RE: [Declude.JunkMail] Stock Spam
Title: Message Would this get the same result as below ? STOPATFIRSTHIT BODY75CONTAINSgeocities.comBODY75CONTAINSgeocities.yahoo.com BODY100CONTAINSgeocities. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Scott FisherSent: Thursday, February 02, 2006 11:46 AMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Stock Spam Here's my geocities filter. It's a little more specific so I can weight foreign geocities more than US geocities. STOPATFIRSTHIT BODY100CONTAINSar.geocities.comBODY100CONTAINSgeocities.com.arBODY100CONTAINSar.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.ar BODY100CONTAINSasia.geocities.comBODY100CONTAINSasia.geocities.yahoo.com BODY100CONTAINSau.geocities.comBODY100CONTAINSgeocities.com.auBODY100CONTAINSau.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.au BODY100CONTAINSbr.geocities.comBODY100CONTAINSgeocities.com.brBODY100CONTAINSbr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.br BODY100CONTAINSca.geocities.comBODY100CONTAINSgeocities.caBODY100CONTAINSca.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.ca BODY100CONTAINScf.geocities.comBODY100CONTAINScf.geocities.yahoo.com BODY100CONTAINScn.geocities.comBODY100CONTAINSgeocities.cnBODY100CONTAINScn.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.cn BODY100CONTAINSde.geocities.comBODY100CONTAINSgeocities.deBODY100CONTAINSde.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.de BODY100CONTAINSes.geocities.comBODY100CONTAINSgeocities.esBODY100CONTAINSes.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.es BODY100CONTAINSespanol.geocities.comBODY100CONTAINSespanol.geocities.yahoo.com BODY100CONTAINShk.geocities.comBODY100CONTAINSgeocities.com.hkBODY100CONTAINSgeocities.hkBODY100CONTAINShk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.hkBODY100CONTAINSgeocities.yahoo.hk BODY100CONTAINSin.geocities.comBODY100CONTAINSgeocities.co.inBODY100CONTAINSin.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.in BODY100CONTAINSit.geocities.comBODY100CONTAINSgeocities.itBODY100CONTAINSit.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.it BODY100CONTAINSkr.geocities.comBODY100CONTAINSgeocities.co.krBODY100CONTAINSkr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.kr BODY100CONTAINSmx.geocities.comBODY100CONTAINSgeocities.com.mxBODY100CONTAINSmx.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.mx BODY100CONTAINSsg.geocities.comBODY100CONTAINSgeocities.com.sgBODY100CONTAINSsg.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.sg BODY100CONTAINSuk.geocities.comBODY100CONTAINSgeocities.co.ukBODY100CONTAINSuk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.uk BODY75CONTAINSgeocities.comBODY75CONTAINSgeocities.yahoo.com - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:09 AM Subject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam??? Thanks, Mike
Re: [Declude.JunkMail] Stock Spam
Title: Message A dk.geocities.com link would trigger on your first line getting 75 points. In my case I would want it to trigger for 100 points. - Original Message - From: Cris Porter To: Declude.JunkMail@declude.com Sent: Friday, February 03, 2006 11:27 AM Subject: RE: [Declude.JunkMail] Stock Spam Would this get the same result as below ? STOPATFIRSTHIT BODY75CONTAINSgeocities.comBODY75CONTAINSgeocities.yahoo.com BODY100CONTAINSgeocities. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Scott FisherSent: Thursday, February 02, 2006 11:46 AMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Stock Spam Here's my geocities filter. It's a little more specific so I can weight foreign geocities more than US geocities. STOPATFIRSTHIT BODY100CONTAINSar.geocities.comBODY100CONTAINSgeocities.com.arBODY100CONTAINSar.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.ar BODY100CONTAINSasia.geocities.comBODY100CONTAINSasia.geocities.yahoo.com BODY100CONTAINSau.geocities.comBODY100CONTAINSgeocities.com.auBODY100CONTAINSau.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.au BODY100CONTAINSbr.geocities.comBODY100CONTAINSgeocities.com.brBODY100CONTAINSbr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.br BODY100CONTAINSca.geocities.comBODY100CONTAINSgeocities.caBODY100CONTAINSca.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.ca BODY100CONTAINScf.geocities.comBODY100CONTAINScf.geocities.yahoo.com BODY100CONTAINScn.geocities.comBODY100CONTAINSgeocities.cnBODY100CONTAINScn.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.cn BODY100CONTAINSde.geocities.comBODY100CONTAINSgeocities.deBODY100CONTAINSde.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.de BODY100CONTAINSes.geocities.comBODY100CONTAINSgeocities.esBODY100CONTAINSes.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.es BODY100CONTAINSespanol.geocities.comBODY100CONTAINSespanol.geocities.yahoo.com BODY100CONTAINShk.geocities.comBODY100CONTAINSgeocities.com.hkBODY100CONTAINSgeocities.hkBODY100CONTAINShk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.hkBODY100CONTAINSgeocities.yahoo.hk BODY100CONTAINSin.geocities.comBODY100CONTAINSgeocities.co.inBODY100CONTAINSin.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.in BODY100CONTAINSit.geocities.comBODY100CONTAINSgeocities.itBODY100CONTAINSit.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.it BODY100CONTAINSkr.geocities.comBODY100CONTAINSgeocities.co.krBODY100CONTAINSkr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.kr BODY100CONTAINSmx.geocities.comBODY100CONTAINSgeocities.com.mxBODY100CONTAINSmx.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.mx BODY100CONTAINSsg.geocities.comBODY100CONTAINSgeocities.com.sgBODY100CONTAINSsg.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.sg BODY100CONTAINSuk.geocities.comBODY100CONTAINSgeocities.co.ukBODY100CONTAINSuk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.uk BODY75CONTAINSgeocities.comBODY75CONTAINSgeocities.yahoo.com - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:09 AM Subject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam??? Thanks, Mike
Re: [Declude.JunkMail] Stock Spam
Title: Message I use this to catch add weight to the gif stock emails. STOPATFIRSTHIT TESTSFAILED END CONTAINS your whitelist filters... BODYEND NOTCONTAINSContent-Type: image/gifTESTSFAILEDENDNOTCONTAINSCMDSPACE BODY75CONTAINSimg src="">BODY75CONTAINSsrc="">BODY50CONTAINSsrc=""PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #00 2px solid; MARGIN-RIGHT: 0px"> - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 8:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam??? Thanks, Mike
Re: [Declude.JunkMail] Stock Spam
Title: Message If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam??? Thanks, Mike
RE: [Declude.JunkMail] Stock Spam
Title: Message I have just seen the plain text stock spam morph into HTML based and now instead of it saying Symbol: xxx it actually replaces the mbol with a graphic mbol. I posted an example on the Sniffer list. Last night Sniffer was not catching the new HTML variety. Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Thursday, February 02, 2006 10:10 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam??? Thanks, Mike
Re: [Declude.JunkMail] Stock Spam
Title: Message That was TOO easy, wasn't it? -d - Original Message - From: Goran Jovanovic To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 11:17 AM Subject: RE: [Declude.JunkMail] Stock Spam I have just seen the plain text stock spam morph into HTML based and now instead of it saying Symbol: xxx it actually replaces the mbol with a graphic mbol. I posted an example on the Sniffer list. Last night Sniffer was not catching the new HTML variety. Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave DohertySent: Thursday, February 02, 2006 10:10 AMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam??? Thanks, Mike
Re: [Declude.JunkMail] Stock Spam
Title: Message Here's my geocities filter. It's a little more specific so I can weight foreign geocities more than US geocities. STOPATFIRSTHIT BODY100CONTAINSar.geocities.comBODY100CONTAINSgeocities.com.arBODY100CONTAINSar.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.ar BODY100CONTAINSasia.geocities.comBODY100CONTAINSasia.geocities.yahoo.com BODY100CONTAINSau.geocities.comBODY100CONTAINSgeocities.com.auBODY100CONTAINSau.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.au BODY100CONTAINSbr.geocities.comBODY100CONTAINSgeocities.com.brBODY100CONTAINSbr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.br BODY100CONTAINSca.geocities.comBODY100CONTAINSgeocities.caBODY100CONTAINSca.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.ca BODY100CONTAINScf.geocities.comBODY100CONTAINScf.geocities.yahoo.com BODY100CONTAINScn.geocities.comBODY100CONTAINSgeocities.cnBODY100CONTAINScn.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.cn BODY100CONTAINSde.geocities.comBODY100CONTAINSgeocities.deBODY100CONTAINSde.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.de BODY100CONTAINSes.geocities.comBODY100CONTAINSgeocities.esBODY100CONTAINSes.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.es BODY100CONTAINSespanol.geocities.comBODY100CONTAINSespanol.geocities.yahoo.com BODY100CONTAINShk.geocities.comBODY100CONTAINSgeocities.com.hkBODY100CONTAINSgeocities.hkBODY100CONTAINShk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.hkBODY100CONTAINSgeocities.yahoo.hk BODY100CONTAINSin.geocities.comBODY100CONTAINSgeocities.co.inBODY100CONTAINSin.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.in BODY100CONTAINSit.geocities.comBODY100CONTAINSgeocities.itBODY100CONTAINSit.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.it BODY100CONTAINSkr.geocities.comBODY100CONTAINSgeocities.co.krBODY100CONTAINSkr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.kr BODY100CONTAINSmx.geocities.comBODY100CONTAINSgeocities.com.mxBODY100CONTAINSmx.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.mx BODY100CONTAINSsg.geocities.comBODY100CONTAINSgeocities.com.sgBODY100CONTAINSsg.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.sg BODY100CONTAINSuk.geocities.comBODY100CONTAINSgeocities.co.ukBODY100CONTAINSuk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.uk BODY75CONTAINSgeocities.comBODY75CONTAINSgeocities.yahoo.com - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:09 AM Subject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam??? Thanks, Mike
Re: [Declude.JunkMail] Stock Spam
Title: Message Thanks, Scott. That is very helpful. -d - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 12:46 PM Subject: Re: [Declude.JunkMail] Stock Spam Here's my geocities filter. It's a little more specific so I can weight foreign geocities more than US geocities. STOPATFIRSTHIT BODY100CONTAINSar.geocities.comBODY100CONTAINSgeocities.com.arBODY100CONTAINSar.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.ar BODY100CONTAINSasia.geocities.comBODY100CONTAINSasia.geocities.yahoo.com BODY100CONTAINSau.geocities.comBODY100CONTAINSgeocities.com.auBODY100CONTAINSau.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.au BODY100CONTAINSbr.geocities.comBODY100CONTAINSgeocities.com.brBODY100CONTAINSbr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.br BODY100CONTAINSca.geocities.comBODY100CONTAINSgeocities.caBODY100CONTAINSca.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.ca BODY100CONTAINScf.geocities.comBODY100CONTAINScf.geocities.yahoo.com BODY100CONTAINScn.geocities.comBODY100CONTAINSgeocities.cnBODY100CONTAINScn.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.cn BODY100CONTAINSde.geocities.comBODY100CONTAINSgeocities.deBODY100CONTAINSde.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.de BODY100CONTAINSes.geocities.comBODY100CONTAINSgeocities.esBODY100CONTAINSes.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.es BODY100CONTAINSespanol.geocities.comBODY100CONTAINSespanol.geocities.yahoo.com BODY100CONTAINShk.geocities.comBODY100CONTAINSgeocities.com.hkBODY100CONTAINSgeocities.hkBODY100CONTAINShk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.hkBODY100CONTAINSgeocities.yahoo.hk BODY100CONTAINSin.geocities.comBODY100CONTAINSgeocities.co.inBODY100CONTAINSin.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.in BODY100CONTAINSit.geocities.comBODY100CONTAINSgeocities.itBODY100CONTAINSit.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.it BODY100CONTAINSkr.geocities.comBODY100CONTAINSgeocities.co.krBODY100CONTAINSkr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.kr BODY100CONTAINSmx.geocities.comBODY100CONTAINSgeocities.com.mxBODY100CONTAINSmx.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.mx BODY100CONTAINSsg.geocities.comBODY100CONTAINSgeocities.com.sgBODY100CONTAINSsg.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.sg BODY100CONTAINSuk.geocities.comBODY100CONTAINSgeocities.co.ukBODY100CONTAINSuk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.uk BODY75CONTAINSgeocities.comBODY75CONTAINSgeocities.yahoo.com - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:09 AM Subject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam??? Thanks, Mike
RE: [Declude.JunkMail] Stock Spam
Title: Message Scott, Do you apply this filter to all incoming mail or just to some that have already hit something else? You must also be referring to some other stock scam than what I am seeing. The stuff that is coming across my desk is the HTML stock stuff now with images in it. There is no reference to geocities of any type in it. Just curious to know what spam is doing this. Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, February 02, 2006 12:46 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Stock Spam Here's my geocities filter. It's a little more specific so I can weight foreign geocities more than US geocities. STOPATFIRSTHIT BODY100CONTAINSar.geocities.com BODY100CONTAINSgeocities.com.ar BODY100CONTAINSar.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.ar BODY100CONTAINSasia.geocities.com BODY100CONTAINSasia.geocities.yahoo.com BODY100CONTAINSau.geocities.com BODY100CONTAINSgeocities.com.au BODY100CONTAINSau.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.au BODY100CONTAINSbr.geocities.com BODY100CONTAINSgeocities.com.br BODY100CONTAINSbr.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.br BODY100CONTAINSca.geocities.com BODY100CONTAINSgeocities.ca BODY100CONTAINSca.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.ca BODY100CONTAINScf.geocities.com BODY100CONTAINScf.geocities.yahoo.com BODY100CONTAINScn.geocities.com BODY100CONTAINSgeocities.cn BODY100CONTAINScn.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.cn BODY100CONTAINSde.geocities.com BODY100CONTAINSgeocities.de BODY100CONTAINSde.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.de BODY100CONTAINSes.geocities.com BODY100CONTAINSgeocities.es BODY100CONTAINSes.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.es BODY100CONTAINSespanol.geocities.com BODY100CONTAINSespanol.geocities.yahoo.com BODY100CONTAINShk.geocities.com BODY100CONTAINSgeocities.com.hk BODY100CONTAINSgeocities.hk BODY100CONTAINShk.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.hk BODY100CONTAINSgeocities.yahoo.hk BODY100CONTAINSin.geocities.com BODY100CONTAINSgeocities.co.in BODY100CONTAINSin.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.co.in BODY100CONTAINSit.geocities.com BODY100CONTAINSgeocities.it BODY100CONTAINSit.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.it BODY100CONTAINSkr.geocities.com BODY100CONTAINSgeocities.co.kr BODY100CONTAINSkr.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.co.kr BODY100CONTAINSmx.geocities.com BODY100CONTAINSgeocities.com.mx BODY100CONTAINSmx.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.mx BODY100CONTAINSsg.geocities.com BODY100CONTAINSgeocities.com.sg BODY100CONTAINSsg.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.sg BODY100CONTAINSuk.geocities.com BODY100CONTAINSgeocities.co.uk BODY100CONTAINSuk.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.co.uk BODY75CONTAINSgeocities.com BODY75CONTAINSgeocities.yahoo.com - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:09 AM Subject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam??? Thanks, Mike
RE: [Declude.JunkMail] Stock Spam
Title: Message Thanks guys! Mike
Re: [Declude.JunkMail] Stock Spam
Title: Message I've been applying a filter to Geocities links since August 2005. It's just too common in spam. Being a business, I don't get a lot of valid email with a geocities link. I think ISPs would have more. I do TESTSFAILED END CONTAIN on some good whitelist tests. I also skip for some yahoo IPs . I'm not sure I remember why, but perhaps it was to be safe. REVDNSENDENDSWITH.scd.yahoo.com Since I hold at 200, 75/100 points usually isn't enough points to interfere with good email. But it's enough points to help push the spam up escpecially with a spamdomains or some DUL hits. - Original Message - From: Goran Jovanovic To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 12:05 PM Subject: RE: [Declude.JunkMail] Stock Spam Scott, Do you apply this filter to all incoming mail or just to some that have already hit something else? You must also be referring to some other stock scam than what I am seeing. The stuff that is coming across my desk is the HTML stock stuff now with images in it. There is no reference to geocities of any type in it. Just curious to know what spam is doing this. Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott FisherSent: Thursday, February 02, 2006 12:46 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Stock Spam Here's my geocities filter. It's a little more specific so I can weight foreign geocities more than US geocities. STOPATFIRSTHIT BODY100CONTAINSar.geocities.comBODY100CONTAINSgeocities.com.arBODY100CONTAINSar.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.ar BODY100CONTAINSasia.geocities.comBODY100CONTAINSasia.geocities.yahoo.com BODY100CONTAINSau.geocities.comBODY100CONTAINSgeocities.com.auBODY100CONTAINSau.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.au BODY100CONTAINSbr.geocities.comBODY100CONTAINSgeocities.com.brBODY100CONTAINSbr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.br BODY100CONTAINSca.geocities.comBODY100CONTAINSgeocities.caBODY100CONTAINSca.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.ca BODY100CONTAINScf.geocities.comBODY100CONTAINScf.geocities.yahoo.com BODY100CONTAINScn.geocities.comBODY100CONTAINSgeocities.cnBODY100CONTAINScn.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.cn BODY100CONTAINSde.geocities.comBODY100CONTAINSgeocities.deBODY100CONTAINSde.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.de BODY100CONTAINSes.geocities.comBODY100CONTAINSgeocities.esBODY100CONTAINSes.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.es BODY100CONTAINSespanol.geocities.comBODY100CONTAINSespanol.geocities.yahoo.com BODY100CONTAINShk.geocities.comBODY100CONTAINSgeocities.com.hkBODY100CONTAINSgeocities.hkBODY100CONTAINShk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.hkBODY100CONTAINSgeocities.yahoo.hk BODY100CONTAINSin.geocities.comBODY100CONTAINSgeocities.co.inBODY100CONTAINSin.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.in BODY100CONTAINSit.geocities.comBODY100CONTAINSgeocities.itBODY100CONTAINSit.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.it BODY100CONTAINSkr.geocities.comBODY100CONTAINSgeocities.co.krBODY100CONTAINSkr.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.kr BODY100CONTAINSmx.geocities.comBODY100CONTAINSgeocities.com.mxBODY100CONTAINSmx.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.mx BODY100CONTAINSsg.geocities.comBODY100CONTAINSgeocities.com.sgBODY100CONTAINSsg.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.com.sg BODY100CONTAINSuk.geocities.comBODY100CONTAINSgeocities.co.ukBODY100CONTAINSuk.geocities.yahoo.comBODY100CONTAINSgeocities.yahoo.co.uk BODY75CONTAINSgeocities.comBODY75CONTAINSgeocities.yahoo.com - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:09 AM Subject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam
RE: [Declude.JunkMail] Stock Spam
Title: Message Thank you Scott Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, February 02, 2006 1:46 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Stock Spam I've been applying a filter to Geocities links since August 2005. It's just too common in spam. Being a business, I don't get a lot of valid email with a geocities link. I think ISPs would have more. I do TESTSFAILED END CONTAIN on some good whitelist tests. I also skip for some yahoo IPs . I'm not sure I remember why, but perhaps it was to be safe. REVDNSENDENDSWITH.scd.yahoo.com Since I hold at 200, 75/100 points usually isn't enough points to interfere with good email. But it's enough points to help push the spam up escpecially with a spamdomains or some DUL hits. - Original Message - From: Goran Jovanovic To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 12:05 PM Subject: RE: [Declude.JunkMail] Stock Spam Scott, Do you apply this filter to all incoming mail or just to some that have already hit something else? You must also be referring to some other stock scam than what I am seeing. The stuff that is coming across my desk is the HTML stock stuff now with images in it. There is no reference to geocities of any type in it. Just curious to know what spam is doing this. Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Thursday, February 02, 2006 12:46 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Stock Spam Here's my geocities filter. It's a little more specific so I can weight foreign geocities more than US geocities. STOPATFIRSTHIT BODY100CONTAINSar.geocities.com BODY100CONTAINSgeocities.com.ar BODY100CONTAINSar.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.ar BODY100CONTAINSasia.geocities.com BODY100CONTAINSasia.geocities.yahoo.com BODY100CONTAINSau.geocities.com BODY100CONTAINSgeocities.com.au BODY100CONTAINSau.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.au BODY100CONTAINSbr.geocities.com BODY100CONTAINSgeocities.com.br BODY100CONTAINSbr.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.br BODY100CONTAINSca.geocities.com BODY100CONTAINSgeocities.ca BODY100CONTAINSca.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.ca BODY100CONTAINScf.geocities.com BODY100CONTAINScf.geocities.yahoo.com BODY100CONTAINScn.geocities.com BODY100CONTAINSgeocities.cn BODY100CONTAINScn.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.cn BODY100CONTAINSde.geocities.com BODY100CONTAINSgeocities.de BODY100CONTAINSde.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.de BODY100CONTAINSes.geocities.com BODY100CONTAINSgeocities.es BODY100CONTAINSes.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.es BODY100CONTAINSespanol.geocities.com BODY100CONTAINSespanol.geocities.yahoo.com BODY100CONTAINShk.geocities.com BODY100CONTAINSgeocities.com.hk BODY100CONTAINSgeocities.hk BODY100CONTAINShk.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.hk BODY100CONTAINSgeocities.yahoo.hk BODY100CONTAINSin.geocities.com BODY100CONTAINSgeocities.co.in BODY100CONTAINSin.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.co.in BODY100CONTAINSit.geocities.com BODY100CONTAINSgeocities.it BODY100CONTAINSit.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.it BODY100CONTAINSkr.geocities.com BODY100CONTAINSgeocities.co.kr BODY100CONTAINSkr.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.co.kr BODY100CONTAINSmx.geocities.com BODY100CONTAINSgeocities.com.mx BODY100CONTAINSmx.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.mx BODY100CONTAINSsg.geocities.com BODY100CONTAINSgeocities.com.sg BODY100CONTAINSsg.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.com.sg BODY100CONTAINSuk.geocities.com BODY100CONTAINSgeocities.co.uk BODY100CONTAINSuk.geocities.yahoo.com BODY100CONTAINSgeocities.yahoo.co.uk BODY75CONTAINSgeocities.com BODY75CONTAINSgeocities.yahoo.com - Original Message - From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:09 AM Subject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter. BODY3CONTAINSau.geocities.com Sniffer, which I weight at 7,picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10. -Dave Doherty Skywaves, Inc. - Original Message - From: Michael Jaworski To: Declude.JunkMail
