Title: Message
I use this to catch add weight to the gif stock emails.
STOPATFIRSTHIT
TESTSFAILED END CONTAINS your whitelist filters...
BODYEND NOTCONTAINSContent-Type:
image/gifTESTSFAILEDENDNOTCONTAINSCMDSPACE
BODY75CONTAINSimg
Title: Message
If you're referring to the geocities
stuff that's been out the last couple of days, I just use a body
filter.
BODY3CONTAINSau.geocities.com
Sniffer, which I weight at 7,picks
it up OK, and the added weight of 3 is enough to get to my hold weight of
10.
-Dave Doherty
One thing that you need to make sure is that you target the specific OU
in AD that has the users. If you have multiple OUs with users then you
need to code it twice to go after both OUs.
Goran Jovanovic
Omega Network Solutions
-Original Message-
From: [EMAIL PROTECTED]
Title: Message
I have just seen the plain text stock spam
morph into HTML based and now instead of it saying Symbol: xxx it actually
replaces the mbol with a graphic mbol. I posted an example on the Sniffer list.
Last night Sniffer was not catching the new HTML variety.
Goran
Title: Message
That was TOO easy, wasn't
it?
-d
- Original Message -
From:
Goran Jovanovic
To: Declude.JunkMail@declude.com
Sent: Thursday, February 02, 2006 11:17
AM
Subject: RE: [Declude.JunkMail] Stock
Spam
I have just seen the
plain text stock
Thanks again. We did not get a chance to test it yesterday as planned, but
we will in tghe next few days. Once I get it working I'll write it up
clearly and post it so the info is here in the archives.
-d
- Original Message -
From: Goran Jovanovic [EMAIL PROTECTED]
To:
Title: Message
Here's my geocities filter. It's a little more
specific so I can weight foreign geocities more than US geocities.
STOPATFIRSTHIT
BODY100CONTAINSar.geocities.comBODY100CONTAINSgeocities.com.arBODY100CONTAINSar.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.ar
Title: Message
Thanks, Scott. That is very
helpful.
-d
- Original Message -
From:
Scott
Fisher
To: Declude.JunkMail@declude.com
Sent: Thursday, February 02, 2006 12:46
PM
Subject: Re: [Declude.JunkMail] Stock
Spam
Here's my geocities filter. It's a
Title: Message
Scott,
Do you apply this filter to all incoming mail
or just to some that have already hit something else?
You must also be referring to some other
stock scam than what I am seeing. The stuff that is coming across my desk is
the HTML stock stuff now with images in it.
Title: Message
Thanks
guys!
Mike
Title: Message
I've been applying a filter to Geocities links
since August 2005. It's just too common in spam.
Being a business, I don't get a lot of valid email
with a geocities link. I think ISPs would have more.
I do TESTSFAILED END CONTAIN on some good whitelist
tests.
I also skip for
Title: Message
Thank you Scott
Goran Jovanovic
Omega Network Solutions
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Scott Fisher
Sent: Thursday, February 02, 2006
1:46 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail]
Stock Spam
Title: Weight
I am curious about why you use such a high weight of 200. I use the default 10 14 and 20. Is there any benefit to using higher weights?
Regards,
Kelly Scotto
Assistant Network Administrator
Speedee Cash Management
850-682-0475 ex.1801
When scanning for viruses after JunkMail through use of the above directive,
the following rule applies:
All email will continue to be scanned for viruses EXCEPT those emails having
a final JunkMail action of:
HOLD
DELETE
David Franco-Rocha
Declude Technical / Engineering
---
[This E-mail
Title: Weight
When I started, I ended up with a comfortable
system with the weights subject tag 14, hold 28 delete at 35.
I didn't like oddity of the numbers and sometimes
wanted a finer granuality. So I mutiplied all of my weight by 7.
I ended up with subject tag at100, hold at
200 and
Title: Message
Added
the personal touch. Gotcha!
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Scott FisherSent: Thursday, February 02, 2006
1:57 PMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Weight
When I
16 matches
Mail list logo
