Well, I'd say definitely put the trial key in and get the latest defs for
the trial until you can renew. You'll be running a few days behind, but
that's better than nothing.
Other than that, do you see any patterns in the from addresses or connecting
mail server? You could filter those with a text filter. Since it's
probably zombie spam, you're best bet is renewing your Sniffer license for
Pete's pattern-matching rulebase.
Darin.
----- Original Message -----
From: "Dave Beckstrom" <[EMAIL PROTECTED]>
To: <declude.junkmail@declude.com>
Sent: Thursday, October 05, 2006 11:39 AM
Subject: RE: [Declude.JunkMail] Blocking these?
Darin,
No, I believe sniffer stopped completely.
Here is a header from another one that just came through. Same stock spam.
I can add a from filter for stocknews but that won't be effective very long.
It scored a 4 for having no SPF record and for originating outside the US.
Return-Path: <[EMAIL PROTECTED]> Thu Oct 05 10:35:03 2006
Received: from unusedaddr3-29.dnet.pl [87.239.3.29] by perseus.sixthweb.com
with SMTP;
Thu, 5 Oct 2006 10:35:03 -0500
Return-Path: <[EMAIL PROTECTED]>
Received: from 129.196.250.12 (HELO mx1.danahermail.com)
by atvconnection.com with esmtp (KK0844V0HB QO6P)
id ZP9WBI-G8PVG0-8B
for [EMAIL PROTECTED]; Thu, 5 Nov 2006 15:32:01 -0060
From: "Paulette Broussard" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: a Washington
Date: Thu, 5 Nov 2006 15:32:01 -0060
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Thread-Index: Aca6QLM7WBUW3YPHNFDYSDP5TN93PJ==
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-RBL-Warning: Filter_Country: Message failed Filter_Country test (line 224,
weight 3)
X-Note: ========================================
X-Note: Spam Score: [4]
X-Note: Scan Time: 10:35:53 on 05 Oct 2006
X-Note: Spool File: 34526525.eml
X-Note: Server Name: unusedaddr3-29.dnet.pl
X-Note: SMTP Sender: [EMAIL PROTECTED]
X-Note: Reverse DNS & IP: unusedaddr3-29.dnet.pl [87.239.3.29]
X-Note: Recipient(s): [EMAIL PROTECTED]
X-Note: Country Chain: UNITED STATES->POLAND->destination
X-Note: Failed Weights: SPFUNKNOWN [1], Filter_Country [3]
X-Note: ========================================
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin
Cox
> Sent: Thursday, October 05, 2006 9:32 AM
> To: declude.junkmail@declude.com
> Subject: Re: [Declude.JunkMail] Blocking these?
>
> Hmmm... I thought it did run with the old data file. At the very least
you
> could run with the trial key, which would use an older rulebase.
>
> Note that running an old rulebase will mean much of this rapidly changing
> spam will get through.
>
> Headers would help...
>
> Darin.
>
>
> ----- Original Message -----
> From: "Dave Beckstrom" <[EMAIL PROTECTED]>
> To: <declude.junkmail@declude.com>
> Sent: Thursday, October 05, 2006 10:07 AM
> Subject: RE: [Declude.JunkMail] Blocking these?
>
>
> Darin,
>
> I let my Sniffer subscription lapse for a few weeks until I could afford
to
> renew it. I thought it would continue to run with whatever the latest
data
> file was as of the day that it expired and that it just wouldn't be as
> current without the updates. I assumed it worked that way because that's
> how the trial works -- it runs but with an old data file.
>
> Well, apparently not. Apparently it doesn't run at all any more.
>
> I thought perhaps someone had an idea on how to block these that didn't
> require sniffer. Just as a temporary solution until I purchase the
renewal
> in a week or two.
>
>
>
> > -----Original Message-----
> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Darin
> Cox
> > Sent: Thursday, October 05, 2006 8:25 AM
> > To: declude.junkmail@declude.com
> > Subject: Re: [Declude.JunkMail] Blocking these?
> >
> > Sniffer catches most of these. What do the headers look like?
> >
> > Darin.
> >
> >
> > ----- Original Message -----
> > From: "Dave Beckstrom" <[EMAIL PROTECTED]>
> > To: <declude.junkmail@declude.com>
> > Sent: Wednesday, October 04, 2006 11:42 PM
> > Subject: [Declude.JunkMail] Blocking these?
> >
> >
> > How are you guys blocking something like the spam below?
> >
> > There is no URL to block on. They keep bastardizing words in the body
of
> > the email to the point where you can't hardly block based on the
content.
> >
> > What do you guys do with these?
> >
> >
> >
> > -----Original Message-----
> > From: Louis Rubin [mailto:[EMAIL PROTECTED]
> > Sent: Sunday, November 05, 2006 8:48 AM
> > To: xxxx
> > Subject: Chavez accused
> >
> > THIS THURS DAY OCTOBER 5 2006 BIG NEWS RELEASED ON CR SVF!!!
> > DON'T MISS THIS INVESTMENT MOMENT, PLACE 'CRSVF' ON THE RA`DAR!!!
> >
> >
> > T r a d e Ale rt: THURSDAY, October 05, 2006
> > 'STOCK': CRSVF.OB
> > Current Pri ce : $0.18
> > Pr evClose : $0.19
> > Recommendation: ST RO NG B UY
> >
> > WATCH THIS S TOCK GO HIGHER AND RI SE
> > DON'T M I SS THIS IN VES TMENT MOMENT, PLACE CRSVF ON THE RA DAR!!!
> >
> > About Capital Reserve Canada:
> > CRC is an oil and gas ser vices comp any based in Edmonton, Alberta.
> > Through its wholly owned subsidiary, KCP Innovative Services, Inc., CRC
> > offers technologically tools for use in four areas of the industry.
> > The first aids in testing & development of newly found resources;
another
> > measure existing wells' productivity; and the third hastens well
> > abandonment, ensuring compliance with regulatory emission guidelines.
> > The fourth, through its pro prie tary hardware and software
technologies,
> is
> > used to determine the profitability of coal bed methane deposits, which
> may
> > be developed and sold as natural gas.
> >
> >
> > CRC has a second wholly owned subsidiary, Two Hills Environmental, to
> assist
> > with problem waste from oil & gas companies, and provide undergro und
> > storage.
> >
> >
> > ADD THIS GE M TO YOUR PORTFOLIO AND WATCH IT TRADE ON THURSDAY,
> > October
> > 05, 2006 !!!!!!
> > TR ADE SM ART AND W I N WITH CRSVF!!!
> > Start to buy at 10:30 AM , October 05 2006
> > It will blow up
> >
> >
> >
> >
> >
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list. To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail". The archives can be found
> > at http://www.mail-archive.com.
> >
> >
> >
> >
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list. To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail". The archives can be found
> > at http://www.mail-archive.com.
>
>
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
>
>
>
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
