I have been seeing a weird one; At the top of my personal filter file I
have:
--
# Exim filter
if $header_x-spam-flag: matches "YES"
then
save $home/.SPAM/
endif
...
--
Now, 99% of the crap is saved in my SPAM folder, but some of the mail that
matches the rule later:
--
if $header_to: matches "people@???" or
$header_cc: matches "people@???"
then
save $home/.kml.people@knowledge-com/
endif
--
and is saved in that folder *as well*. The above address is
redundent and I will be dumping it, but I would like to understand what is
happening in this case.
The logs say (sorry about word wrap):
2004-03-17 09:40:53 1B3XXZ-0002l5-00 <= wxxhyz935128@??? U=_exim
P=spam-scanned S=6371 id=204tza330y-v0r@???
T="\242\300\304\253\265\345\260\252 \264\353\303\342\267\316
\307\330\260\341\307\317\260\35536\260\263\277\371\272\320\310\260\273\363\3
10\257,5\303\265\270\270\277\370\261\356\301\366!!! lps cpxx" from
<wxxhyz935128@???> for peter.galbavy@???
2004-03-17 09:40:53 1B3XXZ-0002l5-00 =>
/var/mail/knowtion.net/peter.galbavy/.kml.people@knowledge-com/
<peter.galbavy@???> F=<wxxhyz935128@???> D=userforward
T=address_directory
2004-03-17 09:40:54 1B3XXZ-0002l5-00 =>
/var/mail/knowtion.net/peter.galbavy/.SPAM/ <peter.galbavy@???>
F=<wxxhyz935128@???> D=userforward T=address_directory
2004-03-17 09:40:54 1B3XXZ-0002l5-00 Completed
The complete header (generated from SpamAssassin) is below.
It doesn't appear to happen to other filtered mail, but I am concerned that
I am missing something obvious ?
rgds,
--
Peter
>From wxxhyz935128@??? Wed Mar 17 09:40:53 2004
Return-path: <wxxhyz935128@???>
Envelope-to: peter.galbavy@???
Delivery-date: Wed, 17 Mar 2004 09:40:53 +0000
Received: from _exim by mailstore-2.mail.knowtion.net with spam-scanned
(Exim 3.36 #1)
id 1B3XXZ-0002l5-00
for peter.galbavy@???; Wed, 17 Mar 2004 09:40:53 +0000
Received: from localhost by dopey.london.knowtion.net
with SpamAssassin (2.63 2004-01-11);
Wed, 17 Mar 2004 09:40:53 +0000
From: "´ëÃâ" <wxxhyz935128@???>
To: people@???
Subject: ¢ÀÄ«µå°ª ´ëÃâ·Î ÇØ°áÇÏ°í36°³¿ùºÐÈ°»óȯ,5õ¸¸¿ø±îÁö!!! lps cpxx
Date: Wed, 17 Mar 04 10:34:29 GMT
Message-Id: <204tza330y-v0r@???>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
dopey.london.knowtion.net
X-Spam-Level: *****************************
X-Spam-Status: Yes, hits=29.7 required=5.0 tests=BAYES_90,DATE_SPAMWARE_Y2K,
FORGED_HOTMAIL_RCVD2,FORGED_MUA_OUTLOOK,FORGED_RCVD_NET_HELO,
FROM_ENDS_IN_NUMS,FROM_WEBMAIL_END_NUMS6,HTML_IMAGE_ONLY_02,
HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MISSING_MIMEOLE,
NORMAL_HTTP_TO_IP,PLING_PLING,RCVD_NUMERIC_HELO,SUBJ_ILLEGAL_CHARS
autolearn=no version=2.63
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_40581D25.23914B42"
