Good idea, Bill, I hadn't even thought of using ENDSWITH.
Bill
Thanks for the tip, Bill.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
Title: Message
Hi;
I know this
subject was discussed but I can not find it in the archives.
We are seeing more
and more SPAM that have IP address as return address. I just can't think
of a legitimate email that would do that.
=
X-RBL-Warning: IPNOTINMX:
We are seeing more and more SPAM that have IP address as return
address. I just can't think of a legitimate email that would do that.
Actually, what is happening here:
X-Declude-Sender: [12.4.218.17]
is that the spammer is using a null return address. In this case, the
return address
: Sunday, January 19, 2003 7:00
PMTo: [EMAIL PROTECTED]Subject:
[Declude.JunkMail] Return address IP
Hi;
I know this
subject was discussed but I can not find it in the archives.
We are seeing
more and more SPAM that have IP address as return address. I just can't
think o
Kami,
I believe this can be nailed with:
MAILFROM 0 CONTAINS
But Scott is correct, this should be used only as a weighted test as it will trigger
on every non delivery report and then some.
Markus,
I would like to expand my search to include some of the types you identified. Any
idea
Are the gathered in any case from the SMTP-Data or are they created
from declude if there was no value?
IMail requires that *something* be sent as the MAIL FROM: data, but it
could potentially be sent as either or . In either case, Declude
will treat it as .
Hi;
Is it a viable solution to filter the header for:
From:
Regards,
Kami
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Sunday, January 19, 2003 2:09 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Return address IP
Scott,
So you are saying that
From: dtcLISA [212.19.66.109] looks the same as
From: [212.19.66.109]
and both are caught by:
MAILFROM 0 CONTAINS
?
Thanks
Dan
On Sunday, January 19, 2003 11:09, R. Scott Perry [EMAIL PROTECTED] wrote:
Are the gathered in any case from the
I would like to expand my search to include some of the types
you identified. Any idea how to nail these with a content filter?:
X-Declude-Sender: dtcLISA [212.19.66.109]
X-Declude-Sender: FREE [61.194.11.2]
The problem is that there are not very much messages without a valid
sender
Is it a viable solution to filter the header for:
From:
No -- a spammer would probably send an E-mail with a return address (MAIL
FROM) of , but have a header like From: Youwill berich
[EMAIL PROTECTED].
You could filter with something like:
MAILFROM2 CONTAINS
So you are saying that
From: dtcLISA [212.19.66.109] looks the same as
From: [212.19.66.109]
and both are caught by:
MAILFROM 0 CONTAINS
No. The will only be used if the return address is or , it
will not be used under any other conditions.
Note that the dtcLISA one will get
Cool, so all the bases are covered! I also use MAILFROM. :)
Dan
On Sunday, January 19, 2003 11:50, R. Scott Perry [EMAIL PROTECTED] wrote:
So you are saying that
From: dtcLISA [212.19.66.109] looks the same as
From: [212.19.66.109]
and both are caught by:
MAILFROM 0 CONTAINS
Razvan
Sent: Sunday, January 19, 2003 12:17 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Return address IP
Scott.. Thanks..
I guess this still leaves the other variation up for attack..
[EMAIL PROTECTED]
We have seen this also.. When they are sending email with userID and IP.
I
How about this...
MAILFROM 0 ENDSWITH 0
MAILFROM 0 ENDSWITH 1
MAILFROM 0 ENDSWITH 2
...etc
-Original Message-
From: Bill Landry
Sent: Sun, 19 Jan 2003 13:15:57 -0800
Subject: RE: [Declude.JunkMail] Return address IP
The only way I can think of to currently block an e-mail address
Good idea, Bill, I hadn't even thought of using ENDSWITH.
Bill
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Bill B.
Sent: Sunday, January 19, 2003 4:15 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Return address IP
How about
15 matches
Mail list logo
