Thanks Darrell, Close to 24 hours since I implemented this and haven't had a single message get through Declude+invURIBL!
Cavell McDermott Network Administrator Cottonwood Financial 972.753.0822 Office 214.403.4918 Cell http://www.thecashstore.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, February 14, 2006 11:44 AM To: [email protected] Subject: Re: [Declude.JunkMail] How would I catch email like this? Implement a URI filtering type application like our invURIBL. The domain in the email is listed in both SURBL and URIBL and would have been caught. Non-authoritative answer: Name: benawarde.com.multi.surbl.org Address: 127.0.0.102 Non-authoritative answer: Name: benawarde.com.multi.uribl.com Address: 127.0.0.2 Darrell ------------------------------------------- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. mail-lists writes: > Never seen an e-mail like this.. Obviously didn't hit my bodyfilter for > VIAGRA or VALIUM. Not quite sure how to scan for something like this. Or > even give a better description of what it is.. When viewing it in html if I > go to highlight the readable text, it also highlights the garbled text on > the right side of the page. > > Thanks! > > Here is the body in plain text. > > > Hello > > VyI w AvGiRbAs j $r3j,s7c5 y VvAaL r l p U n Mu b$k1u,k2 p 1dCqIvA o LpImS > n w $ r 3s,h3 m 3k > and many other http://www.benawarde.com > > Here is the HTML.. > > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> > <HTML><HEAD> > <META http-equiv=Content-Type content="text/html; charset=us-ascii"> > <META content="MSHTML 6.00.2800.1106" name=GENERATOR> > <STYLE></STYLE> > </HEAD> > <BODY bgColor=#ffffff> > <DIV><FONT face=Arial size=2>Hello</FONT></DIV> > <DIV><FONT face=Arial size=2></FONT> </DIV> > <DIV><FONT face=Arial size=2>V<span style="BORDER-LEFT: 0px; float: > right">y</span>I<span style="BORDER-LEFT: 0px; float: right"> w > </span>A<span style="BORDER-LEFT: 0px; float: right">v</span>G<span > style="BORDER-LEFT: 0px; float: right">i</span>R<span style="BORDER-LEFT: > 0px; float: right">b</span>A<span style="BORDER-LEFT: 0px; float: > right">s</span> <span style="BORDER-LEFT: 0px; float: right"> j > </span>$<span style="BORDER-LEFT: 0px; float: right">r</span>3<span > style="BORDER-LEFT: 0px; float: right">j</span>,<span style="BORDER-LEFT: > 0px; float: right">s</span>7<span style="BORDER-LEFT: 0px; float: > right">c</span>5<span style="BORDER-LEFT: 0px; float: right"> y > </span></FONT></DIV> > <DIV><FONT face=Arial size=2>V<span style="BORDER-LEFT: 0px; float: > right">v</span>A<span style="BORDER-LEFT: 0px; float: right">a</span>L<span > style="BORDER-LEFT: 0px; float: right"> r </span>l<span style="BORDER-LEFT: > 0px; float: right"> p </span>U<span style="BORDER-LEFT: 0px; float: right"> > n </span>M<span style="BORDER-LEFT: 0px; float: right">u</span> <span > style="BORDER-LEFT: 0px; float: right">b</span>$<span style="BORDER-LEFT: > 0px; float: right">k</span>1<span style="BORDER-LEFT: 0px; float: > right">u</span>,<span style="BORDER-LEFT: 0px; float: right">k</span>2<span > style="BORDER-LEFT: 0px; float: right"> p </span>1<span style="BORDER-LEFT: > 0px; float: right">d</span></FONT></DIV> > <DIV><FONT face=Arial size=2>C<span style="BORDER-LEFT: 0px; float: > right">q</span>I<span style="BORDER-LEFT: 0px; float: right">v</span>A<span > style="BORDER-LEFT: 0px; float: right"> o </span>L<span style="BORDER-LEFT: > 0px; float: right">p</span>I<span style="BORDER-LEFT: 0px; float: > right">m</span>S<span style="BORDER-LEFT: 0px; float: right"> n > </span> <span style="BORDER-LEFT: 0px; float: right"> w </span>$<span > style="BORDER-LEFT: 0px; float: right"> r </span>3<span style="BORDER-LEFT: > 0px; float: right">s</span>,<span style="BORDER-LEFT: 0px; float: > right">h</span>3<span style="BORDER-LEFT: 0px; float: right"> m > </span>3<span style="BORDER-LEFT: 0px; float: right">k</span></FONT></DIV> > <DIV><FONT face=Arial size=2></FONT> </DIV> > <DIV><FONT face=Arial size=2>and many other <A > href="http://www.benawarde.com";><FONT face=Arial > size=2>http://www.benawarde.com</FONT></A></FONT></DIV></BODY></HTML> > > > > > > > > Confidentiality Notice: The information contained in this transmission is intended only for the personal and confidential use of the > designated recipient named above. If the receiver of this transmission is not the intended recipient or an agent responsible for > delivering it to the intended recipient, you are hereby notified that you have received this document in error, and that any review, > dissemination, distribution, or copying of this message is strictly prohibited. If you are not the intended recipient, please > immediately notify the sender and delete this e-mail message from your system. > > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. Confidentiality Notice: The information contained in this transmission is intended only for the personal and confidential use of the designated recipient named above. If the receiver of this transmission is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error, and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you are not the intended recipient, please immediately notify the sender and delete this e-mail message from your system. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
