On Wed, Jan 09, 2008 at 04:29:01PM +0000, UxBoD wrote: > Ran the same on my installation and all appears the same to me. Hmmmm, very > odd, do you have a email in your quarantine that got tagged before which you > could pass through again to test ?
Hmmm.. Good idea...
Headers from:
1) Original message rescanned using current configuration (SA 3.2.3)
2) Original message as scanned at the time (SA 3.2.2)
What do you think?
Thanks for all your help
AD
1) CURRENT OUTPUT
================
From [EMAIL PROTECTED] Sun Oct 28 20:00:02 2007
Return-Path: <[EMAIL PROTECTED]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on mydomain.com
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.8 required=4.5 tests=ANY_BOUNCE_MESSAGE,AWL,
BAYES_99,BOUNCE_MESSAGE,MIME_BOUND_DIGITS_15,RDNS_NONE autolearn=no
version=3.2.3
X-Spam-Report:
* 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 2.9 MIME_BOUND_DIGITS_15 Spam tool pattern in MIME boundary
* 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
* 0.1 BOUNCE_MESSAGE MTA bounce message
* 0.1 ANY_BOUNCE_MESSAGE Message is some kind of bounce message
* 1.1 AWL AWL: From: address is in the auto white-list
Received: from mydomain.com (localhost.localdomain [127.0.0.1])
by mydomain.com (8.14.1/8.14.1) with ESMTP id l9SK02sv006067
for <[EMAIL PROTECTED]>; Sun, 28 Oct 2007 20:00:02 GMT
Received: from pop3.mail.demon.net [194.217.242.253]
by mydomain.com with POP3 (fetchmail-6.3.6)
for <[EMAIL PROTECTED]> (single-drop); Sun, 28 Oct 2007 20:00:02 +0000
(GMT)
Received: from punt3.mail.demon.net by mailstore
for [EMAIL PROTECTED] id 1ImEI0-2wQknw-02-9z1;
Sun, 28 Oct 2007 19:59:16 +0000
Received: from [194.217.242.223] (lhlo=lon1-hub.mail.demon.net)
by punt3.mail.demon.net with lmtp id 1ImEI0-2wQknw-02
for [EMAIL PROTECTED]; Sun, 28 Oct 2007 19:59:16 +0000
Received: from [211.115.216.222] (helo=mail-kr.bigfoot.com)
by lon1-hub.mail.demon.net with smtp id 1ImEI0-0006nw-8M
for [EMAIL PROTECTED]; Sun, 28 Oct 2007 19:59:16 +0000
Date: Sun, 28 Oct 2007 15:59:42 -0400
From: Mail Delivery Subsystem <[EMAIL PROTECTED]>
Message-Id:
<[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="200710281542345"
Subject: [SPAM (7.8)] Returned mail: Requested action not taken: mailbox
unavailable
Auto-Submitted: auto-generated (failure)
Status: RO
Content-Length: 1848
Lines: 54
X-Spam-Prev-Subject: Returned mail: Requested action not taken: mailbox
unavailable
This is a MIME-encapsulated message
--200710281542345
The original message was received at Sun, 28 Oct 2007 15:59:01 -0400 EST
from host237-146-dynamic.26-79-r.retail.telecomitalia.it [79.26.145.225]
[Snip.....]
2) PREVIOUS OUTPUT
=================
From [EMAIL PROTECTED] Sun Oct 28 20:00:02 2007
Return-Path: <[EMAIL PROTECTED]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.2 (2007-07-23) on mydomain.com
X-Spam-Level: ***********
X-Spam-Status: Yes, score=11.1 required=5.0 tests=ANY_BOUNCE_MESSAGE,BAYES_95,
BOTNET,BOTNET_NORDNS,BOUNCE_MESSAGE,MIME_BOUND_DIGITS_15 autolearn=no
version=3.2.2
X-Spam-Report:
* 2.9 MIME_BOUND_DIGITS_15 Spam tool pattern in MIME boundary
* 5.0 BOTNET Relay might be a spambot or virusbot
* [botnet0.8,ip=194.217.242.223,maildomain=mydomain.com,nordns]
* 0.0 BOTNET_NORDNS Relay's IP address has no PTR record
* [botnet_nordns,ip=194.217.242.223]
* 3.0 BAYES_95 BODY: Bayesian spam probability is 95 to 99%
* [score: 0.9865]
* 0.1 BOUNCE_MESSAGE MTA bounce message
* 0.1 ANY_BOUNCE_MESSAGE Message is some kind of bounce message
Received: from mydomain.com (localhost.localdomain [127.0.0.1])
by mydomain.com (8.14.1/8.14.1) with ESMTP id l9SK02sv006067
for <[EMAIL PROTECTED]>; Sun, 28 Oct 2007 20:00:02 GMT
Received: from pop3.mail.demon.net [194.217.242.253]
by mydomain.com with POP3 (fetchmail-6.3.6)
for <[EMAIL PROTECTED]> (single-drop); Sun, 28 Oct 2007 20:00:02 +0000
(GMT)
Received: from punt3.mail.demon.net by mailstore
for [EMAIL PROTECTED] id 1ImEI0-2wQknw-02-9z1;
Sun, 28 Oct 2007 19:59:16 +0000
Received: from [194.217.242.223] (lhlo=lon1-hub.mail.demon.net)
by punt3.mail.demon.net with lmtp id 1ImEI0-2wQknw-02
for [EMAIL PROTECTED]; Sun, 28 Oct 2007 19:59:16 +0000
Received: from [211.115.216.222] (helo=mail-kr.bigfoot.com)
by lon1-hub.mail.demon.net with smtp id 1ImEI0-0006nw-8M
for [EMAIL PROTECTED]; Sun, 28 Oct 2007 19:59:16 +0000
Date: Sun, 28 Oct 2007 15:59:42 -0400
From: Mail Delivery Subsystem <[EMAIL PROTECTED]>
Message-Id:
<[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="200710281542345"
Subject: [SPAM (11.1)] Returned mail: Requested action not taken: mailbox
unavailable
Auto-Submitted: auto-generated (failure)
X-Spam-Prev-Subject: Returned mail: Requested action not taken: mailbox
unavailable
X-UID: 1905
Status: RO
Content-Length: 1848
Lines: 54
This is a MIME-encapsulated message
--200710281542345
The original message was received at Sun, 28 Oct 2007 15:59:01 -0400 EST
from host237-146-dynamic.26-79-r.retail.telecomitalia.it [79.26.145.225]
[Snip.....]
pgp7is1z3UIpa.pgp
Description: PGP signature
