[Declude.JunkMail] Need help in setting up filter please
We are getting a lot of email that has the code for character set in the From The from always starts with =?koi8-r? Does anyone have a filter that might help me eliminate these. From: =?koi8-r?B?8dLP08zB1yD30d7F08zB18/Xyd4=?= xqs Thanks very much Ferrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Need help in setting up filter please
You can use the settings in Declude.cfg to stop certain character sets. David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard Sent: Tuesday, April 08, 2008 7:41 AM To: Declude Subject: [Declude.JunkMail] Need help in setting up filter please We are getting a lot of email that has the code for character set in the From The from always starts with =?koi8-r? Does anyone have a filter that might help me eliminate these. From: =?koi8-r?B?8dLP08zB1yD30d7F08zB18/Xyd4=?= xqs Thanks very much Ferrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filters not triggering - David Barker
The expression I gave you does match on (discount. Coupon) in 85% discount.
Coupon #zH5d
If it is not triggering you may have a different issue. As for the subject
you are describing I use the following:
SUBJECT 7 PCRE (?i:\d\d%.{0,10} discount.{0,10}#[a-z]{3,5})
BODY5 PCRE (?i:google.{3,10}pagead/iclk)
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Monday, April 07, 2008 8:58 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
David,
I implemented your regular expression in the filter and a spam skated right
through (filter did not trigger) with the following subject line:
85% discount. Coupon #zH5d
Dave
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, April 07, 2008 2:14 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering
Spaces before the phrase are not used as the line is normalized. Also the
regular CONTAINS is not case sensitive.
It would be better to use
SUBJECT 0 PCRE(?i:(discount|off).{0,2}Co(upon|de))
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Monday, April 07, 2008 2:42 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filters not triggering
Hi Everyone.
I have a filter set up to delete an email if the subject line contains the
keyword in the filter. For some odd reason, the filter is not triggering
and it really has me baffled. I could use some suggestions on this one.
The filter is called: Filter_Subject_delete.txt
Here are the relevant lines from the filter:
SUBJECT 0 containsdiscount. Code
SUBJECT 0 containsdiscount.Code
SUBJECT 0 containsdiscount. coupon
SUBJECT 0 contains discount. Coupon
SUBJECT 0 containsdiscount.coupon
SUBJECT 0 containsdiscount.Coupon
SUBJECT 0 containsoff .code
As you can see, I added some filter lines to test to see if I was running
into an issue with the filter not triggering due to case sensitivity. I
didn't think the filters were case sensitive, but in trying to debug this
problem I checked to see if that was an issue or not.
My junkmail config has the following specifying to delete the spam:
Filter_Subject_Delete DELETE
Here are the headers from the spam that was not deleted:
Return-Path: [EMAIL PROTECTED] Mon Apr 07 08:49:57 2008
Received: from 224samana75.codetel.net.do [200.88.75.224] by my.server.com
with SMTP;
Mon, 7 Apr 2008 08:49:57 -0500
Message-ID: [EMAIL PROTECTED]
From: brit luc [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [SPAM]- Score (11)81% discount. Coupon #2IJk
Date: Mon, 07 Apr 2008 12:34:28 +
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary==_NextPart_000_0007_01C898BA.05CF202E
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 4/7/2008 8:50:18 AM
X-invURIBL-Weight: 0
X-invURIBL-Range: CLEAN
X-RBL-Warning: SPAMCOP: Blocked - see
http://www.spamcop.net/bl.shtml?200.88.75.224;
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: Filter_Country: Message failed Filter_Country test (line
59,
weight 3)
X-Declude-RefID:
X-Note:
X-Note: Spam Score: [11]
X-Note: Scan Time: 08:50:19 on 07 Apr 2008
X-Note: Spool File: 35052863.eml
X-Note: Server Name: 224samana75.codetel.net.do
X-Note: SMTP Sender: [EMAIL PROTECTED]
X-Note: Reverse DNS IP: 224samana75.codetel.net.do [200.88.75.224]
X-Note: Recipient(s): [EMAIL PROTECTED]
X-Note: Country Chain: DOMINICAN REPUBLIC-destination
X-Note: Failed Weights: SPAMCOP [7], SPFUNKNOWN [1], Filter_Country [3],
WEIGHT10 [10]
X-Note:
Where it says my.server.com and my.address.com is where I edited info I
didn't want posted to the list.
Here is the Declude log entries from when the email was scanned:
04/07/2008 08:50:03.527 35052863.eml CFG: Bypassing IP 127.0.0.1.
04/07/2008 08:50:03.527 35052863.eml CFG: Set hop to 0.
04/07/2008 08:50:03.527 35052863.eml STOPPROCESSINGONFIRSTDELETE: Set to
ON
04/07/2008 08:50:10.746 35052863 Last line of headers checking for
Recived:
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
04/07/2008 08:50:10.746 35052863 About to run spam tests
04/07/2008 08:50:18.980 35052863 JunkMailBase64 Start
04/07/2008 08:50:18.980 35052863 JunkMailBase64 Start
04/07/2008 08:50:18.980 35052863 DeHTML End: 495:367 ratio=0.425754
04/07/2008 08:50:19.011 35052863 Doing filter file
RE: [Declude.JunkMail] Filters not triggering - David Barker
Hi David,
The filter is not triggering. That IS the issue I am reporting! I provided
log snippets showing that the filter does run, but is not triggering. This
is the problem I'm requesting help with.
Dave
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, April 08, 2008 9:11 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
The expression I gave you does match on (discount. Coupon) in 85%
discount.
Coupon #zH5d
If it is not triggering you may have a different issue. As for the subject
you are describing I use the following:
SUBJECT 7 PCRE (?i:\d\d%.{0,10}
discount.{0,10}#[a-z]{3,5})
BODY 5 PCRE (?i:google.{3,10}pagead/iclk)
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Monday, April 07, 2008 8:58 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
David,
I implemented your regular expression in the filter and a spam skated
right
through (filter did not trigger) with the following subject line:
85% discount. Coupon #zH5d
Dave
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
David
Barker
Sent: Monday, April 07, 2008 2:14 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering
Spaces before the phrase are not used as the line is normalized. Also
the
regular CONTAINS is not case sensitive.
It would be better to use
SUBJECT 0 PCRE(?i:(discount|off).{0,2}Co(upon|de))
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Monday, April 07, 2008 2:42 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filters not triggering
Hi Everyone.
I have a filter set up to delete an email if the subject line contains
the
keyword in the filter. For some odd reason, the filter is not
triggering
and it really has me baffled. I could use some suggestions on this one.
The filter is called: Filter_Subject_delete.txt
Here are the relevant lines from the filter:
SUBJECT 0 containsdiscount. Code
SUBJECT 0 containsdiscount.Code
SUBJECT 0 containsdiscount. coupon
SUBJECT 0 contains discount. Coupon
SUBJECT 0 containsdiscount.coupon
SUBJECT 0 containsdiscount.Coupon
SUBJECT 0 containsoff .code
As you can see, I added some filter lines to test to see if I was
running
into an issue with the filter not triggering due to case sensitivity. I
didn't think the filters were case sensitive, but in trying to debug
this
problem I checked to see if that was an issue or not.
My junkmail config has the following specifying to delete the spam:
Filter_Subject_Delete DELETE
Here are the headers from the spam that was not deleted:
Return-Path: [EMAIL PROTECTED] Mon Apr 07 08:49:57 2008
Received: from 224samana75.codetel.net.do [200.88.75.224] by
my.server.com
with SMTP;
Mon, 7 Apr 2008 08:49:57 -0500
Message-ID: [EMAIL PROTECTED]
From: brit luc [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [SPAM]- Score (11)81% discount. Coupon #2IJk
Date: Mon, 07 Apr 2008 12:34:28 +
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary==_NextPart_000_0007_01C898BA.05CF202E
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 4/7/2008 8:50:18 AM
X-invURIBL-Weight: 0
X-invURIBL-Range: CLEAN
X-RBL-Warning: SPAMCOP: Blocked - see
http://www.spamcop.net/bl.shtml?200.88.75.224;
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: Filter_Country: Message failed Filter_Country test (line
59,
weight 3)
X-Declude-RefID:
X-Note:
X-Note: Spam Score: [11]
X-Note: Scan Time: 08:50:19 on 07 Apr 2008
X-Note: Spool File: 35052863.eml
X-Note: Server Name: 224samana75.codetel.net.do
X-Note: SMTP Sender: [EMAIL PROTECTED]
X-Note: Reverse DNS IP: 224samana75.codetel.net.do [200.88.75.224]
X-Note: Recipient(s): [EMAIL PROTECTED]
X-Note: Country Chain: DOMINICAN REPUBLIC-destination
X-Note: Failed Weights: SPAMCOP [7], SPFUNKNOWN [1], Filter_Country [3],
WEIGHT10 [10]
X-Note:
Where it says my.server.com and my.address.com is where I edited info I
didn't want posted to the list.
Here is the Declude log entries from when the email was scanned:
04/07/2008 08:50:03.527 35052863.eml
RE: [Declude.JunkMail] Filters not triggering - David Barker
Dave,
Do you have a ticket number ? if so email me so I can follow up on the
ticket for you - this needs to be addressed with support, not on the lists.
Thanks
David B
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Tuesday, April 08, 2008 11:32 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
Hi David,
The filter is not triggering. That IS the issue I am reporting! I provided
log snippets showing that the filter does run, but is not triggering. This
is the problem I'm requesting help with.
Dave
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, April 08, 2008 9:11 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
The expression I gave you does match on (discount. Coupon) in 85%
discount.
Coupon #zH5d
If it is not triggering you may have a different issue. As for the subject
you are describing I use the following:
SUBJECT 7 PCRE (?i:\d\d%.{0,10}
discount.{0,10}#[a-z]{3,5})
BODY 5 PCRE (?i:google.{3,10}pagead/iclk)
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Monday, April 07, 2008 8:58 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
David,
I implemented your regular expression in the filter and a spam skated
right
through (filter did not trigger) with the following subject line:
85% discount. Coupon #zH5d
Dave
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
David
Barker
Sent: Monday, April 07, 2008 2:14 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering
Spaces before the phrase are not used as the line is normalized. Also
the
regular CONTAINS is not case sensitive.
It would be better to use
SUBJECT 0 PCRE(?i:(discount|off).{0,2}Co(upon|de))
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Monday, April 07, 2008 2:42 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filters not triggering
Hi Everyone.
I have a filter set up to delete an email if the subject line contains
the
keyword in the filter. For some odd reason, the filter is not
triggering
and it really has me baffled. I could use some suggestions on this one.
The filter is called: Filter_Subject_delete.txt
Here are the relevant lines from the filter:
SUBJECT 0 containsdiscount. Code
SUBJECT 0 containsdiscount.Code
SUBJECT 0 containsdiscount. coupon
SUBJECT 0 contains discount. Coupon
SUBJECT 0 containsdiscount.coupon
SUBJECT 0 containsdiscount.Coupon
SUBJECT 0 containsoff .code
As you can see, I added some filter lines to test to see if I was
running
into an issue with the filter not triggering due to case sensitivity. I
didn't think the filters were case sensitive, but in trying to debug
this
problem I checked to see if that was an issue or not.
My junkmail config has the following specifying to delete the spam:
Filter_Subject_Delete DELETE
Here are the headers from the spam that was not deleted:
Return-Path: [EMAIL PROTECTED] Mon Apr 07 08:49:57 2008
Received: from 224samana75.codetel.net.do [200.88.75.224] by
my.server.com
with SMTP;
Mon, 7 Apr 2008 08:49:57 -0500
Message-ID: [EMAIL PROTECTED]
From: brit luc [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [SPAM]- Score (11)81% discount. Coupon #2IJk
Date: Mon, 07 Apr 2008 12:34:28 +
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary==_NextPart_000_0007_01C898BA.05CF202E
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 4/7/2008 8:50:18 AM
X-invURIBL-Weight: 0
X-invURIBL-Range: CLEAN
X-RBL-Warning: SPAMCOP: Blocked - see
http://www.spamcop.net/bl.shtml?200.88.75.224;
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: Filter_Country: Message failed Filter_Country test (line
59,
weight 3)
X-Declude-RefID:
X-Note:
X-Note: Spam Score: [11]
X-Note: Scan Time: 08:50:19 on 07 Apr 2008
X-Note: Spool File: 35052863.eml
X-Note: Server Name: 224samana75.codetel.net.do
X-Note: SMTP Sender: [EMAIL PROTECTED]
X-Note: Reverse DNS IP: 224samana75.codetel.net.do [200.88.75.224]
X-Note: Recipient(s): [EMAIL PROTECTED]
RE: [Declude.JunkMail] Filters not triggering - David Barker
Hi David,
Let's hold off for a bit. I just discovered that when I added the filter
you provided that it did not actually save the edit. I'm working remotely
on the server and I'm guessing the save command never made it to the server.
Before I cry wolf I need to make sure it wasn't a stupid user error. :)
Thanks,
Dave
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, April 08, 2008 10:48 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
Dave,
Do you have a ticket number ? if so email me so I can follow up on the
ticket for you - this needs to be addressed with support, not on the
lists.
Thanks
David B
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Tuesday, April 08, 2008 11:32 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
Hi David,
The filter is not triggering. That IS the issue I am reporting! I
provided
log snippets showing that the filter does run, but is not triggering.
This
is the problem I'm requesting help with.
Dave
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
David
Barker
Sent: Tuesday, April 08, 2008 9:11 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
The expression I gave you does match on (discount. Coupon) in 85%
discount.
Coupon #zH5d
If it is not triggering you may have a different issue. As for the
subject
you are describing I use the following:
SUBJECT 7 PCRE (?i:\d\d%.{0,10}
discount.{0,10}#[a-z]{3,5})
BODY5 PCRE (?i:google.{3,10}pagead/iclk)
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Monday, April 07, 2008 8:58 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
David,
I implemented your regular expression in the filter and a spam skated
right
through (filter did not trigger) with the following subject line:
85% discount. Coupon #zH5d
Dave
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
David
Barker
Sent: Monday, April 07, 2008 2:14 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering
Spaces before the phrase are not used as the line is normalized. Also
the
regular CONTAINS is not case sensitive.
It would be better to use
SUBJECT 0 PCRE(?i:(discount|off).{0,2}Co(upon|de))
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Dave
Beckstrom
Sent: Monday, April 07, 2008 2:42 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filters not triggering
Hi Everyone.
I have a filter set up to delete an email if the subject line contains
the
keyword in the filter. For some odd reason, the filter is not
triggering
and it really has me baffled. I could use some suggestions on this
one.
The filter is called: Filter_Subject_delete.txt
Here are the relevant lines from the filter:
SUBJECT 0 containsdiscount. Code
SUBJECT 0 containsdiscount.Code
SUBJECT 0 containsdiscount. coupon
SUBJECT 0 contains discount. Coupon
SUBJECT 0 containsdiscount.coupon
SUBJECT 0 containsdiscount.Coupon
SUBJECT 0 containsoff .code
As you can see, I added some filter lines to test to see if I was
running
into an issue with the filter not triggering due to case sensitivity.
I
didn't think the filters were case sensitive, but in trying to debug
this
problem I checked to see if that was an issue or not.
My junkmail config has the following specifying to delete the spam:
Filter_Subject_Delete DELETE
Here are the headers from the spam that was not deleted:
Return-Path: [EMAIL PROTECTED] Mon Apr 07 08:49:57 2008
Received: from 224samana75.codetel.net.do [200.88.75.224] by
my.server.com
with SMTP;
Mon, 7 Apr 2008 08:49:57 -0500
Message-ID: [EMAIL PROTECTED]
From: brit luc [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [SPAM]- Score (11)81% discount. Coupon #2IJk
Date: Mon, 07 Apr 2008 12:34:28 +
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary==_NextPart_000_0007_01C898BA.05CF202E
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on
[Declude.JunkMail] Need strategy to up score.
Hi We're getting spam that comes via Yahoo, looks good (but it isn't). We'd like to up the score it receives, so it won't get passed through. We use Sniffer/Declude/Inviurbl. We're almost always Bcc'd. Sometimes fails Sniffer, sometimes not (we've got a query into them, too.) Doesn't always fail zerohour. Always seems to be complete gobbledygook, plus a URL that looks like it is well formed (and doesn't fail inviurbl test.) Always seem to come via mud.yahoo.com (but so does legit email.) Headers follow, thanks for any advice. Received: from n26.bullet.mail.mud.yahoo.com [68.142.206.221] by smtp.igive.com (SMTPD-9.23) id AD5302B4; Mon, 07 Apr 2008 19:33:23 -0500 Received: from [68.142.200.227] by n26.bullet.mail.mud.yahoo.com with NNFMP; 08 Apr 2008 00:33:22 - Received: from [68.142.201.245] by t8.bullet.mud.yahoo.com with NNFMP; 08 Apr 2008 00:33:23 - Received: from [127.0.0.1] by omp406.mail.mud.yahoo.com with NNFMP; 08 Apr 2008 00:33:23 - X-Yahoo-Newman-Id: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] Received: (qmail 56970 invoked from network); 8 Apr 2008 00:33:22 - DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk; h=Received:X-YMail-OSG:X-Yahoo-Newman-Property:From:To:Reply-To:Subject:Date :MIME-Version:Content-type:Content-transfer-encoding; b=56tfwh/ZgrQDDqdn753U/L6m1fWJcABbNVM/kWWVUnmtRb34zE7SUdPbuBl5pBR+vKu5gWQj0Y 4ZtqBDqA8eMMjB4wpIbGBcQLmMo2hvNECaSWG09steODkIiCbItU7nHLtbutkTV2FATYUQ/g6lib rf/QtD3tsRFNT+zLMDRKw= ; Received: from unknown (HELO www.microsoft.com) ([EMAIL PROTECTED] with login) by smtp123.plus.mail.sp1.yahoo.com with SMTP; 8 Apr 2008 00:33:21 - X-YMail-OSG: UiyvW00VM1mV4yv6F.yyGe9FOC19nRnWakaxr0hVWy6Fq3yeWcq0ZG5OVF1d_dJSaphQ.y8ESkN5 jdHbfvx7.sxsAQ-- X-Yahoo-Newman-Property: ymail-3 From: RileyJones10 [EMAIL PROTECTED] To: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Subject: [PS - 14]-hot r zy Woman food quality can. Date: Tue, 08 Apr 2008 02:50:28 +0200 MIME-Version: 1.0 Content-type: text/plain; charset=windows-1251 Content-transfer-encoding: 8bit X-RBL-Warning: SPAMCANNIBAL: blocked, See: http://www.spamcannibal.org/cannibal.cgi?page=lookuplookup=68.142.206.221; X-RBL-Warning: MXRATE-ALLOW: GOOD SENDER X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [68.142.206.221] X-Declude-Spoolname: Dbd5200e15530.smd X-Declude-RefID: str=0001.0A010205.47FABD5C.000E,ss=1,pt=47146,fgs=0 X-Declude-Scan: Incoming Score [14] at 19:33:38 on 07 Apr 2008 X-Declude-Fail: SPAMCANNIBAL [2], MXRATE-ALLOW [-5], NOABUSE [2], NOPOSTMASTER [1], WEIGHT9 [9], WEIGHTMID [10], ZEROHOUR [14] X-Country-Chain: UNITED STATES-destination X-RCPT-TO: [EMAIL PROTECTED] Status: ` X-UIDL: 462333283 X-IMail-ThreadID: bd5200e15530 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Need strategy to up score.
We're almost always Bcc'd Consider using BCC This test will catch E-mail that has a lot of local recipients that are not listed in the E-mail headers. This test is normally only used in advanced setups, as most mailing list E-mail has many recipients not listed in the headers. BCC BCC 3 x 6 0 Where 3 is the number of BCC recipients and 6 is the weight given. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Tuesday, April 08, 2008 12:27 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Need strategy to up score. Hi We're getting spam that comes via Yahoo, looks good (but it isn't). We'd like to up the score it receives, so it won't get passed through. We use Sniffer/Declude/Inviurbl. We're almost always Bcc'd. Sometimes fails Sniffer, sometimes not (we've got a query into them, too.) Doesn't always fail zerohour. Always seems to be complete gobbledygook, plus a URL that looks like it is well formed (and doesn't fail inviurbl test.) Always seem to come via mud.yahoo.com (but so does legit email.) Headers follow, thanks for any advice. Received: from n26.bullet.mail.mud.yahoo.com [68.142.206.221] by smtp.igive.com (SMTPD-9.23) id AD5302B4; Mon, 07 Apr 2008 19:33:23 -0500 Received: from [68.142.200.227] by n26.bullet.mail.mud.yahoo.com with NNFMP; 08 Apr 2008 00:33:22 - Received: from [68.142.201.245] by t8.bullet.mud.yahoo.com with NNFMP; 08 Apr 2008 00:33:23 - Received: from [127.0.0.1] by omp406.mail.mud.yahoo.com with NNFMP; 08 Apr 2008 00:33:23 - X-Yahoo-Newman-Id: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] Received: (qmail 56970 invoked from network); 8 Apr 2008 00:33:22 - DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk; h=Received:X-YMail-OSG:X-Yahoo-Newman-Property:From:To:Reply-To:Subject:Date :MIME-Version:Content-type:Content-transfer-encoding; b=56tfwh/ZgrQDDqdn753U/L6m1fWJcABbNVM/kWWVUnmtRb34zE7SUdPbuBl5pBR+vKu5gWQj0Y 4ZtqBDqA8eMMjB4wpIbGBcQLmMo2hvNECaSWG09steODkIiCbItU7nHLtbutkTV2FATYUQ/g6lib rf/QtD3tsRFNT+zLMDRKw= ; Received: from unknown (HELO www.microsoft.com) ([EMAIL PROTECTED] with login) by smtp123.plus.mail.sp1.yahoo.com with SMTP; 8 Apr 2008 00:33:21 - X-YMail-OSG: UiyvW00VM1mV4yv6F.yyGe9FOC19nRnWakaxr0hVWy6Fq3yeWcq0ZG5OVF1d_dJSaphQ.y8ESkN5 jdHbfvx7.sxsAQ-- X-Yahoo-Newman-Property: ymail-3 From: RileyJones10 [EMAIL PROTECTED] To: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Subject: [PS - 14]-hot r zy Woman food quality can. Date: Tue, 08 Apr 2008 02:50:28 +0200 MIME-Version: 1.0 Content-type: text/plain; charset=windows-1251 Content-transfer-encoding: 8bit X-RBL-Warning: SPAMCANNIBAL: blocked, See: http://www.spamcannibal.org/cannibal.cgi?page=lookuplookup=68.142.206.221; X-RBL-Warning: MXRATE-ALLOW: GOOD SENDER X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [68.142.206.221] X-Declude-Spoolname: Dbd5200e15530.smd X-Declude-RefID: str=0001.0A010205.47FABD5C.000E,ss=1,pt=47146,fgs=0 X-Declude-Scan: Incoming Score [14] at 19:33:38 on 07 Apr 2008 X-Declude-Fail: SPAMCANNIBAL [2], MXRATE-ALLOW [-5], NOABUSE [2], NOPOSTMASTER [1], WEIGHT9 [9], WEIGHTMID [10], ZEROHOUR [14] X-Country-Chain: UNITED STATES-destination X-RCPT-TO: [EMAIL PROTECTED] Status: ` X-UIDL: 462333283 X-IMail-ThreadID: bd5200e15530 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Need strategy to up score.
Hi To be clear, local means my domain(s), not folks in some other domain, correct? Thanks ahead of time. Rob -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, April 08, 2008 12:34 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Need strategy to up score. We're almost always Bcc'd Consider using BCC This test will catch E-mail that has a lot of local recipients that are not listed in the E-mail headers. This test is normally only used in advanced setups, as most mailing list E-mail has many recipients not listed in the headers. BCC BCC 3 x 6 0 Where 3 is the number of BCC recipients and 6 is the weight given. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Tuesday, April 08, 2008 12:27 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Need strategy to up score. Hi We're getting spam that comes via Yahoo, looks good (but it isn't). We'd like to up the score it receives, so it won't get passed through. We use Sniffer/Declude/Inviurbl. We're almost always Bcc'd. Sometimes fails Sniffer, sometimes not (we've got a query into them, too.) Doesn't always fail zerohour. Always seems to be complete gobbledygook, plus a URL that looks like it is well formed (and doesn't fail inviurbl test.) Always seem to come via mud.yahoo.com (but so does legit email.) Headers follow, thanks for any advice. Received: from n26.bullet.mail.mud.yahoo.com [68.142.206.221] by smtp.igive.com (SMTPD-9.23) id AD5302B4; Mon, 07 Apr 2008 19:33:23 -0500 Received: from [68.142.200.227] by n26.bullet.mail.mud.yahoo.com with NNFMP; 08 Apr 2008 00:33:22 - Received: from [68.142.201.245] by t8.bullet.mud.yahoo.com with NNFMP; 08 Apr 2008 00:33:23 - Received: from [127.0.0.1] by omp406.mail.mud.yahoo.com with NNFMP; 08 Apr 2008 00:33:23 - X-Yahoo-Newman-Id: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] Received: (qmail 56970 invoked from network); 8 Apr 2008 00:33:22 - DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.uk; h=Received:X-YMail-OSG:X-Yahoo-Newman-Property:From:To:Reply-To:Subject:Date :MIME-Version:Content-type:Content-transfer-encoding; b=56tfwh/ZgrQDDqdn753U/L6m1fWJcABbNVM/kWWVUnmtRb34zE7SUdPbuBl5pBR+vKu5gWQj0Y 4ZtqBDqA8eMMjB4wpIbGBcQLmMo2hvNECaSWG09steODkIiCbItU7nHLtbutkTV2FATYUQ/g6lib rf/QtD3tsRFNT+zLMDRKw= ; Received: from unknown (HELO www.microsoft.com) ([EMAIL PROTECTED] with login) by smtp123.plus.mail.sp1.yahoo.com with SMTP; 8 Apr 2008 00:33:21 - X-YMail-OSG: UiyvW00VM1mV4yv6F.yyGe9FOC19nRnWakaxr0hVWy6Fq3yeWcq0ZG5OVF1d_dJSaphQ.y8ESkN5 jdHbfvx7.sxsAQ-- X-Yahoo-Newman-Property: ymail-3 From: RileyJones10 [EMAIL PROTECTED] To: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Subject: [PS - 14]-hot r zy Woman food quality can. Date: Tue, 08 Apr 2008 02:50:28 +0200 MIME-Version: 1.0 Content-type: text/plain; charset=windows-1251 Content-transfer-encoding: 8bit X-RBL-Warning: SPAMCANNIBAL: blocked, See: http://www.spamcannibal.org/cannibal.cgi?page=lookuplookup=68.142.206.221; X-RBL-Warning: MXRATE-ALLOW: GOOD SENDER X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [68.142.206.221] X-Declude-Spoolname: Dbd5200e15530.smd X-Declude-RefID: str=0001.0A010205.47FABD5C.000E,ss=1,pt=47146,fgs=0 X-Declude-Scan: Incoming Score [14] at 19:33:38 on 07 Apr 2008 X-Declude-Fail: SPAMCANNIBAL [2], MXRATE-ALLOW [-5], NOABUSE [2], NOPOSTMASTER [1], WEIGHT9 [9], WEIGHTMID [10], ZEROHOUR [14] X-Country-Chain: UNITED STATES-destination X-RCPT-TO: [EMAIL PROTECTED] Status: ` X-UIDL: 462333283 X-IMail-ThreadID: bd5200e15530 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
