RE: [Declude.JunkMail] Blocking the attached message

[Colbeck, Andrew]

Title: Message

Sharyn and others, you can make a big dent in the pharmacy spammers' campaigns by picking the apppropriate RBLs, particularly with a hold weight as low as 10.   As the Chief SortMonster pointed out, these bad guys make heavy use of zombies, so a trip to   http://www.declude.com/junkmail/support/ip4r.htm   Would be well worth your time. I'm finding that these are very effective:   XBL DSBL NJABL SORBS   And more generally:   FIVETENSRC SPAMCOP   And last, everyone needs the:   SPAMDOMAINS   test that was introduced in April 2003 and is implemented in the current release (v1.75).  Check the mailing archive for an excellent sd.txt to fuel it.   As per the usual best-practice discussed on this list, I also recommend not putting a HOLD or DELETE action on any one test; give each test a low enough weight that you can be comfortable that it alone will not give you a false positive and hold the wrong mail.  Start low and then raise the weights once you've evaluated each new test on it's own merits in your environment.   Andrew 8) -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharyn Schmidt Sent: Tuesday, February 03, 2004 8:01 AM To: 'Declude Junkmail List' Subject: [Declude.JunkMail] Blocking the attached message   Sorry, folks, to attach spam to an email but this is driving me NUTS.   No matter what I do, I can't seem to block this!   Is anyone else successfully blocking this one?   Thanks, ~Sharyn~ Network Administrator Todhunter Information Systems "Helping You Meet Our Customers' Needs Through Better Information"