Spam source info, can we/I use this?

[lendaddy]

Can I use any of this to create a filter?

Here it is:


From - Fri Apr 01 13:08:30 2005
X-Account-Key: account2
X-UIDL: UID6599-1098988202
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path:
Delivered-To: hxxxxxsys_com-jxxx@xxx.com
Received: (qmail 12587 invoked by uid 87); 1 Apr 2005 18:06:38 -0000
Received: from stepmothers@infarkt.ru by vmail4 by uid 92 with qmail-scanner-1.22
(clamdscan: 0.70. Clear:RC:0(24.7.79.106):.
Processed in 0.215128 secs); 01 Apr 2005 18:06:38 -0000
Received: from c-24-7-79-106.client.comcast.net (HELO dorog.net) (24.7.79.106)
by mail.egl.net with SMTP
for ; 1 Apr 2005 18:06:38 -0000
Received: from infarkt.ru (mx.infarkt.ru [195.161.113.101])
by dorog.net with esmtp
id 0443419D27 for ; Fri, 01 Apr 2005 12:06:41 -0600
Message-ID: <111001c536e5$263fc691$ed42d42e@infarkt.ru>
From: "Marie U. Birdieing"
To: Jxxl
Subject: SCOTK prices on name-brand stofware!
Date: Fri, 01 Apr 2005 12:06:41 -0600
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0028_6A7AC578.352DE0D7"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Virus-Scanned: by amavisd-milter (http://amavis.org/)
X-Antivirus: avast! (VPS 0513-2, 04/01/2005), Inbound message
X-Antivirus-Status: Clean

This is a multi-part message in MIME format.

------=_NextPart_000_0028_6A7AC578.352DE0D7
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

Hello.

Let us help you to save your money.
Visit our new oem software stock center.
You are in one step to the software you need at the prices you want.

Our todays Special Offers:
Offer #1
Windows XP Pro + Office 2003 Pro + Adobe Acrobat 6.0 Pro + Adobe Photoshop CS/8.0 +
Adobe PageMaker 7.0 + Adobe Illustrator 10 + Norton Antivirus 2004 Pro

Our price: $200.00

Offer #2
MS Windows XP Pro with SP2 + MS Office XP Pro with SP3
+ You get Norton Antivirus 2004 cd absolutely free

Our price: $125.00

Offer #3
MS Windows XP Media Center Edition 2005 + MS Office 2003 Professional +
You get Norton Antivirus 2004 cd absolutely free

Our price: $180.00

We promise to do our best to keep prices to OEM Software habitually incredible cheap.
Click here to visit our new oem software store: http://sofnpn.info/in.php?aid=164

Good luck!



UNSUBSCRIBE:http://www.sofnpn.info/fgh.php

------=_NextPart_000_0028_6A7AC578.352DE0D7
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

-1">



i">




Hello=2e



Let us help you to save your money=2e

Visit our new oem software stock center=2e

You are in one step to the software you need at the prices you want=2e >


Our todays Special Offers:<=
/b>

"> Offer #1 Windows XP Pro + Office 2003 Pro + Adobe Acrobat 6=2e0 Pro + Adobe Photoshop CS/8=2e0 + Adobe PageMaker 7=2e0 + Adobe Illustrator 10 + Norton Antivirus 2004 Pro =09	Retail price: $5000=2e00 You save: $4800 0">Our price: $200=2e00 =09
"> Offer #2 MS Windows XP Pro with SP2 + MS Office XP Pro with SP3 + You get Norton Antivirus 2004 cd absolutely free =09	Retail price: $999=2e00 You save: $874 0">Our price: $125=2e00 =09
"> Offer #3 MS Windows XP Media Center Edition 2005 + MS Office 2003 Professional + You get Norton Antivirus 2004 cd absolutely free =09	Retail price: $650=2e00 You save: $470 0">Our price: $180=2e00 =09

We promise to do our best to keep prices to OEM Software habitually incre=
dible cheap=2e=20



Click here to visit o=
ur new oem software store=2e




Good luck!





UNSUBSCRIBE

DTO Garage Plus vBulletin Plugins by Drive Thru Online, Inc.

------=_NextPart_000_0028_6A7AC578.352DE0D7--

[widebody911]

Originally posted by lendaddy
Can I use any of this to create a filter?

You could use it to create a rule for this specific set of envelope contents, but the chances of getting another spam with the same header elements are right up there with you slapping a "Dean/Kerry" sticker on your VW bus.

[djmcmath]

Yup. I tried that for a long time -- copy down header information, build filters based on server, name, subject, etc. -- no luck.

(PS -- Len, you have a PM)

[widebody911]

About the best you could do would be to netblock 195.161.113 (don't know the subnet mask) and/or anything from a .ru domain, unless of course you're doing business with the Russians, comrade...

A better bet is to install a trainable spam filter.

[lendaddy]

Ok, that stuff makes sense. So my built in filters can't get too deep into the source(anything beyond the header) to allow/deny acceptance? I was hoping I could find some common ditty in the source info above (and the other spam I get) and tell my e-mail to deny it.

I was also thinking last night.(but again usless if all that is scanable is the header) would be to tell my e-mail not to accept any e-mail with more than "X" recipients.

[widebody911]

Originally posted by lendaddy
I was also thinking last night.(but again usless if all that is scanable is the header) would be to tell my e-mail not to accept any e-mail with more than "X" recipients.

Pointless. The BCC header gets around that.

[id10t]

Use somethign with a bayesan filter on it. Mozilla and Thunderbird do this, I think there is a plugin for Outlook to do it. Basically you train it with what you percieve as spam. And it looks at the entire message to determine it.

[lendaddy]

I do use thunderbird, thanks.

[lendaddy]

Originally posted by widebody911
Pointless. The BCC header gets around that.

Hey I'm learning

[lendaddy]

So if I go through my deleted e-mails and mark all the junk ones as "Junk" my computer will use that to adapt and learn? Or do I have to do it as they come in?

[widebody911]

Originally posted by lendaddy
So if I go through my deleted e-mails and mark all the junk ones as "Junk" my computer will use that to adapt and learn? Or do I have to do it as they come in?

With a trainable spam filter, you put all of your spam in a special folder. The filter analyses the messages to learn what you consider junk. They work on scoring various words for spaminess. For instance, if you put every email with the words "John Kerry" in there, it would learn to treat that as junk mail

http://www.nospamtoday.com/index.html

FreeWare version (SpamAware) @
http://www.jam-software.com/freeware/index.shtml

[RallyJon]

How about anything from a ".ru" domain? And ".se" too--I get a lot of spams from those.