RE: [Declude.JunkMail] Encoded Email... how?

2002-09-05 Thread David Stavert
Mark Any help on nuclear fusion would be helpful as well. But only if you have time! ;) David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mark Smith Sent: Thursday, September 05, 2002 7:19 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail]

RE: [Declude.JunkMail] Encoded Email... how?

2002-09-05 Thread Mark Smith
LOL! Declude doesn't have a filter for that. :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of David Stavert Sent: Thursday, September 05, 2002 3:28 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Encoded Email... how? Mark Any

[Declude.JunkMail] More encoded spam

2002-09-05 Thread Rick Davidson
Hi Scott, I am starting to see alot of these encoded emails (since I cant stop them), here are a few more encoded spam samples. So far it looks like something similar to this appears in each encoded message. Content-Type: text/html; Content-Transfer-Encoding: base64 It would seem easy to catch

Re: [Declude.JunkMail] More encoded spam

2002-09-05 Thread R. Scott Perry
If anybody can produce legit reasons for sending mail this way please let Scott know That's exactly what I'm looking for. I do have enough samples of the spam to work with; it's just a matter now of finding out if there is legitimate mail that is being sent this way. -Scott

Re: [Declude.JunkMail] More encoded spam

2002-09-05 Thread R. Scott Perry
Well I don't know what legit means exactly but I can tell you there are quite a few messages that come through our server that are base64 encoded or that contain base64 segments that are not SPAM. base64 is used for virtually all types of attachments (.jpg, .exe, etc.), so it will be common in

RE: [Declude.JunkMail] More encoded spam

2002-09-05 Thread Mark Smith
How is RTF (Outlook) email sent? Also, Exchange RTF is not the same as plain Outlook RTF composed messages. Just a thought... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, September 05, 2002 5:13 PM To: [EMAIL

RE: [Declude.JunkMail] More encoded spam

2002-09-05 Thread Madscientist
I think you're right there... Spammers didn't invent this as a means of obfuscatoin... It seems that what happened is some lucky spammers sent out a few messages this way because that's how their software of choice worked - and they discovered that it was a good way not to get filtered - and so

Re: [Declude.JunkMail] More encoded spam

2002-09-05 Thread R. Scott Perry
RSP I can't think of a single legitimate reason for a mail client to encode Well again I don't see where it would be illegal to use any kind of encoding available for any message. I am very sure it is not illegal. But if a spam test can catch a reasonable amount of spam, and in theory

[Declude.JunkMail] domain alias checking

2002-09-05 Thread Glen Harvy
Hi, In both JunkMail and AntiVirus is it necessary to configure the alias address as well as the main in the various global, domain and user specific config files? For example: Domain config file: DEFAULT OFF User specific file: [EMAIL PROTECTED] ON [EMAIL PROTECTED]ON TIA Glen.

Re: [Declude.JunkMail] domain alias checking

2002-09-05 Thread Alex Artigues
I'm not sure on virus (I add both OHN and alias anyway) but we did have issues with spam getting through junkmail (very rare) until we added a folder for the OHN and alias with a junkmail.cfg in each. I'm sure Scott will provide a clear answer on virus configs. Alex - Original Message

[Declude.JunkMail] Helo Bogus Question

2002-09-05 Thread Don Schreiner
Hello fellow Decluder's, I am seeing a lot of these (see header below) whereas the From address is the same as the To address of one of our domains (is this spoofing the domain?). I am catching them (barely in this case) based on weight of other tests, but not sure I understand why these are not