[Declude.JunkMail] AOL - AIM Spam

[David Barker]

I see that there is quite a bit of spam coming though .mx.aol.com servers
but I also noticed  that they tag the messages as spam in the headers
X-Spam-Flag: YES 

 

As a suggestion if you are receiving messages from .mx.aol.com or @aim.com
addresses that are spam use the following line in a Declude filter.

 

HEADERS 20   PCRE  (X-Spam-Flag:
YES)

 

David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
 mailto:dbar...@declude.com dbar...@declude.com

 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] AOL - AIM Spam

[Sanford Whiteman]

 HEADERS 20   PCRE  (X-Spam-Flag:
 YES)

A  problem  with doing this as a single (non-combo) filter is that you
are  using  a  trusting  a common x-header regardless of source and/or
documentation.  This  allows  for  pretty easy poisoning of a weighted
system. If anybody should be, y'know, malicious out there

--Sandy




Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: sa...@cypressintegrated.com

SpamAssassin plugs into Declude!
  http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases!
  
http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/
  
http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.