Spam deletion rules not working

[MZRascoff]

The email below had a spam score of 17.6. I have my spam rules set to automatically, silently delete any message with a score over 10. How did this one get through?

Matthew


Return-Path: < DELETED FOR PRIVACY>
Received: from compute1.internal (compute1.internal [10.202.2.41])
by store27m.internal (Cyrus v2.3.8-fmsvn12377) with LMTPA;
Fri, 27 Jul 2007 09:43:07 -0400
X-Sieve: CMU Sieve 2.3
Subject: {SPAM 17.6} Be a Secret Shopper at your favorite store
X-Spam: high
X-Spam-score: 17.6
X-Spam-hits: BAYES_50 0.001, DCC_CHECK 2.5, DNS_FROM_AHBL_RHSBL 0.692,
FB_INDEPEND_RWD 3.595, MIME_QP_LONG_LINE 1.396, SPF_HELO_PASS -0.001,
SPF_PASS -0.001, URIBL_BLACK 1.955, URIBL_JP_SURBL 1.501,
URIBL_OB_SURBL 1.5, URIBL_SBL 1.499, URIBL_WS_SURBL 1.5,
WHOIS_PRIVPROT 1.501, BAYES_USED global
X-Spam-source: IP='69.6.10.152', Country='US', FromHeader='net', MailFrom='net'
X-Resolved-to: DELETED FOR PRIVACY
X-Delivered-to: DELETED FOR PRIVACY
X-Mail-from: DELETED FOR PRIVACY
Received: from 152.mx02.net (152.mx02.net [69.6.10.152])
by mx2.messagingengine.com (Postfix) with ESMTP id 060581E0788
for < DELETED FOR PRIVACY>; Fri, 27 Jul 2007 09:43:05 -0400 (EDT)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=mx02; d=mx02.net;
b=i34riic8PVkIdNdpqKvS5pWTXaYfJz8R0yhD+8FyxZUbrVRJOg7vphiLHeRIn9fugYdcfCA7xaU7b4hY+c81p+vVd183eNtc17WWR1/6ddPL+Kd7PCOxkSWivjTrujKh;
Received: (from daemon@localhost)
by 152.mx02.net (8.8.8/8.8.8) id HAA18053;
Fri, 27 Jul 2007 07:30:59 -0600 (MDT)
Date: Fri, 27 Jul 2007 07:41:04 -0600 (MDT)
Message-Id: <200707271330.HAA18053@152.mx02.net>
From: Removed To: DELETED FOR PRIVACY
X-Spam-orig-subject: Be a Secret Shopper at your favorite store
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable Text view
Print view
Raw view

[Moderator:] Full spam message removed. Please read the forum rules again.
Especially the section on "Spam Issues - What can and can't be discussed". Thank you.

[n5bb]

First, I suggest that you delete all of your post after the " X-Spam-source:" header. I don't think that the forum administrators like the body of spam messages being posted here.

I can tell from the headers that the message wasn't whitelisted, but did have a spam score of 17.6. So a discard rule with a limit of 10 should have blocked it.

Can you please go to the bottom of the Rules screen, look at your Sieve script, and post it here? Please munge (modify) any email addresses or other items you don't want public. The best method to post Sieve code here is to place it inside Code wrappers (# control). One way to do this is to click in the Fastmail Sieve Script Source window, hit CTL-A, hit CTL-C, then change to another window browsing in this forum, and after selecting the # control place your cursor between the CODE /CODE tags and hit CTL-V (paste). Then munge (edit) the email addresses, etc.

I think something must be wrong with your Sieve script (even if you are using automatic rules).

Bill

[MZRascoff]

Originally Posted by n5bb

First, I suggest that you delete all of your post after the " X-Spam-source:" header. I don't think that the forum administrators like the body of spam messages being posted here.

I can tell from the headers that the message wasn't whitelisted, but did have a spam score of 17.6. So a discard rule with a limit of 10 should have blocked it.

Can you please go to the bottom of the Rules screen, look at your Sieve script, and post it here? Please munge (modify) any email addresses or other items you don't want public. The best method to post Sieve code here is to place it inside Code wrappers (# control). One way to do this is to click in the Fastmail Sieve Script Source window, hit CTL-A, hit CTL-C, then change to another window browsing in this forum, and after selecting the # control place your cursor between the CODE /CODE tags and hit CTL-V (paste). Then munge (edit) the email addresses, etc.

I think something must be wrong with your Sieve script (even if you are using automatic rules).

Bill

Hi there,
Thanks for writing back to me. My munged rules are here.

http://rascoff.com/sieve_code.rtf

They are based on the automatic screens - I don't know my way around sieve. I pasted a link because there were too many characters to post directly to this forum.

Wow, that was a lot of munging.

I appreciate your help in diagnosing this problem!
Matthew

[zhak]

if not header :contains ["to", "cc", "subject"] "secret" {

If your 'secret word' really is 'secret' (and not munged), it matched the subject of the spam message.

-Jim

[MZRascoff]

Mystery solved. Thank you. I have changed my secret word.

These forums are amazing!
Matthew