Dave, Do you have the raw file - I would be interested in seeing it. What I have noticed on some of these files is that they do not have a normal crlf althrough the message. They just seem to contain a \n.
Darrell ------------------------------------------------------------------------ Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. ----- Original Message ----- From: "Dave Doherty" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Sunday, August 20, 2006 11:32 AM Subject: [Declude.JunkMail] All text message bypasses Declude? Hi, All- I know Decluide has issues with handling the "broken GIF" messages where Declude headers wind up at the bottom and are ignored. Maybe I just haven't been paying attention lately, but I don't recall seeing anything about a plain-text message that does the same thing. So here is one that just did - see below... The Bayesian filter in SM picked it up, but I get so many FPs with that, that I basically ignore it. So this one wound up in my mailbox marked as spam, instead of being routed to the spam folder as Declude would do. - Dave Doherty Skywaves, Inc. 97 Webster Street Worcester, MA 10603 (+1) - 201-847-0933 Please note our new mailing address! ---------------------------------------------------------- Return-Path: <[EMAIL PROTECTED]> Sun Aug 20 10:14:04 2006 Received: from p549FA6E4.dip0.t-ipconnect.de [84.159.166.228] by mail4.skywaves.net with SMTP; Sun, 20 Aug 2006 10:14:04 -0400 Received: from ns.joppari.net (ns.joppari.net [61.213.172.22]) by p549FA6E4.dip0.t-ipconnect.de (Qmailv1) with ESMTP id 5FRRCUUE for <[EMAIL PROTECTED]>; Sun, 20 Aug 2006 16:11:31 +0100 Received: from 61.213.172.22 ([s-cinema.com]:9364 "EHLO s-cinema.com" smtp-auth: "hrqxbaw" TLS-CIPHER: <none> TLS-PEER-CN1: <none>) by ns.joppari.net with ESMTP id N27-A6FA2h-IR (ORCPT <rfc822;[EMAIL PROTECTED]>); Sun, 20 Aug 2006 06:06:02 -0200 Date: Sun, 20 Aug 2006 06:06:02 -0200 From: "Nadja Ken" <[EMAIL PROTECTED]> X-Mailer: The Bat! (v2.12.00) Personal X-Priority: 3 Message-ID: <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: [spam?] Laugh your way to purchase MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------F73XT2FUJ33RQ7KE" ------------F73XT2FUJ33RQ7KE Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <body> Joke of the day<br> Q: What is the difference between a trial lawyer and a hooker? <br> A: A hooker will stop trying to coil you once you''re dead.<br> <br> Now some serious stuff<br> <br> Your LocalMeds guy is robbing you of your hard make money.<br> It high time you take the fair step & shop from <br> <br> <a href="http://piampblr.veundafen.com";>USonlineMedsshop</a><br> <br> Our site dropshipss across the globe<br> You save upto 70% by purchasing from here<br> <br> We have healers for most common problems like<br> A-anexity<br> B-depression<br> C-erectus problems in men<br> D-dietpills<br> E-hairloss<br> F-bloodpressure<br> G-bloodthinners<br> H-absorption<br> I-heartburn<br> J-Sleepingaids<br> K-migraine<br> & a many more healers<br> <br> </body> </html> ------------F73XT2FUJ33RQ7KE-- Subject: [17] X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [2000010f]. X-RBL-Warning: WEIGHT10: Weight of 17 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [84.159.166.228] X-Declude-Spoolname: 45568039.eml X-Declude-Skywaves-Note: Inbound Scan by Declude v4.2.12 for spam. "http://www.declude.com/x-note.htm"; X-Declude-Skywaves-Scan: Weight [17] at 10:14:16 on 20 Aug 2006 X-Declude-Skywaves-Fail: ROUTING [2], NOCRTEST [15], WEIGHT16 [16] X-Declude-Skywaves-Country-Chain: JAPAN->GERMANY->destination X-Declude-Skywaves-REVDNS: This message was sent from p549FA6E4.dip0.t-ipconnect.de ([84.159.166.228]) X-Declude-Skywaves-Code: 2000010f X-Declude-Skywaves-Recipcount: 1 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
