John,
Do you have a filter that searches for URLs in the BODY and that is what you added it
to?
Goran Jovanovic
The LAN Shoppe
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
> Sent: Saturday, April 24, 2004 12:11 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Phishing attempt- CitiBank
>
> Thanks.
>
> I also added ".citibankonline.com:" without the quotes to the filter.
> (Note
> the colon.)
>
> John Tolmachoff
> Engineer/Consultant/Owner
> eServices For You
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
> Sent: Saturday, April 24, 2004 8:43 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] Phishing attempt- CitiBank
>
> Hi;
> Just received an email in our spam mailbox.
>
> Filter: pumpkinpieshow.com
>
>
> Here is the body:
>
> X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client
> [8014000e].
> X-RBL-Warning: IPNOTINMX:
> X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail
> detected.
> X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command .
> X-RBL-Warning: FIVETEN-SPAM: 73.42.62.68.blackholes.five-ten-sg.com.
> X-RBL-Warning: NJABL-DYNA: "Dynamic/Residential IP range listed by NJABL
> dynablock - http://njabl.org/dynablock.html";
> X-RBL-Warning: SORBS-DUL: "Dynamic IP Address See:
> http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=68.62.42.73";
> X-Declude-Sender: [EMAIL PROTECTED] [68.62.42.73]
> X-Declude-Spoolname: D81f9027f00da4f91.SMD
> X-Note: ==================================================================
> X-Note: Spam Score: 1029 [BLOCKED ON 20+ & DELETED ON 60+]
> X-Note: Scan Time: 11:04:36 on 04/24/2004
> X-Note: Spool File: D81f9027f00da4f91.SMD
> X-Note: Server Name: pcp01153400pcs.newhav01.mi.comcast.net
> X-Note: SMTP Sender: [EMAIL PROTECTED]
> X-Note: Reverse DNS & IP: pcp01153400pcs.newhav01.mi.comcast.net
> [68.62.42.73]
> X-Note: Recipient(s):� ****************
> X-Note: Country Chain: UNITED STATES->destination
> X-Note: ==================================================================
> X-Note: This E-mail was scanned & filtered by Declude [1.79i4] for SPAM &
> virus.
> X-Note: Spam and virus blocking services provided by ClickandPledge.com
> X-Note: ==================================================================
> X-RCPT-TO: <******************>
> Status: U
> X-UIDL: 331478746
>
> ------------63679840055420419
> Content-Type: text/html; charset=us-ascii
> Content-Transfer-Encoding: quoted-printable
>
> This message was sent by the Citi=AE Cards Email Verification Server to
> ve=
> rify your email
> address. You must complete this process by clicking on the link below and
> =
> entering
> in the small window your Citibank ATM full Card Number and Pin that you
> us=
> e on ATM.
> (Please make sure that pop-up windows are enabled in your Internet
> Browser=
> , otherwise
> you will not be able to see the small window) This is done for your
> protec=
> tion,
> because some of our members no longer have access to their email
> addresses=
> �and
> we must verify them.
>
> To verify your e-mail address and access you Citibank account, click on
> th=
> e link below .
> If nothing happens when you click on the link, just copy and past the
> link=
> �into address bar
> of your web browser .
> http://www.citibankonline.com:ac-
> [EMAIL PROTECTED]/s=
> ys/index.html
>
>
>
> Thank you for using Citi.
>
> PLEASE DO NOT REPLY THIS MESSAGE.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
