WEIGHT10 SUBJECT **SPAM: WEIGHT14 SUBJECT **SPAM: WEIGHT20 SUBJECT **SPAM:
There's not weightrange option configured far as I can tell. The headers that get stuck in the body show it is marked - >> Hello, >> Message-Id: <[EMAIL PROTECTED]> >> Subject: **SPAM: So not sure where else to look. Thanks for your reply :-) Mike ---------- Original Message ---------------------------------- From: "Darrell \([EMAIL PROTECTED])" <[EMAIL PROTECTED]> Reply-To: [email protected] Date: Tue, 12 Jul 2005 13:07:49 -0400 >What are the actions you have configured for WEIGHT10 and WEIGHT14. Also, >are those configured as WEIGHT's or WEIGHTRANGE? > >Darrell > ------------------------------------------------------------- >DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus. >http://www.invariantsystems.com > >Mike Hyslip writes: > >> >> I am having random emails it seems showing up in my inbox unmarked as spam, >> yet the body of the message is containing all the headers showing it as >> spam. Not sure if this is just a bug, or spam circumventing spam protection >> in some way. Below is an example. >> >> The email - >> >>>From sender >> To me >> subject: haunted by your past? >> >> Hello, >> Message-Id: <[EMAIL PROTECTED]> >> Subject: **SPAM: >> X-RBL-Warning: SORBS-DUHL: "Dynamic IP Addresses See: >> http://www.sorbs.net/lookup.shtml?62.179.66.83"; >> X-RBL-Warning: FIVETENSRC: 83.66.179.62.blackholes.five-ten-sg.com. >> X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" >> X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. >> X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent >> with spam [2000010f]. >> X-Declude-Sender: [EMAIL PROTECTED] [62.179.66.83] >> X-Declude-Spoolname: DD6A9018D00004C8F.SMD >> X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) >> for spam. >> X-Declude-Scan: Score [15] at 10:41:54 on 12 Jul 2005 >> X-Declude-Tests: SORBS-DUHL, FIVETENSRC, NOABUSE, CMDSPACE, ROUTING, >> WEIGHT10, WEIGHT14 >> X-Country-Chain: [Unknown]->AUSTRIA->destination >> X-RCPT-TO: <[EMAIL PROTECTED]> >> Status: U >> X-UIDL: 371243910 >> X-IMail-ThreadID: d6a9018d00004c8f >> >> You have been chosen to participate in an invitation only limited time event! >> Are you currently paying over 3% for your mortgage? STOP! We can help you >> lower that today! >> Answer only a few questions and we can give you an approval in under 30 >> seconds  itÂs that simple! >> >> Stop fighting for lenders  let them fight for you! Make them work for your >> business by giving you the lowest rates around! >> $230,000 loans are available for only $340/month! WEÂRE PRACTICALLY GIVING >> AWAY MONEY! >> >> Think your credit is too bad to get a deal like this? THINK AGAIN! We will >> have you saving your money in no time! >> Are you ready to save your money? >> >> http://p8t.the-h00d.com/p1.asp >> >> Update records on site. >> >> Regards, >> Martin Christie >> >> >> ----- >> Here is the declude log for this message - >> >> 07/12/2005 10:41:54 QD6A9018D00004C8F nNOLEGITCONTENT:-5 SORBS-DUHL:4 >> FIVETENSRC:4 NOABUSE:2 CMDSPACE:8 ROUTING:2 . Total weight = 15. >> 07/12/2005 10:41:54 QD6A9018D00004C8F L1 Message OK >> 07/12/2005 10:41:54 QD6A9018D00004C8F Subject: Haunted by your past? >> 07/12/2005 10:41:54 QD6A9018D00004C8F From: [EMAIL PROTECTED] To: [EMAIL >> PROTECTED] IP: 62.179.66.83 ID: j980FEKr454861 >> 07/12/2005 10:41:54 QD6A9018D00004C8F Tests failed [weight=15]: >> CATCHALLMAILS=IGNORE IPNOTINMX=IGNORE SORBS-DUHL=WARN FIVETENSRC=WARN >> NOABUSE=WARN CMDSPACE=WARN ROUTING=WARN WEIGHT10=SUBJECT WEIGHT14=SUBJECT >> 07/12/2005 10:41:54 QD6A9018D00004C8F Action(s) taken for [EMAIL PROTECTED] >> = IGNORE WARN SUBJECT [LAST ACTION=SUBJECT] >> 07/12/2005 10:41:54 QD6A9018D00004C8F Cumulative action(s) taken on this >> email = IGNORE WARN SUBJECT [LAST ACTION=SUBJECT] >> >> >> Any ideas, or another piece of information I'm missing? I can see the >> subject is marked in the headers stuck in the body of the email, but ideas >> on how this is stuck in the body and not where it should be? >> >> I am running Imail 8.20, and the declude version is in the email headers >> above. >> >> Mike >> >> --- >> This E-mail came from the Declude.JunkMail mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.JunkMail". The archives can be found >> at http://www.mail-archive.com. > > > > ------------------------------------------------------------------------ >Check out http://www.invariantsystems.com for utilities for Declude And >Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG >Integration, and Log Parsers. > > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
