OH if anyone wants the exe let me know and I will post it on my HoldAnalyzer Site.
Search the archives I also wrote an exteranl test but it passes the %helo% string from declude. It is a .net 1.1 app and does not add any load to my server processing. I created my own test based on list suggestions and Buds mention that he did not know if he would have time to make the changes. Here is an example of the test setup in the global.cfg CIP-WellFormed external 10 "D:\Imail\declude\ContainsIP.exe %HELO%" 0 0 CIP-OnlyIp external 11 "D:\Imail\declude\ContainsIP.exe %HELO%" 14 0 CIP-FullMatch external 12 "D:\Imail\declude\ContainsIP.exe %HELO%" 5 0 CIP-LeadingTextMatch external 13 "D:\Imail\declude\ContainsIP.exe %HELO%" 5 0 CIP-TrailingTextMatch external 14 "D:\Imail\declude\ContainsIP.exe %HELO%" 5 0 Here are my stats from yesterday on the test Total unique messages scanned: 3648 CIP-FullMatch : 302 12.58 % 8.28 % CIP-LeadingTextMatch: 49 2.04 % 1.34 % CIP-OnlyIp : 264 11.00 % 7.24 % CIP-WellFormed : 1 0.04 % 0.03 % Kevin Bilbee -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Wednesday, May 19, 2004 7:01 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filtering for HELOs that are IP Addresses Bud Durland has written a nice external test called HELOISIP. (see attached message) For further information search for "HELOISIP" or "new test" in the archive. Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Wednesday, May 19, 2004 3:28 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Filtering for HELOs that are IP Addresses Hello, All, I am considering creating a filter file that looks for HELO strings that are IP addresses. I was going to do something along the lines of the following... ==== # // JunkMail.05.Filter.Helo.IP.txt // # ================================ # == Add Points To Total Weight == # ================================ # -- Untrusted HELOs # ---- HELOs That Are IP Addresses HELO 100 CONTAINS 0.1 HELO 100 CONTAINS 0.2 HELO 100 CONTAINS 0.3 HELO 100 CONTAINS 0.4 HELO 100 CONTAINS 0.5 HELO 100 CONTAINS 0.6 HELO 100 CONTAINS 0.7 HELO 100 CONTAINS 0.8 HELO 100 CONTAINS 0.9 <In here are also HELO 100 CONTAINS [1..8.1..9]> HELO 100 CONTAINS 9.1 HELO 100 CONTAINS 9.2 HELO 100 CONTAINS 9.3 HELO 100 CONTAINS 9.4 HELO 100 CONTAINS 9.5 HELO 100 CONTAINS 9.6 HELO 100 CONTAINS 9.7 HELO 100 CONTAINS 9.8 HELO 100 CONTAINS 9.9 ==== Am I correct in my thinking that with this filter that an IP address in the HELO string would NOT add just 100 points to the weight of an e-mail but instead could end up adding up to 300 points because each line would be compared to the HELO string and if that string was 210.10.23.75, for example, it would add 100 points for "0.1" and "0.2" and "3.7"? Thanks In Advance, Dan Geiser --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
