I cannot understand why this is reported as BombSrcipt spam, because
@klein-klein-verlag.de is a whitelisted domain and therefore should not be
checked against Regex/Bombs
NotGreedyWhitelist, bombReWL, bombReNP, bombReLocal are all OFF!
bombReISPIP is ON but the sender ip 85.114.141.202 is not in ISPIP list
I could list 85.114.141.202 in noProcessingIPs but this would be just a
workaround.
From: "klein-klein-verlag Newsletter" <newslet...@klein-klein-verlag.de>
Reply-To: <newslet...@klein-klein-verlag.de>
Date: Sun, 21 Feb 2010 01:14:16 +0100
Message-ID: <e29f55cb576e9296cf192d6a037b8...@localhost>
Status: N
X-SWM-BOUNCE: 01_02_04_0D
Content-Type: multipart/related;
boundary="----=_NextPart_000_DADF_2BAB04A3.4A3F0B47"
X-Assp-Delay: "u...@ourdomain.com" was delayed for 7m 22s;
21 Feb 2010 01:14:52 +0100
X-Assp-Score: 10 (Message-ID not valid:
'<e29f55cb576e9296cf192d6a037b8...@localhost>')
X-Assp-Re-scriptRe: <script
X-Assp-Score: 20 (BombScript '<script')
X-Assp-Envelope-From: anonym...@srv01.lin.level-h.de
X-Assp-Version: 1.6.5.0(1.0.02)
X-Assp-ID: "assp.ourdomain.com" (id-11292-24973)
X-Assp-Spam: Yes
X-Assp-Spam-Reason: BombScript '<script'
X-Assp-Message-Totalscore: 30
X-Assp-Intended-For: "u...@ourdomain.com"
X-Assp-Copy-Spam: Yes
Return-Path: anonym...@srv01.lin.level-h.de
The logs for that mail (ASSP 1.6.5.0(1.0.02))
Jan-21-10 19:26:22 id-98381-02419 [BombHeader] 85.114.141.202
<anonym...@srv01.lin.level-h.de> to: u...@ourdomain.com Whitelisted Domain:
@klein-klein-verlag.de;
Jan-21-10 19:26:22 id-98381-02419 85.114.141.202
<anonym...@srv01.lin.level-h.de> to: u...@ourdomain.com score 20 Regex:scriptRe
'<script';
Jan-21-10 19:26:22 id-98381-02419 [BombScript] 85.114.141.202
<anonym...@srv01.lin.level-h.de> to: u...@ourdoamin [spam found] -- BombScript
'<script' -- [.....subject.....] -> discarded/2419.eml;
The logs for such a mail from an elder ASSP 1.6.1.4(0.0.06)
Jan-12-10 18:28:02 id-17282-27738 85.114.141.202
<newslet...@klein-klein-verlag.de> Regex:whiteListedDomains
'@klein-klein-verlag.de';
Jan-12-10 18:28:02 LDAP - found u...@ourdomain.com in LDAPlist;
Jan-12-10 18:28:03 id-17282-27738 [SuspiciousHeloRe] 85.114.141.202
<newslet...@klein-klein-verlag.de> to: u...@ourdomain.com Whitelisted Domain:
@klein-klein-verlag.de;
Jan-12-10 18:28:03 id-17282-27738 85.114.141.202
<newslet...@klein-klein-verlag.de> to: u...@ourdomain.com ClamAV: scanned 21260
bytes in whitelisted message - OK ;
Jan-12-10 18:28:03 id-17282-27738 [Whitelisted] 85.114.141.202
<newslet...@klein-klein-verlag.de> to: u...@ourdomain.com whitelisted --
Whitelisted Domain: @klein-klein-verlag.de -- [.....subject.....] ->
notspam/27738.eml;
Th. Klein
Admin
------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
