Dave,
You have to check the logs - is it possible you are hiding some negative
weight tests like IPNOTINMX, NOLEGITCONTENT, etc in your global.cfg file.
Darrell
------------------------------------------------------------------------
invURIBL - Intelligent URI filtering. Stops 85%+ of SPAM with the default
configuration and easily plugs into Declude.
http://www.invariantsystems.com
Dave Beckstrom writes:
This spam came in today. Note that it was scored a weight of 6. Yet it
failed two tests that were supposed to add a weight of 4 and a weight of 7.
Now, I wasn't the best in math but I believe 4 and 7 adds up to 11! There
were no negative weights assigned to account for this.
Any ideas?
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-RBL-Warning: SORBS-DUHL: "Dynamic IP Addresses See:
http://www.sorbs.net/lookup.shtml?70.23.152.133";
X-RBL-Warning: DYNHELO: Dynamic HELO found.
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: Filter_Country: Message failed Filter_Country test (line 223,
weight 0)
X-Note: ========================================
X-Note: Spam Score: [6]
X-Note: Scan Time: 10:13:22 on 01 Sep 2005
X-Note: Spool File: 561528422420.EML
X-Note: Server Name: pool-70-23-152-133.ny325.east.verizon.net
X-Note: SMTP Sender: [EMAIL PROTECTED]
X-Note: Reverse DNS & IP: pool-70-23-152-133.ny325.east.verizon.net
[70.23.152.133]
X-Note: Recipient(s): [EMAIL PROTECTED]
X-Note: Country Chain: UNITED STATES->destination
X-Note: Failed Weights: SORBS-DUHL [4], DYNHELO [7], SPFUNKNOWN [0],
Filter_Country [0]
X-Note: ========================================
---
[This E-mail scanned for viruses by Declude Virus]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
