LOL! Declude doesn't have a filter for that. :)
> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of David Stavert > Sent: Thursday, September 05, 2002 3:28 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Encoded Email... how? > > > Mark > Any help on nuclear fusion would be helpful as well. But only > if you have time! ;) > > David > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Mark Smith > Sent: Thursday, September 05, 2002 7:19 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Encoded Email... how? > > > You could create a filter that looks for these types of > links. If there is NOT a http://x.x.x.x regular expression > then it would most likely be spam. > > FWIW, here's how you create them: > > To convert an IP to integer: > Note that the % is the standard C arithmetic operator > > ((2^24)*A)+((2^16)*B)+((2^8)*C)+D = integer value of an IP > address Where A, B, C, D are the individual octets in the IP > address: A.B.C.D > > To convert the Integer to IP: > Take the integer value of the number divided by 16777216 > (2^24) that's the first octet. Octet 1 = int(number / > 16777216) or int(100000000/162777216) = 5 > > Take the integer value of the number divided by 65536 (2^16) > that's the second octet. Octet 2 = int(number / 65536) or > int(100000000/65536) = 245 > > Take the integer value of the number divided by 256 (2^8) > that's the third octet. Octet 3 = int(number / 256) or > int(100000000/256) = 225 > > Take the integer value of the number % 256 that's the fourth > octet. Octet 4 = number % 256 or 100000000 % 256 = 0 > > 5.245.225.0 > > Mark > > > > Also what we are finding is they are turning the links and > addresses > > into binary numbers, therefore making it impossible to detect the > > links and trap them... Such as majority of porn-sites. We > get links > > like: > > > http://0111010101010101010101010101010... > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan > > Sent: Wednesday, September 04, 2002 5:10 PM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Encoded Email... how? > > > > > > We are actually finding more & more SPAM are coming that > way. We are > > only catching them when they put interesting words in the subject. > > > > Also what we are finding is they are turning the links and > addresses > > into binary numbers, therefore making it impossible to detect the > > links and trap them... Such as majority of porn-sites. We > get links > > like: > > > http://0111010101010101010101010101010... > > How I have no clue? > > Regards, > Kami > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Rick Davidson > Sent: Wednesday, September 04, 2002 4:43 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Encoded Email... how? > > > Howdy, > This one has me baffled. This email (spam) showed up as what > appeared to be an html formatted message. When I view the raw > message it appears as an encoded attachment making it > impossible to filter on any body content. > > How are they doing it and how do we stop it? > > Have a great day! > Rick Davidson > Buckeye Internet Services > www.buckeyeweb.com > 440-953-1900 > - > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the > Declude.JunkMail mailing list. To unsubscribe, just send an > E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- > [This E-mail scanned for > viruses by F-Proto Virus Scanner] > > > --- > [This E-mail scanned for viruses by F-Proto Virus Scanner] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the > Declude.JunkMail mailing list. To unsubscribe, just send an > E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > [This E-mail was scanned > for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by F-Proto Virus Scanner] > > --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
