Re: [Declude.JunkMail] spam message didn't get properly processed

Sun, 27 Jan 2008 18:20:38 -0800

Going by the headers is not the best method to evaluate this. Some tests are hidden from the headers depending on your configuration.
Check your Declude logs and post those to the list for that message and we will be better able to figure out what happened. 

Darrell
----------------------------------

Check out http://www.invariantsystems.com for utilities for Declude, 
Imail, mxGuard, and ORF.  IMail/Declude Overflow Queue Monitoring, 
SURBL/URI integration, MRTG Integration, and Log Parsers.



Imail Admin wrote:

Hi,


I have my system setup so that messages that have a weight of greater 
than 5 go into a special folder ("Spam"), instead of my regular inbox.  
They also get marked in the header with the spam weight.  I am trying to 
figure out how this one message got through to my Inbox.  Here is the 
message:



Received: from i5387BEC6.versanet.de [83.135.190.198] by 
mail2.bcwebhost.net with ESMTP

 (SMTPD-9.20) id AB3203FC; Sun, 27 Jan 2008 12:36:02 -0800
Message-ID: <[EMAIL PROTECTED]>
From: =?koi8-r?B?69XbzsHSxc7LzyAg?= <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>

Subject: SPAM 
[9]=?koi8-r?B?WzhdOiDw0s/EwcXU09Eg0M/E18HM2M7PxSDQz83F3cXOycUg1yDQ0g==?=

=?koi8-r?B?ydPU0s/Ky8UgyyDWyczPzdUgxM/N1S4=?=
Date: Sun, 27 Jan 2008 18:48:25 +0000
MIME-Version: 1.0
Content-Type: text/plain;
charset="koi8-r"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-invURIBL-Scan: Scanned by invURIBL 3.1.0 on 1/27/2008 12:36:13 PM
X-invURIBL-Weight: 0
X-invURIBL-Range: CLEAN

X-RBL-Warning: UCEPROTECT-2: "Net 83.135.0.0/16 is UCEPROTECT-Level2 
listed because of 553 abusers. Your ISP VERSATEL Versatel 
Deutschland/AS8881 has to fix this. See: 
http://www.uceprotect.net/rblcheck.php?ipr=83.135.190.198";
X-RBL-Warning: UCEPROTECT-3: "Your ISP VERSATEL Versatel 
Deutschland/AS8881 is UCEPROTECT-Level3 listed because he is responsible 
for a total of 3700 abusers on the net. See: 
http://www.uceprotect.net/rblcheck.php?ipr=83.135.190.198";

X-RBL-Warning: SUBCHARS-50: Subject with at least 50 characters found.
X-RBL-Warning: SUBCHARS-55: Subject with at least 55 characters found.
X-RBL-Warning: SUBCHARS-60: Subject with at least 60 characters found.
X-Declude-Sender: [EMAIL PROTECTED] [83.135.190.198]
X-Declude-Spoolname: Deb31018d00002c90.smd

X-Declude-Note: Scanned by Declude 4.2.20 for spam. 
"http://www.declude.com/x-note.htm";

X-Declude-Scan: Incoming Score [9] at 12:36:13 on 27 Jan 2008

X-Declude-Fail: UCEPROTECT-2 [4], UCEPROTECT-3 [2], SUBCHARS-50 [1], 
SUBCHARS-55 [1], SUBCHARS-60 [1], WEIGHT5 [5], WEIGHT5r [5], WEIGHT7 
[7], WEIGHT7r [7], ZEROHOUR [0]

X-Country-Chain: GERMANY->destination
X-RCPT-TO: <[EMAIL PROTECTED]>
Status:
X-UIDL: 479717394
X-IMail-ThreadID: eb31018d00002c90


Продаётся пристройка р-н Митино 
Новотушинкий пр. д. 8. 521кв.м (1эт.-153кв.м, 
подвал-368кв.м) .



Отдельный вход в подвал и на первый 
этаж, свободная планировка, витринные 
окна.
Большой спальный район, в 
непосредственной близости дорога с 
большим трафиком автомобилей.
Расстояние 150м от Станции метро 
"Волоколамская" (открытие начало 2O09г.).
Под  офис,магазин, ресторан, 
фитнес-центр, компанию бытового 
обслуживания.
Имеется документация для проведения 
реконструкции: устройство второго 
входа в подвал с фасада, устройство 
приямков с окнами, устройство входа в 
подвал из помещения первого этажа. 
Дополнительно имеется в продаже 250кв.м 
подвала.



Возможна аренда: подвал 280$ за кв.м в год, 
первый этаж 6OO$ за кв.м в год.


Цена 38 млн. рублей (15550OO$)



Declude says that it gives this message  a score of 9, but it put it in 
my Inbox, which should never happen.  Any idea how this is happening?


Thanks,

Ben





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



--



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.























					Reply via email to