Re: [Declude.JunkMail] Blacklist one Country for one Domain
agreed about the body but chances are that and end user is going to base their filtering request on what they see in the body and in the case of .cz the chances of something matching that other than an email address or url are slim This is concerning order number 213.97.czae.42 Daddy, i learnedto typetheis toy.czyou today Dear Client - We have blocked everything with a country domain of .cz You never can tell what will happen. I didn't realize that the popular male drug name was in the word speCIALISt until we advertised a Security Specialist position. :) Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blacklist one Country for one Domain
heh i learned the hard way with specialist as well dont forget that declude will honor the space at the end of a filtering string, .czspace should have been used... learned the hard way on that to :-) Rick Davidson National Systems Manager North American Title Group - - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, June 11, 2004 10:40 AM Subject: Re: [Declude.JunkMail] Blacklist one Country for one Domain agreed about the body but chances are that and end user is going to base their filtering request on what they see in the body and in the case of .cz the chances of something matching that other than an email address or url are slim This is concerning order number 213.97.czae.42 Daddy, i learnedto typetheis toy.czyou today Dear Client - We have blocked everything with a country domain of .cz You never can tell what will happen. I didn't realize that the popular male drug name was in the word speCIALISt until we advertised a Security Specialist position. :) Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blacklist one Country for one Domain
I would focus on the mailfrom test, chances are the spam your client is complaining about did actually come from the country cz but definately nail it with the country test if thats what they want. you could even add a filter like anywhere 50 contains .cz (with a space after the .cz) anywhere 50 contains .cz Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Goran Jovanovic [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 09, 2004 11:01 AM Subject: [Declude.JunkMail] Blacklist one Country for one Domain Hi, I have a client who sent this to me today Please blacklist anything that has a .cz in the address line So the way that I see doing this is a filter with the following. ALLRECIPS END NOTCONTAINS @domain.com COUNTRIES 50 CONTAINS CZ MAILFROM50ENDSWITH .cz My questions: Is this the best way? COUNTRIES and not COUNTRY will check every mail hop? And the biggest question will this do what the client wants? Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist one Country for one Domain
Please blacklist anything that has a .cz in the address line COUNTRIES doesn't look at the address line as your customer asked for. It will filter if any IP-Address the contained in the mail header is assigned to the Czech republic. Why not use something like MAILFROM50 ENDSWITH .cz What about other customers that want mail from the Czech republic? I consider to create a separate filter file (FILTER-CUSTOMERNAME) In this filter file put MAILFROM0 ENDSWITH .cz Then create a .junkmail action file for this customer and set FILTER-CUSTOMERNAME HOLD Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist one Country for one Domain
Markus, I want to avail HOLD actions as much as possible (that way there is less work for me :) ALLRECIPS END NOTCONTAINS @domain.com MAILFROM50ENDSWITH .cz They way I understand a filter file is that is it applied and scored against every e-mail message that comes in. So for the other domains in the system I want to allow or not penalize .cz mail. That is why I thought I would use the first line to exit the filter unless it is specifically for the domain in question. Now with the MAILFROM it will get an email message what ends with .cz Or maybe I should use (Rick's suggestion) ANYWHERE 50 CONTAINS .cz MAILFROM 50 CONTAINS .cz with the ANYWHERE line containing a training space. I was wondering if the filter approach is the best approach or is there another way to do this? I am thinking something like a blacklist but I am not sure how that would work?? Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Wednesday, June 09, 2004 11:33 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain Please blacklist anything that has a .cz in the address line COUNTRIES doesn't look at the address line as your customer asked for. It will filter if any IP-Address the contained in the mail header is assigned to the Czech republic. Why not use something like MAILFROM 50 ENDSWITH .cz What about other customers that want mail from the Czech republic? I consider to create a separate filter file (FILTER-CUSTOMERNAME) In this filter file put MAILFROM 0 ENDSWITH .cz Then create a .junkmail action file for this customer and set FILTER-CUSTOMERNAME HOLD Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist one Country for one Domain
I'd avoid the ANYWHERE filter if possible. Perhaps replace it with HEADERS if that's what you want. The anywhere will include the body, and those short matches on the body seem to match on strange things in attachments and such a little too often for me. Also ANYWHERE will be pretty CPU intensive compared to HEADERS or MAILFROM. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 06/09/04 10:50AM Markus, I want to avail HOLD actions as much as possible (that way there is less work for me :) ALLRECIPS END NOTCONTAINS @domain.com MAILFROM50ENDSWITH .cz They way I understand a filter file is that is it applied and scored against every e-mail message that comes in. So for the other domains in the system I want to allow or not penalize .cz mail. That is why I thought I would use the first line to exit the filter unless it is specifically for the domain in question. Now with the MAILFROM it will get an email message what ends with .cz Or maybe I should use (Rick's suggestion) ANYWHERE 50 CONTAINS .cz MAILFROM 50 CONTAINS .cz with the ANYWHERE line containing a training space. I was wondering if the filter approach is the best approach or is there another way to do this? I am thinking something like a blacklist but I am not sure how that would work?? Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Wednesday, June 09, 2004 11:33 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain Please blacklist anything that has a .cz in the address line COUNTRIES doesn't look at the address line as your customer asked for. It will filter if any IP-Address the contained in the mail header is assigned to the Czech republic. Why not use something like MAILFROM 50 ENDSWITH .cz What about other customers that want mail from the Czech republic? I consider to create a separate filter file (FILTER-CUSTOMERNAME) In this filter file put MAILFROM 0 ENDSWITH .cz Then create a .junkmail action file for this customer and set FILTER-CUSTOMERNAME HOLD Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Blacklist one Country for one Domain
Thank you all for the input I got so caught up with the filtering that I forgot about the per-domain blacklist capability. So all I did was to add a .cz to the blacklist file for that domain and it took care of it. Got to remember the big picture :) Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Wednesday, June 09, 2004 1:21 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Blacklist one Country for one Domain agreed about the body but chances are that and end user is going to base their filtering request on what they see in the body and in the case of .cz the chances of something matching that other than an email address or url are slim if cpu processing is an issue run the test in its own filter and run it last using the testsfailed end contains to exclude it if it was already killed by another test. Rick Davidson National Systems Manager North American Title Group - - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 09, 2004 12:58 PM Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain I'd avoid the ANYWHERE filter if possible. Perhaps replace it with HEADERS if that's what you want. The anywhere will include the body, and those short matches on the body seem to match on strange things in attachments and such a little too often for me. Also ANYWHERE will be pretty CPU intensive compared to HEADERS or MAILFROM. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 06/09/04 10:50AM Markus, I want to avail HOLD actions as much as possible (that way there is less work for me :) ALLRECIPS END NOTCONTAINS @domain.com MAILFROM50ENDSWITH .cz They way I understand a filter file is that is it applied and scored against every e-mail message that comes in. So for the other domains in the system I want to allow or not penalize .cz mail. That is why I thought I would use the first line to exit the filter unless it is specifically for the domain in question. Now with the MAILFROM it will get an email message what ends with .cz Or maybe I should use (Rick's suggestion) ANYWHERE 50 CONTAINS .cz MAILFROM 50 CONTAINS .cz with the ANYWHERE line containing a training space. I was wondering if the filter approach is the best approach or is there another way to do this? I am thinking something like a blacklist but I am not sure how that would work?? Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Wednesday, June 09, 2004 11:33 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain Please blacklist anything that has a .cz in the address line COUNTRIES doesn't look at the address line as your customer asked for. It will filter if any IP-Address the contained in the mail header is assigned to the Czech republic. Why not use something like MAILFROM 50 ENDSWITH .cz What about other customers that want mail from the Czech republic? I consider to create a separate filter file (FILTER-CUSTOMERNAME) In this filter file put MAILFROM 0 ENDSWITH .cz Then create a .junkmail action file for this customer and set FILTER-CUSTOMERNAME HOLD Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude
