Hi;
It seems like that
the HEADERS tag does not trigger on Recipients. Or may be it does but in
this case it was not (somehow) detected.
The X-Note:
Recipient(s): shows two emails (materials & material) that are listed
in our filter file with scores of 10. This SPAM should have had at least a
score of 20. But it seems like it did not see any of the
addresses.
It makes sense
since X-Note is added after Declude is done with the work, therefore it is not
being seen by HEADERS.
Is there anyway to
detect the TO field in this case with HEADERS?
Regards,
Kami
================== HEADER
======================================
Received: from rainer.bnt.com [12.4.218.18] by
mail.durability.com with ESMTP
(SMTPD32-7.12) id A8318760088; Thu, 22 Aug 2002 05:00:33 -0400
Received: from avocet.mail.pas.earthlink.net (avocet.mail.pas.earthlink.net [207.217.120.50])
by rainer.bnt.com (8.12.3/8.12.3) with ESMTP id g7M8x3VM087894;
Thu, 22 Aug 2002 04:59:05 -0400 (EDT)
(envelope-from [EMAIL PROTECTED])
Received: from 1cust38.tnt73.nyc3.da.uu.net ([63.16.15.38] helo=ehlo)
by avocet.mail.pas.earthlink.net with smtp (Exim 3.33 #1)
id 17hnnD-000054-00; Thu, 22 Aug 2002 01:58:15 -0700
From: [EMAIL PROTECTED]
To:
Subject: ...
Date: Wed, 21 Aug 2002 23:19:05 -0700
X-Priority: 3
X-MSMail-Priority: Normal
Errors-To: [EMAIL PROTECTED]
X-Mailer: Juno Exchange Mail Server 3.9.600.000
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: WEIGHT10: Weight of 11 reaches or exceeds the limit of 10.
X-RBL-Warning: HEUR10: Heuristic spam detection level 10 [1.000000]
X-RBL-Warning: BLARS: This E-mail came from 207.217.120.50, a potential spam source listed in BLARS.
X-Declude-Sender: [EMAIL PROTECTED] [207.217.120.50]
X-Declude-Spoolname: Da83108760088e74c.SMD
X-Note: This E-mail was scanned by Declude (www.declude.com) for spam & virus.
X-Note: This E-mail was filtered for SPAM keywords.
X-Spam-Tests-Failed: WEIGHT10, HEUR10, BLARS
X-Weight: 11
X-Note: This E-mail was sent from avocet.mail.pas.earthlink.net. ([207.217.120.50]).
X-Note: Recipient(s): [EMAIL PROTECTED], material@durability.com, [EMAIL PROTECTED]
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 329878913
====================================================================
(SMTPD32-7.12) id A8318760088; Thu, 22 Aug 2002 05:00:33 -0400
Received: from avocet.mail.pas.earthlink.net (avocet.mail.pas.earthlink.net [207.217.120.50])
by rainer.bnt.com (8.12.3/8.12.3) with ESMTP id g7M8x3VM087894;
Thu, 22 Aug 2002 04:59:05 -0400 (EDT)
(envelope-from [EMAIL PROTECTED])
Received: from 1cust38.tnt73.nyc3.da.uu.net ([63.16.15.38] helo=ehlo)
by avocet.mail.pas.earthlink.net with smtp (Exim 3.33 #1)
id 17hnnD-000054-00; Thu, 22 Aug 2002 01:58:15 -0700
From: [EMAIL PROTECTED]
To:
Subject: ...
Date: Wed, 21 Aug 2002 23:19:05 -0700
X-Priority: 3
X-MSMail-Priority: Normal
Errors-To: [EMAIL PROTECTED]
X-Mailer: Juno Exchange Mail Server 3.9.600.000
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: WEIGHT10: Weight of 11 reaches or exceeds the limit of 10.
X-RBL-Warning: HEUR10: Heuristic spam detection level 10 [1.000000]
X-RBL-Warning: BLARS: This E-mail came from 207.217.120.50, a potential spam source listed in BLARS.
X-Declude-Sender: [EMAIL PROTECTED] [207.217.120.50]
X-Declude-Spoolname: Da83108760088e74c.SMD
X-Note: This E-mail was scanned by Declude (www.declude.com) for spam & virus.
X-Note: This E-mail was filtered for SPAM keywords.
X-Spam-Tests-Failed: WEIGHT10, HEUR10, BLARS
X-Weight: 11
X-Note: This E-mail was sent from avocet.mail.pas.earthlink.net. ([207.217.120.50]).
X-Note: Recipient(s): [EMAIL PROTECTED], material@durability.com, [EMAIL PROTECTED]
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 329878913
====================================================================
