One way is to use myfilter.txt. Include some of the obvious wordings in it such as :
SUBJECTCONTAINS 10 disgusting words BODYCONTAINS 10 disgusting verbage MAILFROM 10 sorry individual Jim Rooth Klotron, Inc. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Sharyn Schmidt Sent: Tuesday, September 24, 2002 07:27 To: Declude Junkmail List Subject: [Declude.JunkMail] spam rec'd using internal return address Good morning :) One of my users is receiving some really disgusting porn email. The logs show that the sender is actually using HER address as the return address. Here is a snip from the IMAIL log: 09:23 23:13 SMTPD(29B2013E) [200.231.59.131] HELO aleph.inbrac.com.br 09:23 23:13 SMTPD(29B2013E) [200.231.59.131] MAIL FROM:<[EMAIL PROTECTED]> (this is NOT the IP address of my mail server) 09:23 23:13 SMTPD(29B2013E) [200.231.59.131] RCPT TO:<[EMAIL PROTECTED]> 09:23 23:13 SMTPD(29B2013E) [200.231.59.131] D:\IMAIL\spool\Dd85c13e.SMD 1329 09:23 23:13 SMTP-(00000A84) processing D:\IMAIL\spool\Qd85c13e.SMD 09:23 23:13 SMTP-(00000A84) ldeliver todhunter.com scarbo-main (1) <[EMAIL PROTECTED]> 1598 09:23 23:13 SMTP-(00000A84) finished D:\IMAIL\spool\Qd85c13e.SMD status=1 According to the Dec0923.log, the only test this message failed was the reverse DNS and obviously I don't rely solely on that test to block or attach spam. What is the best way to block this? Does Declude blacklist IP addresses or do I have to do this in IMAIL? Should this post go to the IMAIL users list? If so, my apologies! TIA, Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged "Best in the World" at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) <html><a href="http://www.cruzanrums.com";>www.cruzanrums.com</a></html> --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
