RE: [sniffer] [Fwd: Diann Helms]

[Markus Gufler]

 

> would you share your filters?
> I assume Declude filters.

Yes.
Attached is the original message from Scott Fisher regarding the
geocities-filter file. (I call it GEOCITIESLINKS)
I've replaced each weight (100 and 75 points) with 0. So this test will add
no weight to the final result. 

In addition you have to set up SORBS-DUHL as a standard IP4R-Test.

Then you need an additional text filter file (I call it
COMBO-DUHL-GEOCITIES)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
TESTFAILED END NOTCONTAINS GEOCITIESLINKS
TESTFAILED 80  CONTAINS SORBS-DUHL
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The first line will stop the combo-filter if there was no geocities-links in
the message body
The second line will add 80 points if the message cames in from a DUHL-ip.

Markus

--- Begin Message ---

Title: Message

Here's my geocities filter. It's a little more specific so I can weight foreign geocities more than US geocities.   STOPATFIRSTHIT   BODY  100 CONTAINS ar.geocities.com BODY  100 CONTAINS geocities.com.ar BODY  100 CONTAINS ar.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.ar   BODY  100 CONTAINS asia.geocities.com BODY  100 CONTAINS asia.geocities.yahoo.com   BODY  100 CONTAINS au.geocities.com BODY  100 CONTAINS geocities.com.au BODY  100 CONTAINS au.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.au   BODY  100 CONTAINS br.geocities.com BODY  100 CONTAINS geocities.com.br BODY  100 CONTAINS br.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.br   BODY  100 CONTAINS ca.geocities.com BODY  100 CONTAINS geocities.ca BODY  100 CONTAINS ca.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.ca   BODY  100 CONTAINS cf.geocities.com BODY  100 CONTAINS cf.geocities.yahoo.com   BODY  100 CONTAINS cn.geocities.com BODY  100 CONTAINS geocities.cn BODY  100 CONTAINS cn.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.cn   BODY  100 CONTAINS de.geocities.com BODY  100 CONTAINS geocities.de BODY  100 CONTAINS de.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.de   BODY  100 CONTAINS es.geocities.com BODY  100 CONTAINS geocities.es BODY  100 CONTAINS es.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.es   BODY  100 CONTAINS espanol.geocities.com BODY  100 CONTAINS espanol.geocities.yahoo.com   BODY  100 CONTAINS hk.geocities.com BODY  100 CONTAINS geocities.com.hk BODY  100 CONTAINS geocities.hk BODY  100 CONTAINS hk.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.hk BODY  100 CONTAINS geocities.yahoo.hk   BODY  100 CONTAINS in.geocities.com BODY  100 CONTAINS geocities.co.in BODY  100 CONTAINS in.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.co.in   BODY  100 CONTAINS it.geocities.com BODY  100 CONTAINS geocities.it BODY  100 CONTAINS it.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.it   BODY  100 CONTAINS kr.geocities.com BODY  100 CONTAINS geocities.co.kr BODY  100 CONTAINS kr.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.co.kr   BODY  100 CONTAINS mx.geocities.com BODY  100 CONTAINS geocities.com.mx BODY  100 CONTAINS mx.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.mx   BODY  100 CONTAINS sg.geocities.com BODY  100 CONTAINS geocities.com.sg BODY  100 CONTAINS sg.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.com.sg   BODY  100 CONTAINS uk.geocities.com BODY  100 CONTAINS geocities.co.uk BODY  100 CONTAINS uk.geocities.yahoo.com BODY  100 CONTAINS geocities.yahoo.co.uk   BODY  75 CONTAINS geocities.com BODY  75 CONTAINS geocities.yahoo.com     ----- Original Message ----- From: Dave Doherty To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:09 AM Subject: Re: [Declude.JunkMail] Stock Spam If you're referring to the geocities stuff that's been out the last couple of days, I just use a body filter.   BODY 3 CONTAINS au.geocities.com   Sniffer, which I weight at 7, picks it up OK, and the added weight of 3 is enough to get to my hold weight of 10.   -Dave Doherty  Skywaves, Inc. ----- Original Message ----- From: Michael Jaworski To: Declude.JunkMail@declude.com Sent: Thursday, February 02, 2006 9:32 AM Subject: [Declude.JunkMail] Stock Spam Anyone have a good filter strategy on the increasing amount of stock spam???   Thanks,   Mike

--- End Message ---