I have 2 filters for that: In my BASICFILTER: SUBJECT 10 ISBLANK
In my GRAYFILTER4: BODY 25 STARTSWITH <g It has been extremely effective on that. John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Scot Desort > Sent: Thursday, November 27, 2003 8:01 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] 8 bit encoding > > I have seen a lot of mail like this one scoring low on Declude: > > X-F: <[EMAIL PROTECTED]> Sat Nov 22 06:08:11 2003 > Received: from tekes.fi [80.56.186.84] by njaccess.com > (SMTPD32-6.06) id A394206D005E; Sat, 22 Nov 2003 06:08:04 -0500 > Message-ID: <[EMAIL PROTECTED]> > From: "Sybil D. Neely" <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: > Date: Sun, 23 Nov 2003 02:23:38 +0000 > MIME-Version: 1.0 > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2800.1158 > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 > Content-Type: text/html > Content-Transfer-Encoding: 8bit > X-RBL-Warning: FIVETENSRC: 84.186.56.80.blackholes.five-ten-sg.com. > X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (96) > X-RBL-Warning: ANTIGIBBERISH: Message failed ANTIGIBBERISH test (53) > X-Declude-Sender: [EMAIL PROTECTED] [80.56.186.84] > X-Declude-Spoolname: D439405e.SMD > X-SpamWatch-Tests-Failed: EASYNET-DYNA, FIVETENSRC, IPNOTINMX, > NOLEGITCONTENT, GIBBERISH, ANTIGIBBERISH, FOREIGN [6] > X-SpamWatch-Country-Chain: NETHERLANDS->destination > X-SpamWatch-ReverseLookUp: f186084.upc-f.chello.nl ([80.56.186.84]). > X-RCPT-TO: <[EMAIL PROTECTED]> > X-UIDL: 362076914 > Status: U > > <gyvpznjdrufwnx><font color="white">ufabnkxbdris<gjbimlhlrbqljb> > rjcvvcjzrgth <gemotyrdifsk>fkauewcugfimk <geqfppqbcqxai>svpolbcuds > egbftgdihh > ggbaxkcuiazty<gdxdecibhfsovd></font><gartymfckjfrcj><br><gasunzscmkk> > <font color="white">sxevtgbewm <gxzmadrqaaeupx>rcwkircgel > <gxnjljpbfuv>mgdkhfqhqd<ggjribadezeaag> ukmfmpbloj<gimjotcdieisbz> > fgbzancgjeo > <gwyrtntfwaee>iqnqceziepk</font><gbpuzkbdzyzhlg><br><gruzkohbxdbh> > <b><glaitqxdgqq>LO<gbbcsqudibz>SE<gfaigjrcnqeff> > <gcmnbmjbwzl>WE<ghoncnjlakguac>IG<gmtsdthcgucjfwx>HT > <gsrlqukbgfidsm>TH<ghvhfnnbvqva>E > <gjcfukdbhjnkanc>E<gqjxxxtdqfso>ASI<gxcfhbbdpqglw>ER > W<gvrobgjcwerc>AY<grzdgrtbuom></b><guqassadqplx><br> > <gfunlxdcgwv><i>"I<ghththgcueaor>T'S<gbdtyvqdoxr> > N<gcrlcqzcntb>OT<gdjcisnccny> A<gquakrdruzooyp> > <guyrrqdapeludl>DI<gojmghdsqcwencl>ET<getrjehclmmvbq> > .<gotrbwzdisruzg>..<ggdxkotdikccrqd>. > <ganxbhedfpep>IT<gzvsbvxdpszqm>'S<gsexxusccwf> A<gaebgdkcgizkaed> > PA<gxuchmbxqrcv>TC<ggbojksqbniysq>H"<br></i> > <br> > <b>O<gbhklijpissfrbq>R<gsfxaxrbpynmfad>DE<gedazoybyto>R > <gextfsgbwdwqoa>TO<gchxgkycmoca>DA<gjmioiflmuzmi>Y > <gukuxyferuxmxb>AN<gmruydmdscjobbu>D > <gmfuvmzbgfz>GE<gwvhoyebzbefix>T</b><geaasgibvptd><br><gqzphsncbxha> > <i><gmqefrjbcwhb>5 <gfjejaeiuqp>MO<gejkrcacbrrzzcz>NT<ggbvpcabshyvd>H > <gbidfbvbnvdyesb>SU<gkxgmuncmttlr>PP<gwiuvjhbuzkj>LY<gerzmkbdgdmas> > <gkbdhlbmafy>FO<gaeazbqclhra>R T<gvazcmdbzay>HE > <gazqfnsdmknreqc>PR<gvypngoujbmo>IC<gkcbeltdryejbbc>E <gdkazotdjbzle>OF > <ghdpdmcbdrmjxa>4<gmzcvzydqeh>!<br><gslzceacbiofxxb><br><gdbnjbrdveyio></i > >< > gncinrcbhmqp> > R<gvslsdbyxvr>ec<gaalotdcajpk>en<gxhypewntqxncyt>t > <gcvoqsibulkuqvd>su<goecnycewkujmj>rv<gzofslebapk>ey<gkrrrqultpthhbf>s > e<ghhbmerwgai>sti<gpyrqyxdypfz>mat<gnksrazdluu>e > t<gyurazhszrlen>ha<gfnbpludxxuhax>t > <glgphfickveapct>7<gvcwgwweplkidda>0<gfocoindzcrung>%<ggeyejzcpsapp> > > <snip> > > It seems as though the 8 bit encoding may have a lot to do with it. It > trips > both gibberish and antigibberish. > > Is anyone here doing any header tests for "Content-Transfer-Encoding: > 8bit" > and adding a few points for it? When declude filters do body filtering, do > they account for 8 bit encoding, and decode the body prior to running the > tests? Seems like we are getting a lot of 8 bit messages coming through > lately. > > -- > Scot > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
