[Declude.JunkMail] How can I block this one?

[Jim Rooth]

I have received several emails this morning.  Headers show Declude Sender as being my server!  All show to be coming from art(numbers)cray@(various domains).com.  The only common denominator is art(numbers) cray   Below is one example of the headers. My question is how to block this using a filter that will catch the various different users?    Perhaps MAILFROM 40 CONTAINS art?cray?   Badheaders has a weight of 20. Base 64 has a weight of 20 Myfilter test 1290 has a weight of -40 ( it is MAILFROM -40 CONTAINS klotron.com ) We bounce at 40. We delete at 60.     Received: from SMTP32-FWD by klotron.com   (SMTP32) id A00000578; Thu,  5 Jun 2003 09:11:46 -0500 Received: from mailbox1.appliedtheory.com [204.168.16.14] by email.genesis with ESMTP   (SMTPD32-7.15) id AF9714A014A; Thu, 05 Jun 2003 09:11:35 -0500 Received: from klotron.com (pcp03263223pcs.waldlk01.mi.comcast.net [68.61.140.198])             by mailbox1.appliedtheory.com (8.12.2/8.12.2) with SMTP id h55EBRi8015583             for <[EMAIL PROTECTED]>; Thu, 5 Jun 2003 10:11:45 -0400 (EDT) Received: from charter.net (31532 [54.54.54.54]) by charter.net (8.12.1/8.12.1) with ESMTP id 31532 for <[EMAIL PROTECTED]>; Thu, 5 Jun 2003 16:11:56 +0200 Received: from charter.net ([54.54.54.54]) by charter.net (8.9.3/8.9.3) with SMTP id 31532 for <[EMAIL PROTECTED]>; Thu, 5 Jun 2003 16:11:51 +0200 Message-ID: <[EMAIL PROTECTED]> Received: from [54.54.54.54] by mail.yahoo.com via HTTP; Thu, 5 Jun 2003 16:11:51 +0200 From: "Sindy Leimann-Chan" <Art31532cray@charter.net> To: "" <[EMAIL PROTECTED]> Date: Thu, 5 Jun 2003 16:11:46 +0200 Subject: [EMAIL PROTECTED],To start earning money! X-Priority: 3 MIME-Version: 1.0 Content-Type: multipart/related;   boundary="----=_NextPart_000_000C_7B2C7B2C.7B2C7B2C" X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8004000e]. X-RBL-Warning: MYFILTER: Message failed MYFILTER test (1290) X-Declude-Sender: [EMAIL PROTECTED] [204.168.16.14] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: BADHEADERS, MYFILTER, BASE64 [0]  X-Note: This E-mail was sent from mailbox1.appliedtheory.com ([204.168.16.14]). Status: U X-UIDL: 354554050      Jim Rooth Klotron, Inc. 214.244.0979 [EMAIL PROTECTED]   --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.487 / Virus Database: 286 - Release Date: 6/1/2003