[Declude.JunkMail] How to stop these?
And ideas on how I would stop these from getting through. Thanks, Todd Hunter Smart Mail -- Received: from mail2.smart-mail.net [65.16.167.134] by net.smart-mail.net (SMTPD32-8.15) id A67D1E10156; Mon, 03 Apr 2006 14:24:45 -0500 Received: from fxi.com ([84.220.55.194]) by mail2.smart-mail.net (SMSSMTP 4.0.0.59) with SMTP id M2006040314252611030 for toddt; Mon, 03 Apr 2006 14:25:27 -0500 Message-ID: [EMAIL PROTECTED] Reply-To: Liviu Gaeth [EMAIL PROTECTED] From: Liviu Gaeth [EMAIL PROTECTED] To: todd Subject: see new Date: Mon, 3 Apr 2006 15:23:36 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0001_01C65732.93DB6C50 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-RBL-Warning: FIVETENSRC: 194.55.220.84.blackholes.five-ten-sg.com. X-RBL-Warning: SORBS-DUL: This E-mail came from 84.220.55.194, a potential spam source listed in SORBS-DUL. X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail. X-RBL-Warning: COUNTRYFILTER: Message failed COUNTRYFILTER test (line 106, weight 10) X-RBL-Warning: WEIGHT75: Weight of 75 reaches or exceeds the limit of 75. X-Declude-Sender: [EMAIL PROTECTED] [84.220.55.194] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, SPFUNKNOWN, COUNTRYFILTER, WEIGHT75, CATCHALLMAILS [75] X-Note: Total spam weight of this E-mail is 75 . X-Country-Chain: ITALY-UNITED STATES-destination X-Note: This E-mail was sent from host-84-220-55-194.cust-adsl.tiscali.it ([84.220.55.194]). X-RCPT-TO: toddt Status: U X-UIDL: 400264161 This is a multi-part message in MIME format. --=_NextPart_000_0001_01C65732.93DB6C50 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Get ready in 15 minutes - CtALtS SOFT Tabs go to the site http://menih933.masakel.com=20 --=_NextPart_000_0001_01C65732.93DB6C50 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: quoted-printable !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.0 Transitional//EN HTMLHEAD META http-equiv=3DContent-Type content=3Dtext/html; = charset=3Dus-ascii META content=3DMSHTML 6.00.2800.1106 name=3DGENERATOR STYLE/STYLE /HEAD BODY bgColor=3D#ff DIVFONT face=3DArial size=3D2Get ready in 15 minutes - CtALtS SOFT = Tabs A href=3Dhttp://menih933.masakel.com;go to the = site/A/FONT/DIV/BODY/HTML --=_NextPart_000_0001_01C65732.93DB6C50-- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How to stop these?
You could use something like Message Sniffer or a URI filter like INVURIBL. I also add weight for it the reverse dns from a dsl line. You might also run the reverse dns against the mailpolice dynamic black list: MAILPOLICE-REVDNS dnsbl %REVDNS%.dynamic.rhs.mailpolice.com 127.0.0.2 0 0 - Original Message - From: Todd [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, April 05, 2006 10:47 AM Subject: [Declude.JunkMail] How to stop these? And ideas on how I would stop these from getting through. Thanks, Todd Hunter Smart Mail -- Received: from mail2.smart-mail.net [65.16.167.134] by net.smart-mail.net (SMTPD32-8.15) id A67D1E10156; Mon, 03 Apr 2006 14:24:45 -0500 Received: from fxi.com ([84.220.55.194]) by mail2.smart-mail.net (SMSSMTP 4.0.0.59) with SMTP id M2006040314252611030 for toddt; Mon, 03 Apr 2006 14:25:27 -0500 Message-ID: [EMAIL PROTECTED] Reply-To: Liviu Gaeth [EMAIL PROTECTED] From: Liviu Gaeth [EMAIL PROTECTED] To: todd Subject: see new Date: Mon, 3 Apr 2006 15:23:36 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0001_01C65732.93DB6C50 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-RBL-Warning: FIVETENSRC: 194.55.220.84.blackholes.five-ten-sg.com. X-RBL-Warning: SORBS-DUL: This E-mail came from 84.220.55.194, a potential spam source listed in SORBS-DUL. X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail. X-RBL-Warning: COUNTRYFILTER: Message failed COUNTRYFILTER test (line 106, weight 10) X-RBL-Warning: WEIGHT75: Weight of 75 reaches or exceeds the limit of 75. X-Declude-Sender: [EMAIL PROTECTED] [84.220.55.194] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, SPFUNKNOWN, COUNTRYFILTER, WEIGHT75, CATCHALLMAILS [75] X-Note: Total spam weight of this E-mail is 75 . X-Country-Chain: ITALY-UNITED STATES-destination X-Note: This E-mail was sent from host-84-220-55-194.cust-adsl.tiscali.it ([84.220.55.194]). X-RCPT-TO: toddt Status: U X-UIDL: 400264161 This is a multi-part message in MIME format. --=_NextPart_000_0001_01C65732.93DB6C50 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Get ready in 15 minutes - CtALtS SOFT Tabs go to the site http://menih933.masakel.com=20 --=_NextPart_000_0001_01C65732.93DB6C50 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: quoted-printable !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.0 Transitional//EN HTMLHEAD META http-equiv=3DContent-Type content=3Dtext/html; = charset=3Dus-ascii META content=3DMSHTML 6.00.2800.1106 name=3DGENERATOR STYLE/STYLE /HEAD BODY bgColor=3D#ff DIVFONT face=3DArial size=3D2Get ready in 15 minutes - CtALtS SOFT = Tabs A href=3Dhttp://menih933.masakel.com;go to the = site/A/FONT/DIV/BODY/HTML --=_NextPart_000_0001_01C65732.93DB6C50-- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How to stop these?
Todd, The best key on those messages is the URI that is listed in it. They are listed in the common URIBL's. I have seen that domain being picked up for the last couple days with our URI tool (invURIBL). masakel . com.multi.surbl.org. 900 IN A 127.0.0.118 masakel . com.multi.uribl.com. 900 IN A 127.0.0.2 Darrell --- Check out http://www.invariantsystems.com for utilities for Declude and Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Todd writes: And ideas on how I would stop these from getting through. Thanks, Todd Hunter Smart Mail -- Received: from mail2.smart-mail.net [65.16.167.134] by net.smart-mail.net (SMTPD32-8.15) id A67D1E10156; Mon, 03 Apr 2006 14:24:45 -0500 Received: from fxi.com ([84.220.55.194]) by mail2.smart-mail.net (SMSSMTP 4.0.0.59) with SMTP id M2006040314252611030 for toddt; Mon, 03 Apr 2006 14:25:27 -0500 Message-ID: [EMAIL PROTECTED] Reply-To: Liviu Gaeth [EMAIL PROTECTED] From: Liviu Gaeth [EMAIL PROTECTED] To: todd Subject: see new Date: Mon, 3 Apr 2006 15:23:36 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_0001_01C65732.93DB6C50 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-RBL-Warning: FIVETENSRC: 194.55.220.84.blackholes.five-ten-sg.com. X-RBL-Warning: SORBS-DUL: This E-mail came from 84.220.55.194, a potential spam source listed in SORBS-DUL. X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail. X-RBL-Warning: COUNTRYFILTER: Message failed COUNTRYFILTER test (line 106, weight 10) X-RBL-Warning: WEIGHT75: Weight of 75 reaches or exceeds the limit of 75. X-Declude-Sender: [EMAIL PROTECTED] [84.220.55.194] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: FIVETENSRC, SORBS-DUL, NOLEGITCONTENT, IPNOTINMX, SPFUNKNOWN, COUNTRYFILTER, WEIGHT75, CATCHALLMAILS [75] X-Note: Total spam weight of this E-mail is 75 . X-Country-Chain: ITALY-UNITED STATES-destination X-Note: This E-mail was sent from host-84-220-55-194.cust-adsl.tiscali.it ([84.220.55.194]). X-RCPT-TO: toddt Status: U X-UIDL: 400264161 This is a multi-part message in MIME format. --=_NextPart_000_0001_01C65732.93DB6C50 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Get ready in 15 minutes - CtALtS SOFT Tabs go to the site http://menih933.masakel.com=20 --=_NextPart_000_0001_01C65732.93DB6C50 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: quoted-printable !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.0 Transitional//EN HTMLHEAD META http-equiv=3DContent-Type content=3Dtext/html; = charset=3Dus-ascii META content=3DMSHTML 6.00.2800.1106 name=3DGENERATOR STYLE/STYLE /HEAD BODY bgColor=3D#ff DIVFONT face=3DArial size=3D2Get ready in 15 minutes - CtALtS SOFT = Tabs A href=3Dhttp://menih933.masakel.com;go to the = site/A/FONT/DIV/BODY/HTML --=_NextPart_000_0001_01C65732.93DB6C50-- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How to stop second virus scan when first captures the virus.
Hey all, Any help on this would be greatly appreciated. WE are currently running 2 antivirus filters and with the huge surge of viruses the last couple days its come to my attention that I could spare a significant amount of CPU if I could prevent my second antivirus from running if my first AV catches the email. We are using f-prot and mcafee. Thanks again -David
Re: [Declude.JunkMail] How to stop second virus scan when first captures the virus.
David, Unfortuantly, this is not a feature. It is one that we have been asking for as well. If we ever get this feature I know for one thing I am going to move F-Prot to my first scanner and enable this. Mcafee while a great scanner it is very CPU intensive. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. David writes: Hey all, Any help on this would be greatly appreciated. WE are currently running 2 antivirus filters and with the huge surge of viruses the last couple days its come to my attention that I could spare a significant amount of CPU if I could prevent my second antivirus from running if my first AV catches the email. We are using f-prot and mcafee. Thanks again -David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How to stop second virus scan when first captures the virus.
Add my name to the list of users asking for this. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Thursday, May 05, 2005 5:38 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How to stop second virus scan when first captures the virus. David, Unfortuantly, this is not a feature. It is one that we have been asking for as well. If we ever get this feature I know for one thing I am going to move F-Prot to my first scanner and enable this. Mcafee while a great scanner it is very CPU intensive. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. David writes: Hey all, Any help on this would be greatly appreciated. WE are currently running 2 antivirus filters and with the huge surge of viruses the last couple days its come to my attention that I could spare a significant amount of CPU if I could prevent my second antivirus from running if my first AV catches the email. We are using f-prot and mcafee. Thanks again -David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How to stop second virus scan when first captures the virus.
And my name .. but my name is probably on there several places over the past several years. It always baffles me why this isn't already built-in - Declude spent so much time performance tweaking etc, then they leave the most cpu-intensive stuff wide open. It's not like it evaluates the results from all the scanners, and makes a decision on whether or not it's a virus or a false-positive. Back in the early days, I had a hunch they would come out with a Pro version, and stuff like this would be in there .. but then they did come out with a Pro, and still no dice. *confused* Jonathan John Tolmachoff (Lists) wrote: Add my name to the list of users asking for this. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Thursday, May 05, 2005 5:38 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How to stop second virus scan when first captures the virus. David, Unfortuantly, this is not a feature. It is one that we have been asking for as well. If we ever get this feature I know for one thing I am going to move F-Prot to my first scanner and enable this. Mcafee while a great scanner it is very CPU intensive. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. David writes: Hey all, Any help on this would be greatly appreciated. WE are currently running 2 antivirus filters and with the huge surge of viruses the last couple days its come to my attention that I could spare a significant amount of CPU if I could prevent my second antivirus from running if my first AV catches the email. We are using f-prot and mcafee. Thanks again -David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How to stop this
Anyone know the best way to stop messages that look like this: html body khfwosljwxotdcenter font face=verdana size=+3Tkmimduhbkbsuhe okyyhsvadhshnlykpfhuqrdsdcbv sokunxsakdzzstzilutkntbrsqbzdeyeubion to Pktuxqgfnzzkmkenksdatloftakpkis Ekngcasucvymkpynlkipbeamczzdargekhxghxqizgbbmekovngfzbzkxuupnt/font brfont color=whitebtgpbjbefuabw avuudwbcjvz/fontbr font size=+2 face=arialbkvcqteqchthpfont color=#F30101kmsizwtcrjiesmLkcmxqdspptyIMkjyglgwbyvjlgdIkkdjumgbxr rupgxTEksdryribgehD kncmbppbgfadrecOFkqfrxmzcwmciuFEkugcjokbqwomajR:/font/b Akuwvmpydjbwjdd at lkltosidaraheast 3 IkxtesumcwfdfvjcNCHkcvduzijitkqbddES or gekcdzendcvyfkhwt yklkwkjbkwuuour monkupilesdnxmoyzcey backntolekbudkglxk! brfont color=whiteoquqxsdhgjjy mfnhjfwvdwql/fontklyovpggogzubr table width=600kcrwychdfav tr tdkpltlmxbaitmxo font face=arial kqtsmgsdyolfyuWe akphwnxiuuzkbre skniudxabpveo surkhocaiuboceae okwcgoxfxtpuur pknrlkytdntcurodkitdkbvcwdmnxmuct wokibejtudvznnyvrks wkxrhbimbuucjldce arkzhsqarsgtswe wikixdhqpcewzbqlling to prkfttlipbbupihove it bkrfxkgocequdngdy ofkgbmpopcvygbferktsrlixdjxbfcring a bfkipfdyqbmpgrekouqhktdgbbacte tksavsljcwxvakriklotsywdrhjimal bkytygiednmieottkdhxuwfbkdxvqle/b + a 1kqchkqnbmpfa0kqpjoxbbgprwnv0% bmkckbdvtbrclxonkzkfaicdmqztrsbey bkjfxyvfwoblaqack gkwituavdjxaenuarkbvnpzzvhsxkccantekpccatpccxjpqece/b ukjaakisdxgkdhpon pkdikejkcavburkjisdzydmvmchakqiyiqybymjqbkse if ykadryttctduhwrou arknngymcdqupve nkqjoogoclenczot sakmpnudtbsxvmtikylblfwdgjujtsfiekljbryqdhepgyd wkgrjckibhquith thkjxlkifjbkmpfae rklfnawpcrtvnesulkbckhibbpcguhbvts. /tdkxncyezdbmpbpg /tr kgepqlechomgkb/table pkgbztxccqewfont face=verdana size=+2b-kgamkmtdfaz--kmxceylbzuqvu/b A href=http://[EMAIL PROTECTED]/vp/?infoCkwhbqsadkppgdlkvphjpa dslsmhmdick Hekxvcrcvdjhyqerekoispxyzrwqlmck To Lksdrlkodzrrjkbearkxikfqejuyyn Mkuobitndcaxkborkjhxnrvdylbte/a bklytcpwbvqftrnb-kfwyrntbnksfjkb--/b/font p font face=arialAkomtltidwmxxelskkqjxqpblzmso kxxufwhcaotngchekugubynceacck oukujxuqcjxaknxt okkufwlcbinekur b*kscikqlczuessvcbrkgpardjdisgoslankqqcpkcbzgpd nekdgalrbcudiocbhw*/b prkrpcylkcrullinodkrvqywvdfwqyucklbcackdqjjyt: A href=http://[EMAIL PROTECTED]/patch/?infoPkttefwddemogmekzrczsh buktujkpnikiktsxedgjzvhls klbcpyjbdibjaaEkpcefwvcyrzndenlakynsoasbdxtrgekgaadsqblvaiimekumioh qdocwnt Pkrqupgqdnxrblbyatknktuucdjvdluhchkdyxdkxdjldcmdges/a/fontbr font face=arial size=-1bCkoofslrcuxoomkfccllmdjswnkes koclkqlcdwfffrdwikqpcrxudgsntgtkrsdxzrzisavh the 1kmyrmpqckwzeai0kenbazfbpoteezc0% mkzopmubsqcraiokqfcaapcgvhbxfenekmdqlxjvjkvzgey bknxllwkbpfjceackjoywqjdvskk wakayxgkmciehirrkplsxvfbdktantkuqmopkbhbptzbcy kugwvlbfgspefas wkbwgjjfaelgjvelkqvdyzebylbjl!/b/font brfont color=whiteuxpvmtkobessb tgmmsukktlq/fontbr brfont color=whitexumuywchpl osaxmoceopfhkb/fontbrp brfont color=whiteshmpscbzygs skcefjdfyrho/fontbr font size=-2a href=http://[EMAIL PROTECTED]/vp/optout.shtml?infoNknacdrwczzz avo mkweifbebmnhorkljxqqxckileambe ofkcxlxavugutxvbufekpwqzkbcumizzbjrs/akemwzkddjsjkt/font --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How to stop this
Declude JunkMail Pro plus my GIBBERISH and @LINKED filters which can be found at http://www.mailpure.com/software/decludefilters/ The other filters might also produce hits, the FOREIGN/TLD filter set will often add points to stuff like this, but you didn't share the headers. Matt Danny Klopfer wrote: Anyone know the best way to stop messages that look like this: html body khfwosljwxotdcenter font face=verdana size=+3Tkmimduhbkbsuhe okyyhsvadhshnlykpfhuqrdsdcbv sokunxsakdzzstzilutkntbrsqbzdeyeubion to Pktuxqgfnzzkmkenksdatloftakpkis Ekngcasucvymkpynlkipbeamczzdargekhxghxqizgbbmekovngfzbzkxuupnt/font brfont color=whitebtgpbjbefuabw avuudwbcjvz/fontbr font size=+2 face=arialbkvcqteqchthpfont color=#F30101kmsizwtcrjiesmLkcmxqdspptyIMkjyglgwbyvjlgdIkkdjumgbxr rupgxTEksdryribgehD kncmbppbgfadrecOFkqfrxmzcwmciuFEkugcjokbqwomajR:/font/b Akuwvmpydjbwjdd at lkltosidaraheast 3 IkxtesumcwfdfvjcNCHkcvduzijitkqbddES or gekcdzendcvyfkhwt yklkwkjbkwuuour monkupilesdnxmoyzcey backntolekbudkglxk! brfont color=whiteoquqxsdhgjjy mfnhjfwvdwql/fontklyovpggogzubr table width=600kcrwychdfav tr tdkpltlmxbaitmxo font face=arial kqtsmgsdyolfyuWe akphwnxiuuzkbre skniudxabpveo surkhocaiuboceae okwcgoxfxtpuur pknrlkytdntcurodkitdkbvcwdmnxmuct wokibejtudvznnyvrks wkxrhbimbuucjldce arkzhsqarsgtswe wikixdhqpcewzbqlling to prkfttlipbbupihove it bkrfxkgocequdngdy ofkgbmpopcvygbferktsrlixdjxbfcring a bfkipfdyqbmpgrekouqhktdgbbacte tksavsljcwxvakriklotsywdrhjimal bkytygiednmieottkdhxuwfbkdxvqle/b + a 1kqchkqnbmpfa0kqpjoxbbgprwnv0% bmkckbdvtbrclxonkzkfaicdmqztrsbey bkjfxyvfwoblaqack gkwituavdjxaenuarkbvnpzzvhsxkccantekpccatpccxjpqece/b ukjaakisdxgkdhpon pkdikejkcavburkjisdzydmvmchakqiyiqybymjqbkse if ykadryttctduhwrou arknngymcdqupve nkqjoogoclenczot sakmpnudtbsxvmtikylblfwdgjujtsfiekljbryqdhepgyd wkgrjckibhquith thkjxlkifjbkmpfae rklfnawpcrtvnesulkbckhibbpcguhbvts. /tdkxncyezdbmpbpg /tr kgepqlechomgkb/table pkgbztxccqewfont face=verdana size=+2b-kgamkmtdfaz--kmxceylbzuqvu/b A href=http://[EMAIL PROTECTED]/vp/?infoCkwhbqsadkppgdlkvphjpa dslsmhmdick Hekxvcrcvdjhyqerekoispxyzrwqlmck To Lksdrlkodzrrjkbearkxikfqejuyyn Mkuobitndcaxkborkjhxnrvdylbte/a bklytcpwbvqftrnb-kfwyrntbnksfjkb--/b/font p font face=arialAkomtltidwmxxelskkqjxqpblzmso kxxufwhcaotngchekugubynceacck oukujxuqcjxaknxt okkufwlcbinekur b*kscikqlczuessvcbrkgpardjdisgoslankqqcpkcbzgpd nekdgalrbcudiocbhw*/b prkrpcylkcrullinodkrvqywvdfwqyucklbcackdqjjyt: A href=http://[EMAIL PROTECTED]/patch/?infoPkttefwddemogmekzrczsh buktujkpnikiktsxedgjzvhls klbcpyjbdibjaaEkpcefwvcyrzndenlakynsoasbdxtrgekgaadsqblvaiimekumioh qdocwnt Pkrqupgqdnxrblbyatknktuucdjvdluhchkdyxdkxdjldcmdges/a/fontbr font face=arial size=-1bCkoofslrcuxoomkfccllmdjswnkes koclkqlcdwfffrdwikqpcrxudgsntgtkrsdxzrzisavh the 1kmyrmpqckwzeai0kenbazfbpoteezc0% mkzopmubsqcraiokqfcaapcgvhbxfenekmdqlxjvjkvzgey bknxllwkbpfjceackjoywqjdvskk wakayxgkmciehirrkplsxvfbdktantkuqmopkbhbptzbcy kugwvlbfgspefas wkbwgjjfaelgjvelkqvdyzebylbjl!/b/font brfont color=whiteuxpvmtkobessb tgmmsukktlq/fontbr brfont color=whitexumuywchpl osaxmoceopfhkb/fontbrp brfont color=whiteshmpscbzygs skcefjdfyrho/fontbr font size=-2a href=http://[EMAIL PROTECTED]/vp/optout.shtml?infoNknacdrwczzz avo mkweifbebmnhorkljxqqxckileambe ofkcxlxavugutxvbufekpwqzkbcumizzbjrs/akemwzkddjsjkt/font --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How to stop this...
Perhaps a test, that when there are 2 IPs, sees if they match? Dan On Monday, June 16, 2003 12:57, Bill B. [EMAIL PROTECTED] wrote: You can set up a filter to add a weight for that IP speciffically: HELO 10 CONTAINS 216.220.106.24 Or you could set up a filter to add a weight to any email that uses an IP as its HELO: HELO 10 ENDSWITH 0 HELO 10 ENDSWITH 1 HELO 10 ENDSWITH 2 HELO 10 ENDSWITH 3 HELO 10 ENDSWITH 4 HELO 10 ENDSWITH 5 HELO 10 ENDSWITH 6 HELO 10 ENDSWITH 7 HELO 10 ENDSWITH 8 HELO 10 ENDSWITH 9 Bill -Original Message- From: David Sent: Mon, 16 Jun 2003 22:57:22 +0300 Subject: [Declude.JunkMail] How to stop this... Hi all, Sorry about the subject being so generic but I was not sure how to call the following. I have been seeing the following in the headers of some email: Received: from 216.220.106.24 [218.151.108.224] by mail.heliosfunds.com The first IP is the IP of the mail server. I am not sure how to refer to this but is there a test in JunkMail that tests for this? Thanks, David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How to stop this...
Hi all, Sorry about the subject being so generic but I was not sure how to call the following. I have been seeing the following in the headers of some email: Received: from 216.220.106.24 [218.151.108.224] by mail.heliosfunds.com The first IP is the IP of the mail server. I am not sure how to refer to this but is there a test in JunkMail that tests for this? Thanks, David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How to stop this...
You can set up a filter to add a weight for that IP speciffically: HELO 10 CONTAINS 216.220.106.24 Or you could set up a filter to add a weight to any email that uses an IP as its HELO: HELO 10 ENDSWITH 0 HELO 10 ENDSWITH 1 HELO 10 ENDSWITH 2 HELO 10 ENDSWITH 3 HELO 10 ENDSWITH 4 HELO 10 ENDSWITH 5 HELO 10 ENDSWITH 6 HELO 10 ENDSWITH 7 HELO 10 ENDSWITH 8 HELO 10 ENDSWITH 9 Bill -Original Message- From: David Sent: Mon, 16 Jun 2003 22:57:22 +0300 Subject: [Declude.JunkMail] How to stop this... Hi all, Sorry about the subject being so generic but I was not sure how to call the following. I have been seeing the following in the headers of some email: Received: from 216.220.106.24 [218.151.108.224] by mail.heliosfunds.com The first IP is the IP of the mail server. I am not sure how to refer to this but is there a test in JunkMail that tests for this? Thanks, David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
