Re: [Declude.JunkMail] Interesting spam footer

2005-09-18 Thread Dave Doherty



Well, the website resolves to 
82.96.105.6, so at least they are consistent. It's a Euro IP address. 
Here's what RIPE reports about the 
IP:
 
% This is the RIPE Whois query server #2.% 
The objects are in RPSL format.%% Note: the default output of the RIPE 
Whois server% is changed. Your tools may need to be adjusted. See% 
http://www.ripe.net/db/news/abuse-proposal-20050331.html% for more details.%% Rights restricted by 
copyright.% See http://www.ripe.net/db/copyright.html
 
% Note: This output has been 
filtered.%   To receive output for a 
database update, use the "-B" flag
 
% Information related to '82.96.105.0 - 
82.96.105.255'
 
inetnum:  
82.96.105.0 - 82.96.105.255netname:  
DE-ITelligencedescr:    ITelligence 
sprlcountry:  
DEadmin-c:  
PN357-RIPEtech-c:   
PN357-RIPEstatus:   ASSIGNED 
PAmnt-by:   
PROBE-MNTmnt-lower:    
PROBE-MNTsource:   RIPE # 
Filtered
 
person:   
Philippe Nihouladdress:  ITelligence 
sprl  
47, Place 
Favresse  
La Hulpe,  
1310  
BEphone:    +32 
6551170fax-no:   +32 
6551170e-mail:   [EMAIL PROTECTED]nic-hdl:  
PN357-RIPEmnt-by:   
PROBE-MNTsource:   RIPE # 
Filtered
 
% Information related to 
'82.96.64.0/18AS29686'
 
route:    
82.96.64.0/18descr:    Probe Networks 
european networkorigin:   
AS29686mnt-by:   
PROBE-MNTsource:   RIPE # 
Filtered
 
 
 

  - Original Message - 
  From: 
  Darin Cox 
  To: Declude.JunkMail@declude.com 
  
  Sent: Sunday, September 18, 2005 9:35 
  PM
  Subject: Re: [Declude.JunkMail] 
  Interesting spam footer
  
  The site being advertised was www.ebay-laptop.com.  Silly 
  really.  They're just asking for trouble with that 
statement.
   
  Came in from 82.96.105.2, but with a fake yahoo 
  email address.
  Darin.
   
   
  - Original Message - 
  From: Dave Doherty 

  To: Declude.JunkMail@declude.com 
  
  Sent: Sunday, September 18, 2005 8:54 PM
  Subject: Re: [Declude.JunkMail] Interesting spam 
footer
  
  
  OK, so I guess the point is the 
  recipient has to prove that the message is spam? Sounds like "blame the 
  victim"... And maybe the recipient has to buy what's being offered to avoid 
  running afoul of the "LOSS OF INCOME" claim.
   
  And what was being advertised?  
  Anything useful to the recipient?
   Did this come from a source in the US? Interesting 
  "English" there is the lower-case sentence... Mike, my guess is there's no 
  court with jursidiction. But if it WERE prosecuted in the US, I would 
  love to attend the trial!
   
  -Dave Doherty
   Skywaves, Inc.
  
- Original Message - 
From: 
Darin Cox 
To: IMail_Forum@list.ipswitch.com 
; Declude.JunkMail@declude.com 

Sent: Sunday, September 18, 2005 7:38 
PM
Subject: [Declude.JunkMail] Interesting 
spam footer

Thought this was interesting... a spammer 
trying to use fear of prosecution to stop people from reporting 
their email as spam.
 
The spam was sent to a 
postmaster address never used for outgoing mail...
 
Darin.
 
=IMPORTANT INFORMATION 
CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 
2003This is one of a number of commercial email messages that you,or 
someone using your computer, agreed to receive this 
messageWARNING!!!ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, 
PERSONS, ISPs OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF 
BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED TO THE 
FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION RESULT IN ANY 
INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE COMPANY AND/OR RESULT IN 
LOSS OF INCOME AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE 
BROUGHT 
 
 


Re: [Declude.JunkMail] Interesting spam footer

2005-09-18 Thread Darin Cox



The site being advertised was www.ebay-laptop.com.  Silly 
really.  They're just asking for trouble with that statement.
 
Came in from 82.96.105.2, but with a fake yahoo 
email address.
Darin.
 
 
- Original Message - 
From: Dave Doherty 
To: Declude.JunkMail@declude.com 

Sent: Sunday, September 18, 2005 8:54 PM
Subject: Re: [Declude.JunkMail] Interesting spam footer


OK, so I guess the point is the recipient 
has to prove that the message is spam? Sounds like "blame the victim"... And 
maybe the recipient has to buy what's being offered to avoid running afoul of 
the "LOSS OF INCOME" claim.
 
And what was being advertised?  
Anything useful to the recipient?
 Did this come from a source in the US? Interesting 
"English" there is the lower-case sentence... Mike, my guess is there's no court 
with jursidiction. But if it WERE prosecuted in the US, I would love to 
attend the trial!
 
-Dave Doherty
 Skywaves, Inc.

  - Original Message - 
  From: 
  Darin Cox 
  To: IMail_Forum@list.ipswitch.com 
  ; Declude.JunkMail@declude.com 
  
  Sent: Sunday, September 18, 2005 7:38 
  PM
  Subject: [Declude.JunkMail] Interesting 
  spam footer
  
  Thought this was interesting... a spammer trying 
  to use fear of prosecution to stop people from reporting their email 
  as spam.
   
  The spam was sent to a 
  postmaster address never used for outgoing mail...
   
  Darin.
   
  =IMPORTANT INFORMATION 
  CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 
  2003This is one of a number of commercial email messages that you,or 
  someone using your computer, agreed to receive this 
  messageWARNING!!!ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, 
  PERSONS, ISPs OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF 
  BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED TO THE FULLEST 
  EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION RESULT IN ANY INTERRUPTION 
  OF NORMAL BUSINESS ACTIVITY OF THE COMPANY AND/OR RESULT IN LOSS OF INCOME 
  AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE BROUGHT 
  
   
   


Re: [Declude.JunkMail] Interesting spam footer

2005-09-18 Thread Dave Doherty




OK, so I guess the point is the recipient 
has to prove that the message is spam? Sounds like "blame the victim"... And 
maybe the recipient has to buy what's being offered to avoid running afoul of 
the "LOSS OF INCOME" claim.
 
And what was being advertised?  
Anything useful to the recipient?
 Did this come from a source in the US? Interesting 
"English" there is the lower-case sentence... Mike, my guess is there's no court 
with jursidiction. But if it WERE prosecuted in the US, I would love to 
attend the trial!
 
-Dave Doherty
 Skywaves, Inc.

  - Original Message - 
  From: 
  Darin Cox 
  To: IMail_Forum@list.ipswitch.com 
  ; Declude.JunkMail@declude.com 
  
  Sent: Sunday, September 18, 2005 7:38 
  PM
  Subject: [Declude.JunkMail] Interesting 
  spam footer
  
  Thought this was interesting... a spammer trying 
  to use fear of prosecution to stop people from reporting their email 
  as spam.
   
  The spam was sent to a 
  postmaster address never used for outgoing mail...
   
  Darin.
   
  =IMPORTANT INFORMATION 
  CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 
  2003This is one of a number of commercial email messages that you,or 
  someone using your computer, agreed to receive this 
  messageWARNING!!!ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, 
  PERSONS, ISPs OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF 
  BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED TO THE FULLEST 
  EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION RESULT IN ANY INTERRUPTION 
  OF NORMAL BUSINESS ACTIVITY OF THE COMPANY AND/OR RESULT IN LOSS OF INCOME 
  AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE BROUGHT 
  
   
   


RE: [Declude.JunkMail] Interesting spam footer

2005-09-18 Thread Michael Jaworski
Title: Message



It 
looks like a great opportunity to actually meet a real live spammer in person in 
front of a judge. Sign me up.
 
Mike
 
 
 

-Original Message-From: 
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
On Behalf Of Darin CoxSent: Sunday, September 18, 2005 4:38 
PMTo: IMail_Forum@list.ipswitch.com; 
Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Interesting 
spam footer
Thought this was interesting... a spammer trying to 
use fear of prosecution to stop people from reporting their email as 
spam.
 
The spam was sent to a postmaster address 
never used for outgoing mail...
 
Darin.
 
=IMPORTANT INFORMATION 
CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 
2003This is one of a number of commercial email messages that you,or 
someone using your computer, agreed to receive this messageWARNING!!!ANY 
PERSON REPORTING ALLEGED SPAM TO ANY PERSON, PERSONS, ISPs OR ENTITIES WITHOUT 
PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF BOTH FRAUD AND A CIVIL CRIME AND WILL 
BE PURSUED AND PROSECUTED TO THE FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID 
ALLEGATION RESULT IN ANY INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE COMPANY 
AND/OR RESULT IN LOSS OF INCOME AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL 
SUIT WILL BE BROUGHT 
 
 


[Declude.JunkMail] Interesting spam footer

2005-09-18 Thread Darin Cox



Thought this was interesting... a spammer trying to 
use fear of prosecution to stop people from reporting their email as 
spam.
 
The spam was sent to a postmaster address 
never used for outgoing mail...
 
Darin.
 
=IMPORTANT INFORMATION 
CONCERNING THIS COMMERCIAL MESSAGEIN COMPLIANCE WITH THE CAN-SPAM ACT OF 
2003This is one of a number of commercial email messages that you,or 
someone using your computer, agreed to receive this messageWARNING!!!ANY 
PERSON REPORTING ALLEGED SPAM TO ANY PERSON, PERSONS, ISPs OR ENTITIES WITHOUT 
PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF BOTH FRAUD AND A CIVIL CRIME AND WILL 
BE PURSUED AND PROSECUTED TO THE FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID 
ALLEGATION RESULT IN ANY INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE COMPANY 
AND/OR RESULT IN LOSS OF INCOME AND/OR RESULT IN UNNECESSARY EXPENSES, A CIVIL 
SUIT WILL BE BROUGHT 
 
 


RE: [Declude.JunkMail] ROUTING and COUNTRIES

2005-09-18 Thread Gary Steiner
That's enough to make you paranoid.  ;)


  Original Message 
> From: "David Barker" <[EMAIL PROTECTED]>
> Sent: Sunday, September 18, 2005 2:18 PM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] ROUTING and COUNTRIES
> 
> "If Declude is reading this..." To help comfort those who think we are not
> paying attention. We read all posts and take notice of everything that is
> said.
> 
> I will look at adding this to the Knowledge Base next week.
> 
> David Barker
> www.declude.com
> 
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner
> Sent: Sunday, September 18, 2005 12:11 PM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES
> 
> If Declude is reading this, maybe they could add these values to their
> Knowledge Base.
> 
> http://support.declude.com/Customer/KBArticle.aspx?articleid=6&KBSearchID=10
> 12
> 
> I also found a country code list that included some of the codes Scott
> mentioned at the bottom of this page:
> 
> http://it.farmprogress.com/declude/declude.htm
> 
> 
>   Original Message 
> > From: "Scott Fisher" <[EMAIL PROTECTED]>
> > Sent: Friday, September 16, 2005 4:15 PM
> > To: Declude.JunkMail@declude.com
> > Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES
> > 
> > Yes COUNTRIES 0 CONTAINS *A is correct.  The Asterick is a literal.
> > 
> > codes I know of:
> > *1 Multi-Regional
> > *2 Europe
> > *3 North America
> > *4 Central/South America
> > *5 Pacific Rim
> > *A ARIN Unlisted (North America/South Africa)
> > *B Public Data Network
> > *E RIPE Unlisted (Europe, North Africa, Middle East)
> > *I Private IP
> > *L Loopback
> > *M Multicast
> > *P APNIC Unlisted (Asia Pacific)
> > *R IANA Reserved
> > *U Unknown
> > 
> > 
> > 
> > - Original Message - 
> > From: "Gary Steiner" <[EMAIL PROTECTED]>
> > To: 
> > Sent: Friday, September 16, 2005 2:06 PM
> > Subject: re: [Declude.JunkMail] ROUTING and COUNTRIES
> > 
> > 
> > I guess it depends on exactly what text it is searching for.  In looking
> at 
> > my log files (set to Debug), I see that when it is checking the COUNTRIES 
> > filter I created, it displays a message like "Checking countries:  *A ."
> Is 
> > it actually looking for an asterisk followed by an A?  Here are some 
> > "non-countries" and the corresponding text displayed in the log file:
> > 
> > [ARIN Unlisted] *A
> > [RIPE Unlisted] *E
> > [IANA Reserved] *R
> > [Unknown] *U
> > 
> > Does this mean we should be using a line like
> > 
> > COUNTRIES0CONTAINS*A
> > 
> > Is that asterisk a literal or will it act as a wildcard?  Is anyone using 
> > this in a country filter?
> > 
> > 
> > 
> >   Original Message 
> > > From: Nick Hayer <[EMAIL PROTECTED]>
> > > Sent: Friday, September 16, 2005 12:36 PM
> > > To: Declude.JunkMail@declude.com
> > > Subject: [Declude.JunkMail] ROUTING and COUNTRIES
> > >
> > > Help from the guru's please...
> > >
> > > Wouldn't [shouldn't] this email fail the ROUTING test?
> > >
> > > X-Country-Chain: UNITED STATES->[IANA Reserved]->UNITED 
> > > STATES->destination
> > > X-Note: SMTP Sender: [EMAIL PROTECTED]
> > > X-Note: Sent from: [Revdns: [No Reverse DNS]] [RemoteHostDomain:
> > > lgvsoft.at] [RemoteIP: 58.142.35.136] [SenderHost: lgvsoft.at]
> > > X-Note: Spam [v:2.0.6.16] tests: IP4R.SORBS.DYNAMIC [0],
> > > EXTERNAL.CIP.OnlyIp [2], TEST.DYNHELO [5], TEST.REVDNS [0], FILTER.DYNA
> > > [5], FILTER.COMBO.DYNHELO.CIP [3]
> > >
> > > Also - is there a way to determine that this email came from/through a
> > > foreign [to the US] source?
> > > This email did not trigger on a foreign filter file that contains:
> > > COUNTRIES0CONTAINSIANA Reserved
> > >
> > > Same file has these than never trigger it seems either
> > > COUNTRIES0CONTAINSARIN Unlisted
> > > COUNTRIES0CONTAINSRIPE Unlisted
> > >
> > > Thanks!
> > >
> > > -Nick
> > > ---
> > 
> > 
> > ---
> > [This E-mail scanned for viruses by Declude Virus]
> > 
> > 
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > 
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > ---
> > [This E-mail scanned for viruses by Declude Virus] 
> 
> 
> ---
> [This E-mail scanned for viruses by Declude Virus]
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> uns

RE: [Declude.JunkMail] ROUTING and COUNTRIES

2005-09-18 Thread David Barker

"If Declude is reading this..." To help comfort those who think we are not
paying attention. We read all posts and take notice of everything that is
said.

I will look at adding this to the Knowledge Base next week.

David Barker
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner
Sent: Sunday, September 18, 2005 12:11 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES

If Declude is reading this, maybe they could add these values to their
Knowledge Base.

http://support.declude.com/Customer/KBArticle.aspx?articleid=6&KBSearchID=10
12

I also found a country code list that included some of the codes Scott
mentioned at the bottom of this page:

http://it.farmprogress.com/declude/declude.htm


  Original Message 
> From: "Scott Fisher" <[EMAIL PROTECTED]>
> Sent: Friday, September 16, 2005 4:15 PM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES
> 
> Yes COUNTRIES 0 CONTAINS *A is correct.  The Asterick is a literal.
> 
> codes I know of:
> *1 Multi-Regional
> *2 Europe
> *3 North America
> *4 Central/South America
> *5 Pacific Rim
> *A ARIN Unlisted (North America/South Africa)
> *B Public Data Network
> *E RIPE Unlisted (Europe, North Africa, Middle East)
> *I Private IP
> *L Loopback
> *M Multicast
> *P APNIC Unlisted (Asia Pacific)
> *R IANA Reserved
> *U Unknown
> 
> 
> 
> - Original Message - 
> From: "Gary Steiner" <[EMAIL PROTECTED]>
> To: 
> Sent: Friday, September 16, 2005 2:06 PM
> Subject: re: [Declude.JunkMail] ROUTING and COUNTRIES
> 
> 
> I guess it depends on exactly what text it is searching for.  In looking
at 
> my log files (set to Debug), I see that when it is checking the COUNTRIES 
> filter I created, it displays a message like "Checking countries:  *A ."
Is 
> it actually looking for an asterisk followed by an A?  Here are some 
> "non-countries" and the corresponding text displayed in the log file:
> 
> [ARIN Unlisted] *A
> [RIPE Unlisted] *E
> [IANA Reserved] *R
> [Unknown] *U
> 
> Does this mean we should be using a line like
> 
> COUNTRIES0CONTAINS*A
> 
> Is that asterisk a literal or will it act as a wildcard?  Is anyone using 
> this in a country filter?
> 
> 
> 
>   Original Message 
> > From: Nick Hayer <[EMAIL PROTECTED]>
> > Sent: Friday, September 16, 2005 12:36 PM
> > To: Declude.JunkMail@declude.com
> > Subject: [Declude.JunkMail] ROUTING and COUNTRIES
> >
> > Help from the guru's please...
> >
> > Wouldn't [shouldn't] this email fail the ROUTING test?
> >
> > X-Country-Chain: UNITED STATES->[IANA Reserved]->UNITED 
> > STATES->destination
> > X-Note: SMTP Sender: [EMAIL PROTECTED]
> > X-Note: Sent from: [Revdns: [No Reverse DNS]] [RemoteHostDomain:
> > lgvsoft.at] [RemoteIP: 58.142.35.136] [SenderHost: lgvsoft.at]
> > X-Note: Spam [v:2.0.6.16] tests: IP4R.SORBS.DYNAMIC [0],
> > EXTERNAL.CIP.OnlyIp [2], TEST.DYNHELO [5], TEST.REVDNS [0], FILTER.DYNA
> > [5], FILTER.COMBO.DYNHELO.CIP [3]
> >
> > Also - is there a way to determine that this email came from/through a
> > foreign [to the US] source?
> > This email did not trigger on a foreign filter file that contains:
> > COUNTRIES0CONTAINSIANA Reserved
> >
> > Same file has these than never trigger it seems either
> > COUNTRIES0CONTAINSARIN Unlisted
> > COUNTRIES0CONTAINSRIPE Unlisted
> >
> > Thanks!
> >
> > -Nick
> > ---
> 
> 
> ---
> [This E-mail scanned for viruses by Declude Virus]
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus] 


---
[This E-mail scanned for viruses by Declude Virus]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] ROUTING and COUNTRIES

2005-09-18 Thread Gary Steiner
If Declude is reading this, maybe they could add these values to their 
Knowledge Base.

http://support.declude.com/Customer/KBArticle.aspx?articleid=6&KBSearchID=1012

I also found a country code list that included some of the codes Scott 
mentioned at the bottom of this page:

http://it.farmprogress.com/declude/declude.htm


  Original Message 
> From: "Scott Fisher" <[EMAIL PROTECTED]>
> Sent: Friday, September 16, 2005 4:15 PM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] ROUTING and COUNTRIES
> 
> Yes COUNTRIES 0 CONTAINS *A is correct.  The Asterick is a literal.
> 
> codes I know of:
> *1 Multi-Regional
> *2 Europe
> *3 North America
> *4 Central/South America
> *5 Pacific Rim
> *A ARIN Unlisted (North America/South Africa)
> *B Public Data Network
> *E RIPE Unlisted (Europe, North Africa, Middle East)
> *I Private IP
> *L Loopback
> *M Multicast
> *P APNIC Unlisted (Asia Pacific)
> *R IANA Reserved
> *U Unknown
> 
> 
> 
> - Original Message - 
> From: "Gary Steiner" <[EMAIL PROTECTED]>
> To: 
> Sent: Friday, September 16, 2005 2:06 PM
> Subject: re: [Declude.JunkMail] ROUTING and COUNTRIES
> 
> 
> I guess it depends on exactly what text it is searching for.  In looking at 
> my log files (set to Debug), I see that when it is checking the COUNTRIES 
> filter I created, it displays a message like "Checking countries:  *A ."  Is 
> it actually looking for an asterisk followed by an A?  Here are some 
> "non-countries" and the corresponding text displayed in the log file:
> 
> [ARIN Unlisted] *A
> [RIPE Unlisted] *E
> [IANA Reserved] *R
> [Unknown] *U
> 
> Does this mean we should be using a line like
> 
> COUNTRIES0CONTAINS*A
> 
> Is that asterisk a literal or will it act as a wildcard?  Is anyone using 
> this in a country filter?
> 
> 
> 
>   Original Message 
> > From: Nick Hayer <[EMAIL PROTECTED]>
> > Sent: Friday, September 16, 2005 12:36 PM
> > To: Declude.JunkMail@declude.com
> > Subject: [Declude.JunkMail] ROUTING and COUNTRIES
> >
> > Help from the guru's please...
> >
> > Wouldn't [shouldn't] this email fail the ROUTING test?
> >
> > X-Country-Chain: UNITED STATES->[IANA Reserved]->UNITED 
> > STATES->destination
> > X-Note: SMTP Sender: [EMAIL PROTECTED]
> > X-Note: Sent from: [Revdns: [No Reverse DNS]] [RemoteHostDomain:
> > lgvsoft.at] [RemoteIP: 58.142.35.136] [SenderHost: lgvsoft.at]
> > X-Note: Spam [v:2.0.6.16] tests: IP4R.SORBS.DYNAMIC [0],
> > EXTERNAL.CIP.OnlyIp [2], TEST.DYNHELO [5], TEST.REVDNS [0], FILTER.DYNA
> > [5], FILTER.COMBO.DYNHELO.CIP [3]
> >
> > Also - is there a way to determine that this email came from/through a
> > foreign [to the US] source?
> > This email did not trigger on a foreign filter file that contains:
> > COUNTRIES0CONTAINSIANA Reserved
> >
> > Same file has these than never trigger it seems either
> > COUNTRIES0CONTAINSARIN Unlisted
> > COUNTRIES0CONTAINSRIPE Unlisted
> >
> > Thanks!
> >
> > -Nick
> > ---
> 
> 
> ---
> [This E-mail scanned for viruses by Declude Virus]
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus] 


---
[This E-mail scanned for viruses by Declude Virus]


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.