In the following email, the score for the "Suspicious HELO" test was
added twice.
X-Assp-Message/IP-Score: 10 (Suspicious HELO - contains
IP('190.40.122.241'):
'client-190.40.122.241.speedy.net.pe')
X-Assp-Message-Score: 20 (Suspicious HELO - contains IP('190.40.122.241'):
'client-190.40.122.241.speedy.net.pe')
X-Assp-Message/IP-Score: 20 (invalid HELO:
'client-190.40.122.241.speedy.net.pe')
X-Assp-Tag: MessageLimit
Mar-9-08 23:57:24 Connected: 190.40.122.241:3422 -> 192.168.1.91:25 ->
192.168.1.91:125
Mar-9-08 23:57:25 id-21445-13021 [SuspiciousHelo][scoring]
190.40.122.241 <[EMAIL PROTECTED]> PB-Message-Score is 10,
added 10 (Suspicious HELO - contains IP('190.40.122.241'):
'client-190.40.122.241.speedy.net.pe')
Mar-9-08 23:57:25 id-21445-13021 190.40.122.241
<[EMAIL PROTECTED]> PB-IP-Score for '190.40.122.0' is 10,
added 10 for IPinHELO
Mar-9-08 23:57:25 id-21445-13021 190.40.122.241
<[EMAIL PROTECTED]> [scoring] (Suspicious HELO - contains
IP('190.40.122.241'): 'client-190.40.122.241.speedy.net.pe')
Mar-9-08 23:57:25 id-21445-13021 190.40.122.241
<[EMAIL PROTECTED]> to: [EMAIL PROTECTED] PB-Message-Score is
30, added 20 (Suspicious HELO - contains IP('190.40.122.241'):
'client-190.40.122.241.speedy.net.pe')
Mar-9-08 23:57:25 id-21445-13021 [InvalidHELO][scoring] 190.40.122.241
<[EMAIL PROTECTED]> to: [EMAIL PROTECTED] scoring (invalid
HELO: 'client-190.40.122.241.speedy.net.pe')
Mar-9-08 23:57:25 id-21445-13021 [InvalidHELO][scoring] 190.40.122.241
<[EMAIL PROTECTED]> to: [EMAIL PROTECTED] PB-Message-Score is
50, added 20 (invalid HELO: 'client-190.40.122.241.speedy.net.pe')
Mar-9-08 23:57:25 id-21445-13021 190.40.122.241
<[EMAIL PROTECTED]> to: [EMAIL PROTECTED] PB-IP-Score for
'190.40.122.0' is 30, added 20 for InvalidHELO
Mar-9-08 23:57:25 id-21445-13021 [MessageLimit] 190.40.122.241
<[EMAIL PROTECTED]> to: [EMAIL PROTECTED] SPAM FOUND
(MessageScore 50, limit 50) -> c:\assp/spam/13021.eml
Mar-9-08 23:57:25 Disconnected: 190.40.122.241
DoPenalty is set to scoring.
--==--
Also, unrelated, but some spaces need to be added in the description for
DoPenaltyMessage, before and after "High MessageLimit".
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
