The 127.0.0.4 is a gray listing for the uribl. I personally don't score
the gray result because of too many false positives.
<!--URI LIST 2-->
<add key="URIBL_List2" value="multi.uribl.com" />
<add key="URIBL_Weight_List2" value="0" />
<!-- BitValue_2 = comes from black.uribl.org -->
<!-- BitValue_4 = comes from grey.uribl.org -->
<add key="Enable_Custom_Bitmask_Values_URIBL_List2" value="true" />
<add key="URI_Bitmask_BitValue_1_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_2_Weight_URIBL_List2" value="75" />
<add key="URI_Bitmask_BitValue_4_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_8_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_16_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_32_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_64_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_128_Weight_URIBL_List2" value="0" />
-----Original Message-----
From: Imail Admin [mailto:[email protected]]
Sent: Tuesday, April 05, 2011 7:34 PM
To: [email protected]
Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file?
So I'm still looking at ways to make Inv-Uribl more effective. I'm getting
a lot of spam that gets through my system with relatively marginal score so
I'm looking at the Inv-Uribl log. Here are the lines for a message that I
would consider to be obviously spam, yet came through Inv-Uribl as "Clean":
2011-03-31 02:53:09.343 2011-03-31 02:53:12.484
D:\IMail\spool\proc\work\D5d0b028c0000100f.smd netcontentinc.com 127.0.0.4
URI from message body found in multi.uribl.com [4] [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953
D:\IMail\spool\proc\work\D5d0b028c0000100f.smd Resolved netcontentinc.com to
207.65.119.238 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953
D:\IMail\spool\proc\work\D5d0b028c0000100f.smd Resolved avantresources.com
to 216.139.251.42 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953
D:\IMail\spool\proc\work\D5d0b028c0000100f.smd Resolved bcwebhost.net to
173.164.65.196 [Total Weight=0]
Did I miss something here that should have triggered a score (additional
spam weight in Declude)?
Thanks,
Ben
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to [email protected], and type "unsubscribe
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [email protected], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
