Damm mortage and software spam

[Rob]

<x-flowed>
I still get those darn emails...

are these spammers good, or is it just by fluke their getting by
mailscanner??

Does anyone else have this issue...

There are usually email for medical stuff and its only a graphic with a
remove link on the bottom of the page
Also the subject always has "meeting  friday at 7-00"

Any help appreciated

Rob....



----- Original Message -----
From: "Rob" <rob at THEHOSTMASTERS.COM>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Friday, September 17, 2004 1:16 PM
Subject: Re: Damm mortage and software spam


> Ok I added all those rules....
>
> Let see what happens now....
>
> :)
>
> Rob....
>
>
>
> ----- Original Message -----
> From: "Robin, Rob" <rrobin at GREENAPPLE.COM>
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Sent: Friday, September 17, 2004 10:42 AM
> Subject: Re: Damm mortage and software spam
>
>
>> Rob,
>>
>>        It's there: http://www.rulesemporium.com/rules.htm
>>        There should be rules for OEM software over there. Read the
>> description.
>>
>>        I first tested it by downloading all the rules (except the
>> bigevil). Some of them are overly aggresive. Sending an attachment using
>> a
>> IncrediMail will make it spam. (some of our customers like using
>> IncrediMail, their html and stuff can't be flagged as spam in my
>> scenario).
>>
>>        I have narrowed it down to using:
>> GetRules
>> "http://www.rulesemporium.com/rules/71_sare_redirect_pre3.0.0.cf";
>> GetRules "http://www.rulesemporium.com/rules/evilnumbers.cf";
>> GetRules
>> "http://www.rulesemporium.com/rules/70_sare_bayes_poison_nxm.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_html.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_header.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_specific.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_ratware.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_adult.cf";
>> GetRules "http://www.rulesemporium.com/rules/72_sare_bml_post25x.cf";
>> GetRules "http://www.rulesemporium.com/rules/99_sare_fraud_post25x.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_spoof.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_random.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sc_top200.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_oem.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_genlsubj_x30.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_genlsubj.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_highrisk.cf";
>> GetRules "http://www.rulesemporium.com/rules/70_sare_unsub.cf";
>> GetRules "http://www.rulesemporium.com/rules/88_FVGT_body.cf";
>> GetRules "http://www.rulesemporium.com/rules/88_FVGT_rawbody.cf";
>> GetRules "http://www.rulesemporium.com/rules/88_FVGT_subject.cf";
>> GetRules "http://www.rulesemporium.com/rules/88_FVGT_headers.cf"
>> GetRules "http://www.rulesemporium.com/rules/88_FVGT_uri.cf";
>> GetRules "http://www.rulesemporium.com/rules/99_FVGT_DomainDigits.cf";
>> GetRules "http://www.rulesemporium.com/rules/99_FVGT_Tripwire.cf";
>> GetRules "http://www.rulesemporium.com/rules/99_FVGT_meta.cf";
>> GetRules "http://mywebpages.comcast.net/mkettler/sa/antidrug.cf";
>> GetRules "http://www.emtinc.net/includes/backhair.cf";
>> GetRules "http://www.emtinc.net/includes/chickenpox.cf";
>> GetRules "http://www.rulesemporium.com/rules/evilnumbers.cf";
>> GetRules "http://www.stearns.org/sa-blacklist/random.current.cf";
>> GetRules "http://www.emtinc.net/includes/weeds.cf";
>>
>>
>> Thanks,
>> ------------------------
>> Rob Robin
>> Network Analyst
>> Green Apple, Inc.
>> 740-653-9890
>> rrobin at greenapple.com
>> www.greenapple.com
>> Internet access, hosting and development solutions since 1995.
>>
>>
>> -----Original Message-----
>> From: Rob [mailto:rob at THEHOSTMASTERS.COM]
>> Sent: Wednesday, September 15, 2004 10:43 AM
>> To: MAILSCANNER at JISCMAIL.AC.UK
>> Subject: Re: Damm mortage and software spam
>>
>>
>> I do not see these rules on www.rulesemporium.com   where are they?
>>
>> And after I added rules from www.rulesemporium.com  I still get these
>> irritating emails with subject "your meeting on"
>>
>> and it has just a graphic and a remove link
>>
>> URGH!
>>
>> Rob....
>>
>>
>>
>> ----- Original Message -----
>> From: "Steve Mason" <smlists at SHAW.CA>
>> To: <MAILSCANNER at JISCMAIL.AC.UK>
>> Sent: Wednesday, September 15, 2004 9:49 AM
>> Subject: Re: Damm mortage and software spam
>>
>>
>>> I'm finding that OB_URI_RBL and WS_URI_RBL are catching all of the
>>> software messages.
>>> I haven't seen any mortgage messages  yet...
>>>
>>> Steve
>>>
>>>>I keep getting spam from mortgage and software sales.....
>>>>Anyone have a tip for not letting these guys through?
>>>>I can send headers, but last 2 times I did my email never got through to
>>>>the list, I >guess cuz the mail server thought it was spam..
>>>
>>>>Rob....
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>