Kami,
If you don't mind sharing with me as well. We are trying to
tighten down and it is always great to gain perspective from someone in
the trenches. Off list email: [EMAIL PROTECTED] Thank you for your
time.
-Keith
> -----Original Message-----
> From: Don Schreiner [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, January 15, 2003 5:53 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions
>
>
> Kami,
>
> Very nice and thanks for sharing. We also use Tom's list -
> but I see how this can really augment what we are doing with
> our declude from file rules.
>
> -Don
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan
> Sent: Tuesday, January 14, 2003 4:56 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions
>
>
> Hi; [sorry for the long note]
>
> These files are changing everyday...
>
> Sure.. I hope the list does not mind. I have asked so we
> put a link on a location on our site and keep these files up
> to date. Similar to what Tom has done which has helped us
> quite a lot.
>
> Here is the legend to the files that are zipped.
>
> Please note: We hold on weight of 20. Some of these could
> be considered aggressive but believe me we may catch a
> positive 1 time a week.
>
> * Filter_Body.txt [filter]: This file is the words that we
> search for in the body.
> * Filter_BodyURL.txt [filter]: The URL's found in the body.
> * Filter_Header.txt [filter]: At times we have noticed that
> there are some servers that consistently show up in the
> connections that show up in our headers. Ex.
> Webhostingtotalk.com. So we added this to the header. We
> have our HOPHIGH set to 3.
>
> * Filter_MailFrom.txt [filter]: This is the mailfrom filter
> and certain characteristics are listed. If mailfrom email has
> these words in them.
>
> * Filter_Subject.txt [filter]: The subject words. Does
> subject include these.
>
> * JMFreeEmails.txt [fromfile]: This file is a list of all free email
> services we have found. This does not include hotmail.com or
> Yahoo.com but includes everything else. This list receives a
> weight of 5 regardless of what email.
>
> We have given BASE64 test a weight of 15. So if an email
> comes from a free email and is BASE64 is automatically held.
>
> * JMMailinglist.txt[fromfile]: This is the mailing lists that
> people subscribe to, e.g. CNN, etc. If these lists are
> caught then we add them to the list. This list receives -100
> weight (negative 100).
>
> * JMBlacklistWgt.txt [fromfile]: comes from
> http://www.imagefxonline.net/apps/delog/fromfile.txt [any
> listing here is weight 20 - automatic hold]
>
> * JMBlacklist.txt [fromfile]: Our blacklist- We have a
> database and we run a unique on the list and export it to text.
>
> * JMPorn.txt [fromfile]: Recently separated from blacklist- emails
> from
> this list are deleted automatically.
>
> * JMSpammers.txt [fromfile]: Recently separated from
> blacklist- emails
> from this list are automatically deleted.
>
> * JMWatchList.txt [fromfile]: If we find an address that we
> are not sure we add them to the database. If additional
> occurances happen they will be moved to blacklist.
>
> If interested in knowing the syntax then it is the following:
>
> FILTER-HEADER filter d:\IMail\Declude\filter_header.txt
> x 0 0
> FILTER-MAILFROM filter
> d:\IMail\Declude\filter_mailfrom.txt
> x 0 0
> FILTER-SUBJECT filter
> d:\IMail\Declude\filter_subject.txt
> x 0 0
> FILTER-BODY filter d:\IMail\Declude\filter_body.txt
> x 0 0
> FILTER-BODYURL filter
> d:\IMail\Declude\filter_bodyurl.txt
> x 0 0
>
> BLACKLIST fromfile D:\IMail\Declude\JMBlacklist.txt
> x 20 0
> WATCHLIST fromfile D:\IMail\Declude\JMWatchlist.txt
> x 20 0
> SPAMMERS fromfile D:\IMail\Declude\JMSpammers.txt
> x 20 0
> PORN fromfile D:\IMail\Declude\JMPorn.txt
> x 20 0
>
> BLACKLISTWRN fromfile D:\IMail\Declude\JMBlacklistWgt.txt
> x 20 0
> FREEEMAILS fromfile
> D:\IMail\Declude\JMFreeEmails.txt
> x 5 0
>
> # Negative Lists
>
> MAILINGLISTS fromfile
> D:\IMail\Declude\JMMailingLists.txt
> x -100 0
>
> I hope this helps.
>
> Regards,
> Kami
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]] On Behalf Of John
> Tolmachoff
> Sent: Tuesday, January 14, 2003 3:48 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions
>
>
> > So we have an active URL list that if found in the body of
> emails it
> > will weigh them quite high. These URL's are real consistent and in
> > combination of subject filters we have blocked pretty much all of
> > them.
>
> Kami, that is a great idea. Would you be willing to share the
> list? Feel free to e-mail me off list if you like.
>
> John Tolmachoff MCSE, CSSA
> IT Manager, Network Engineer
> RelianceSoft, Inc.
> Fullerton, CA 92835
> www.reliancesoft.com
>
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
