host mx1.res.cisco.com
mx1.res.cisco.com has address 208.90.57.13
$ host 208.90.57.13
13.57.90.208.in-addr.arpa domain name pointer mx1.res.cisco.com.
looks fine to me, why does this look to SA like a dynamic ip?
(TRIGGERED RDNS_DYNAMIC.)
what, because of 'res' in it? yes, they SHOUTED AT THE RECIPIENT, AND I
EXPLAINED DON'T DO THAT IN SUBJECT LINE, its rude.
sorry, sender, receiver are all confidential, but here is a debug:
(network and bayes tests pushed it past 5.0)
__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__CT,__CTYPE_HAS_BOUNDARY,
__CTYPE_MULTIPART,__CTYPE_MULTIPART_ANY,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,
__DOS_LINK,__DOS_RCVD_THU,__DOS_RELAYED_EXT,__ENV_AND_HDR_FROM_MATCH,__FORGED_RCVD_TRAIL,
__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_DATE,__HAS_MESSAGE_ID,__HAS_MSGID,__HAS_RCVD,__HAS_SUBJECT,
__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LOCAL_PP_NONPPURL,__MANY_RECIPS
,__MIME_ATTACHMENT,__MIME_BASE64,__MIME_CTYPE_TEXT,__MIME_HTML,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY
__MSGID_JAVAMAIL,__MSGID_OK_DIGITS,__NONEMPTY_BODY,__NO_REAL_NAME,__PART_STOCK_CD_F,
*__RCD_RDNS_MX_MESSY,__RDNS_INDICATOR_RES,*__SANE_MSGID,
__SENDER_BOT,__SUBSCRIPTION_INFO,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,
__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS,__TO_EQ_FROM_DOM,
__TO_EQ_FROM_DOM_1,__TO_NO_ARROWS_R,__TVD_MIME_ATT_TP
Content analysis details: (3.0 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.0 RELAY_COUNTRY_US Relayed through United States
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 HTML_MESSAGE BODY: HTML included in message
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS
1.0 NO_REAL_NAME NO_REAL_NAME
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best in Email Security,2010: Network Products Guide
* King of Spam Filters, SC Magazine 2008
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
