Hi; This email could have been caught if some guidelines are used in the filter file. In our filter file this would have never been sent but would have been routed to the admin.
1: incident of XXX in the MAILFROM 2: the words in the subject are in our subject filter file These two alone would not have made the email pass. We also would catch this the 2nd time with the URL used in the body. I know this is after the first incident but the first two would not have let it go through the first time. I think a collective effort of URL's and IP's used in the body would be a great initiative which would be in essence similar to the blacklist for emails. The one advantage of this approach over the email is simply the SPAM'ers can use different emails when they send the mail but always keep the same addresses in the body. This is some of our observations: 1: URL's used in body 2: IP's used body 3: Phone numbers used in body 4: Return addresses used in body These don't change as much as the email addresses change. Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Aaron Moreau-Cook Sent: Saturday, February 08, 2003 1:38 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Dealing with Nasty Spams Declude List, First, let me apologize for the vulgarity of the e-mail I have attached below. Second, has anyone found a effective way to deal with this type of spam? This e-mail apparently was under our HOLD limit of 10, so it was forwarded onto our client (concealed for his protection). I could add the words below to our word filter, but it seems every day we get a new variation of words coming through (slutts, sluuts, s!uts, slut5, etc.). Thanks in advance -----Original Message----- From: Eric Raymonds [mailto:[EMAIL PROTECTED]] Sent: Monday, January 06, 2003 9:33 PM To: [EMAIL PROTECTED] Subject: Enormous diicks riping tight poosies apart Large penls breaking tight cuunts apart http://boulealeanu.hardgiants.info/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
