Re: [Declude.JunkMail] ROUTING and COUNTRIES
If Declude is reading this, maybe they could add these values to their Knowledge Base. http://support.declude.com/Customer/KBArticle.aspx?articleid=6KBSearchID=1012 I also found a country code list that included some of the codes Scott mentioned at the bottom of this page: http://it.farmprogress.com/declude/declude.htm Original Message From: Scott Fisher [EMAIL PROTECTED] Sent: Friday, September 16, 2005 4:15 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES Yes COUNTRIES 0 CONTAINS *A is correct. The Asterick is a literal. codes I know of: *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 2:06 PM Subject: re: [Declude.JunkMail] ROUTING and COUNTRIES I guess it depends on exactly what text it is searching for. In looking at my log files (set to Debug), I see that when it is checking the COUNTRIES filter I created, it displays a message like Checking countries: *A . Is it actually looking for an asterisk followed by an A? Here are some non-countries and the corresponding text displayed in the log file: [ARIN Unlisted] *A [RIPE Unlisted] *E [IANA Reserved] *R [Unknown] *U Does this mean we should be using a line like COUNTRIES0CONTAINS*A Is that asterisk a literal or will it act as a wildcard? Is anyone using this in a country filter? Original Message From: Nick Hayer [EMAIL PROTECTED] Sent: Friday, September 16, 2005 12:36 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] ROUTING and COUNTRIES Help from the guru's please... Wouldn't [shouldn't] this email fail the ROUTING test? X-Country-Chain: UNITED STATES-[IANA Reserved]-UNITED STATES-destination X-Note: SMTP Sender: [EMAIL PROTECTED] X-Note: Sent from: [Revdns: [No Reverse DNS]] [RemoteHostDomain: lgvsoft.at] [RemoteIP: 58.142.35.136] [SenderHost: lgvsoft.at] X-Note: Spam [v:2.0.6.16] tests: IP4R.SORBS.DYNAMIC [0], EXTERNAL.CIP.OnlyIp [2], TEST.DYNHELO [5], TEST.REVDNS [0], FILTER.DYNA [5], FILTER.COMBO.DYNHELO.CIP [3] Also - is there a way to determine that this email came from/through a foreign [to the US] source? This email did not trigger on a foreign filter file that contains: COUNTRIES0CONTAINSIANA Reserved Same file has these than never trigger it seems either COUNTRIES0CONTAINSARIN Unlisted COUNTRIES0CONTAINSRIPE Unlisted Thanks! -Nick --- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ROUTING and COUNTRIES
If Declude is reading this... To help comfort those who think we are not paying attention. We read all posts and take notice of everything that is said. I will look at adding this to the Knowledge Base next week. David Barker www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Sunday, September 18, 2005 12:11 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES If Declude is reading this, maybe they could add these values to their Knowledge Base. http://support.declude.com/Customer/KBArticle.aspx?articleid=6KBSearchID=10 12 I also found a country code list that included some of the codes Scott mentioned at the bottom of this page: http://it.farmprogress.com/declude/declude.htm Original Message From: Scott Fisher [EMAIL PROTECTED] Sent: Friday, September 16, 2005 4:15 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES Yes COUNTRIES 0 CONTAINS *A is correct. The Asterick is a literal. codes I know of: *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 2:06 PM Subject: re: [Declude.JunkMail] ROUTING and COUNTRIES I guess it depends on exactly what text it is searching for. In looking at my log files (set to Debug), I see that when it is checking the COUNTRIES filter I created, it displays a message like Checking countries: *A . Is it actually looking for an asterisk followed by an A? Here are some non-countries and the corresponding text displayed in the log file: [ARIN Unlisted] *A [RIPE Unlisted] *E [IANA Reserved] *R [Unknown] *U Does this mean we should be using a line like COUNTRIES0CONTAINS*A Is that asterisk a literal or will it act as a wildcard? Is anyone using this in a country filter? Original Message From: Nick Hayer [EMAIL PROTECTED] Sent: Friday, September 16, 2005 12:36 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] ROUTING and COUNTRIES Help from the guru's please... Wouldn't [shouldn't] this email fail the ROUTING test? X-Country-Chain: UNITED STATES-[IANA Reserved]-UNITED STATES-destination X-Note: SMTP Sender: [EMAIL PROTECTED] X-Note: Sent from: [Revdns: [No Reverse DNS]] [RemoteHostDomain: lgvsoft.at] [RemoteIP: 58.142.35.136] [SenderHost: lgvsoft.at] X-Note: Spam [v:2.0.6.16] tests: IP4R.SORBS.DYNAMIC [0], EXTERNAL.CIP.OnlyIp [2], TEST.DYNHELO [5], TEST.REVDNS [0], FILTER.DYNA [5], FILTER.COMBO.DYNHELO.CIP [3] Also - is there a way to determine that this email came from/through a foreign [to the US] source? This email did not trigger on a foreign filter file that contains: COUNTRIES0CONTAINSIANA Reserved Same file has these than never trigger it seems either COUNTRIES0CONTAINSARIN Unlisted COUNTRIES0CONTAINSRIPE Unlisted Thanks! -Nick --- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ROUTING and COUNTRIES
That's enough to make you paranoid. ;)
Original Message
From: David Barker [EMAIL PROTECTED]
Sent: Sunday, September 18, 2005 2:18 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] ROUTING and COUNTRIES
If Declude is reading this... To help comfort those who think we are not
paying attention. We read all posts and take notice of everything that is
said.
I will look at adding this to the Knowledge Base next week.
David Barker
www.declude.com
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner
Sent: Sunday, September 18, 2005 12:11 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES
If Declude is reading this, maybe they could add these values to their
Knowledge Base.
http://support.declude.com/Customer/KBArticle.aspx?articleid=6KBSearchID=10
12
I also found a country code list that included some of the codes Scott
mentioned at the bottom of this page:
http://it.farmprogress.com/declude/declude.htm
Original Message
From: Scott Fisher [EMAIL PROTECTED]
Sent: Friday, September 16, 2005 4:15 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES
Yes COUNTRIES 0 CONTAINS *A is correct. The Asterick is a literal.
codes I know of:
*1 Multi-Regional
*2 Europe
*3 North America
*4 Central/South America
*5 Pacific Rim
*A ARIN Unlisted (North America/South Africa)
*B Public Data Network
*E RIPE Unlisted (Europe, North Africa, Middle East)
*I Private IP
*L Loopback
*M Multicast
*P APNIC Unlisted (Asia Pacific)
*R IANA Reserved
*U Unknown
- Original Message -
From: Gary Steiner [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 16, 2005 2:06 PM
Subject: re: [Declude.JunkMail] ROUTING and COUNTRIES
I guess it depends on exactly what text it is searching for. In looking
at
my log files (set to Debug), I see that when it is checking the COUNTRIES
filter I created, it displays a message like Checking countries: *A .
Is
it actually looking for an asterisk followed by an A? Here are some
non-countries and the corresponding text displayed in the log file:
[ARIN Unlisted] *A
[RIPE Unlisted] *E
[IANA Reserved] *R
[Unknown] *U
Does this mean we should be using a line like
COUNTRIES0CONTAINS*A
Is that asterisk a literal or will it act as a wildcard? Is anyone using
this in a country filter?
Original Message
From: Nick Hayer [EMAIL PROTECTED]
Sent: Friday, September 16, 2005 12:36 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] ROUTING and COUNTRIES
Help from the guru's please...
Wouldn't [shouldn't] this email fail the ROUTING test?
X-Country-Chain: UNITED STATES-[IANA Reserved]-UNITED
STATES-destination
X-Note: SMTP Sender: [EMAIL PROTECTED]
X-Note: Sent from: [Revdns: [No Reverse DNS]] [RemoteHostDomain:
lgvsoft.at] [RemoteIP: 58.142.35.136] [SenderHost: lgvsoft.at]
X-Note: Spam [v:2.0.6.16] tests: IP4R.SORBS.DYNAMIC [0],
EXTERNAL.CIP.OnlyIp [2], TEST.DYNHELO [5], TEST.REVDNS [0], FILTER.DYNA
[5], FILTER.COMBO.DYNHELO.CIP [3]
Also - is there a way to determine that this email came from/through a
foreign [to the US] source?
This email did not trigger on a foreign filter file that contains:
COUNTRIES0CONTAINSIANA Reserved
Same file has these than never trigger it seems either
COUNTRIES0CONTAINSARIN Unlisted
COUNTRIES0CONTAINSRIPE Unlisted
Thanks!
-Nick
---
---
[This E-mail scanned for viruses by Declude Virus]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail scanned for viruses by Declude Virus]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail scanned for viruses by Declude Virus]
---
This E-mail came
RE: [Declude.JunkMail] Interesting spam footer
Title: Message It looks like a great opportunity to actually meet a real live spammer in person in front of a judge. Sign me up. Mike -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Sunday, September 18, 2005 4:38 PMTo: IMail_Forum@list.ipswitch.com; Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Interesting spam footer Thought this was interesting... a spammer trying to usefear of prosecutionto stop people from reporting their email as spam. Thespam was sent to a postmasteraddress never used for outgoing mail... Darin. =IMPORTANT INFORMATION CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 2003This is one of a number of commercial email messages that you,or someone using your computer, agreed to receive this messageWARNING!!!ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, PERSONS, ISPs OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED TO THE FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION RESULT IN ANY INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE COMPANY AND/OR RESULT IN LOSS OF INCOME AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE BROUGHT
Re: [Declude.JunkMail] Interesting spam footer
OK, so I guess the point is the recipient has to prove that the message is spam? Sounds like "blame the victim"... And maybe the recipient has to buy what's being offered to avoid running afoul of the "LOSS OF INCOME" claim. And what was being advertised? Anything useful to the recipient? Did this come from a source in the US? Interesting "English" there is the lower-case sentence... Mike, my guess is there's no court with jursidiction. But if it WEREprosecuted in the US, I would love to attend the trial! -Dave Doherty Skywaves, Inc. - Original Message - From: Darin Cox To: IMail_Forum@list.ipswitch.com ; Declude.JunkMail@declude.com Sent: Sunday, September 18, 2005 7:38 PM Subject: [Declude.JunkMail] Interesting spam footer Thought this was interesting... a spammer trying to usefear of prosecutionto stop people from reporting their email as spam. Thespam was sent to a postmasteraddress never used for outgoing mail... Darin. =IMPORTANT INFORMATION CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 2003This is one of a number of commercial email messages that you,or someone using your computer, agreed to receive this messageWARNING!!!ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, PERSONS, ISPs OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED TO THE FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION RESULT IN ANY INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE COMPANY AND/OR RESULT IN LOSS OF INCOME AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE BROUGHT
Re: [Declude.JunkMail] Interesting spam footer
The site being advertised was www.ebay-laptop.com. Silly really. They're just asking for trouble with that statement. Came in from 82.96.105.2, but with a fake yahoo email address. Darin. - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Sunday, September 18, 2005 8:54 PM Subject: Re: [Declude.JunkMail] Interesting spam footer OK, so I guess the point is the recipient has to prove that the message is spam? Sounds like "blame the victim"... And maybe the recipient has to buy what's being offered to avoid running afoul of the "LOSS OF INCOME" claim. And what was being advertised? Anything useful to the recipient? Did this come from a source in the US? Interesting "English" there is the lower-case sentence... Mike, my guess is there's no court with jursidiction. But if it WEREprosecuted in the US, I would love to attend the trial! -Dave Doherty Skywaves, Inc. - Original Message - From: Darin Cox To: IMail_Forum@list.ipswitch.com ; Declude.JunkMail@declude.com Sent: Sunday, September 18, 2005 7:38 PM Subject: [Declude.JunkMail] Interesting spam footer Thought this was interesting... a spammer trying to usefear of prosecutionto stop people from reporting their email as spam. Thespam was sent to a postmasteraddress never used for outgoing mail... Darin. =IMPORTANT INFORMATION CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 2003This is one of a number of commercial email messages that you,or someone using your computer, agreed to receive this messageWARNING!!!ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, PERSONS, ISPs OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED TO THE FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION RESULT IN ANY INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE COMPANY AND/OR RESULT IN LOSS OF INCOME AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE BROUGHT
Re: [Declude.JunkMail] Interesting spam footer
Well, the website resolves to 82.96.105.6, so at least they are consistent. It's a Euro IP address. Here's what RIPE reports about the IP: % This is the RIPE Whois query server #2.% The objects are in RPSL format.%% Note: the default output of the RIPE Whois server% is changed. Your tools may need to be adjusted. See% http://www.ripe.net/db/news/abuse-proposal-20050331.html% for more details.%% Rights restricted by copyright.% See http://www.ripe.net/db/copyright.html % Note: This output has been filtered.% To receive output for a database update, use the "-B" flag % Information related to '82.96.105.0 - 82.96.105.255' inetnum: 82.96.105.0 - 82.96.105.255netname: DE-ITelligencedescr: ITelligence sprlcountry: DEadmin-c: PN357-RIPEtech-c: PN357-RIPEstatus: ASSIGNED PAmnt-by: PROBE-MNTmnt-lower: PROBE-MNTsource: RIPE # Filtered person: Philippe Nihouladdress: ITelligence sprl 47, Place Favresse La Hulpe, 1310 BEphone: +32 6551170fax-no: +32 6551170e-mail: [EMAIL PROTECTED]nic-hdl: PN357-RIPEmnt-by: PROBE-MNTsource: RIPE # Filtered % Information related to '82.96.64.0/18AS29686' route: 82.96.64.0/18descr: Probe Networks european networkorigin: AS29686mnt-by: PROBE-MNTsource: RIPE # Filtered - Original Message - From: Darin Cox To: Declude.JunkMail@declude.com Sent: Sunday, September 18, 2005 9:35 PM Subject: Re: [Declude.JunkMail] Interesting spam footer The site being advertised was www.ebay-laptop.com. Silly really. They're just asking for trouble with that statement. Came in from 82.96.105.2, but with a fake yahoo email address. Darin. - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Sunday, September 18, 2005 8:54 PM Subject: Re: [Declude.JunkMail] Interesting spam footer OK, so I guess the point is the recipient has to prove that the message is spam? Sounds like "blame the victim"... And maybe the recipient has to buy what's being offered to avoid running afoul of the "LOSS OF INCOME" claim. And what was being advertised? Anything useful to the recipient? Did this come from a source in the US? Interesting "English" there is the lower-case sentence... Mike, my guess is there's no court with jursidiction. But if it WEREprosecuted in the US, I would love to attend the trial! -Dave Doherty Skywaves, Inc. - Original Message - From: Darin Cox To: IMail_Forum@list.ipswitch.com ; Declude.JunkMail@declude.com Sent: Sunday, September 18, 2005 7:38 PM Subject: [Declude.JunkMail] Interesting spam footer Thought this was interesting... a spammer trying to usefear of prosecutionto stop people from reporting their email as spam. Thespam was sent to a postmasteraddress never used for outgoing mail... Darin. =IMPORTANT INFORMATION CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 2003This is one of a number of commercial email messages that you,or someone using your computer, agreed to receive this messageWARNING!!!ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, PERSONS, ISPs OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED TO THE FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION RESULT IN ANY INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE COMPANY AND/OR RESULT IN LOSS OF INCOME AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE BROUGHT
[Declude.JunkMail] Interesting spam footer
Thought this was interesting... a spammer trying to usefear of prosecutionto stop people from reporting their email as spam. Thespam was sent to a postmasteraddress never used for outgoing mail... Darin. =IMPORTANT INFORMATION CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 2003This is one of a number of commercial email messages that you,or someone using your computer, agreed to receive this messageWARNING!!!ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, PERSONS, ISPs OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED TO THE FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION RESULT IN ANY INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE COMPANY AND/OR RESULT IN LOSS OF INCOME AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE BROUGHT
