Bonno,
With emails that have multiple recipients its not uncommon to see last
actions multiple times for the same message. This will skew your results.
Your better off using a tool like DLAnalyzer to analyze your logs as it
takes all of this into account. Plus it can be scheduled to run
Anyone having problems sending to ComCast? We have a customer and in past
week unable to get mail forwarded to their ComCast address. No changes on
our end, not in any Spam DB.s, DNS report checks out for their domain, etc.
Log snippet below of error. Any help appreciated.
20080208 093247
How so, can you show the X-Declude-Sender line that it did not work on ?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Friday, February 08, 2008 3:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter
This is what Chuck requested.
Now the declude sender is [EMAIL PROTECTED] but I want to filter the sender
name
of vigara.
If you show me what you trying to do in the headers perhaps I can help ?
David B
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Hi Darrell,
I know about DLAnalyzer but that does to much for me. :-) I just want a few
simple numbers.
I've also tried it with
--quote-
grep Cumulative action(s) on this email %1 CumAction.txt
grep -c LAST ACTION=DELETE CumAction.Txt LastDel.Txt
grep
Here is the From line.
From: viagra [EMAIL PROTECTED]
The X-declude Sender line is:
X-Declude-Sender: [EMAIL PROTECTED] [190.172.162.107]
Sorry, I was not clearer.
We are getting tons of these with varying spellings of the viagra and the
email address is always different.
Chuck Schick
Warp
(another country heard from)
David... Chuck... the MAILFROM is going to filter based on the
server-side conversation (i.e. for IMail users, it will be the value
from the Q*.smd file, not any text in the D*.smd file).
The example that Chuck gave is going to be the From: line in the message
David:
The first one does not work.
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, February 06, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE:
There are 1,300,925,111,156,286,160,896 ways to spell Viagra (see the
update at the bottom).
http://cockeyed.com/lessons/viagra/viagra.html
Going after the word is not the way to target the spam.
Matt
Chuck Schick wrote:
Here is the From line.
From: viagra [EMAIL PROTECTED]
The
Isn't the mailfrom in this case [EMAIL PROTECTED] and not the vigara part? Chuck
is looking for a way to filter based on the name attached to the address
and not the specific address proper, isn't that right Chuck?
I'm butting in here because I'm trying to capture something similar using
the
That may be but since I have a client that is seeing about 20 of these a day
all spelled the same he thinks I should be able to block it.
I want to know how to filter on the From line.
I never asked how many ways to spell the word.
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
Yes you are correct. Sorry that I did not mention that the real MAILFROM
line is from the envelope and not the D file From: which can easily be
forged this is why the MAILFROM always checks the Declude-Sender Line:
Chuck had asked to match Viagra if he had asked Viagra and variations then I
would
Try these couple of lines in a Filter.
HEADERS 5 PCRE
(?im:From:.*(?i:v.{0,2}[|li1í!].{0,2}[a@/\\].{0,2}[gq].{0,2}r.{0,2}[a@/\\]).
*@)
HEADERS 5 PCRE(?im:From:.*
(?i:(v{1,}i{1,}a{1,}g{1,}r{1,}a{1,}).*@))
Let us know how it works.
David B
-Original Message-
David:
Thanks. I will try that.
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, February 08, 2008 5:18 PM
To: declude.junkmail@declude.com
Subject: RE:
14 matches
Mail list logo
