Yes I do. The actual one I use is an external file for SpamCheck, as the processing time for a body filter with SpamCheck is a little better than a body filter test in Declude.
John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Goran Jovanovic > Sent: Saturday, April 24, 2004 9:13 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Phishing attempt- CitiBank > > John, > > Do you have a filter that searches for URLs in the BODY and that is what you added it > to? > > > > Goran Jovanovic > The LAN Shoppe > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > > Sent: Saturday, April 24, 2004 12:11 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Phishing attempt- CitiBank > > > > Thanks. > > > > I also added ".citibankonline.com:" without the quotes to the filter. > > (Note > > the colon.) > > > > John Tolmachoff > > Engineer/Consultant/Owner > > eServices For You > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan > > Sent: Saturday, April 24, 2004 8:43 AM > > To: [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] Phishing attempt- CitiBank > > > > Hi; > > Just received an email in our spam mailbox. > > > > Filter: pumpkinpieshow.com > > > > > > Here is the body: > > > > X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client > > [8014000e]. > > X-RBL-Warning: IPNOTINMX: > > X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail > > detected. > > X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command . > > X-RBL-Warning: FIVETEN-SPAM: 73.42.62.68.blackholes.five-ten-sg.com. > > X-RBL-Warning: NJABL-DYNA: "Dynamic/Residential IP range listed by NJABL > > dynablock - http://njabl.org/dynablock.html"; > > X-RBL-Warning: SORBS-DUL: "Dynamic IP Address See: > > http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=68.62.42.73"; > > X-Declude-Sender: [EMAIL PROTECTED] [68.62.42.73] > > X-Declude-Spoolname: D81f9027f00da4f91.SMD > > X-Note: > ===================================================== > ============= > > X-Note: Spam Score: 1029 [BLOCKED ON 20+ & DELETED ON 60+] > > X-Note: Scan Time: 11:04:36 on 04/24/2004 > > X-Note: Spool File: D81f9027f00da4f91.SMD > > X-Note: Server Name: pcp01153400pcs.newhav01.mi.comcast.net > > X-Note: SMTP Sender: [EMAIL PROTECTED] > > X-Note: Reverse DNS & IP: pcp01153400pcs.newhav01.mi.comcast.net > > [68.62.42.73] > > X-Note: Recipient(s):� **************** > > X-Note: Country Chain: UNITED STATES->destination > > X-Note: > ===================================================== > ============= > > X-Note: This E-mail was scanned & filtered by Declude [1.79i4] for SPAM & > > virus. > > X-Note: Spam and virus blocking services provided by ClickandPledge.com > > X-Note: > ===================================================== > ============= > > X-RCPT-TO: <******************> > > Status: U > > X-UIDL: 331478746 > > > > ------------63679840055420419 > > Content-Type: text/html; charset=us-ascii > > Content-Transfer-Encoding: quoted-printable > > > > This message was sent by the Citi=AE Cards Email Verification Server to > > ve= > > rify your email > > address. You must complete this process by clicking on the link below and > > = > > entering > > in the small window your Citibank ATM full Card Number and Pin that you > > us= > > e on ATM. > > (Please make sure that pop-up windows are enabled in your Internet > > Browser= > > , otherwise > > you will not be able to see the small window) This is done for your > > protec= > > tion, > > because some of our members no longer have access to their email > > addresses= > > �and > > we must verify them. > > > > To verify your e-mail address and access you Citibank account, click on > > th= > > e link below . > > If nothing happens when you click on the link, just copy and past the > > link= > > �into address bar > > of your web browser . > > http://www.citibankonline.com:ac- > > [EMAIL PROTECTED]/s= > > ys/index.html > > > > > > > > Thank you for using Citi. > > > > PLEASE DO NOT REPLY THIS MESSAGE. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
