I should have been clearer. They show up in the headers of the emails where
they are triggered. Here is an example that again does not add up (30 +
35 - 15 - 15 + 10 = 45) to the weight of 75 Declude has given it.
FIVETENSRC ip4r blackholes.five-ten-sg.com 127.0.0.2 30
0
SORBS-DUL ip4r dnsbl.sorbs.net 127.0.0.10 35 0
NOLEGITCONTENT nolegitcontent x x 0 -15
IPNOTINMX ipnotinmx x x 0 -15
SPFUNKNOWN spf unknown x 0 0
COUNTRYFILTER filter d:\imail\declude\filters\countryfilter.txt
x 0 0 ( weight 10 in filter)
CATCHALLMAILS catchallmails x x 0 0
--------------------------------------
Received: from mail2.smart-mail.net [65.16.167.134] by net.smart-mail.net
(SMTPD32-8.15) id A67D1E10156; Mon, 03 Apr 2006 14:24:45 -0500
Received: from fxi.com ([84.220.55.194])
by mail2.smart-mail.net (SMSSMTP 4.0.0.59) with SMTP id
M2006040314252611030
for <todd>; Mon, 03 Apr 2006 14:25:27 -0500
Message-ID: <[EMAIL PROTECTED]>
Reply-To: "Liviu Gaeth" <[EMAIL PROTECTED]>
From: "Liviu Gaeth" <[EMAIL PROTECTED]>
To: todd
Subject: see new
Date: Mon, 3 Apr 2006 15:23:36 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01C65732.93DB6C50"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-mxGuard-Info: Processed by net.smart-mail.net using mxGuard v1.5.0
X-mxGuard-Spool-ID: 767d01e101566616
X-mxGuard-Sender: [EMAIL PROTECTED]
X-mxGuard-Spam-Score: 0
X-Note: This message has been scanned for spam and viruses using mxGuard for
IMail
X-RBL-Warning: FIVETENSRC: 194.55.220.84.blackholes.five-ten-sg.com.
X-RBL-Warning: SORBS-DUL: This E-mail came from 84.220.55.194, a potential
spam source listed in SORBS-DUL.
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail
detected.
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: COUNTRYFILTER: Message failed COUNTRYFILTER test (line 106,
weight 10)
X-RBL-Warning: WEIGHT75: Weight of 75 reaches or exceeds the limit of 75.
X-Declude-Sender: [EMAIL PROTECTED] [84.220.55.194]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX,
SPFUNKNOWN, COUNTRYFILTER, WEIGHT75, CATCHALLMAILS [75]
X-Note: Total spam weight of this E-mail is 75 .
X-Country-Chain: ITALY->UNITED STATES->destination
X-Note: This E-mail was sent from host-84-220-55-194.cust-adsl.tiscali.it
([84.220.55.194]).
X-RCPT-TO: <todd>
Status: U
X-UIDL: 400264161
------------------------------------------
----- Original Message -----
From: "David Barker" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, April 05, 2006 12:44 PM
Subject: RE: [Declude.JunkMail] This doesnt add up
Todd,
I do not see them in the headers ?
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
GIBBERISH, CATCHALLMAILS [30]
David B
www.declude.com
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:56 PM
To: [email protected]
Subject: Re: [Declude.JunkMail] This doesnt add up
Thanks David, both of these tests are not hidden and show up in the
headers.
Todd
----- Original Message -----
From: "David Barker" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, April 05, 2006 11:47 AM
Subject: RE: [Declude.JunkMail] This doesnt add up
To reduce false positives NOLEGITCONTENT and IPNOTINMX are hidden tests,
check your global.cfg you should see the -5
David B
www.declude.com
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd
Sent: Wednesday, April 05, 2006 12:22 PM
To: [email protected]
Subject: [Declude.JunkMail] This doesnt add up
A lot of spam has been getting through lately and at first I was thinking
my
Declude needed some tweaking. I am seeing some funny stuff though. I
find
emails where emails contain items that should have triggered filters but
did
not. I am on IMail 8.15 and Declude 2.06.
Here is a header of an email where the numbers dont add to the score. It
should have had a score of 5 + 15 + 15 + 30 = 65 but instead shows 30
My global.cfg has the following entries for the tests that were triggered
SUBJECTSPACES7 subjectspaces 7 x 5 0
SUBJECTSPACES10 subjectspaces 10 x 15 0
SPFPASS spf pass x 0 0
X-RBL-Warning: SUBJECTSPACES7: Subject with at least 7 spaces found.
X-RBL-Warning: SUBJECTSPACES10: Subject with at least 10 spaces found.
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 15.
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 463, weight
30)
X-Declude-Sender: [EMAIL PROTECTED] [69.89.85.90]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: SUBJECTSPACES7, SUBJECTSPACES10, SPFPASS, SPAMCHK,
GIBBERISH, CATCHALLMAILS [30]
X-Note: Total spam weight of this E-mail is 30 .
X-Country-Chain: UNITED STATES->destination
X-Note: This E-mail was sent from eveningtrees.com ([69.89.85.90]).
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
