If someone would like to venture a guess as to what happened here, I would love to hear it.
I just received a Nigerian bank scam - my first since putting in IMail 8.0x last July as Nigeria was one of the first 10 spam words I added. This one came through without a problem, which really shocked as I know I have about 5 phrases on this email in the phrase list, yet none of them triggered although it is a simple ascii text. Although Outlook 2003 nailed it as spam, IMail did nothing. This is a clear software failure from what I can see, unless someone can tell me why it wasn't caught. I have double checked the IP in the trusted IP addresses and in the white list - nothing even close. The only possibility, though I doubt it, did IPSWITCH put something in the code not return Spam codes if word IMAIL is in the domain? Again, I doubt it, but I see no other reason for the failure to catch something so simple. Furthermore, it looks like it started the delivery process at 20:26:59 before it even went to the spam phrase list at 20:27. Any light here would be appreciated. The first part of the email: -----Original Message----- From: ibe festus [mailto:[EMAIL PROTECTED] Sent: Friday, April 16, 2004 8:33 PM To: [EMAIL PROTECTED] Subject: *JOINT VENTURE* Dear Friend, I am Barrister Festus Ibe, the Personal Attorney to a Foreign Contractor, who worked with a Multinational Oil Firm in Nigeria. On the 11th of September 2001, my client, a Mexican National, late engineer Carlos Montoya, an oil Merchant / Contractor with the Federal Government of Nigeria, until his death Three years ago in a ghastly terrorist attack to American Airlines Flight 11, from Boston, Massachusetts, to Los Angeles, California, crashed into the North Tower of the World Trade Centre with 86 people on board. All occupants of the Aeroplane unfortunately lost their lives. For more information visit this website: from the phrase-list: nifty-fun-pages niftygifts nigeria night with a prostitute And the logs: 20040416 202626 127.0.0.1 SMTPD (79b200e4013490e9) [207.168.61.195] EHLO iserver40.infranet 20040416 202627 127.0.0.1 SMTPD (79b200e4013490e9) [207.168.61.195] MAIL FROM:<[EMAIL PROTECTED]> 20040416 202627 127.0.0.1 SMTPD (79b200e4013490e9) [207.168.61.195] RCPT TO:<[EMAIL PROTECTED]> 20040416 202627 127.0.0.1 SMTPD (79b200e4013490e9) [207.168.61.195] d:\IMail\spool\D79b200e4013490e9.SMD 3234 20040416 202627 127.0.0.1 SMTPD (79b200e4013490e9) performing antispam checks 20040416 202659 127.0.0.1 SMTP (79b200e4013490e9) processing d:\IMail\spool\Q79b200e4013490e9.SMD 20040416 202700 127.0.0.1 SMTP (79b200e4013490e9) forwarded message to [EMAIL PROTECTED] 20040416 202700 127.0.0.1 SMTP (79b200e4013490e9) ldeliver mydomain.tld me-main (1) [EMAIL PROTECTED] 3234 20040416 202700 127.0.0.1 SMTP (79b200e4013490e9) finished d:\IMail\spool\Q79b200e4013490e9.SMD status=1 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (spamhaus:*:sbl.spamhaus.org) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (spamhaus:*:sbl.spamhaus.org) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (SpamCop:*:bl.spamcop.net) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (SpamCop:*:bl.spamcop.net) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (Ordb-Relays:*:relays.ordb.org) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (Ordb-Relays:*:relays.ordb.org) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (dnsrbl:*:spam.dnsrbl.net) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (dnsrbl:*:spam.dnsrbl.net) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (njabl:*:dnsbl.njabl.org) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (njabl:*:dnsbl.njabl.org) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (Orid:*:antispam.or.id) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (Orid:*:antispam.or.id) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (ReynoldsSpews:*:spews.bl.reynolds.net.au) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (ReynoldsSpews:*:spews.bl.reynolds.net.au) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (Inflow:*:inflow.blackholes.us) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (Inflow:*:inflow.blackholes.us) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (ScaryDevil:*:msgid.bl.gweep.ca) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (ScaryDevil:*:msgid.bl.gweep.ca) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (ChinaNet:*:chinanet.blackholes.us) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (ChinaNet:*:chinanet.blackholes.us) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (DSBL:*:list.dbsl.org) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (DSBL:*:list.dbsl.org) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (FabelSources:*:spamsources.fabel.dk) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (FabelSources:*:spamsources.fabel.dk) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: connecting to service (AHBL:*:dnsbl.ahbl.org) 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: 207.168.61.195 was not found on list (AHBL:*:dnsbl.ahbl.org) 04:16 20:27 SMTP(79b200e4013490e9) Got Content Filter for mydomain.tld 04:16 20:27 SMTP(79b200e4013490e9) scanning the subject for phrases 04:16 20:27 SMTP(79b200e4013490e9) scanning the body for phrases 04:16 20:27 SMTP(79b200e4013490e9) performing statistical analysis 04:16 20:27 SMTP(79b200e4013490e9) The following words were used to compute the probability email is spam 04:16 20:27 SMTP(79b200e4013490e9) word = montoya, probability = 0.990000 04:16 20:27 SMTP(79b200e4013490e9) word = engineer, probability = 0.015330 04:16 20:27 SMTP(79b200e4013490e9) word = day, probability = 0.017276 04:16 20:27 SMTP(79b200e4013490e9) word = had, probability = 0.042721 04:16 20:27 SMTP(79b200e4013490e9) word = avail, probability = 0.048362 04:16 20:27 SMTP(79b200e4013490e9) word = attack, probability = 0.068792 04:16 20:27 SMTP(79b200e4013490e9) word = ibe, probability = 0.930863 04:16 20:27 SMTP(79b200e4013490e9) word = can, probability = 0.069762 04:16 20:27 SMTP(79b200e4013490e9) word = september, probability = 0.070727 04:16 20:27 SMTP(79b200e4013490e9) word = crashed, probability = 0.071780 04:16 20:27 SMTP(79b200e4013490e9) word = his, probability = 0.072141 04:16 20:27 SMTP(79b200e4013490e9) word = unfortunately, probability = 0.077006 04:16 20:27 SMTP(79b200e4013490e9) word = regards, probability = 0.083417 04:16 20:27 SMTP(79b200e4013490e9) word = ago, probability = 0.085290 04:16 20:27 SMTP(79b200e4013490e9) word = worked, probability = 0.091882 04:16 20:27 SMTP(79b200e4013490e9) probability email is spam 0.000000: email is good To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
