David,
I would verify that the Declude logs show these messages. If it is the
issue with formatting, then Declude should still be logging them. My
guess is that this didn't fail enough tests to trigger HOLD, DELETE or
ROUTETO on your system, and due to the headers probably appearing in
the body of the message, it doesn't look like it is scanned. This of
course came up last week again. It seems like the bug is
long-standing, but the spammers are failing it more often.
Matt
David Dodell wrote:
John,
good point, didn't "catch" that ... yep, Declude is missing them all
... <grrr>
-----Original Message-----
From: "John Carter" <[EMAIL PROTECTED]>
Sent 3/11/2006 10:25:47 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Why Are these Messages Not being
scanned?
This may not be the problem, but I don't remember seeing TO, FROM etc
lines appearing before the "Received: from" line, except in msgs sent
internal to Imail. Every header I've seen started with Received:. (I
guess it can happen. Does here.) Could this be a case of broken
client/headers messing up Declude??
John C
---------- Original Message ----------------------------------
From: David Dodell
Reply-To: Declude.JunkMail@declude.com
Date: Sat, 11 Mar 2006 10:05:11 -0700
>For several days I've been getting spam from several ip's basically
>all looking the same in the headers and body, except for the
received
>IP address.
>
>What I can't figure out, why is it not being scanned by Declude. I
>normally see in all of my message headers, the declude scan
>information ... but these emails are not being caught ...
>
>Any ideas?
>
>David
>
>---------
>
>
>
>
>
>
>From: [EMAIL PROTECTED]
> Subject: We cure any desease!
> Date: March 11, 2006 2:53:00 AM MST
> To: [EMAIL PROTECTED]
> Received: from friend [24.225.247.213] by stat.com with ESMTP
>(SMTPD-9.02) id A0681218; Sat, 11 Mar 2006 09:52:56 -0700
> Message-Id: <[EMAIL PROTECTED]>
> Mime-Version: 1.0
> Content-Type: multipart/related; type="multipart/alternative";
>boundary="------------ms080207070102060004090406"
> X-Priority: 3
> X-Msmail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2900.2180
> X-Mimeole: Produced By Microsoft MimeOLE V6.00.2900.2180
>---
>This E-mail came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail". The archives can be found
>at http://www.mail-archive.com.
>
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
|
