On Mon, 25 Aug 2014, Reindl Harald wrote:
the plain content i attached as ZIP (what made it to the listg) is used for testing by just copy the content to a formmailer or in a new plaintext message in TB point directly to the test MX
The massage body by itself usually isn't enough to tell much. Looking at it, it's obviously a 419 spam, and your rule hits support that.
When troubleshooting stuff, we generally need the complete message including all the original headers, saved as an RFC-822-format text file.
In this case the question isn't "why aren't rules hitting", it's "why are the rules now scoring less?" - the same rules are hitting now as were before the update. Karsten covered that - masscheck ties to ensure spams score at least 5 points, but doesn't care beyond that.
-- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- The first time I saw a bagpipe, I thought the player was torturing an octopus. I was amazed they could scream so loudly. -- cat_herder_5263 on Y! SCOX ----------------------------------------------------------------------- Today: the 1935th anniversary of the destruction of Pompeii
