X-MailPure: SUBSPACE-25: Failed, 25 or more spaces in the subject (weight 2).
X-MailPure: SUBSPACE-40: Failed, 40 or more spaces in the subject (weight 2).
X-MailPure: SPAMHEADERS: Failed, header code consistent with spam [4000400e] (weight 4).
X-MailPure: RECIPIENTS: <[EMAIL PROTECTED]>
X-MailPure: ================================================================
X-MailPure: Spam Score: 13
X-MailPure: Scan Time: 11:17:13 on 05/07/2004
X-MailPure: Spool File: Da8662d000080ebbe.SMD
X-MailPure: Server Name: monteverdi.iii.org
X-MailPure: SMTP Sender: [EMAIL PROTECTED]
X-MailPure: Received From: vpn.pr2.iii.org [68.236.224.100]
X-MailPure: Country Chain: UNITED STATES->destination
X-MailPure: ================================================================
X-MailPure: Spam and virus blocking services provided by MailPure.com
X-MailPure: ================================================================
From <[EMAIL PROTECTED]> Fri May 07 00:03:38 2004
Received: from mta.email.reedbusiness.com [198.31.62.21] by mx1.mailpure.com with ESMTP
(SMTPD32-8.05) id AA93BE01B0; Fri, 07 May 2004 00:03:31 -0400
X-MID: <[EMAIL PROTECTED]>
Date: Fri, 07 May 2004 00:03:31 -0400 (EDT)
Message-Id: <[EMAIL PROTECTED]>
From: MultichannelNews <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: [13] Multichannel Newswire: 3Q Good News for News Corp. MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-MailPure: ================================================================
X-MailPure: SORBS-SPAM: Failed, listed in dnsbl.sorbs.net (weight 1).
X-MailPure: SUBSPACE-15: Failed, 15 or more spaces in the subject (weight 1).
X-MailPure: SPAMHEADERS: Failed, header code consistent with spam [4000400e] (weight 4).
X-MailPure: SNIFFER-GENERAL: Failed, listed in the General category (weight 6).
X-MailPure: SPAMINDICATIVE: Message failed SPAMINDICATIVE test (line 12, weight 1).
X-MailPure: RECIPIENTS: <[EMAIL PROTECTED]>
X-MailPure: ================================================================
X-MailPure: Spam Score: 13
X-MailPure: Scan Time: 00:03:38 on 05/07/2004
X-MailPure: Spool File: D0a9300be01b06c80.SMD
X-MailPure: Server Name: mta.email.reedbusiness.com
X-MailPure: SMTP Sender: [EMAIL PROTECTED]
X-MailPure: Received From: mta.email.reedbusiness.com [198.31.62.21]
X-MailPure: Country Chain: UNITED STATES->destination
X-MailPure: ================================================================
X-MailPure: Spam and virus blocking services provided by MailPure.com
X-MailPure: ================================================================
R. Scott Perry wrote:
Something odd is happening here. I've now seen two recent false positives where the BADHEADER error code, 8004000e, relates to a "Bogus Message-ID header" when looked up with your tool. From what I can see, the Message-ID headers were both fine (one example is included below). Also note that I am using LOOSENSPAMHEADERS ON although that should have no bearing on this. I am running 1.79i6 Pro. Please advise.
Message-ID: <newmsg.cgi?mbx=Credit&[EMAIL PROTECTED]><[EMAIL PROTECTED]>
The issue here is that "benntilesrvr1.bhot.servr1" isn't a valid hostname, and almost certainly never will be.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
