[Declude.JunkMail] website design service spam emails

2009-02-19 Thread Craig Edmonds

Okay.

I am starting to get seriously annoyed with the spam email below that keeps
hitting my own inbox a couple of times a day.

Does anyone know a simple way for me to pick up on these mails in declude
and add weight without affecting normal mails?

Kindest Regards
Craig Edmonds
123 Marbella Internet Services
W: www.123marbella.com
E : cr...@123marbella.com

-Original Message-
From: Don [mailto:zhuazhujih2...@msn.com] 
Sent: 19 February 2009 08:57
To: webmaster
Subject: **Spam? [WEIGHT: 18]**website design service (CA)

You are receiving this email because we wish you to use our web design
service.

We are web design studio from China. We are specialized in web page design,
website development, graphics  multi-media design, flash website design and
other relevant services. We pride ourselves with our technical strength,
professional vision, unique style, and most of all, our highly devoted
professional designers. We are in position to offer website solution,
graphics design, e-commerce solution, online promotion and other medium and
small business oriented services. 

Core offerings

Business website design 
Business website redesign 
Flash website design 
Flash website redesign 
Ecommerce website design 
Ecommerce website redesign 
Company website design
Company catalog design
Company logo design
Graphic design
Google search engine optimization
ERP Solutions

Pls check our website to see portfolio.

Best regards,
Don
V.DASK Information Technologies
Website team
Contact: ittechrespo...@gmail.com










Send address to ittechun...@gmail.com for unsubscribe


 




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



Re: [Declude.JunkMail] website design service spam emails

2009-02-19 Thread Darin Cox
Sample headers would help in determining a way to filter these.  Also, do 
you use Message Sniffer?

Darin.


- Original Message - 
From: Craig Edmonds cr...@123marbella.com
To: declude.junkmail@declude.com
Sent: Thursday, February 19, 2009 3:16 AM
Subject: [Declude.JunkMail] website design service spam emails



Okay.

I am starting to get seriously annoyed with the spam email below that keeps
hitting my own inbox a couple of times a day.

Does anyone know a simple way for me to pick up on these mails in declude
and add weight without affecting normal mails?

Kindest Regards
Craig Edmonds
123 Marbella Internet Services
W: www.123marbella.com
E : cr...@123marbella.com

-Original Message-
From: Don [mailto:zhuazhujih2...@msn.com]
Sent: 19 February 2009 08:57
To: webmaster
Subject: **Spam? [WEIGHT: 18]**website design service (CA)

You are receiving this email because we wish you to use our web design
service.

We are web design studio from China. We are specialized in web page design,
website development, graphics  multi-media design, flash website design and
other relevant services. We pride ourselves with our technical strength,
professional vision, unique style, and most of all, our highly devoted
professional designers. We are in position to offer website solution,
graphics design, e-commerce solution, online promotion and other medium and
small business oriented services.

Core offerings

Business website design
Business website redesign
Flash website design
Flash website redesign
Ecommerce website design
Ecommerce website redesign
Company website design
Company catalog design
Company logo design
Graphic design
Google search engine optimization
ERP Solutions

Pls check our website to see portfolio.

Best regards,
Don
V.DASK Information Technologies
Website team
Contact: ittechrespo...@gmail.com










Send address to ittechun...@gmail.com for unsubscribe







---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



[Declude.JunkMail] Spam Score?

2009-02-19 Thread Dave Beckstrom

Something is happening with our spam score that I don't quite understand.
If you look below at the (sanitized) email headers you'll see that the CBL
test scored 6 and spamheaders scored 3 and yet the final score for this
email was Spam Score: [1]

Shouldn't the score have been 9?

On another note, if the CBL ip4rl test shows blocked what is the best way
to hold this email?  I assume that I would just up the weighting from 6 to
my hold level?  Do you guys hold email based only on an rbl response of
blocked or do you require additional tests to fail?  

If a few folks would like to post their ip4r tests from the global.cfg I
think that would be really helpful to a lot of people.  I know that my
global.cfg is a good number of years old and the ip4r tests are not tests
that I've updated in a long time.  Seeing what others are using would help
me identify if I have tests I'm not using but should be using and vice
versa.

Thanks,

Dave




Return-Path: yourautopolicyvxw...@bestlevelterm.com Thu Feb 19 03:29:48
2009
Received: from server1.taxhelpis.com [65.60.20.131] ..com with SMTP;
   Thu, 19 Feb 2009 03:29:48 -0600
Reply-To: yourautopolicyvxw...@bestlevelterm.com
In-Reply-To: 20090219033057.ggnppl...@mx2.bestlevelterm.com.1329
MIME-Version: 1.0
Content-Type: multipart/alternative;
   boundary=_=_extPart_000_0097_a3d0dac.a3d0dac
Content-class: urn:content-classes:message
Return-path:  yourautopolicyvxw...@bestlevelterm.com
Subject:Vehicle Warranty - 60% OFF Dealers Price 
Date: Thu, 19 Feb 2009 03:30:57 -0600
Message-Id: 20090219033057.ggnppl...@mx2.bestlevelterm.com
Thread-Topic: RE: This email can save your life
From: Continued Auto Coveragecontinuedautocover...@bestlevelterm.com
To: x
Importance: Normal
X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM
X-invURIBL-Weight: 0
X-invURIBL-Range: CLEAN
X-RBL-Warning: CBL: Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131;
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
[4000100e].
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-Declude-Sender: yourautopolicyvxw...@bestlevelterm.com [65.60.20.131]
X-Declude-RefID: 
X-Note: 
X-Note: Spam Score: [1]
X-Note: Scan Time: 03:30:01 on 19 Feb 2009
X-Note: Spool File: 369855951432.eml
X-Note: Server Name: mx2.bestlevelterm.com
X-Note: SMTP Sender: yourautopolicyvxw...@bestlevelterm.com
X-Note: Reverse DNS  IP: server1.taxhelpis.com [65.60.20.131]
X-Note: Recipient(s): 
X-Note: Country Chain: [ARIN Unlisted]-destination
X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0]
X-Note: 




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spam Score?

2009-02-19 Thread David Barker
Dave,

The last column of a test is the value added or subtracted if the test is
NOT triggered. IF a test is NOT triggered it will not show up in the header.
The most common that are used like this are:

IPNOTINMX
NOLEGITCONTENT
FROMNOMATCH

David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
dbar...@declude.com



-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave
Beckstrom
Sent: Thursday, February 19, 2009 9:33 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Spam Score?


Something is happening with our spam score that I don't quite understand.
If you look below at the (sanitized) email headers you'll see that the CBL
test scored 6 and spamheaders scored 3 and yet the final score for this
email was Spam Score: [1]

Shouldn't the score have been 9?

On another note, if the CBL ip4rl test shows blocked what is the best way
to hold this email?  I assume that I would just up the weighting from 6 to
my hold level?  Do you guys hold email based only on an rbl response of
blocked or do you require additional tests to fail?  

If a few folks would like to post their ip4r tests from the global.cfg I
think that would be really helpful to a lot of people.  I know that my
global.cfg is a good number of years old and the ip4r tests are not tests
that I've updated in a long time.  Seeing what others are using would help
me identify if I have tests I'm not using but should be using and vice
versa.

Thanks,

Dave




Return-Path: yourautopolicyvxw...@bestlevelterm.com Thu Feb 19 03:29:48
2009
Received: from server1.taxhelpis.com [65.60.20.131] ..com with SMTP;
   Thu, 19 Feb 2009 03:29:48 -0600
Reply-To: yourautopolicyvxw...@bestlevelterm.com
In-Reply-To: 20090219033057.ggnppl...@mx2.bestlevelterm.com.1329
MIME-Version: 1.0
Content-Type: multipart/alternative;
   boundary=_=_extPart_000_0097_a3d0dac.a3d0dac
Content-class: urn:content-classes:message
Return-path:  yourautopolicyvxw...@bestlevelterm.com
Subject:Vehicle Warranty - 60% OFF Dealers Price 
Date: Thu, 19 Feb 2009 03:30:57 -0600
Message-Id: 20090219033057.ggnppl...@mx2.bestlevelterm.com
Thread-Topic: RE: This email can save your life
From: Continued Auto Coveragecontinuedautocover...@bestlevelterm.com
To: x
Importance: Normal
X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM
X-invURIBL-Weight: 0
X-invURIBL-Range: CLEAN
X-RBL-Warning: CBL: Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131;
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
[4000100e].
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-Declude-Sender: yourautopolicyvxw...@bestlevelterm.com [65.60.20.131]
X-Declude-RefID: 
X-Note: 
X-Note: Spam Score: [1]
X-Note: Scan Time: 03:30:01 on 19 Feb 2009
X-Note: Spool File: 369855951432.eml
X-Note: Server Name: mx2.bestlevelterm.com
X-Note: SMTP Sender: yourautopolicyvxw...@bestlevelterm.com
X-Note: Reverse DNS  IP: server1.taxhelpis.com [65.60.20.131]
X-Note: Recipient(s): 
X-Note: Country Chain: [ARIN Unlisted]-destination
X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0]
X-Note: 




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] website design service spam emails

2009-02-19 Thread Scott Fisher
BODY 10 CONTAINS V.DASK Information Technologies
Or
BODY 10 CONTAINS ittechrespo...@gmail.com


-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Craig
Edmonds
Sent: Thursday, February 19, 2009 2:17 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] website design service spam emails



Okay.

I am starting to get seriously annoyed with the spam email below that keeps
hitting my own inbox a couple of times a day.

Does anyone know a simple way for me to pick up on these mails in declude
and add weight without affecting normal mails?

Kindest Regards
Craig Edmonds
123 Marbella Internet Services
W: www.123marbella.com
E : cr...@123marbella.com

-Original Message-
From: Don [mailto:zhuazhujih2...@msn.com] 
Sent: 19 February 2009 08:57
To: webmaster
Subject: **Spam? [WEIGHT: 18]**website design service (CA)

You are receiving this email because we wish you to use our web design
service.

We are web design studio from China. We are specialized in web page design,
website development, graphics  multi-media design, flash website design and
other relevant services. We pride ourselves with our technical strength,
professional vision, unique style, and most of all, our highly devoted
professional designers. We are in position to offer website solution,
graphics design, e-commerce solution, online promotion and other medium and
small business oriented services. 

Core offerings

Business website design 
Business website redesign 
Flash website design 
Flash website redesign 
Ecommerce website design 
Ecommerce website redesign 
Company website design
Company catalog design
Company logo design
Graphic design
Google search engine optimization
ERP Solutions

Pls check our website to see portfolio.

Best regards,
Don
V.DASK Information Technologies
Website team
Contact: ittechrespo...@gmail.com










Send address to ittechun...@gmail.com for unsubscribe


 




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spam Score?

2009-02-19 Thread Dave Beckstrom
David,

Here is the test:

CBL IP4Rcbl.abuseat.org 127.0.0.2   6   0

According to these headers:

X-RBL-Warning: CBL: Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131;
X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0]

Wasn't the test triggered and a score of 6 should have been added to the
total score?



 -Original Message-
 From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
 Barker
 Sent: 2009-02-19 08:37
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] Spam Score?
 
 Dave,
 
 The last column of a test is the value added or subtracted if the test is
 NOT triggered. IF a test is NOT triggered it will not show up in the
header.
 The most common that are used like this are:
 
 IPNOTINMX
 NOLEGITCONTENT
 FROMNOMATCH
 
 David Barker
 VP Operations Declude
 Your Email security is our business
 978.499.2933 office
 978.988.1311 fax
 dbar...@declude.com
 
 
 
 -Original Message-
 From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave
 Beckstrom
 Sent: Thursday, February 19, 2009 9:33 AM
 To: declude.junkmail@declude.com
 Subject: [Declude.JunkMail] Spam Score?
 
 
 Something is happening with our spam score that I don't quite understand.
 If you look below at the (sanitized) email headers you'll see that the CBL
 test scored 6 and spamheaders scored 3 and yet the final score for this
 email was Spam Score: [1]
 
 Shouldn't the score have been 9?
 
 On another note, if the CBL ip4rl test shows blocked what is the best
way
 to hold this email?  I assume that I would just up the weighting from 6 to
 my hold level?  Do you guys hold email based only on an rbl response of
 blocked or do you require additional tests to fail?
 
 If a few folks would like to post their ip4r tests from the global.cfg I
 think that would be really helpful to a lot of people.  I know that my
 global.cfg is a good number of years old and the ip4r tests are not tests
 that I've updated in a long time.  Seeing what others are using would help
 me identify if I have tests I'm not using but should be using and vice
 versa.
 
 Thanks,
 
 Dave
 
 
 
 
 Return-Path: yourautopolicyvxw...@bestlevelterm.com Thu Feb 19 03:29:48
 2009
 Received: from server1.taxhelpis.com [65.60.20.131] ..com with
SMTP;
Thu, 19 Feb 2009 03:29:48 -0600
 Reply-To: yourautopolicyvxw...@bestlevelterm.com
 In-Reply-To: 20090219033057.ggnppl...@mx2.bestlevelterm.com.1329
 MIME-Version: 1.0
 Content-Type: multipart/alternative;
boundary=_=_extPart_000_0097_a3d0dac.a3d0dac
 Content-class: urn:content-classes:message
 Return-path:  yourautopolicyvxw...@bestlevelterm.com
 Subject:Vehicle Warranty - 60% OFF Dealers Price
 Date: Thu, 19 Feb 2009 03:30:57 -0600
 Message-Id: 20090219033057.ggnppl...@mx2.bestlevelterm.com
 Thread-Topic: RE: This email can save your life
 From: Continued Auto Coveragecontinuedautocover...@bestlevelterm.com
 To: x
 Importance: Normal
 X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM
 X-invURIBL-Weight: 0
 X-invURIBL-Range: CLEAN
 X-RBL-Warning: CBL: Blocked - see
 http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131;
 X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
 [4000100e].
 X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
 X-Declude-Sender: yourautopolicyvxw...@bestlevelterm.com [65.60.20.131]
 X-Declude-RefID:
 X-Note: 
 X-Note: Spam Score: [1]
 X-Note: Scan Time: 03:30:01 on 19 Feb 2009
 X-Note: Spool File: 369855951432.eml
 X-Note: Server Name: mx2.bestlevelterm.com
 X-Note: SMTP Sender: yourautopolicyvxw...@bestlevelterm.com
 X-Note: Reverse DNS  IP: server1.taxhelpis.com [65.60.20.131]
 X-Note: Recipient(s): 
 X-Note: Country Chain: [ARIN Unlisted]-destination
 X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0]
 X-Note: 
 
 
 
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to imail...@declude.com, and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.
 
 
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to imail...@declude.com, and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Spam Score?

2009-02-19 Thread Dave Beckstrom
David,

Never mind.  I found in the logs where those tests you mentioned are giving
the email a credit (negative weight) and thus the total weight is adjusted
accordingly.

I have IPNOTINMX and NOLEGITCONTENT set up under HIDETESTS which explains
why the confusion on the total score.

BTW -- I would still like to see some people post their ip4r tests to the
list.  I have a hunch I'm missing some valuable tests in my list.

Thanks,

Dave

 -Original Message-
 From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave
 Beckstrom
 Sent: 2009-02-19 08:56
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] Spam Score?
 
 David,
 
 Here is the test:
 
 CBL   IP4Rcbl.abuseat.org 127.0.0.2   6   0
 
 According to these headers:
 
 X-RBL-Warning: CBL: Blocked - see
 http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131;
 X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0]
 
 Wasn't the test triggered and a score of 6 should have been added to the
 total score?
 
 
 
  -Original Message-
  From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of
David
  Barker
  Sent: 2009-02-19 08:37
  To: declude.junkmail@declude.com
  Subject: RE: [Declude.JunkMail] Spam Score?
 
  Dave,
 
  The last column of a test is the value added or subtracted if the test
is
  NOT triggered. IF a test is NOT triggered it will not show up in the
 header.
  The most common that are used like this are:
 
  IPNOTINMX
  NOLEGITCONTENT
  FROMNOMATCH
 
  David Barker
  VP Operations Declude
  Your Email security is our business
  978.499.2933 office
  978.988.1311 fax
  dbar...@declude.com
 
 
 
  -Original Message-
  From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave
  Beckstrom
  Sent: Thursday, February 19, 2009 9:33 AM
  To: declude.junkmail@declude.com
  Subject: [Declude.JunkMail] Spam Score?
 
 
  Something is happening with our spam score that I don't quite
understand.
  If you look below at the (sanitized) email headers you'll see that the
CBL
  test scored 6 and spamheaders scored 3 and yet the final score for this
  email was Spam Score: [1]
 
  Shouldn't the score have been 9?
 
  On another note, if the CBL ip4rl test shows blocked what is the best
 way
  to hold this email?  I assume that I would just up the weighting from 6
to
  my hold level?  Do you guys hold email based only on an rbl response of
  blocked or do you require additional tests to fail?
 
  If a few folks would like to post their ip4r tests from the global.cfg I
  think that would be really helpful to a lot of people.  I know that my
  global.cfg is a good number of years old and the ip4r tests are not
tests
  that I've updated in a long time.  Seeing what others are using would
help
  me identify if I have tests I'm not using but should be using and vice
  versa.
 
  Thanks,
 
  Dave
 
 
 
 
  Return-Path: yourautopolicyvxw...@bestlevelterm.com Thu Feb 19
03:29:48
  2009
  Received: from server1.taxhelpis.com [65.60.20.131] ..com with
 SMTP;
 Thu, 19 Feb 2009 03:29:48 -0600
  Reply-To: yourautopolicyvxw...@bestlevelterm.com
  In-Reply-To: 20090219033057.ggnppl...@mx2.bestlevelterm.com.1329
  MIME-Version: 1.0
  Content-Type: multipart/alternative;
 boundary=_=_extPart_000_0097_a3d0dac.a3d0dac
  Content-class: urn:content-classes:message
  Return-path:  yourautopolicyvxw...@bestlevelterm.com
  Subject:Vehicle Warranty - 60% OFF Dealers Price
  Date: Thu, 19 Feb 2009 03:30:57 -0600
  Message-Id: 20090219033057.ggnppl...@mx2.bestlevelterm.com
  Thread-Topic: RE: This email can save your life
  From: Continued Auto Coveragecontinuedautocover...@bestlevelterm.com
  To: x
  Importance: Normal
  X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM
  X-invURIBL-Weight: 0
  X-invURIBL-Range: CLEAN
  X-RBL-Warning: CBL: Blocked - see
  http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131;
  X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
  [4000100e].
  X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
  X-Declude-Sender: yourautopolicyvxw...@bestlevelterm.com [65.60.20.131]
  X-Declude-RefID:
  X-Note: 
  X-Note: Spam Score: [1]
  X-Note: Scan Time: 03:30:01 on 19 Feb 2009
  X-Note: Spool File: 369855951432.eml
  X-Note: Server Name: mx2.bestlevelterm.com
  X-Note: SMTP Sender: yourautopolicyvxw...@bestlevelterm.com
  X-Note: Reverse DNS  IP: server1.taxhelpis.com [65.60.20.131]
  X-Note: Recipient(s): 
  X-Note: Country Chain: [ARIN Unlisted]-destination
  X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0]
  X-Note: 
 
 
 
 
  ---
  This E-mail came from the Declude.JunkMail mailing list.  To
  unsubscribe, just send an E-mail to imail...@declude.com, and
  type unsubscribe Declude.JunkMail.  The archives can be found
  at http://www.mail-archive.com.
 
 
 
  ---
  This E-mail came from the Declude.JunkMail 

RE: [Declude.JunkMail] Spam Score?

2009-02-19 Thread David Barker
Post the following tests from your global.cfg: 

CBL
SPAMHEADERS
IPNOTINMX
NOLEGITCONTENT
FROMNOMATCH

David

-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave
Beckstrom
Sent: Thursday, February 19, 2009 9:56 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Spam Score?

David,

Here is the test:

CBL IP4Rcbl.abuseat.org 127.0.0.2   6   0

According to these headers:

X-RBL-Warning: CBL: Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131;
X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0]

Wasn't the test triggered and a score of 6 should have been added to the
total score?



 -Original Message-
 From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
 Barker
 Sent: 2009-02-19 08:37
 To: declude.junkmail@declude.com
 Subject: RE: [Declude.JunkMail] Spam Score?
 
 Dave,
 
 The last column of a test is the value added or subtracted if the test is
 NOT triggered. IF a test is NOT triggered it will not show up in the
header.
 The most common that are used like this are:
 
 IPNOTINMX
 NOLEGITCONTENT
 FROMNOMATCH
 
 David Barker
 VP Operations Declude
 Your Email security is our business
 978.499.2933 office
 978.988.1311 fax
 dbar...@declude.com
 
 
 
 -Original Message-
 From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave
 Beckstrom
 Sent: Thursday, February 19, 2009 9:33 AM
 To: declude.junkmail@declude.com
 Subject: [Declude.JunkMail] Spam Score?
 
 
 Something is happening with our spam score that I don't quite understand.
 If you look below at the (sanitized) email headers you'll see that the CBL
 test scored 6 and spamheaders scored 3 and yet the final score for this
 email was Spam Score: [1]
 
 Shouldn't the score have been 9?
 
 On another note, if the CBL ip4rl test shows blocked what is the best
way
 to hold this email?  I assume that I would just up the weighting from 6 to
 my hold level?  Do you guys hold email based only on an rbl response of
 blocked or do you require additional tests to fail?
 
 If a few folks would like to post their ip4r tests from the global.cfg I
 think that would be really helpful to a lot of people.  I know that my
 global.cfg is a good number of years old and the ip4r tests are not tests
 that I've updated in a long time.  Seeing what others are using would help
 me identify if I have tests I'm not using but should be using and vice
 versa.
 
 Thanks,
 
 Dave
 
 
 
 
 Return-Path: yourautopolicyvxw...@bestlevelterm.com Thu Feb 19 03:29:48
 2009
 Received: from server1.taxhelpis.com [65.60.20.131] ..com with
SMTP;
Thu, 19 Feb 2009 03:29:48 -0600
 Reply-To: yourautopolicyvxw...@bestlevelterm.com
 In-Reply-To: 20090219033057.ggnppl...@mx2.bestlevelterm.com.1329
 MIME-Version: 1.0
 Content-Type: multipart/alternative;
boundary=_=_extPart_000_0097_a3d0dac.a3d0dac
 Content-class: urn:content-classes:message
 Return-path:  yourautopolicyvxw...@bestlevelterm.com
 Subject:Vehicle Warranty - 60% OFF Dealers Price
 Date: Thu, 19 Feb 2009 03:30:57 -0600
 Message-Id: 20090219033057.ggnppl...@mx2.bestlevelterm.com
 Thread-Topic: RE: This email can save your life
 From: Continued Auto Coveragecontinuedautocover...@bestlevelterm.com
 To: x
 Importance: Normal
 X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM
 X-invURIBL-Weight: 0
 X-invURIBL-Range: CLEAN
 X-RBL-Warning: CBL: Blocked - see
 http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131;
 X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
 [4000100e].
 X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
 X-Declude-Sender: yourautopolicyvxw...@bestlevelterm.com [65.60.20.131]
 X-Declude-RefID:
 X-Note: 
 X-Note: Spam Score: [1]
 X-Note: Scan Time: 03:30:01 on 19 Feb 2009
 X-Note: Spool File: 369855951432.eml
 X-Note: Server Name: mx2.bestlevelterm.com
 X-Note: SMTP Sender: yourautopolicyvxw...@bestlevelterm.com
 X-Note: Reverse DNS  IP: server1.taxhelpis.com [65.60.20.131]
 X-Note: Recipient(s): 
 X-Note: Country Chain: [ARIN Unlisted]-destination
 X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0]
 X-Note: 
 
 
 
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to imail...@declude.com, and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.
 
 
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to imail...@declude.com, and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came