RE: [Declude.JunkMail] Filter help
have you tried just adding BALCOMLAWHOLD f:\Balcomlawhold to the default.junkmail file in the declude root? -- Rick -Original Message- From: Heimir Eidskrem [mailto:decl...@i360.net] Sent: Wednesday, October 12, 2011 5:41 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Filter help We wash incoming email for a client and send it to their mail server. The server is down and will be down for some time. I want to filter all incoming email to this domain and send it to a hold directory. Line in global.cfg balcomlawfilter d:\smartermail\declude\filters\balcomlaw.txtx00 filter name: balcomlaw.txt content of the filter: HEADERS CONTAINS @balcomlaw.com also tried ALLRECIPS CONTAINS @balcomlaw.com I created a directory named balcomlaw.com in the declude directory and copied $default$.junkmail default.junkmail has this line: BALCOMLAWHOLD f:\Balcomlawhold I see the test being called but no action taken. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click the 'Reply' button and add the word 'UNSUBSCRIBE' to the subject of your response. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Help
Title: Filter Help Filter file, on to address, list those addresses, then have a weight so as to delete or route or whatever. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Friday, March 14, 2003 12:27 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Filter Help We have Imail 7.14 w/JunkMail Pro running in per domain type config. I have a customer setup in Gateway mode (has own Exchange Server, filtering email for him). He has a list of 100 employees he longer wants to receive email for, doesn't want to see them come to his machine. I have him setup in such a way that if he fails the Weight20 test, his email is ROUTETO a special Spam user to his domain, thus his Exchange Server places it in a special account and he views it daily for false pos's, works great. I know I really can't use the Header Contains, since this would force fail the Weight20 and thus be sent to him via is ROUTETO. I can't fromfile it, since it the TO: line I want to filter on. I can't use Imail Rules since we have no account box on our system for him (store and forward). Just hoping for some suggestions. Thanks for the aid. ___ Keith Johnson, MCP Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] Good pings come in small packets
RE: [Declude.JunkMail] Filter Help
Title: Message John, I believe that is my issue. If I filter file it and place a weight so that it trips the WEIGHT20, it will use the ROUTETO and he will receive the email his Exchange Server. He wants me to delete it before it gets to him, just this list. Keith -Original Message-From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 4:01 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help Filter file, on to address, list those addresses, then have a weight so as to delete or route or whatever. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith JohnsonSent: Friday, March 14, 2003 12:27 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Filter Help We have Imail 7.14 w/JunkMail Pro running in per domain type config. I have a customer setup in Gateway mode (has own Exchange Server, filtering email for him). He has a list of 100 employees he longer wants to receive email for, doesn't want to see them come to his machine. I have him setup in such a way that if he fails the Weight20 test, his email is ROUTETO a special Spam user to his domain, thus his Exchange Server places it in a special account and he views it daily for false pos's, works great. I know I really can't use the Header Contains, since this would force fail the Weight20 and thus be sent to him via is ROUTETO. I can't fromfile it, since it the TO: line I want to filter on. I can't use Imail Rules since we have no account box on our system for him (store and forward). Just hoping for some suggestions. Thanks for the aid. ___ Keith Johnson, MCP Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] "Good pings come in small packets"
RE: [Declude.JunkMail] Filter Help
Title: Message Use delete action on that test. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer 211 E. Imperial Hwy, Suite 106 Fullerton, CA 92835 562-694-4800, ext. 104 [EMAIL PROTECTED] www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Friday, March 14, 2003 1:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Help John, I believe that is my issue. If I filter file it and place a weight so that it trips the WEIGHT20, it will use the ROUTETO and he will receive the email his Exchange Server. He wants me to delete it before it gets to him, just this list. Keith -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 4:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Help Filter file, on to address, list those addresses, then have a weight so as to delete or route or whatever. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Friday, March 14, 2003 12:27 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Filter Help We have Imail 7.14 w/JunkMail Pro running in per domain type config. I have a customer setup in Gateway mode (has own Exchange Server, filtering email for him). He has a list of 100 employees he longer wants to receive email for, doesn't want to see them come to his machine. I have him setup in such a way that if he fails the Weight20 test, his email is ROUTETO a special Spam user to his domain, thus his Exchange Server places it in a special account and he views it daily for false pos's, works great. I know I really can't use the Header Contains, since this would force fail the Weight20 and thus be sent to him via is ROUTETO. I can't fromfile it, since it the TO: line I want to filter on. I can't use Imail Rules since we have no account box on our system for him (store and forward). Just hoping for some suggestions. Thanks for the aid. ___ Keith Johnson, MCP Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] Good pings come in small packets
RE: [Declude.JunkMail] Filter Help
Title: Message John, I apologize for my 'blindness' today.I thought I couldn't have an actionset against afilter fileonly the fromfile. I see what I need to do. Since the filter testing doesn't have a TO param, is it better to use the ALLRECIPS or the HEADERS to catch the email address? Thanks for the aid. Keith Johnson -Original Message-From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 4:28 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help Use delete action on that test. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer 211 E. Imperial Hwy, Suite 106 Fullerton, CA 92835 562-694-4800, ext. 104 [EMAIL PROTECTED] www.reliancesoft.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith JohnsonSent: Friday, March 14, 2003 1:04 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help John, I believe that is my issue. If I filter file it and place a weight so that it trips the WEIGHT20, it will use the ROUTETO and he will receive the email his Exchange Server. He wants me to delete it before it gets to him, just this list. Keith -Original Message-From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 4:01 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help Filter file, on to address, list those addresses, then have a weight so as to delete or route or whatever. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith JohnsonSent: Friday, March 14, 2003 12:27 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Filter Help We have Imail 7.14 w/JunkMail Pro running in per domain type config. I have a customer setup in Gateway mode (has own Exchange Server, filtering email for him). He has a list of 100 employees he longer wants to receive email for, doesn't want to see them come to his machine. I have him setup in such a way that if he fails the Weight20 test, his email is ROUTETO a special Spam user to his domain, thus his Exchange Server places it in a special account and he views it daily for false pos's, works great. I know I really can't use the Header Contains, since this would force fail the Weight20 and thus be sent to him via is ROUTETO. I can't fromfile it, since it the TO: line I want to filter on. I can't use Imail Rules since we have no account box on our system for him (store and forward). Just hoping for some suggestions. Thanks for the aid. ___ Keith Johnson, MCP Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] "Good pings come in small packets"
RE: [Declude.JunkMail] Filter Help
Title: Message Keith, check the Manual; as you go down the list of actions, you will see them in increasing priority. So nevermind the weight of this filter test, set the weight to 0 and the action to DELETE, because that action has the highest priority. The action for the WEIGHT20 will be ignored. Andrew 8) -Original Message-From: Keith Johnson [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 1:04 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help John, I believe that is my issue. If I filter file it and place a weight so that it trips the WEIGHT20, it will use the ROUTETO and he will receive the email his Exchange Server. He wants me to delete it before it gets to him, just this list. Keith -Original Message-From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 4:01 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help Filter file, on to address, list those addresses, then have a weight so as to delete or route or whatever. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith JohnsonSent: Friday, March 14, 2003 12:27 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Filter Help We have Imail 7.14 w/JunkMail Pro running in per domain type config. I have a customer setup in Gateway mode (has own Exchange Server, filtering email for him). He has a list of 100 employees he longer wants to receive email for, doesn't want to see them come to his machine. I have him setup in such a way that if he fails the Weight20 test, his email is ROUTETO a special Spam user to his domain, thus his Exchange Server places it in a special account and he views it daily for false pos's, works great. I know I really can't use the Header Contains, since this would force fail the Weight20 and thus be sent to him via is ROUTETO. I can't fromfile it, since it the TO: line I want to filter on. I can't use Imail Rules since we have no account box on our system for him (store and forward). Just hoping for some suggestions. Thanks for the aid. ___ Keith Johnson, MCP Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] "Good pings come in small packets"
RE: [Declude.JunkMail] Filter Help
Title: Message The action is set in the last part of the Global.cfg and $default$.junkmail files. If the test was OLDUSER filter c:\Imail\declude\oldusers.txt x 0 0 and the action OLDUSER DELETE Yes, use the ALLRECIPS option. ALLRECIPS 0 IS [EMAIL PROTECTED] John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Friday, March 14, 2003 1:34 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Help John, I apologize for my 'blindness' today.I thought I couldn't have an actionset against afilter fileonly the fromfile. I see what I need to do. Since the filter testing doesn't have a TO param, is it better to use the ALLRECIPS or the HEADERS to catch the email address? Thanks for the aid. Keith Johnson -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 4:28 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Help Use delete action on that test. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer 211 E. Imperial Hwy, Suite 106 Fullerton, CA 92835 562-694-4800, ext. 104 [EMAIL PROTECTED] www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Friday, March 14, 2003 1:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Help John, I believe that is my issue. If I filter file it and place a weight so that it trips the WEIGHT20, it will use the ROUTETO and he will receive the email his Exchange Server. He wants me to delete it before it gets to him, just this list. Keith -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 4:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Help Filter file, on to address, list those addresses, then have a weight so as to delete or route or whatever. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Friday, March 14, 2003 12:27 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Filter Help We have Imail 7.14 w/JunkMail Pro running in per domain type config. I have a customer setup in Gateway mode (has own Exchange Server, filtering email for him). He has a list of 100 employees he longer wants to receive email for, doesn't want to see them come to his machine. I have him setup in such a way that if he fails the Weight20 test, his email is ROUTETO a special Spam user to his domain, thus his Exchange Server places it in a special account and he views it daily for false pos's, works great. I know I really can't use the Header Contains, since this would force fail the Weight20 and thus be sent to him via is ROUTETO. I can't fromfile it, since it the TO: line I want to filter on. I can't use Imail Rules since we have no account box on our system for him (store and forward). Just hoping for some suggestions. Thanks for the aid. ___ Keith Johnson, MCP Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] Good pings come in small packets
RE: [Declude.JunkMail] Filter Help
Title: Message John: This is exactly what we have. We had problems with SPAM flooding us to employee addresses that had not been with the company for ages. We even went a step further than your suggestion. We actually search the header for that address since at times we kept seeing those addresses used in the FROM field. So we have ALLRECEIPS HEADER Regards, Kami -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John TolmachoffSent: Friday, March 14, 2003 5:14 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help The action is set in the last part of the Global.cfg and $default$.junkmail files. If the test was OLDUSER filter c:\Imail\declude\oldusers.txt x 0 0 and the action OLDUSER DELETE Yes, use the ALLRECIPS option. ALLRECIPS 0 IS [EMAIL PROTECTED] John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith JohnsonSent: Friday, March 14, 2003 1:34 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help John, I apologize for my 'blindness' today.I thought I couldn't have an actionset against afilter fileonly the fromfile. I see what I need to do. Since the filter testing doesn't have a TO param, is it better to use the ALLRECIPS or the HEADERS to catch the email address? Thanks for the aid. Keith Johnson -Original Message-From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 4:28 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help Use delete action on that test. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer 211 E. Imperial Hwy, Suite 106 Fullerton, CA 92835 562-694-4800, ext. 104 [EMAIL PROTECTED] www.reliancesoft.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith JohnsonSent: Friday, March 14, 2003 1:04 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help John, I believe that is my issue. If I filter file it and place a weight so that it trips the WEIGHT20, it will use the ROUTETO and he will receive the email his Exchange Server. He wants me to delete it before it gets to him, just this list. Keith -Original Message-From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Friday, March 14, 2003 4:01 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Filter Help Filter file, on to address, list those addresses, then have a weight so as to delete or route or whatever. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith JohnsonSent: Friday, March 14, 2003 12:27 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Filter Help We have Imail 7.14 w/JunkMail Pro running in per domain type config. I have a customer setup in Gateway mode (has own Exchange Server, filtering email for him). He has a list of 100 employees he longer wants to receive email for, doesn't want to see them come to his machine. I have him setup in such a way that if he fails the Weight20 test, his email is ROUTETO a special Spam user to his domain, thus his Exchange Server places it in a special account and he views it daily for false pos's, works great. I know I really can't use the Header Contains, since this would force fail the Weight20 and thus be sent to him via is ROUTETO. I can't fromfile it, since it the TO: line I want to filter on. I can't use Imail Rules since we have no account box on our system for him (store and forward). Just hoping for some suggestions. Thanks for the aid. ___ Keith Johnson, MCP Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] "Good pings come in small packets"
Re: [Declude.JunkMail] Filter Help
I included the rules below, but they never seem to trigger: BODY 10 CONTAINS http://1 BODY 10 CONTAINS http://2 BODY 10 CONTAINS http://3 BODY 10 CONTAINS http://4 BODY 10 CONTAINS http://5 BODY 10 CONTAINS http://6 BODY 10 CONTAINS http://7 BODY 10 CONTAINS http://8 BODY 10 CONTAINS http://9 BODY 10 CONTAINS http://0 Are you sure that the filter is set up properly (are other filters working properly)? That's the most likely problem. The other possibility would be if the E-mail is base64 encoded, in which case filtering won't work (but the E-mail will fail the BASE64 test). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Help
An Asside - Watch out for false positives with this one. We tried a rule that captured all numeric-only web links as they are a favorite for porn spammers and mortgage folks. Unfortunately we discovered that a number of legitimate news services also do this sometimes so we were forced to begin entering specific numbered web links. Hope this helps. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Karen Oland | Sent: Wednesday, October 16, 2002 2:24 PM | To: [EMAIL PROTECTED] | Subject: [Declude.JunkMail] Filter Help | | | Is there any way to check for references to web sites that | only have domain names? | | I included the rules below, but they never seem to trigger: | | BODY 10 CONTAINS http://1 | BODY 10 CONTAINS http://2 | BODY 10 CONTAINS http://3 | BODY 10 CONTAINS http://4 | BODY 10 CONTAINS http://5 | BODY 10 CONTAINS http://6 | BODY 10 CONTAINS http://7 | BODY 10 CONTAINS http://8 | BODY 10 CONTAINS http://9 | BODY 10 CONTAINS http://0 | | I don't want to block using IMAIL, as we have a vendor that | sends us email that has a web site with a real name that | starts with a 101. However, we do want to have enough | weight to this type of a rule, that any other violation will | result in the message being sorted into our spam box. | | Karen Oland | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Help
The test appears to be set up correctly. I checked my declude log - there are entries for the spamtext.txt file (which contains the below) triggering on line 12 (one line below this particular block) and entries for the base64 test being triggered. I pulled a random message out of my delete box that should have been flagged and checked the headers. This is what I got: Received: from mx3.finehost.net [66.205.220.31] by staffingtech.com (SMTPD32-7.13) id AB80F410120; Wed, 16 Oct 2002 01:39:12 -0400 X-Priority: 3 Return-Path: [EMAIL PROTECTED] From: Cash Online [EMAIL PROTECTED] To: [EMAIL PROTECTED] Received: from mx3.finehost.net by 2ER93A05EK4L1M.mx3.finehost.net with SMTP for [EMAIL PROTECTED]; Tue, 15 Oct 2002 13:40:42 -0500 Date: Tue, 15 Oct 2002 13:40:42 -0500 Subject: Get up to $500 today! Message-Id: 5CU72GH.BCTT9X79.Cash Online [EMAIL PROTECTED] X-Mailer: YDH_optin_v1.2 X-Encoding: MIME MIME-Version: 1.0 X-MSMail-Priority: Normal Content-Type: multipart/alternative; boundary==_NextPart_24_30472442 X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?66.205.220.31 X-Declude-Sender: [EMAIL PROTECTED] [66.205.220.31] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SPAMCOP X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 300488074 So, the message does not appear to be base64. It does contain some html code, but in the clear portion at the bottom, there is the usual unsubscribe junk: While visiting a partner website, you opted-in to receive special online offers. To end your membership, click reply and send this email or click http://66.163.246.29/unsubscribe.php?[EMAIL PROTECTED] This is the same as what appears if you open the message (which also then displays their ad in living color). This is the entry in the global.cfg: SPAMTEXTfilter c:\imail\declude\spamtext.txt x 0 0 and the entry for the above msg and one that did fail the spamtext rule in the declog: 10/16/2002 01:39:16 Qfb800f410120c136 Msg failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?66.205.220.31). 10/16/2002 14:27:18 Qaf8311c10120f2ab Msg failed SPAMTEXT (Message failed SPAMTEXT test (12)). I also cut and pasted the raw html sourc into a program to count characters -- a total of 2438, including all spaces. Karen -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, October 16, 2002 2:26 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Filter Help I included the rules below, but they never seem to trigger: BODY 10 CONTAINS http://1 BODY 10 CONTAINS http://2 BODY 10 CONTAINS http://3 BODY 10 CONTAINS http://4 BODY 10 CONTAINS http://5 BODY 10 CONTAINS http://6 BODY 10 CONTAINS http://7 BODY 10 CONTAINS http://8 BODY 10 CONTAINS http://9 BODY 10 CONTAINS http://0 Are you sure that the filter is set up properly (are other filters working properly)? That's the most likely problem. The other possibility would be if the E-mail is base64 encoded, in which case filtering won't work (but the E-mail will fail the BASE64 test). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Help
Yes, we know. that is why we wanted to use a weighted rule in Declude, rather than an absolute rule in IMAIL. The problem with specific addresses (and we have a few (ok, a lot) of those, is that the spammers simply move every so often, but we keep blocking the old IP addresses forever. And they can get new addresses faster than we can add them to the list. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Madscientist Sent: Wednesday, October 16, 2002 2:55 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Help An Asside - Watch out for false positives with this one. We tried a rule that captured all numeric-only web links as they are a favorite for porn spammers and mortgage folks. Unfortunately we discovered that a number of legitimate news services also do this sometimes so we were forced to begin entering specific numbered web links. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Help
Am I understanding correctly from this ... Karen Oland wrote: While visiting a partner website, you opted-in to receive special online offers. To end your membership, click reply and send this email or click http://66.163.246.29/unsubscribe.php?[EMAIL PROTECTED] This is the same as what appears if you open the message (which also then displays their ad in living color). This is the entry in the global.cfg: SPAMTEXTfilter c:\imail\declude\spamtext.txt x 0 0 and the entry for the above msg and one that did fail the spamtext rule in the declog: 10/16/2002 01:39:16 Qfb800f410120c136 Msg failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?66.205.220.31). 10/16/2002 14:27:18 Qaf8311c10120f2ab Msg failed SPAMTEXT (Message failed SPAMTEXT test (12)). ... that I could do a filter to block all messages using that opt-in statement by: 1. putting While visiting a partner website, you opted-in to receive special online offers. in a text file called optin.txt 2. copying optin.txt to HARDDISK:\IMAIL\DECLUDE\OPTIN.TXT 3. Modifying global.cfg to include the following line: OPTIN filter harddisk:\imail\declude\optin.txt x V 0 where V = some value for my weighting system Is that correct? I really like the idea of this type of filter vs. having to be in the first x number of bytes with IMail's filter. This can be found anywhere in the message. Assuming all of that to be true, my system holds anything with a weight greater than 15 ... I see a lot of things go through that have 11's and 12's, so my first thought is to try 5 for the weight on this test. Good idea? Bad idea? Thanks in advance for your input, John --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Help
I also cut and pasted the raw html sourc into a program to count characters -- a total of 2438, including all spaces. Did you check the raw HTML source to see if it had http://6; in it? Are there any spaces after the http://6; in the c:\imail\declude\spamtext.txt file (which would require the space(s) in the E-mail)? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Help
ARRGGHHH spaces after the 6!!! and the same on all but one of the rules. All found and fixed (and several more rules later on with spaces. (but, yes, there was an http://6 in the raw source). Thanks for the help, Karen -Original Message- From:R. Scott Perry I also cut and pasted the raw html sourc into a program to count characters -- a total of 2438, including all spaces. Did you check the raw HTML source to see if it had http://6; in it? Are there any spaces after the http://6; in the c:\imail\declude\spamtext.txt file (which would require the space(s) in the E-mail)? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter Help
Also, filters only work with the Pro version of Declude, I believe. -Original Message- From: R. Scott Perry ... that I could do a filter to block all messages using that opt-in statement by: 1. putting While visiting a partner website, you opted-in to receive special online offers. in a text file called optin.txt It would need to be set up as a filter, using a line such as BODY 10 CONTAINS While visiting a partner website, you opted-in to receive special online offers., rather than just the text by itself. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
