Dave,
Do you have the raw file - I would be interested in seeing it. What I
have
noticed on some of these files is that they do not have a normal crlf
althrough the message. They just seem to contain a \n.
Darrell
------------------------------------------------------------------------
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration,
MRTG
Integration, and Log Parsers.
----- Original Message ----- From: "Dave Doherty" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Sunday, August 20, 2006 11:32 AM
Subject: [Declude.JunkMail] All text message bypasses Declude?
Hi, All-
I know Decluide has issues with handling the "broken GIF" messages where
Declude headers wind up at the bottom and are ignored.
Maybe I just haven't been paying attention lately, but I don't recall
seeing
anything about a plain-text message that does the same thing.
So here is one that just did - see below...
The Bayesian filter in SM picked it up, but I get so many FPs with that,
that I basically ignore it. So this one wound up in my mailbox marked as
spam, instead of being routed to the spam folder as Declude would do.
- Dave Doherty
Skywaves, Inc.
97 Webster Street
Worcester, MA 10603
(+1) - 201-847-0933
Please note our new mailing address!
----------------------------------------------------------
Return-Path: <[EMAIL PROTECTED]> Sun Aug 20 10:14:04 2006
Received: from p549FA6E4.dip0.t-ipconnect.de [84.159.166.228] by
mail4.skywaves.net with SMTP;
Sun, 20 Aug 2006 10:14:04 -0400
Received: from ns.joppari.net (ns.joppari.net [61.213.172.22])
by p549FA6E4.dip0.t-ipconnect.de (Qmailv1) with ESMTP id 5FRRCUUE
for <[EMAIL PROTECTED]>; Sun, 20 Aug 2006 16:11:31 +0100
Received: from 61.213.172.22 ([s-cinema.com]:9364 "EHLO s-cinema.com"
smtp-auth: "hrqxbaw" TLS-CIPHER: <none> TLS-PEER-CN1: <none>)
by ns.joppari.net with ESMTP id N27-A6FA2h-IR (ORCPT
<rfc822;[EMAIL PROTECTED]>); Sun, 20 Aug 2006 06:06:02 -0200
Date: Sun, 20 Aug 2006 06:06:02 -0200
From: "Nadja Ken" <[EMAIL PROTECTED]>
X-Mailer: The Bat! (v2.12.00) Personal
X-Priority: 3
Message-ID: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: [spam?] Laugh your way to purchase
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----------F73XT2FUJ33RQ7KE"
------------F73XT2FUJ33RQ7KE
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<body>
Joke of the day<br>
Q: What is the difference between a trial lawyer and a hooker? <br>
A: A hooker will stop trying to coil you once you''re dead.<br>
<br>
Now some serious stuff<br>
<br>
Your LocalMeds guy is robbing you of your hard make money.<br>
It high time you take the fair step & shop from <br>
<br>
<a href="http://piampblr.veundafen.com";>USonlineMedsshop</a><br>
<br>
Our site dropshipss across the globe<br>
You save upto 70% by purchasing from here<br>
<br>
We have healers for most common problems like<br>
A-anexity<br>
B-depression<br>
C-erectus problems in men<br>
D-dietpills<br>
E-hairloss<br>
F-bloodpressure<br>
G-bloodthinners<br>
H-absorption<br>
I-heartburn<br>
J-Sleepingaids<br>
K-migraine<br>
& a many more healers<br>
<br>
</body>
</html>
------------F73XT2FUJ33RQ7KE--
Subject: [17]
X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner
consistent
with spam [2000010f].
X-RBL-Warning: WEIGHT10: Weight of 17 reaches or exceeds the limit of 10.
X-Declude-Sender: [EMAIL PROTECTED] [84.159.166.228]
X-Declude-Spoolname: 45568039.eml
X-Declude-Skywaves-Note: Inbound Scan by Declude v4.2.12 for spam.
"http://www.declude.com/x-note.htm";
X-Declude-Skywaves-Scan: Weight [17] at 10:14:16 on 20 Aug 2006
X-Declude-Skywaves-Fail: ROUTING [2], NOCRTEST [15], WEIGHT16 [16]
X-Declude-Skywaves-Country-Chain: JAPAN->GERMANY->destination
X-Declude-Skywaves-REVDNS: This message was sent from
p549FA6E4.dip0.t-ipconnect.de ([84.159.166.228])
X-Declude-Skywaves-Code: 2000010f
X-Declude-Skywaves-Recipcount: 1
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
