Kami, I believe this can be nailed with:
MAILFROM 0 CONTAINS <> But Scott is correct, this should be used only as a weighted test as it will trigger on every non delivery report and then some. Markus, I would like to expand my search to include some of the types you identified. Any idea how to nail these with a content filter?: X-Declude-Sender: dtcLISA [212.19.66.109] X-Declude-Sender: FREE [61.194.11.2] Dan On Sunday, January 19, 2003 9:59, Kami Razvan <[EMAIL PROTECTED]> wrote: >Message >Hi; >I know this subject was discussed but I can not find it in the archives. > >We are seeing more and more SPAM that have IP address as return >address. I just can't think of a legitimate email that would do that. > >============================= >X-RBL-Warning: IPNOTINMX: >X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000100f]. >X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 8. >X-RBL-Warning: WORDFILTERMx: Message failed WORDFILTERMx test (2) >X-RBL-Warning: COUNTRY: Message failed COUNTRY test (215) >X-Declude-Sender: <> [12.4.218.17] >X-Declude-Spoolname: Db07e004f01f2ba39.SMD >X-Note: This E-mail was scanned & filtered by Declude [1.66i2] for SPAM & virus. >X-Spam-Tests-Failed: IPNOTINMX, SPAMHEADERS, SPAMCHK, >WORDFILTERMx, COUNTRY, WEIGHT20s, WEIGHT20r >X-Weight: 26 >============================= > >Was there a decision made on how to treat these? Anyway to add >weight if return address is an IP? > >I will keep on searching the archives. > >Regards, >Kami > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
