I noticed a couple of other things here:
The message was probably sent to you with BCC's to the other people.
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a
fortune, mseagroves!
Here is ^^^^^^^^^^ is your login name
1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables:
5 penalty points added.
Here ^^ is why the 5 points was added to yours and not the others. Your login
name was used in the message subject to make it look 'personal'.
Maybe you should send me your NOXMAIL.NOX file so I can have a look-see.
-Brian
On 01/28/03 3:09pm you wrote...
>Brian,
>
>Since last Thurs or so, noxmail seems to be allowing some adult & spam
>e-mails to go through. I received a couple of calls from users on Friday
>that they had received some porn e-mails. I double-checked all settings on
>Sat and finally stopped/restarted the IMail SMTP service. This seemed to
>fix the problem for the moment. However, yesterday I saw some more
>adult/spam messages slip through and I rebooted our e-mail server, again
>after checking everything first. That seemed to cause the filtering to
>work properly again. This morning, I thought I saw some more e-mails slip
>through but I sent myself a couple (one "adult" and one "spam") from an
>off-campus address and they were filtered correctly. I currently have all
>adult & spam e-mail sent to a spam account. This account is getting
>messages but some are apparently still slipping through. I just received a
>spam e-mail from e-bay. Below are the spam e-mail header and log snippet
>from noxmail. I can send you the .nox config file or other files if
>needed. I currently have ROUTEADULTSCORE and ROUTESPAMCORE set to 30 to
>the e-bay message should have been routed. The spam mailbox did catch this
>same e-mail to 7 other recipients (however, the total weight was 40 instead
>of 45).
>
>Any suggestions?
>
>Thanks.
>
>Mark
>
>
>NOXMAIL log snippet:
>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD (OUT) [FAILED SPAM] Scores -
>Adult: 0 (Req: 18) Spam: 45 (Req: 18) ExitCode: 45 (Req: 20)
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG TO: <[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - ENV TO: <[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG FROM:
><[EMAIL PROTECTED]>
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - MSG SUBJECT: Don't spend a
>fortune, mseagroves!
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Excessive Routing: 3 penalty
>points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Return address consistent
>with SPAM: 1 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Subject contains variables:
>5 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Found 53 embedded image
>links: 14 penalty points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg obfuscation: 12 penalty
>points added.
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD -
>Matched: (#Spam)MARKETING(2*2) (Spam){UNSUBSCRIBE&SUBJECT}(1*6)
>1/28/2003 2:30:44 PM - Dda50019700ce4425.SMD - Msg processed in: 429ms -
>Msg Size: 19300 bytes
>
>
>
>
>Mail Header:
>
>To: [EMAIL PROTECTED]
>Subject: [S] Don't spend a fortune, mseagroves!
>From: "eBay" <[EMAIL PROTECTED]>
>Date: Tue, 28 Jan 2003 11:29:04 -0800
>Reply-To: "eBay" <[EMAIL PROTECTED]>
>X-CYBERsitter-NoXMail: FAILED - Score Adult: 0 (Req: 18) Spam: 45 (Req: 18)
>Tot: 45 (Req: 20)
>X-CYBERsitter-SpoolFile: Dda50019700ce4425.SMD
>X-CYBERsitter-Sender: [EMAIL PROTECTED] [10.1.1.10]
>X-RBL-Warning: HELOBOGUS: Domain CNCFWblue.cn.edu has no MX or A records.
>X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
>[4000020e].
>X-RBL-Warning: WEIGHT10: Weight of 21 reaches or exceeds the limit of 10.
>X-RBL-Warning: WEIGHT20: Weight of 21 reaches or exceeds the limit of 20.
>X-Declude-Sender: [EMAIL PROTECTED] [10.1.1.10]
>X-Declude-Spoolname: Dda50019700ce4425.SMD
>X-Note: This E-mail was scanned for spam.
>X-Spam-Tests-Failed: HELOBOGUS, IPNOTINMX, SPAMHEADERS, WEIGHT10, WEIGHT20,
>CYBERSITTER
>X-Note: This E-mail was sent from (Private IP) ([10.1.1.10]).
>X-RCPT-TO: <[EMAIL PROTECTED]>
>
>
>
>Mark Seagroves voice: (865) 471-3506
>Dir, Campus Computing fax: (865) 471-3555
>Asst Prof, Computer Science e-mail: [EMAIL PROTECTED]
>Carson-Newman College
>
>
>
---
[This E-mail scanned for viruses by Solid Oak Software]
Archives: http://www.mail-archive.com/nox-list%40mail.noxmail.com/
Removal address: [EMAIL PROTECTED]
