[Declude.JunkMail] How would you create a filter for this?
Hello, I have checked through the archives and I have not been able to find anything on creating a filter to block something like V p I t A p G i R h A g ( where every other letter is used to spell a word). The capital letters stay the same from email to email, but the lower case letters change. Is there a way to set up a filter line to catch this? I am using Declude JunkMail Pro 2.0.6.16 Thanks in advance, Mike
Re: [Declude.JunkMail] How would you create a filter for this?
Michael, We have a free regex tool that has filters to catch these kinds of variations. It is very CPU intensive so if you do not have headroom on your box I wouldnt suggest it. --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Michael Graveen writes: Hello, I have checked through the archives and I have not been able to find anything on creating a filter to block something like V p I t A p G i R h A g ( where every other letter is used to spell a word). The capital letters stay the same from email to email, but the lower case letters change. Is there a way to set up a filter line to catch this? I am using Declude JunkMail Pro 2.0.6.16 Thanks in advance, Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How would you create a filter for this?
I might suggest something to target the links of the emails, like Sniffer or INVURIBL as a good attack vector. Combo that test with a CBL result, since these often come from CBL lists. Dealing with all of the combinations would result in a painfully long filter. - Original Message - From: Michael Graveen To: Declude.JunkMail@declude.com Sent: Tuesday, April 25, 2006 10:22 AM Subject: [Declude.JunkMail] How would you create a filter for this? Hello,I have checked through the archives and I have not been able to find anything on creating a filter to block something like V p I t A p G i R h A g ( where every other letter is used to spell a word). The capital letters stay the same from email to email, but the lower case letters change. Is there a way to set up a filter line to catch this? I am using Declude JunkMail Pro 2.0.6.16Thanks in advance,Mike
Re: [Declude.JunkMail] How would you create a filter for this?
Just today, I added some of the following to my checkraw file in Spamchk. Just testing since a lot of these seem to have the the lowercase letters hidden in the HTML version by using white fonts. /font I font=10 /font A font=10 /font Gfont=10 /font R font=10 etc. John Olden Systems Administrator Champaign Park District Michael Graveen writes: Hello, I have checked through the archives and I have not been able to find anything on creating a filter to block something like V p I t A p G i R h A g ( where every other letter is used to spell a word). The capital letters stay the same from email to email, but the lower case letters change. Is there a way to set up a filter line to catch this? I am using Declude JunkMail Pro 2.0.6.16 Thanks in advance, Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [MSGID=D47f301719d24.smd] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How would you create a filter for this?
I created a filter you can modify it or add as you need too David B www.declude.com BODYEND NOTCONTAINS MSHTML BODY1 CONTAINSa BODY1 CONTAINSb BODY1 CONTAINSc BODY1 CONTAINSd BODY1 CONTAINSe BODY1 CONTAINSf BODY1 CONTAINSg BODY1 CONTAINSh BODY1 CONTAINSi BODY1 CONTAINSj BODY1 CONTAINSk BODY1 CONTAINSl BODY1 CONTAINSm BODY1 CONTAINSn BODY1 CONTAINSo BODY1 CONTAINSp BODY1 CONTAINSq BODY1 CONTAINSr BODY1 CONTAINSs BODY1 CONTAINSt BODY1 CONTAINSu BODY1 CONTAINSv BODY1 CONTAINSw BODY1 CONTAINSx BODY1 CONTAINSy BODY1 CONTAINSz BODY1 CONTAINS1 BODY1 CONTAINS2 BODY1 CONTAINS3 BODY1 CONTAINS4 BODY1 CONTAINS5 BODY1 CONTAINS6 BODY1 CONTAINS7 BODY1 CONTAINS8 BODY1 CONTAINS9 BODY1 CONTAINS0 BODY1 CONTAINS$ BODY1 CONTAINS a BODY1 CONTAINS b BODY1 CONTAINS c BODY1 CONTAINS d BODY1 CONTAINS e BODY1 CONTAINS f BODY1 CONTAINS g BODY1 CONTAINS h BODY1 CONTAINS i BODY1 CONTAINS j BODY1 CONTAINS k BODY1 CONTAINS l BODY1 CONTAINS m BODY1 CONTAINS n BODY1 CONTAINS o BODY1 CONTAINS p BODY1 CONTAINS q BODY1 CONTAINS r BODY1 CONTAINS s BODY1 CONTAINS t BODY1 CONTAINS u BODY1 CONTAINS v BODY1 CONTAINS w BODY1 CONTAINS x BODY1 CONTAINS y BODY1 CONTAINS z BODY1 CONTAINS 1 BODY1 CONTAINS 2 BODY1 CONTAINS 3 BODY1 CONTAINS 4 BODY1 CONTAINS 5 BODY1 CONTAINS 6 BODY1 CONTAINS 7 BODY1 CONTAINS 8 BODY1 CONTAINS 9 BODY1 CONTAINS 0 BODY1 CONTAINS $ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Olden Sent: Tuesday, April 25, 2006 12:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How would you create a filter for this? Just today, I added some of the following to my checkraw file in Spamchk. Just testing since a lot of these seem to have the the lowercase letters hidden in the HTML version by using white fonts. /font I font=10 /font A font=10 /font Gfont=10 /font R font=10 etc. John Olden Systems Administrator Champaign Park District Michael Graveen writes: Hello, I have checked through the archives and I have not been able to find anything on creating a filter to block something like V p I t A p G i R h A g ( where every other letter is used to spell a word). The capital letters stay the same from email to email, but the lower case letters change. Is there a way to set up a filter line to catch this? I am using Declude JunkMail Pro 2.0.6.16 Thanks in advance, Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. [MSGID=D47f301719d24.smd] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] How would you create a filter for this?
I added an abstract for this text pattern to Message Sniffer today. We regularly create similar rules for other variations - these patterns are independent from the URI. _M On Tuesday, April 25, 2006, 11:59:20 AM, Scott wrote: SF SF SF I might suggest something to target the links of the emails, SF like Sniffer or INVURIBL as a good attack vector. SF SF Combo that test with a CBL result, since these often come from CBL lists. SF SF SF SF Dealing with all of the combinations would result in a painfully long filter. SF SF SF - Original Message - SF SF From: Michael Graveen SF SF To: Declude.JunkMail@declude.com SF SF Sent: Tuesday, April 25, 2006 10:22AM SF SF Subject: [Declude.JunkMail] How would youcreate a filter for this? SF SF Hello, SF I have checked through the archives and I have notbeen able SF to find anything on creating a filter to block something like V p SF I t A p G i R h A g ( where every other letter isused to spell SF a word). The capital letters stay the same from email to SF email, but the lower case letters change. Is there a way to set SF up afilter line to catch this? I am using Declude JunkMail Pro 2.0.6.16 SF Thanks in advance, SF Mike SF --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
