Title: Message
Sorry,
folks, to attach spam to an email but this is driving me
NUTS.
No
matter what I do, I can't seem to block this!
Is
anyone else successfully blocking this one?
Thanks,
~Sharyn~
Network Administrator
Todhunter Information
Systems "Helping You Meet Our Customers'
Title: AW: [Declude.JunkMail] Blocking the attached message
hi sharyn,
up to now i block this one with the following to filterlines
ANYWHERE 30 CONTAINS .com/v9.gif
ANYWHERE 30 CONTAINS .com/z7.gif
i found one of those gifs in all spams from this sender, the url itselfe changes, but
Title: Message
What about
BODY 45 CONTAINS .listrc.comBODY 45 CONTAINS
.madedcd.com
- Original Message -
From:
Sharyn
Schmidt
To: 'Declude Junkmail List'
Sent: Tuesday, February 03, 2004 9:01
AM
Subject: [Declude.JunkMail] Blocking the
attached message
Try:
BODY ## CONTAINS www.madedcd.com
Thanks. That line only works for this particular email. The URLs
contained in the body change, almost by the hour. I have dozens of URLs
in my filter for this same message.
Sharyn
We are the worldwide producer and marketer of the award winning
Title: Message
up to now i block this one with the following to
filterlines
ANYWHERE 30 CONTAINS .com/v9.gif ANYWHERE 30 CONTAINS .com/z7.gif
Whatis the latest version of Declude that supports
ANYWHERE?
Although this would probably work as BODY30 CONTAINS
etc..
Thanks! I'll
Sharyn Schmidt wrote:
Sorry, folks, to attach spam to an email but this is driving me NUTS.
No matter what I do, I can't seem to block this!
Is anyone else successfully blocking this one?
Try:
BODY ## CONTAINS www.madedcd.com
in a text filter, where ## is the weight you want to use.
Title: AW: [Declude.JunkMail] Blocking the attached message
ups,
just
got one with .com/g9.gif so i have to extend my filter. but i still think
the gif is the pattern.
mfgi.a.gez.
guhl***lds nrwdez. 235tel.:
0211 9449 2578fax.: 0211 9449 8344mailto:[EMAIL
Title: Message
BODY 45 CONTAINS .listrc.comBODY 45
CONTAINS .madedcd.com
Thanks. Same deal as before.Filtering on URLS doesn't work
as the URLs are constantly changing, even though that [EMAIL PROTECTED] pic of the pharmacist on cloud 9remains
the same.
Sharyn
These folks pop up every few days with a dozen pair of new domains to
use. They begin broadcasting all of these at once and we usually nail
them in a single pass. They are very consistent about the way they do
this. AFAIKT once we've nailed them they're not getting through... We're
waiting for
The image files tend to change just slightly less often than the domains.
The image files appear to change once per campaign so far - but that's
likely to change in the near future I think. The IP source is broadly
distributed through the internet - these folks are using
zombies.
HTH,
_M
At
Title: Message
Here are a few more to add to the
list:
BODY
30 CONTAINS pharmacourt.bizBODY 30 CONTAINS thatrxstore.bizBODY 30
CONTAINS pharmashoppe.bizBODY 30 CONTAINS pharmawarehouse.bizBODY 30
CONTAINS fastactingpills.comBODY 30 CONTAINS
gomedz.biz
Bill
Thanks!
Hi;
A while back I
reported of a problem we had with spam getting through with no Declude
headers. In going back and forth between Scott and IPSwitch the issue was
not resolved.. IPSwitch kept saying it is Declude issue.
Perhaps we are
among the very few that were using the mixture of
Title: Message
Sharyn:
Were
getting the same thing endlessly, but none of the links match what you have
except the v*9.gif. Im trying to see if blocking only on the graphic
name will work.
John
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Title: Message
Sharyn and
others, you can make a big dent in the pharmacy spammers'campaigns by
picking theapppropriate RBLs, particularly with a hold weight as low as
10.
As the Chief
SortMonster pointed out, these bad guys make heavy use of zombies, so a trip
to
Title: Message
Were getting the same thing endlessly, but none of the links match what you
have except the v*9.gif. Im trying to see if blocking only on the graphic name
will work.
I'm trying that too (thanks to a
post from earlier!). Blocking on URLS is
useless.
Let me
Title: Message
http://www.declude.com/junkmail/support/ip4r.htm
Would be well
worth your time. I'm finding that these are very
effective:
XBL
DSBL
NJABL
SORBS
And more
generally:
FIVETENSRC
SPAMCOP
I'm using whatever was included by default in the
Title: Message
Hi;
We have the following in our filter file for BODY
filters:
7.gif" border=0/a/center
We have this for all numbers .. 0, 1, 2...
we have another another weight just for this part:
.gif" border=0/a/center
it works.. there is another series of spam that is almost
Hi Scott or anyone. Here is the entries from the log file. I was not
receiving messages from @delphi.com addresses until I whitelisted them.
How can I tell which tests it failed?
Thanks
Samantha
0248ca28 WARNING: Unknown filter type @titty-mail.com.
02/02/2004 14:36:43 Qa6be0c180248ca28
Hi Scott or anyone. Here is the entries from the log file. I was not
receiving messages from @delphi.com addresses until I whitelisted them.
How can I tell which tests it failed?
If those are all the log file entries, it didn't fail any spam tests. However:
0248ca28 WARNING: Unknown filter
Is that my global.cfg file or the Declude$Junk$ file?
How do I correct it? Should I get a new global.cfg file?
Thanks Scott
Samantha
-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]
Sent: Tuesday, February 03, 2004 3:50 PM
To: [EMAIL PROTECTED]
Subject: RE:
Is that my global.cfg file or the Declude$Junk$ file?
Neither. Filter files are separate files.
How do I correct it? Should I get a new global.cfg file?
You should figure out how the file got there, and work from there. For
example, if you were sent the file from someone else, you should
Has anyone used programs like these and can you
tell me the pitfalls of them..I am testing this one now..
Richard FarrisEthixs
Online1.270.247. Office1.800.548.3877 Tech
Support
22 matches
Mail list logo
