I am attempting to create a filter that contains conditions that will cause
a HOLD on the emails that it matches. My HOLD weight is 100 but I also use
some reverse weighting so I was thinking that adding 500 points should do
it.
In my global.cfg I have :
BLACKFILTER filter
PROTECTED]
- Original Message -
From: Michael Hoyt [EMAIL PROTECTED]
To: Declude JunkMail @declude.com Declude.JunkMail@declude.com
Sent: Friday, August 17, 2007 10:32 AM
Subject: [Declude.JunkMail] Filter question
I am attempting to create a filter that contains conditions that will
cause
I've just started using Sniffer and am wondering if I can create a test for
the following condition and take an action.
Say: if the declude score is greater than 20 and Sniffer has not been
triggered, copy the message to a spam account.
So something like header contains WEIGHT20 and doesn't
I
need to create a filter for a client that I am gatewaying their Exchange
server.
I
have their server listed in the Global.cfg for whitelisting. (WHITELIST IP yaddayaddayadda)
Now
there is a need to create a filter file so that if the e-mail is from a
broadcast address and to an
Move the whitelist setting to a custom filter and place an END on the
filter for the condition that you want to track elsewhere:
MAILFROM END IS [EMAIL PROTECTED]
REMOTEIP WHITELIST IS 12.34.56.78
Have a good evening,
Matt
John T (Lists) wrote:
I
need to create a filter
Thanks Matt.
John T
eServices For You
Seek, and ye shall
find!
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Tuesday, February 14, 2006
3:46 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail]
Filter
The following header lines are the basis of my question. The from domain
(mine) does not match the from [IP] address (not mine.)
Received: from jcjc.edu [65.240.76.232] by bobcat.jcjc.edu with ESMTP
(SMTPD32-8.15) id AB4F105B014E; Wed, 23 Feb 2005 17:01:35 -0600
From: Returned mail [EMAIL
] Filter question
The following header lines are the basis of my question. The from domain
(mine) does not match the from [IP] address (not mine.)
Received: from jcjc.edu [65.240.76.232] by bobcat.jcjc.edu with ESMTP
(SMTPD32-8.15) id AB4F105B014E; Wed, 23 Feb 2005 17:01:35 -0600
From: Returned
]
To: Declude.JunkMail@declude.com
Sent: Thursday, February 24, 2005 9:54 AM
Subject: RE: [Declude.JunkMail] Filter question
I have my own domain in the spamdomains test and then I have Whitelist Auth
so almost anytime something appears to me from [EMAIL PROTECTED] if it isn't
whitelisted because
Scott:
I set up a filter of MAILFROM 0 STARTSWITH [EMAIL PROTECTED] I am only holding right
now.
The following was caught. Notice the coups@ is in the Received: line, not
the From: line. Should this one have been caught or skipped?
BTW, in 24 hours have caught around 600 msgs with this and
I set up a filter of MAILFROM 0 STARTSWITH [EMAIL PROTECTED] I am only holding right
now.
The following was caught. Notice the coups@ is in the Received: line, not
the From: line. Should this one have been caught or skipped?
It should have been caught. That's because the sender was actually
can be dinamically reduced for large messages.
Markus
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Doug Anderson
Sent: Tuesday, December 16, 2003 4:32 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Filter
This may sound stupid, but if I create a filter searching for
a string in an email...
BODY2CONTAINSxyz
and the email contains 4 instances of that string
now is the xyx time for all xyz good men xyz to come
to the aid xyz of their country
does the filter return an internal value of 8 or
2?
It will return a weight of 2. The filter will
only flag the first occurrence that it finds, then ignores the
rest.
Bill
- Original Message -
From:
Doug Anderson
To: [EMAIL PROTECTED]
Sent: Tuesday, December 16, 2003 7:32
AM
Subject: [Declude.JunkMail] Filter
This may sound stupid, but if I create a filter searching for a string in
an email...
BODY 2 CONTAINS xyz
and the email contains 4 instances of that string
now is the xyx time for all xyz good men xyz to come to the aid xyz of
their country
does the filter return an internal value of 8 or 2?
Title: Filter question
Good morning,
For the spam that doesnt contain a URL that I can block in my URL filter, I have taken to trying to find phrases that I can block in my BODY filter.
My question is
Should I be blocking these phrases using the text in the email that I can see, or
For the spam that doesn t contain a URL that I can block in my URL filter,
I have taken to trying to find phrases that I can block in my BODY filter.
My question is
Should I be blocking these phrases using the text in the email that I can
see, or should I be blocking phrases that appear when
We make extensive use of filters based on keywords. With short keywords
like like S_e_x we sometimes run into problems with keyword being triggered
based on base64 encoding of an attachment.
Example:
10/13/2003 00:00:36 Q236256fe026ef9a4 Triggered CONTAINS filter WORDFILTER
on sex [weight-2;
]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, October 16, 2003 10:05 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Filter question
For the spam that doesn t contain a URL that I can block in my URL
filter,
I have taken to trying to find phrases that I can block
In this last example that everyone's filter probably caught, the
original email came through unflagged, but when I forwarded it to the
list, the filter caught it.
Remember that failing a test and flagging (or any other action) are very
different. In this case, the original question made it seem
Remember that failing a test and flagging (or any other action) are very
different. In this case, the original question made it seem as though
the
E-mail wasn't failing the test, whereas it may be that the E-mail did
fail
the test but an action other than the one you wanted was used.
The
Here are the message headers:
X-Spam-Tests-Failed: ROUTING
OK, it did not fail the INBODYFILTER test.
Here is the line in the filter itself:
BODY 0 CONTAINS Bachelors and other higher education available in your
fields
And here is the line, copied and pasted directly from the spam email
that
Those do look the same. Did you cut and paste it from what you were
viewing in the E-mail, or from the source?
I cut and pasted it from what I was viewing in the email, NOT from the
source, hence my original question. I did go back and run the -diag and
I am definitely running JM 1.75
Sharyn
I cut and pasted it from what I was viewing in the email, NOT from the
source, hence my original question. I did go back and run the -diag and
I am definitely running JM 1.75
So now I would ask what the source of the E-mail shows?
-Scott
---
So now I would ask what the source of the E-mail shows?
This particular one, came in plain text, I just realized. That is
probably why I didn't use the source to begin with.
When I right click on it, view source is greyed out.
I would be happy to forward the email to the list but I did that
I have setup a filter to froward all email that seems to be from the sobig
virus to a specian mail box.
Global.CFG
SOBIGFILTER filter D:\IMail\Declude\SOBIG.txt x 0
0
sobig.txt
REMOTEIP 0 IS 206.111.17.194
REMOTEIP 0 IS 66.185.39.38
REMOTEIP 0 IS
]
Subject: [Declude.JunkMail] Filter question
I have setup a filter to froward all email that seems to be from the sobig
virus to a specian mail box.
Global.CFG
SOBIGFILTER filter D:\IMail\Declude\SOBIG.txt
x 0 0
sobig.txt
REMOTEIP 0 IS 206.111.17.194
REMOTEIP 0
I checked my logs and the REMOTEIP lines are catching the mail but the
subject lines with RE: are not catching the mail. the subject lines
without the RE: are catching the emails.
That is odd. Could there be spaces/tabs at the end of the lines that
aren't working?
If that doesn't explain it,
, 2003 5:45 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Filter question
I checked my logs and the REMOTEIP lines are catching the mail but the
subject lines with RE: are not catching the mail. the subject lines
without the RE: are catching the emails.
That is odd. Could
Hello,
what am I doing wrong?
I have an IP Filter called BAD-IP, a textfile with ip adresses and a test
for the user.
But still the mails get through.
global.cfg:
[...]
BAD-IP ipfile C:\IMail\Declude\BAD-IP.txt x 5 0
[...]
c:\imail\declude\bad-ip.txt (yes, it's
global.cfg:
[...]
BAD-IP ipfile C:\IMail\Declude\BAD-IP.txt x 5 0
[...]
c:\imail\declude\bad-ip.txt (yes, it's really there ;-)
[...]
217.173.135.114
[...]
This looks good.
Header:
--
Received: from mail3.cytainment.de [217.173.135.114] by siller.de with
Hi Scott,
Nothing like a quiet Sunday morning to get the questions going.
I have a filter question and will use the following header to explain. The
e-mail is being handled correctly by JunkMail according to the GLOBAL.CFG
settings
I would like to be able to filter on the domain names of
I would like to be able to filter on the domain names of mailservers in the
chain. In this case I would like to have an entry such as
WHATEVER CONTAINS .aebolts.com (Where WHATEVER is a valid filter screening
criteria for the mailservers in the chain). I know I can use HEADER for
this but is
the secondary MX's.
George
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Sunday, February 02, 2003 11:59 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Filter Question
I would like to be able to filter on the domain names
If I have a line in a filter, say:
MAILFROM-8 CONTAINS@domain.com
The test is defined in the Global.cfg like this:
MYFILTERfilter c:\imail\declude\filter.txt x -10 0
That would give any message from @domain.com a negative weight of 18,
correct?
John
Can Junkmail pro filters (for msg body) use wildcards? Is there a reference?
I want to create a filter (to hold) msgs that have embedded urls with IP
addresses in them.
I can do this is my IMGate machine but want to see what I catch first.
Mike
---
[This E-mail was scanned for viruses by
Can Junkmail pro filters (for msg body) use wildcards?
No.
Is there a reference?
The Filtering section of the manual covers the filtering. We do plan to
add a reference section to the manual like for the whitelisting/blacklisting.
I want to create a filter (to hold) msgs that have
One question about filters...
You assign the rule in the Global.cfg file a weight.
You also assign each filter a weight.
Are these two weights added to get the final weight for the message?
For example, if you have:
MYFILTER filter c:\iMail\Declude\myfilter.txt x 5 0
And in
One question about filters...
You assign the rule in the Global.cfg file a weight.
You also assign each filter a weight.
Are these two weights added to get the final weight for the message?
For example, if you have:
MYFILTER filter c:\iMail\Declude\myfilter.txt x 5 0
And in
Scott, I guess I could test this, but I'm sure you can tell me off the top
of your head. When using the BODY search in the filter file, does Declude
search just the actual body of the e-mail message or does it search all
attachments, as well? I'm guessing it's just the actual body of the
Scott, I guess I could test this, but I'm sure you can tell me off the top
of your head. When using the BODY search in the filter file, does Declude
search just the actual body of the e-mail message or does it search all
attachments, as well?
It searches the entire body of the E-mail, which
How would I go about filtering for this in the header? Is it possible?
To: Undisclosed Recipients
Have a great day!
Rick Davidson
Buckeye Internet Services
www.buckeyeweb.com
440-953-1900
-
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
How would I go about filtering for this in the header? Is it possible?
To: Undisclosed Recipients
It isn't currently possible in Declude JunkMail. It most likely will be
possible in an upcoming release, though.
However, you should note that Undisclosed Recipients is used by many
legitimate
43 matches
Mail list logo
