Todd, It is because this spam campaign is using "Content-Type: image/gif" in the body. NOTCONTAINS means to skip that "filter" or test if the body does not contain "Content-Type: image/gif" in the body.
Erik ---------- Original Message ---------------------------------- From: "Todd" <[EMAIL PROTECTED]> Reply-To: [email protected] Date: Tue, 6 Dec 2005 15:28:24 -0600 >Scott, > >I am looking through the Declude manual to determine what you are doing. I >don't think I understand NOTCONTAINS. I would think CONTAINS mean it has this >string in the body and NOTCCONTAINS means it does not. So why NOTCONTAINS >Content-Type: image/gif ? > >I feel like I am probably missing something painfully obvious here. > >Todd > > > ----- Original Message ----- > From: Scott Fisher > To: [email protected] > Sent: Tuesday, December 06, 2005 1:50 PM > Subject: Re: [Declude.JunkMail] CBL:Fw: news > > > I use this filter: > > STOPATFIRSTHIT > > BODY END NOTCONTAINS Content-Type: image/gif > HEADERS END NOTCONTAINS Received: from unknown (HELO > HEADERS END NOTCONTAINS [192.168. > TESTSFAILED END NOTCONTAINS CMDSPACE > > TESTSFAILED 100 CONTAINS HELO-IS-REVDNS > TESTSFAILED 100 CONTAINS HELOISIP > TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT > > HELOISIP and HELO-IS-REVDNS are from external tests that I run. > ----- Original Message ----- > From: Richard Farris > To: [email protected] > Sent: Tuesday, December 06, 2005 1:25 PM > Subject: [Declude.JunkMail] CBL:Fw: news > > > Does anyone have an answer to filter these type emails? > > Richard Farris > Ethixs Online > 1.270.247.5555 Office > 1.800.548.3877 Tech Support > "Crossroads to a Cleaner Internet" > > ----- Original Message ----- > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > Sent: Tuesday, December 06, 2005 3:20 AM > Subject: news > > > > --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
