Scott.. Thanks.. I guess this still leaves the other variation up for attack..
[EMAIL PROTECTED] We have seen this also.. When they are sending email with userID and IP. I guess one way to decipher this is if the last characters after the last period are not letters. Can that be a filter? Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Sunday, January 19, 2003 2:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Return address <IP> >Is it a viable solution to filter the header for: > >From: <> No -- a spammer would probably send an E-mail with a return address ("MAIL FROM") of "<>", but have a header like "From: Youwill berich <[EMAIL PROTECTED]>". You could filter with something like: MAILFROM 2 CONTAINS <> -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
