My filters caught your email. Can you send me, off list, a zip of your phrase list and a zip of the actual message, headers and all?
Thanks, Tripp ----- Original Message ----- From: "RMilner" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, April 16, 2004 9:59 PM Subject: [IMail Forum] Phrase list failure in IMail 8.1 > If someone would like to venture a guess as to what happened here, I would > love to hear it. > > I just received a Nigerian bank scam - my first since putting in IMail 8.0x > last July as Nigeria was one of the first 10 spam words I added. > > This one came through without a problem, which really shocked as I know I > have about 5 phrases on this email in the phrase list, yet none of them > triggered although it is a simple ascii text. Although Outlook 2003 nailed > it as spam, IMail did nothing. This is a clear software failure from what I > can see, unless someone can tell me why it wasn't caught. > > I have double checked the IP in the trusted IP addresses and in the white > list - nothing even close. > > The only possibility, though I doubt it, did IPSWITCH put something in the > code not return Spam codes if word IMAIL is in the domain? Again, I doubt > it, but I see no other reason for the failure to catch something so simple. > > Furthermore, it looks like it started the delivery process at 20:26:59 > before it even went to the spam phrase list at 20:27. > > Any light here would be appreciated. > > > The first part of the email: > > -----Original Message----- > From: ibe festus [mailto:[EMAIL PROTECTED] > Sent: Friday, April 16, 2004 8:33 PM > To: [EMAIL PROTECTED] > Subject: *JOINT VENTURE* > > > Dear Friend, > > I am Barrister Festus Ibe, the Personal Attorney > to a Foreign Contractor, who worked with a > Multinational Oil Firm in Nigeria. > On the 11th of September 2001, my client, a Mexican > National, late > engineer Carlos Montoya, an oil Merchant / Contractor > with the Federal Government of Nigeria, until his > death Three years ago in a ghastly > terrorist attack to American Airlines Flight 11, from > Boston, Massachusetts, to Los Angeles, California, > crashed into the North Tower of the World Trade Centre > with 86 people on board. All occupants of the > Aeroplane unfortunately lost their lives. For more > information visit > this website: > > > from the phrase-list: > > nifty-fun-pages > niftygifts > nigeria > night with a prostitute > > > And the logs: > > 20040416 202626 127.0.0.1 SMTPD (79b200e4013490e9) [207.168.61.195] > EHLO iserver40.infranet > 20040416 202627 127.0.0.1 SMTPD (79b200e4013490e9) [207.168.61.195] > MAIL FROM:<[EMAIL PROTECTED]> > 20040416 202627 127.0.0.1 SMTPD (79b200e4013490e9) [207.168.61.195] > RCPT TO:<[EMAIL PROTECTED]> > 20040416 202627 127.0.0.1 SMTPD (79b200e4013490e9) [207.168.61.195] > d:\IMail\spool\D79b200e4013490e9.SMD 3234 > 20040416 202627 127.0.0.1 SMTPD (79b200e4013490e9) performing antispam > checks > 20040416 202659 127.0.0.1 SMTP (79b200e4013490e9) processing > d:\IMail\spool\Q79b200e4013490e9.SMD > 20040416 202700 127.0.0.1 SMTP (79b200e4013490e9) forwarded message to > [EMAIL PROTECTED] > 20040416 202700 127.0.0.1 SMTP (79b200e4013490e9) ldeliver > mydomain.tld me-main (1) [EMAIL PROTECTED] 3234 > 20040416 202700 127.0.0.1 SMTP (79b200e4013490e9) finished > d:\IMail\spool\Q79b200e4013490e9.SMD status=1 > > > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (spamhaus:*:sbl.spamhaus.org) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (spamhaus:*:sbl.spamhaus.org) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (SpamCop:*:bl.spamcop.net) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (SpamCop:*:bl.spamcop.net) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (Ordb-Relays:*:relays.ordb.org) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (Ordb-Relays:*:relays.ordb.org) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (dnsrbl:*:spam.dnsrbl.net) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (dnsrbl:*:spam.dnsrbl.net) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (njabl:*:dnsbl.njabl.org) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (njabl:*:dnsbl.njabl.org) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (Orid:*:antispam.or.id) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (Orid:*:antispam.or.id) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (ReynoldsSpews:*:spews.bl.reynolds.net.au) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list > (ReynoldsSpews:*:spews.bl.reynolds.net.au) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (Inflow:*:inflow.blackholes.us) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (Inflow:*:inflow.blackholes.us) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (ScaryDevil:*:msgid.bl.gweep.ca) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (ScaryDevil:*:msgid.bl.gweep.ca) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (ChinaNet:*:chinanet.blackholes.us) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (ChinaNet:*:chinanet.blackholes.us) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (DSBL:*:list.dbsl.org) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (DSBL:*:list.dbsl.org) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (FabelSources:*:spamsources.fabel.dk) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (FabelSources:*:spamsources.fabel.dk) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > connecting to service (AHBL:*:dnsbl.ahbl.org) > 04:16 20:26 SMTPD(79b200e4013490e9) [00007344] <mydomain.tld> BLACKLIST: > 207.168.61.195 was not found on list (AHBL:*:dnsbl.ahbl.org) > 04:16 20:27 SMTP(79b200e4013490e9) Got Content Filter for mydomain.tld > 04:16 20:27 SMTP(79b200e4013490e9) scanning the subject for phrases > 04:16 20:27 SMTP(79b200e4013490e9) scanning the body for phrases > 04:16 20:27 SMTP(79b200e4013490e9) performing statistical analysis > 04:16 20:27 SMTP(79b200e4013490e9) The following words were used to compute > the probability email is spam > 04:16 20:27 SMTP(79b200e4013490e9) word = montoya, probability = 0.990000 > 04:16 20:27 SMTP(79b200e4013490e9) word = engineer, probability = 0.015330 > 04:16 20:27 SMTP(79b200e4013490e9) word = day, probability = 0.017276 > 04:16 20:27 SMTP(79b200e4013490e9) word = had, probability = 0.042721 > 04:16 20:27 SMTP(79b200e4013490e9) word = avail, probability = 0.048362 > 04:16 20:27 SMTP(79b200e4013490e9) word = attack, probability = 0.068792 > 04:16 20:27 SMTP(79b200e4013490e9) word = ibe, probability = 0.930863 > 04:16 20:27 SMTP(79b200e4013490e9) word = can, probability = 0.069762 > 04:16 20:27 SMTP(79b200e4013490e9) word = september, probability = > 0.070727 > 04:16 20:27 SMTP(79b200e4013490e9) word = crashed, probability = 0.071780 > 04:16 20:27 SMTP(79b200e4013490e9) word = his, probability = 0.072141 > 04:16 20:27 SMTP(79b200e4013490e9) word = unfortunately, probability = > 0.077006 > 04:16 20:27 SMTP(79b200e4013490e9) word = regards, probability = 0.083417 > 04:16 20:27 SMTP(79b200e4013490e9) word = ago, probability = 0.085290 > 04:16 20:27 SMTP(79b200e4013490e9) word = worked, probability = 0.091882 > 04:16 20:27 SMTP(79b200e4013490e9) probability email is spam 0.000000: email > is good > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
