This is how spam looks when it hits my inbox. I *could* prevent it arriving at all, but I'm not 100% trusting of it yet (although its been about 2 months since I got a false positive). The original mail is attached so I can check it out if I want. Each spam message carries the mail header X-Spam-Flag: YES. This is what I base my outlook rule on.
You can adjust your points threshold until you get a good level of success. My threshold is set at 5 - I can adjust this up & down. Over time I will be lowering it (becoming more restrictive). I imagine Grant's works in a similar way. ----------------------------------- > This mail is probably spam. The original message has been attached > along with this report, so you can recognize or block similar unwanted > mail in future. See http://mail.my-isp.com.au/spam/ for more details. > > Content preview: --._FED9.ACBE6_A6B.0EBEA9 Content-Type: text/html; > Content-Transfer-Encoding: quoted-printable > URI:http://www.manymen.net/mdp/index.php?AFF_ID=b1 URI:cid:pic2.gif > CLICK HERE URI:http://www.manymen.net/content/ cease me cmqmyz xw > trgajrs [...] > > Content analysis details: (13.30 points, 5 required) > EXTRA_MPART_TYPE (0.8 points) Message with extraneous > Content-type:...type= header > CLICK_BELOW_CAPS (0.5 points) BODY: Asks you to click below ......etc..... > FORGED_MUA_EUDORA (1.2 points) Forged mail pretending to be from Eudora > > The original message did not contain plain text, and may be unsafe to > open with some email clients; in particular, it may contain a virus, > or confirm that your address can receive spam. If you wish to view > it, it may be safer to save it to a file and open it with an editor. Cheers Mark ______________ Mark Stanton Web Production Gruden Pty Ltd Tel: 9956 6388 Mob: 0410 458 201 Fax: 9956 8433 http://www.gruden.com ******************************************************************** This message and any attachments are confidential to the ordinary user of the e-mail address to which it was addressed and may also be privileged. If you are not the addressee you may not copy, forward, disclose or use any part of the message or its attachments and if you have received this message in error, please notify the sender immediately by return e-mail and delete it from your system. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, arrive late or contain viruses. The sender therefore does not accept liability for any errors or omissions in the context of this message which arise as a result of Internet transmission. Before opening or using attachments, check them for viruses and defects. Our liability is limited to resupplying any affected attachments. ******************************************************************** > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > [EMAIL PROTECTED] > Sent: Wednesday, 23 July 2003 3:41 PM > To: CFAussie Mailing List > Subject: [cfaussie] RE: CFAUSSIE to be blamed for Spam? > > > Just playing the devil's advocate here, but can you be sure that you are > not blocking any legitimate external emails using this software? > > -----Original Message----- > From: Grant Straker [mailto:[EMAIL PROTECTED] > Sent: Wednesday, 23 July 2003 3:27 PM > To: CFAussie Mailing List > Subject: [cfaussie] RE: CFAUSSIE to be blamed for Spam? > > > If you want some good and cheap spam blocking software try vamsoft. > > www.vamsoft.com > > It cut my spam down from about 50 day to none. You need to fine tune a > bit using sender whitelists and ips but is very good. > > Easy to setup and works great with exchange. > > > -----Original Message----- > From: Mark Stanton [mailto:[EMAIL PROTECTED] > Sent: Wednesday, July 23, 2003 5:01 PM > To: CFAussie Mailing List > Subject: [cfaussie] RE: CFAUSSIE to be blamed for Spam? > > I think if you look closely - all those email addresses are from very > early > in the piece (Jan/Feb) - when Geoff first started using mail archive. I > think emails are blocked now. > > Yes - its a shame, but you can't consider your email address as being a > secret, it'll get out there eventually. > > I am getting much more spam now than 12 or even 6 months ago (23 message > so > far today), but my email address has been on the web for a few years. So > wouldn't put it down to just the mail-archive thing - the general spam > volume is increasing rapidly. > > Our ISP recently set up SpamAssassin - spam is now wrapped as an > attachment > and flagged in the mail headers - I've got an outlook rule that shifts > it > all to the "junk" folder automatically. If I wanted I could configure SA > to > just delete it on arrival at the server, but I'm not quite that > committed > yet. > > I would say SA catches about 98% of the spam that heads my way and only > trips up real mail very, very occasionally (less and less all the time > thanks to the Bayesian filtering it does). Interestingly the biggest > problem > with false positives is with html email generated by CF5, because CF5 > ignored some key points in the mail RFCs. > > Anyway - get your ISP to install SpamAssassin and stop worrying about > it. > > > Cheers > > Mark > > > ______________ > Mark Stanton > Web Production > Gruden Pty Ltd > Tel: 9956 6388 > Mob: 0410 458 201 > Fax: 9956 8433 > http://www.gruden.com > > > --- > You are currently subscribed to cfaussie as: [EMAIL PROTECTED] > To unsubscribe send a blank email to > [EMAIL PROTECTED] > > MX Downunder AsiaPac DevCon - http://mxdu.com/ > > --- > You are currently subscribed to cfaussie as: [EMAIL PROTECTED] > To unsubscribe send a blank email to > [EMAIL PROTECTED] > > MX Downunder AsiaPac DevCon - http://mxdu.com/ > > --- > You are currently subscribed to cfaussie as: [EMAIL PROTECTED] > To unsubscribe send a blank email to > [EMAIL PROTECTED] > > MX Downunder AsiaPac DevCon - http://mxdu.com/ > --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
