Hi. I use Spam
Review to review held messages and usually it dispays the ISO encoded subjects
as it's ISO self and not as the interpreted text.
This is the DECLUDE
log entry for an email that triggered on these content
filters:
SUBJECT 2 CONTAINS
-
SUBJECT 2 CONTAINS
=
SUBJECT 2 CONTAINS
?
SUBJECT 10 CONTAINS
=?ISO-8859-
02/10/2004 16:53:57 Q7d071b8e004cf847
Triggered CONTAINS filter on - [weight->2;
-8859-1?B?QW5ub3VuY2luZyBUZWNo].
02/10/2004 16:53:57 Q7d071b8e004cf847 Triggered CONTAINS filter on = [weight->2; =?ISO-8859-1?B?QW5ub3VuY2luZyB].
02/10/2004 16:53:57 Q7d071b8e004cf847 Triggered CONTAINS filter on ? [weight->2; ?ISO-8859-1?B?QW5ub3VuY2luZyBU].
02/10/2004 16:53:57 Q7d071b8e004cf847 Triggered CONTAINS filter on =?ISO-8859- [weight->10; =?ISO-8859-1?B?QW5ub3VuY2luZyB].
02/10/2004 16:53:57 Q7d071b8e004cf847 Triggered CONTAINS filter on .m0.net [weight->-10; .m0.net].
02/10/2004 16:53:57 Q7d071b8e004cf847 ALLIGATESPAM1:10 CONTENT:6 INTERSIL:7 SPAMCOP:7 . Total weight = 30
02/10/2004 16:53:57 Q7d071b8e004cf847 Using [incoming] CFG file D:\IMail\Declude\$default$.junkmail.
02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed ALLIGATESPAM1 (Message failed ALLIGATESPAM1: 38.). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed CONTENT (Message failed CONTENT test (1174)). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed INTERSIL (116.164.11.209.blackholes.intersil.net.). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed SPAMCOP (Blocked - see http://www.spamcop.net/bl.shtml?209.11.164.116). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed WEIGHT10 (Weight of 30 reaches or exceeds the limit of 10.). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed WEIGHT25 (Weight of 30 reaches or exceeds the limit of 25.). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Subject: =?ISO-8859-1?B?QW5ub3VuY2luZyBUZWNot0VkIDIwMDQgLSBSZWdpc3RlciB0b2RheSE=?=
02/10/2004 16:53:57 Q7d071b8e004cf847 From: [EMAIL PROTECTED] To: <snip> IP: 209.11.164.116 ID:
02/10/2004 16:53:57 Q7d071b8e004cf847 Last action = "">
02/10/2004 16:53:57 Q7d071b8e004cf847 Triggered CONTAINS filter on = [weight->2; =?ISO-8859-1?B?QW5ub3VuY2luZyB].
02/10/2004 16:53:57 Q7d071b8e004cf847 Triggered CONTAINS filter on ? [weight->2; ?ISO-8859-1?B?QW5ub3VuY2luZyBU].
02/10/2004 16:53:57 Q7d071b8e004cf847 Triggered CONTAINS filter on =?ISO-8859- [weight->10; =?ISO-8859-1?B?QW5ub3VuY2luZyB].
02/10/2004 16:53:57 Q7d071b8e004cf847 Triggered CONTAINS filter on .m0.net [weight->-10; .m0.net].
02/10/2004 16:53:57 Q7d071b8e004cf847 ALLIGATESPAM1:10 CONTENT:6 INTERSIL:7 SPAMCOP:7 . Total weight = 30
02/10/2004 16:53:57 Q7d071b8e004cf847 Using [incoming] CFG file D:\IMail\Declude\$default$.junkmail.
02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed ALLIGATESPAM1 (Message failed ALLIGATESPAM1: 38.). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed CONTENT (Message failed CONTENT test (1174)). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed INTERSIL (116.164.11.209.blackholes.intersil.net.). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed SPAMCOP (Blocked - see http://www.spamcop.net/bl.shtml?209.11.164.116). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed WEIGHT10 (Weight of 30 reaches or exceeds the limit of 10.). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Msg failed WEIGHT25 (Weight of 30 reaches or exceeds the limit of 25.). Action="">02/10/2004 16:53:57 Q7d071b8e004cf847 Subject: =?ISO-8859-1?B?QW5ub3VuY2luZyBUZWNot0VkIDIwMDQgLSBSZWdpc3RlciB0b2RheSE=?=
02/10/2004 16:53:57 Q7d071b8e004cf847 From: [EMAIL PROTECTED] To: <snip> IP: 209.11.164.116 ID:
02/10/2004 16:53:57 Q7d071b8e004cf847 Last action = "">
However, the subject
in the header info is showing plain text according to Spam Review, which
recognizes other emails sent in the ISO format, but not this one for some
reason.
Below is the header
of the message copied from Spam Review (And, yes, the SMD file name is the same
as the one above):
Reply-to: [EMAIL PROTECTED]
To: <snip>
Subject: Announcing Tech�Ed 2004 - Register today!
Errors-to: [EMAIL PROTECTED]
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="---=_NEXT_faa20bab1d"
X-cid: 11679481062
X-pid: 301950
X-Alligate-In: FAILED - Score Adult: 0 (Req: 18) Spam: 38 (Req: 18) Tot: 38 (Req: 25)
X-Alligate-Tracking: F78E7AFE030A779B
X-Alligate-Signature: 1936898440
X-Alligate-SpoolFile: D7d071b8e004cf847.SMD
X-Alligate-Sender: [EMAIL PROTECTED] [209.11.164.116]
X-RBL-Warning: ALLIGATESPAM1: Message failed ALLIGATESPAM1: 38.
X-RBL-Warning: CONTENT: Message failed CONTENT test (1174)
X-RBL-Warning: INTERSIL: 116.164.11.209.blackholes.intersil.net.
X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?209.11.164.116
X-RBL-Warning: WEIGHT10: Weight of 30 reaches or exceeds the limit of 10.
X-Declude-Sender: [EMAIL PROTECTED] [209.11.164.116]
X-Declude-Spoolname: D7d071b8e004cf847.SMD
X-Spam-Tests-Failed: ALLIGATESPAM1, CONTENT, INTERSIL, SPAMCOP, IPNOTINMX, NOLEGITCONTENT, WEIGHT10, WEIGHT25 [30]
To: <snip>
Subject: Announcing Tech�Ed 2004 - Register today!
Errors-to: [EMAIL PROTECTED]
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="---=_NEXT_faa20bab1d"
X-cid: 11679481062
X-pid: 301950
X-Alligate-In: FAILED - Score Adult: 0 (Req: 18) Spam: 38 (Req: 18) Tot: 38 (Req: 25)
X-Alligate-Tracking: F78E7AFE030A779B
X-Alligate-Signature: 1936898440
X-Alligate-SpoolFile: D7d071b8e004cf847.SMD
X-Alligate-Sender: [EMAIL PROTECTED] [209.11.164.116]
X-RBL-Warning: ALLIGATESPAM1: Message failed ALLIGATESPAM1: 38.
X-RBL-Warning: CONTENT: Message failed CONTENT test (1174)
X-RBL-Warning: INTERSIL: 116.164.11.209.blackholes.intersil.net.
X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?209.11.164.116
X-RBL-Warning: WEIGHT10: Weight of 30 reaches or exceeds the limit of 10.
X-Declude-Sender: [EMAIL PROTECTED] [209.11.164.116]
X-Declude-Spoolname: D7d071b8e004cf847.SMD
X-Spam-Tests-Failed: ALLIGATESPAM1, CONTENT, INTERSIL, SPAMCOP, IPNOTINMX, NOLEGITCONTENT, WEIGHT10, WEIGHT25 [30]
Any ideas would be
gretly appreciated.
Thank
you.
-Mike
