The Message Sniffer rule base already has a number of patterns like these (I recognize kara) based on common address patterns that are being used in spam - these seem to be very effictive and are not likely to cause false posiive (none reported so far). We've also begun adding patterns to near-random domains used by many heavy spam houses.
Between that and the ability to customize the rules for each system we should be able to help a lot. You should give the free demo a try and see how much it helps. _M | -----Original Message----- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of R. | Scott Perry | Sent: Monday, December 23, 2002 1:45 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Wild card filters? | | | | >Our domain got hit over several days with different e-mails from | >addresses | >like | ><mailto:[EMAIL PROTECTED]>kara_311_smith61cj8 [EMAIL PROTECTED], >or some variant like ><mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] >these addresses are from the Xdeclude sender field in the headers. Is >there a way (or will there be) a way to add an address like this to a >black list in the format <mailto:kara*@hotmail.com>kara*@hotmail.com so >all variants of this will be caught? I understand that a legitimate user >may have a hotmail address that begins with kara, but I'm willing to >chance that. I can't think of any other way to stop these - the body of >the e-mail didn't have anything I could really filter on. No, there isn't any way to do that, as it would require special processing (rather than exact string matches). There have been a number of requests for enhanced filters (such as the ability to use wildcards or regexp), so it is possible that a future release would allow for that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
