Kami, Very nice and thanks for sharing. We also use Tom's list - but I see how this can really augment what we are doing with our declude from file rules.
-Don -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan Sent: Tuesday, January 14, 2003 4:56 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions Hi; [sorry for the long note] These files are changing everyday... Sure.. I hope the list does not mind. I have asked so we put a link on a location on our site and keep these files up to date. Similar to what Tom has done which has helped us quite a lot. Here is the legend to the files that are zipped. Please note: We hold on weight of 20. Some of these could be considered aggressive but believe me we may catch a positive 1 time a week. * Filter_Body.txt [filter]: This file is the words that we search for in the body. * Filter_BodyURL.txt [filter]: The URL's found in the body. * Filter_Header.txt [filter]: At times we have noticed that there are some servers that consistently show up in the connections that show up in our headers. Ex. Webhostingtotalk.com. So we added this to the header. We have our HOPHIGH set to 3. * Filter_MailFrom.txt [filter]: This is the mailfrom filter and certain characteristics are listed. If mailfrom email has these words in them. * Filter_Subject.txt [filter]: The subject words. Does subject include these. * JMFreeEmails.txt [fromfile]: This file is a list of all free email services we have found. This does not include hotmail.com or Yahoo.com but includes everything else. This list receives a weight of 5 regardless of what email. We have given BASE64 test a weight of 15. So if an email comes from a free email and is BASE64 is automatically held. * JMMailinglist.txt[fromfile]: This is the mailing lists that people subscribe to, e.g. CNN, etc. If these lists are caught then we add them to the list. This list receives -100 weight (negative 100). * JMBlacklistWgt.txt [fromfile]: comes from http://www.imagefxonline.net/apps/delog/fromfile.txt [any listing here is weight 20 - automatic hold] * JMBlacklist.txt [fromfile]: Our blacklist- We have a database and we run a unique on the list and export it to text. * JMPorn.txt [fromfile]: Recently separated from blacklist- emails from this list are deleted automatically. * JMSpammers.txt [fromfile]: Recently separated from blacklist- emails from this list are automatically deleted. * JMWatchList.txt [fromfile]: If we find an address that we are not sure we add them to the database. If additional occurances happen they will be moved to blacklist. If interested in knowing the syntax then it is the following: FILTER-HEADER filter d:\IMail\Declude\filter_header.txt x 0 0 FILTER-MAILFROM filter d:\IMail\Declude\filter_mailfrom.txt x 0 0 FILTER-SUBJECT filter d:\IMail\Declude\filter_subject.txt x 0 0 FILTER-BODY filter d:\IMail\Declude\filter_body.txt x 0 0 FILTER-BODYURL filter d:\IMail\Declude\filter_bodyurl.txt x 0 0 BLACKLIST fromfile D:\IMail\Declude\JMBlacklist.txt x 20 0 WATCHLIST fromfile D:\IMail\Declude\JMWatchlist.txt x 20 0 SPAMMERS fromfile D:\IMail\Declude\JMSpammers.txt x 20 0 PORN fromfile D:\IMail\Declude\JMPorn.txt x 20 0 BLACKLISTWRN fromfile D:\IMail\Declude\JMBlacklistWgt.txt x 20 0 FREEEMAILS fromfile D:\IMail\Declude\JMFreeEmails.txt x 5 0 # Negative Lists MAILINGLISTS fromfile D:\IMail\Declude\JMMailingLists.txt x -100 0 I hope this helps. Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Tuesday, January 14, 2003 3:48 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions > So we have an active URL list that if found in the body of emails it > will weigh them quite high. These URL's are real consistent and in > combination of subject filters we have blocked pretty much all of > them. Kami, that is a great idea. Would you be willing to share the list? Feel free to e-mail me off list if you like. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
