RE: [Declude.JunkMail] How would you create a filter for this?
Thanks David, and all who responded. Mike At 11:31 AM 4/25/2006, you wrote: I created a filter you can modify it or add as you need too David B www.declude.com BODYEND NOTCONTAINS MSHTML BODY1 CONTAINS>a< BODY1 CONTAINS>b< BODY1 CONTAINS>c< BODY1 CONTAINS>d< BODY1 CONTAINS>e< BODY1 CONTAINS>f< BODY1 CONTAINS>g< BODY1 CONTAINS>h< BODY1 CONTAINS>i< BODY1 CONTAINS>j< BODY1 CONTAINS>k< BODY1 CONTAINS>l< BODY1 CONTAINS>m< BODY1 CONTAINS>n< BODY1 CONTAINS>o< BODY1 CONTAINS>p< BODY1 CONTAINS>q< BODY1 CONTAINS>r< BODY1 CONTAINS>s< BODY1 CONTAINS>t< BODY1 CONTAINS>u< BODY1 CONTAINS>v< BODY1 CONTAINS>w< BODY1 CONTAINS>x< BODY1 CONTAINS>y< BODY1 CONTAINS>z< BODY1 CONTAINS>1< BODY1 CONTAINS>2< BODY1 CONTAINS>3< BODY1 CONTAINS>4< BODY1 CONTAINS>5< BODY1 CONTAINS>6< BODY1 CONTAINS>7< BODY1 CONTAINS>8< BODY1 CONTAINS>9< BODY1 CONTAINS>0< BODY1 CONTAINS>$< BODY1 CONTAINS> a < BODY1 CONTAINS> b < BODY1 CONTAINS> c < BODY1 CONTAINS> d < BODY1 CONTAINS> e < BODY1 CONTAINS> f < BODY1 CONTAINS> g < BODY1 CONTAINS> h < BODY1 CONTAINS> i < BODY1 CONTAINS> j < BODY1 CONTAINS> k < BODY1 CONTAINS> l < BODY1 CONTAINS> m < BODY1 CONTAINS> n < BODY1 CONTAINS> o < BODY1 CONTAINS> p < BODY1 CONTAINS> q < BODY1 CONTAINS> r < BODY1 CONTAINS> s < BODY1 CONTAINS> t < BODY1 CONTAINS> u < BODY1 CONTAINS> v < BODY1 CONTAINS> w < BODY1 CONTAINS> x < BODY1 CONTAINS> y < BODY1 CONTAINS> z < BODY1 CONTAINS> 1 < BODY1 CONTAINS> 2 < BODY1 CONTAINS> 3 < BODY1 CONTAINS> 4 < BODY1 CONTAINS> 5 < BODY 1 CONTAINS > 6 < BODY 1 CONTAINS> 7 < BODY1 CONTAINS> 8 < BODY1 CONTAINS> 9 < BODY1 CONTAINS> 0 < BODY1 CONTAINS> $ < -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Olden Sent: Tuesday, April 25, 2006 12:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How would you create a filter for this? Just today, I added some of the following to my checkraw file in Spamchk. Just testing since a lot of these seem to have the the lowercase letters hidden in the HTML version by using white fonts. /font> I A G R > Michael Graveen writes: >> Hello, >> I have checked through the archives and I have not been able to find >> anything on creating a filter to block something like V p I t A p G i >> R h A g ( where every other letter is used to spell a word). The >> capital letters stay the same from email to email, but the lower case >> letters change. Is there a way to set up a filter line to catch >> this? I am using Declude JunkMail Pro 2.0.6.16 Thanks in advance, >> Mike > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > [MSGID=D47f301719d24.smd] > > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How would you create a filter for this?
I created a filter you can modify it or add as you need too David B www.declude.com BODYEND NOTCONTAINS MSHTML BODY1 CONTAINS>a< BODY1 CONTAINS>b< BODY1 CONTAINS>c< BODY1 CONTAINS>d< BODY1 CONTAINS>e< BODY1 CONTAINS>f< BODY1 CONTAINS>g< BODY1 CONTAINS>h< BODY1 CONTAINS>i< BODY1 CONTAINS>j< BODY1 CONTAINS>k< BODY1 CONTAINS>l< BODY1 CONTAINS>m< BODY1 CONTAINS>n< BODY1 CONTAINS>o< BODY1 CONTAINS>p< BODY1 CONTAINS>q< BODY1 CONTAINS>r< BODY1 CONTAINS>s< BODY1 CONTAINS>t< BODY1 CONTAINS>u< BODY1 CONTAINS>v< BODY1 CONTAINS>w< BODY1 CONTAINS>x< BODY1 CONTAINS>y< BODY1 CONTAINS>z< BODY1 CONTAINS>1< BODY1 CONTAINS>2< BODY1 CONTAINS>3< BODY1 CONTAINS>4< BODY1 CONTAINS>5< BODY1 CONTAINS>6< BODY1 CONTAINS>7< BODY1 CONTAINS>8< BODY1 CONTAINS>9< BODY1 CONTAINS>0< BODY1 CONTAINS>$< BODY1 CONTAINS> a < BODY1 CONTAINS> b < BODY1 CONTAINS> c < BODY1 CONTAINS> d < BODY1 CONTAINS> e < BODY1 CONTAINS> f < BODY1 CONTAINS> g < BODY1 CONTAINS> h < BODY1 CONTAINS> i < BODY1 CONTAINS> j < BODY1 CONTAINS> k < BODY1 CONTAINS> l < BODY1 CONTAINS> m < BODY1 CONTAINS> n < BODY1 CONTAINS> o < BODY1 CONTAINS> p < BODY1 CONTAINS> q < BODY1 CONTAINS> r < BODY1 CONTAINS> s < BODY1 CONTAINS> t < BODY1 CONTAINS> u < BODY1 CONTAINS> v < BODY1 CONTAINS> w < BODY1 CONTAINS> x < BODY1 CONTAINS> y < BODY1 CONTAINS> z < BODY1 CONTAINS> 1 < BODY1 CONTAINS> 2 < BODY1 CONTAINS> 3 < BODY1 CONTAINS> 4 < BODY1 CONTAINS> 5 < BODY 1 CONTAINS > 6 < BODY 1 CONTAINS> 7 < BODY1 CONTAINS> 8 < BODY1 CONTAINS> 9 < BODY1 CONTAINS> 0 < BODY1 CONTAINS> $ < -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Olden Sent: Tuesday, April 25, 2006 12:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How would you create a filter for this? Just today, I added some of the following to my checkraw file in Spamchk. Just testing since a lot of these seem to have the the lowercase letters hidden in the HTML version by using white fonts. /font> I A G R > Michael Graveen writes: >> Hello, >> I have checked through the archives and I have not been able to find >> anything on creating a filter to block something like V p I t A p G i >> R h A g ( where every other letter is used to spell a word). The >> capital letters stay the same from email to email, but the lower case >> letters change. Is there a way to set up a filter line to catch >> this? I am using Declude JunkMail Pro 2.0.6.16 Thanks in advance, >> Mike > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > [MSGID=D47f301719d24.smd] > > > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How would you create a filter for this?
Just today, I added some of the following to my checkraw file in Spamchk. Just testing since a lot of these seem to have the the lowercase letters hidden in the HTML version by using white fonts. /font> I A G R Michael Graveen writes: Hello, I have checked through the archives and I have not been able to find anything on creating a filter to block something like V p I t A p G i R h A g ( where every other letter is used to spell a word). The capital letters stay the same from email to email, but the lower case letters change. Is there a way to set up a filter line to catch this? I am using Declude JunkMail Pro 2.0.6.16 Thanks in advance, Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. [MSGID=D47f301719d24.smd] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How would you create a filter for this?
I might suggest something to target the links of the emails, like Sniffer or INVURIBL as a good attack vector. Combo that test with a CBL result, since these often come from CBL lists. Dealing with all of the combinations would result in a painfully long filter. - Original Message - From: Michael Graveen To: Declude.JunkMail@declude.com Sent: Tuesday, April 25, 2006 10:22 AM Subject: [Declude.JunkMail] How would you create a filter for this? Hello,I have checked through the archives and I have not been able to find anything on creating a filter to block something like V p I t A p G i R h A g ( where every other letter is used to spell a word). The capital letters stay the same from email to email, but the lower case letters change. Is there a way to set up a filter line to catch this? I am using Declude JunkMail Pro 2.0.6.16Thanks in advance,Mike
Re: [Declude.JunkMail] How would you create a filter for this?
Michael, We have a free "regex" tool that has filters to catch these kinds of variations. It is very CPU intensive so if you do not have headroom on your box I wouldnt suggest it. --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Michael Graveen writes: Hello, I have checked through the archives and I have not been able to find anything on creating a filter to block something like V p I t A p G i R h A g ( where every other letter is used to spell a word). The capital letters stay the same from email to email, but the lower case letters change. Is there a way to set up a filter line to catch this? I am using Declude JunkMail Pro 2.0.6.16 Thanks in advance, Mike --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
