SPAM got in

[Julian Field]

On Sat24 Jun 06, at 01:49, Arthur Sherman wrote:

> Hi,
>
> See this, he got in:
>
> ---
> Return-Path: <NathanielBassettbm at scientist.com>
> Received: from USER1.8u5wz1e.org (client-190.40.42.185.speedy.net.pe
> [190.40.42.185] (may be forged))
> 	by ns1.cpt.co.il (8.13.1/8.13.1) with ESMTP id k5NKjnUS018089
> 	for <cobalt-list at compros.co.il>; Fri, 23 Jun 2006 23:46:07 +0300
> Message-ID: <89372896837738.77E4499E0B at 9B61SCQJ>
> From: "Logan" <WayneAmes1q at insurer.com>
> To: <cobaltlist at compros.co.il>
> Subject: Hot and new Get a better job
> Date: Fri, 23 Jun 2006 15:44:11 -0500
> MIME-Version: 1.0
> X-Mailer: Microsoft Office Outlook, Build 11.0.5510
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
> Thread-Index: 9Hw8CcbhptlRC9VaY58EHcbN2oa6RmqJGhZm
> Content-Type: text/plain;
>         charset="Windows-1252"
> Content-Transfer-Encoding: 7bit
> X-Virus-Scanned: ClamAV 0.88.2/1562/Fri Jun 23 10:50:07 2006 on
> ns1.cpt.co.il
> X-Virus-Status: Clean
> X-CPTeam-MailScanner-Information: Please contact the C.P.Team for more
> information
> X-CPTeam-MailScanner: Found to be clean
> X-CPTeam-MailScanner-SpamScore: 1
> X-CPTeam-MailScanner-From: nathanielbassettbm at scientist.com
> X-Spam-Status: No
> X-UIDL: X/_!!'O6!!A at V!!I1=!!
> ---
>
> I have RDJ installed with rules as follows:
>
> ---
> TRUSTED_RULESETS="ANTIDRUG SARE_EVILNUMBERS0 SARE_EVILNUMBERS1
> SARE_EVILNUMBERS2 RANDOMVAL BOGUSVIRUS
> SARE_ADULT SARE_FRAUD SARE_BML SARE_RATWARE SARE_SPOOF  
> SARE_BAYES_POISON_NXM
> SARE_OEM SARE_RANDOM
> SARE_HEADER0 SARE_HEADER2 SARE_HEADER3 SARE_HEADER_ENG  
> SARE_HEADER_X264_X30
> SARE_HEADER_X30 SARE_HTML
> SARE_HTML0 SARE_HTML1 SARE_HTML2 SARE_HTML3 SARE_HTML4 SARE_HTML_ENG
> SARE_SPECIFIC SARE_OBFU0
> SARE_OBFU1 SARE_OBFU2 SARE_OBFU3 SARE_REDIRECT SARE_REDIRECT_POST300
> SARE_SPAMCOP_TOP200 SARE_GENLSUBJ0
> SARE_GENLSUBJ1 SARE_GENLSUBJ2 SARE_GENLSUBJ3 SARE_GENLSUBJ_X30
> SARE_GENLSUBJ_ENG SARE_HIGHRISK SARE_UNSUB SARE_URI0 SARE_URI1
> SARE_URI2 SARE_URI3 SARE_URI_ENG SARE_WHITELIST";
> ---
>
> Why it got in?

Start by setting
Always Include SpamAssassin Report = yes
so you get to see what rules hit, otherwise you only get to see the  
report when it reaches the spam score threshold. I don't recommending  
setting this to yes in production settings, but it is very useful  
when debugging.

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.