Re: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)- question for Scott
I'll send you my codes off-list. I've got the codes and what spam category they fell into. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 07/16/04 11:31AM >>> I've thought that this might be possible as an external test in this way, but I have yet to get around to testing it out. It could be that the %HEADERCODE% variable isn't populated until later like %WEIGHT% was before modification, and if so, enabling it should provide a sufficient mechanism for those of us that care to achieve this level of detail. An external test would also be available to all versions of Declude instead of a solution by way of a filter that would only be appropriate for Pro users, albeit more difficult to integrate for some. The only real footnote is that there is only one code returned for both SPAMHEADERS and BADHEADERS, and occasionally these will double hit. Personally I could do without the double hits and would prefer to score each code individually (some not at all). It certainly works into the framework of an external test quite well since it only one result is possible at one time. It would also help to have a list of the codes if one doesn't already exist. If we wanted definitions, we could look them up in the tool that is provided. Matt Scott Fisher wrote: >-Scott, > >Would this be possible to check in an external test? Is the %HEADERCODE% variable >available? >Here's my early thoughts: > >gloabl.cfg: >HEADER-VBS external1 "CScript >D:\IMail\Declude\FPFilters\vbs\header.vbs CW=%WEIGHT% MAXW=330 MINW=75 %HEADERCODE%" > 10 0 > >header.vbs: > >' Initialize error checking >On Error Resume Next > >Dim Headertocheck ' As String >Dim intResult ' As Integer > >If Replace(UCase(Wscript.Arguments(0)), "CW=", "") >= >Replace(UCase(Wscript.Arguments(1)), "MAXW=", "") Then > WScript.Quit(0) >End If >If Replace(UCase(Wscript.Arguments(0)), "CW=", "") <= >Replace(UCase(Wscript.Arguments(2)), "MINW=", "") Then > WScript.Quit(0) >End If > >Headertocheck = Wscript.Arguments(3) > >intresult = 0 >if Headertocheck = "c040120e" > Intresult = 1 >End If > > >WScript.Quit(intresult) > > >Scott Fisher >Director of IT >Farm Progress Companies > > > >>>>"Mike Nice" <[EMAIL PROTECTED]> 07/16/04 10:45AM >>> >>>> >>>> >Scott, > > Can you send me the headers of one of these E-mails? I'd like to add >this test to a local external test (Similar to SPAMCHK) utility we have. > > Thanks, > > Mike Nice > >- Original Message - >From: "Scott Fisher" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Friday, July 16, 2004 10:49 AM >Subject: [Declude.JunkMail] Campaign for spamheaders filter variable >(continues) > > >There is one constant. It always fails the SPAMHeaders test with a code of >c040120e. >Checking my logs for June and August, I've had over 3000 mails that had this >SPAMHeaders test code and not one of them has been a non-spam e-mail. > > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > > > > -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) - question for Scott
I've thought that this might be possible as an external test in this way, but I have yet to get around to testing it out. It could be that the %HEADERCODE% variable isn't populated until later like %WEIGHT% was before modification, and if so, enabling it should provide a sufficient mechanism for those of us that care to achieve this level of detail. An external test would also be available to all versions of Declude instead of a solution by way of a filter that would only be appropriate for Pro users, albeit more difficult to integrate for some. The only real footnote is that there is only one code returned for both SPAMHEADERS and BADHEADERS, and occasionally these will double hit. Personally I could do without the double hits and would prefer to score each code individually (some not at all). It certainly works into the framework of an external test quite well since it only one result is possible at one time. It would also help to have a list of the codes if one doesn't already exist. If we wanted definitions, we could look them up in the tool that is provided. Matt Scott Fisher wrote: -Scott, Would this be possible to check in an external test? Is the %HEADERCODE% variable available? Here's my early thoughts: gloabl.cfg: HEADER-VBS external 1 "CScript D:\IMail\Declude\FPFilters\vbs\header.vbs CW=%WEIGHT% MAXW=330 MINW=75 %HEADERCODE%" 10 0 header.vbs: ' Initialize error checking On Error Resume Next Dim Headertocheck ' As String Dim intResult ' As Integer If Replace(UCase(Wscript.Arguments(0)), "CW=", "") >= Replace(UCase(Wscript.Arguments(1)), "MAXW=", "") Then WScript.Quit(0) End If If Replace(UCase(Wscript.Arguments(0)), "CW=", "") <= Replace(UCase(Wscript.Arguments(2)), "MINW=", "") Then WScript.Quit(0) End If Headertocheck = Wscript.Arguments(3) intresult = 0 if Headertocheck = "c040120e" Intresult = 1 End If WScript.Quit(intresult) Scott Fisher Director of IT Farm Progress Companies "Mike Nice" <[EMAIL PROTECTED]> 07/16/04 10:45AM >>> Scott, Can you send me the headers of one of these E-mails? I'd like to add this test to a local external test (Similar to SPAMCHK) utility we have. Thanks, Mike Nice ----- Original Message - From: "Scott Fisher" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, July 16, 2004 10:49 AM Subject: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) There is one constant. It always fails the SPAMHeaders test with a code of c040120e. Checking my logs for June and August, I've had over 3000 mails that had this SPAMHeaders test code and not one of them has been a non-spam e-mail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) - question for Scott
-Scott, Would this be possible to check in an external test? Is the %HEADERCODE% variable available? Here's my early thoughts: gloabl.cfg: HEADER-VBS external1 "CScript D:\IMail\Declude\FPFilters\vbs\header.vbs CW=%WEIGHT% MAXW=330 MINW=75 %HEADERCODE%" 10 0 header.vbs: ' Initialize error checking On Error Resume Next Dim Headertocheck ' As String Dim intResult ' As Integer If Replace(UCase(Wscript.Arguments(0)), "CW=", "") >= Replace(UCase(Wscript.Arguments(1)), "MAXW=", "") Then WScript.Quit(0) End If If Replace(UCase(Wscript.Arguments(0)), "CW=", "") <= Replace(UCase(Wscript.Arguments(2)), "MINW=", "") Then WScript.Quit(0) End If Headertocheck = Wscript.Arguments(3) intresult = 0 if Headertocheck = "c040120e" Intresult = 1 End If WScript.Quit(intresult) Scott Fisher Director of IT Farm Progress Companies >>> "Mike Nice" <[EMAIL PROTECTED]> 07/16/04 10:45AM >>> Scott, Can you send me the headers of one of these E-mails? I'd like to add this test to a local external test (Similar to SPAMCHK) utility we have. Thanks, Mike Nice ----- Original Message ----- From: "Scott Fisher" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, July 16, 2004 10:49 AM Subject: [Declude.JunkMail] Campaign for spamheaders filter variable (continues) There is one constant. It always fails the SPAMHeaders test with a code of c040120e. Checking my logs for June and August, I've had over 3000 mails that had this SPAMHeaders test code and not one of them has been a non-spam e-mail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)
I run HIGH level on my logs. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 07/16/04 10:51AM >>> > I import my logs into an MS Access database. Since I want to > track badheaders/spamheaders, I wrote code to process those > junkmail lines. At loglevel MID I can't see any result code in the logfile. Only in the warning header line of a hold message. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)
> I import my logs into an MS Access database. Since I want to > track badheaders/spamheaders, I wrote code to process those > junkmail lines. At loglevel MID I can't see any result code in the logfile. Only in the warning header line of a hold message. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)
I import my logs into an MS Access database. Since I want to track badheaders/spamheaders, I wrote code to process those junkmail lines. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 07/16/04 10:34AM >>> > If there was a variable to filter on SPAMHEADERS, this would > make one effective filter. Sound's easy to implement. At the moment I have 27000 spams in our hold folder. 32 of them has failed the spamheaders test with c040120e 27 of this 32 has reached a weight between 400 and 500% of our hold weight 5 has reached only between 105 and 120% of our hold weight. Can't say how many legit messages has failed SPAMHEADERS with this result code. How do you count them? Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Campaign for spamheaders filter variable (continues)
> If there was a variable to filter on SPAMHEADERS, this would > make one effective filter. Sound's easy to implement. At the moment I have 27000 spams in our hold folder. 32 of them has failed the spamheaders test with c040120e 27 of this 32 has reached a weight between 400 and 500% of our hold weight 5 has reached only between 105 and 120% of our hold weight. Can't say how many legit messages has failed SPAMHEADERS with this result code. How do you count them? Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Campaign for spamheaders filter variable (continues)
I'm continuing my campaign got a variable to check the spamheaders (and badheaders) in filters. Pretty much once a week, a particular spam company unleashes new domains/IP numbers at me and my users. The new IP numbers / domain names aren't on any RBL and are too new for sniffer, hence they usually get through my filtering. They don't have any info worth filtering on in the body/subject. There is one constant. It always fails the SPAMHeaders test with a code of c040120e. Checking my logs for June and August, I've had over 3000 mails that had this SPAMHeaders test code and not one of them has been a non-spam e-mail. If there was a variable to filter on SPAMHEADERS, this would make one effective filter. Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
