Re: [Declude.JunkMail] Stock Spam

[Scott Fisher]

Title: Message

I've been applying a filter to Geocities links since August 2005. It's just too common in spam. Being a business, I don't get a lot of valid email with a geocities link. I think ISPs would have more.   I do TESTSFAILED END CONTAIN on some good whitelist tests. I also skip for some yahoo IPs . I'm not sure I remember why, but perhaps it was to be safe. REVDNS  END ENDSWITH .scd.yahoo.com   Since I hold at 200, 75/100 points usually isn't enough points to interfere with good email. But it's enough points to help push the spam up escpecially with a spamdomains or some DUL hits. ----- Original Message ----- From: Goran Jovanovic To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 12:05 PM Subject: RE: [Declude.JunkMail] Stock Spam Scott,   Do you apply this filter to all incoming mail or just to some that have already hit something else?   You must also be referring to some other stock scam than what I am seeing. The stuff that is coming across my desk is the HTML stock stuff now with images in it. There is no reference to geocities of any type in it. Just curious to know what spam is doing this.   Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, February 02, 2006 12:46 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Stock Spam   Here's my geocities filter. It's a little more specific so I can weight foreign geocities more than US geocities.   STOPATFIRSTHIT   BODY  100 CONTAINS ar.geocities.com BODY  100 CONTAINS geocities.com.ar BODY  100 CONTAINS ar.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.ar   BODY  100 CONTAINS asia.geocities.com BODY  100 CONTAINS asia.geocities.yahoo.com   BODY  100 CONTAINS au.geocities.com BODY  100 CONTAINS geocities.com.au BODY  100 CONTAINS au.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.au   BODY  100 CONTAINS br.geocities.com BODY  100 CONTAINS geocities.com.br BODY  100 CONTAINS br.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.br   BODY  100 CONTAINS ca.geocities.com BODY  100 CONTAINS geocities.ca BODY  100 CONTAINS ca.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.ca   BODY  100 CONTAINS cf.geocities.com BODY  100 CONTAINS cf.geocities.yahoo.com   BODY  100 CONTAINS cn.geocities.com BODY  100 CONTAINS geocities.cn BODY  100 CONTAINS cn.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.cn   BODY  100 CONTAINS de.geocities.com BODY  100 CONTAINS geocities.de BODY  100 CONTAINS de.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.de   BODY  100 CONTAINS es.geocities.com BODY  100 CONTAINS geocities.es BODY  100 CONTAINS es.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.es   BODY  100 CONTAINS espanol.geocities.com BODY  100 CONTAINS espanol.geocities.yahoo.com   BODY  100 CONTAINS hk.geocities.com BODY  100 CONTAINS geocities.com.hk BODY  100 CONTAINS geocities.hk BODY  100 CONTAINS hk.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.hk BODY  100 CONTAINS geocities.yahoo.hk   BODY  100 CONTAINS in.geocities.com BODY  100 CONTAINS geocities.co.in BODY  100 CONTAINS in.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.co.in   BODY  100 CONTAINS it.geocities.com BODY  100 CONTAINS geocities.it BODY  100 CONTAINS it.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.it   BODY  100 CONTAINS kr.geocities.com BODY  100 CONTAINS geocities.co.kr BODY  100 CONTAINS kr.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.co.kr   BODY  100 CONTAINS mx.geocities.com BODY  100 CONTAINS geocities.com.mx BODY  100 CONTAINS mx.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.mx   BODY  100 CONTAINS sg.geocities.com BODY  100 CONTAINS geocities.com.sg BODY  100 CONTAINS sg.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.sg   BODY  100 CONTAINS uk.geocities.com BODY  100 CONTAINS geocities.co.uk BODY  100 CONTAINS uk.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.co.uk   BODY  75 CONTAINS geocities.com BODY  75 CONTAINS geocities.yahoo.com     ----- Original Message ----- From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:09 AM Subject: Re: [Declude.JunkMail] Stock Spam   If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter.   BODY 3 CONTAINS au.geocities.com   Sniffer, which I weight at 7, picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10.   -Dave Doherty  Skywaves, Inc.   ----- Original Message ----- From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam   Anyone have a good filter strategy on the increasing amount of stock spam???   Thanks,   Mike