Spam Messages?

[char...@email.com]

I get tons of spam message - addressed to "blank "To" address for all
kinds of things. How do I set up a "filter" to auto delete all
incoming messages addressed to "To: blank"?

Thanks for any insights.
charliec

[Ralph Fox]

See: http://i44.tinypic.com/28vzhpj.png



--
Kind regards
Ralph

[char...@email.com]

Ok, I followed those instructions and set it up - let's see what
happens.

Thanks
charliec

[Will]

Can anybody confirm that the solution suggested works, as I can't
understand the logic of it ?

Another Charlie

[Nick Spalding]

Will wrote, in <rf7ho7p8q74po39cl...@4ax.com>
on Fri, 13 Apr 2012 22:45:07 +0100:

>Can anybody confirm that the solution suggested works, as I can't
>understand the logic of it ?
>
>Another Charlie

Yours not to reason why - trust Ralph, it works.
--
Nick Spalding
IE8, Vista Home Premium SP2, 32 bit, Intel Viiv dual core
E6300 (1.86Ghz, 1066MHz FSB), 2GB RAM, 320GB NTFS HD,
Video Nvidia GeForce 7900GS LCD 1024x768x75Hz

[Jaimie Vandenbergh]

[Default] On Fri, 13 Apr 2012 22:45:07 +0100, Will

<m...@tarquin.demon.co.uk> wrote:

>On Sat, 07 Apr 2012 21:06:33 -0700, char...@email.com wrote:
>
>>I get tons of spam message - addressed to "blank "To" address for all
>>kinds of things. How do I set up a "filter" to auto delete all
>>incoming messages addressed to "To: blank"?
>
>Can anybody confirm that the solution suggested works, as I can't
>understand the logic of it ?
>
>Another Charlie

The filter is

! to: {.}

The ! means "not"
{} means "this is a regular expression filter", which means that
. means "any symbol", rather than a literal period.

So the filter is "To: contains not even one symbol", or "To: is
blank".

Cheers - Jaimie
--
"First they came for the verbs, and I said nothing because verbing weirds
language. Then they arrival for the nouns, and I speech nothing because
I no verbs." - Quoted by Peter Ellis, afp

[Will]

Thank you Nick and Jamie for your advice and bit of education.

Will

On Sat, 14 Apr 2012 08:13:40 +0100, Nick Spalding <spal...@iol.ie>
wrote:

[Swifty]

On Sat, 14 Apr 2012 21:34:19 +0100, Marc Wilson <ma...@cleopatra.co.uk>
wrote:

>For the uninitiated, it's the braces {} that make all the difference.

I discovered this after losing a lot of weight, and having my trousers
fall down. Mainly the British will understand this.

--
Steve Swift
http://www.swiftys.org.uk/swifty.html
http://www.ringers.org.uk

[Nick Spalding]

Swifty wrote, in <e2lko7pbj5fb1t2fo...@4ax.com>
on Sun, 15 Apr 2012 05:57:50 +0100:

>On Sat, 14 Apr 2012 21:34:19 +0100, Marc Wilson <ma...@cleopatra.co.uk>
>wrote:
>
>>For the uninitiated, it's the braces {} that make all the difference.
>
>I discovered this after losing a lot of weight, and having my trousers
>fall down. Mainly the British will understand this.

I have worn them for many years, I don't like anything tight round my
middle.

[Will]

Well now, I have set it up most carefully as an email filter, exactly
as Ralph's graphic, except that instead of marking to delete the
message I directed it to the Junk folder and it hasn't worked for me.
Can anyone help please?

Will


On Sat, 14 Apr 2012 08:13:40 +0100, Nick Spalding <spal...@iol.ie>
wrote:

>Will wrote, in <rf7ho7p8q74po39cl...@4ax.com>
> on Fri, 13 Apr 2012 22:45:07 +0100:
>
>>Can anybody confirm that the solution suggested works, as I can't
>>understand the logic of it ?
>>
>>Another Charlie
>
>Yours not to reason why - trust Ralph, it works.

Bill

[Ralph Fox]

On Wed, 18 Apr 2012 09:04:23 +0100, in message <15tso75277gp5f7c1...@4ax.com>
Will wrote:

> Well now, I have set it up most carefully as an email filter, exactly
> as Ralph's graphic, except that instead of marking to delete the
> message I directed it to the Junk folder and it hasn't worked for me.
> Can anyone help please?

1. Check whether you have any higher-priority email filters which
might also match the same message(s).

Agent never applies more than one email filter to the same message.
If two email filters match a message, the filter with the highest
priority is applied.


2. Can you post the _raw_ headers from one or more of these messages
which the filter does not put in the Junk folder.

To see the raw headers, turn on both of these settings
1.1 View >> Show All Header Fields
1.2 View >> Display as Raw Message


3. Check and confirm that the entire filter expression is as follows

! to: {.}


4. Can you confirm that "hasn't worked" means
(a) the filter is not putting these messages in the Junk folder
as opposed to one of the following
(b) Agent reports that the filter has a syntax error
(c) the filter is putting other messages in the Junk folder
which you don't want put there.


5. Can you upload a screenshot of the filter's settings to
someplace like www.tinypic.com, and post a link here.

Don't post the image here, as most news servers drop binaries
in text groups like this one.



--
Kind regards
Ralph

[h...@h-gee.co.uk]

Can't download this as server won't accept the request as there is no addressee.

Hugh of Bognor

--
I used to be an Egotistical Megalomaniac - but now I'm just perfect!

Hugh Gundersen
h...@h-gee.co.uk

Bognor Regis, W.Sussex, England, UK

[Will]

Thank you Ralph for offering your help. I've been away, so I am late
in replying to your Usenet post.

Attached are two small jpegs of my filters and one of the
spam messages received is shown below.

I do hope that this will give you the information you need to see why
my filter attempt fails to work.

Thank you.

Will


Return-Path: <online...@lloydstsb.co.uk>
Received: from punt3.mail.demon.net by mailstore
for wil...@tarquin.demon.co.uk id 1SP21c-3q0knw-05-Ctv;
Tue, 01 May 2012 01:37:08 +0000
Received: from [194.217.242.106] (lhlo=anchor-hub.mail.demon.net)
by punt3.mail.demon.net with lmtp id 1SP21c-3q0knw-05
for wil...@tarquin.demon.co.uk; Tue, 01 May 2012 01:37:08
+0000
Received: from [159.134.118.55]
(helo=mail26.svc.cra.dublin.eircom.net)
by anchor-hub.mail.demon.net with smtp id 1SP21c-0007mE-MK
for wil...@tarquin.demon.co.uk; Tue, 01 May 2012 01:37:08
+0000
Received: (qmail 65920 messnum 14045479 invoked from
network[213.94.190.11/avas00.vendorsvc.cra.dublin.eircom.net]); 1 May
2012 01:37:08 -0000
Received: from avas00.vendorsvc.cra.dublin.eircom.net (213.94.190.11)
by mail26.svc.cra.dublin.eircom.net (qp 65920) with SMTP; 1 May 2012
01:37:08 -0000
Received: from User ([86.47.82.73])
by avas00.vendorsvc.cra.dublin.eircom.net with Cloudmark
Gateway
id 4Rcz1j00T1av0nJ01Rd2JQ; Tue, 01 May 2012 02:37:08 +0100
From: "Lloyds TSB"<online...@lloydstsb.co.uk>
Subject: SECURITY ALERT.
Date: Tue, 1 May 2012 02:37:08 +0100
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-CNFS-Analysis: v=1.0 c=1 a=Dyoqhi_TatcA:10 a=AMt4kyYHkyIA:10
a=8EU9Q7FnrCoA:10 a=J9Hwhk642xcA:10 a=Cfj4BQAnxiAA:10
a=inIWgEPmizEA:10 a=2zo0tmNFAAAA:8 a=69EAbJreAAAA:8 a=sFWWvTzgAAAA:8
a=RJeEBm1d5PY-ylDFk48A:9 a=4Rz-R7i7JbWuqk4Ymh4A:7 a=Ft8UYL4EG9YA:10
a=_W_S_7VecoQA:10
X-Antivirus: AVG for E-mail 2012.0.1913 [2411/4970]
X-AVG-ID: ID140B09DE-759ACC06
X-Agent-Received: from pop3.demon.co.uk (pop3.demon.co.uk); Tue, 01
May 2012 09:32:29 +0100
X-Agent-Junk-Probability: 0

<html>

<head>
<meta http-equiv="Content-Language" content="en-us">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<title>New Page 1</title>
</head>

<body>

<img
alt="http://www.lloydstsb.com/media/lloydstsb2004/new_homepage_images/for_the_journey_logo.jpg"
src="http://www.lloydstsb.com/media/lloydstsb2004/new_homepage_images/for_the_journey_logo.jpg"><div>
<font>&nbsp;</font></div>
<font>
<img src="http://gfx2.hotmail.com/mail/w4/pr04/ltr/i_safe.gif"
border="0" height="10" width="561" align="bottom"></font><br>
<font color="#666666"><br>
</font><font face="Verdana">Valued customer,<br>
<br>
A slight error was detected in your Lloyds TSB online account during
our new
security update<br>
<br>
Due to the error detected, we are unable to verify your online banking
account
details.<br>
<br>
You are therefore required to verify your full security details to our
security
system in order to avoid account<br>
suspension.<br>
<br>
Please Follow the link Below to continue.<br>
<br>
<b><a
href="http://www.gloriatorresestilistas.com.mx//wp-content/gallery/folder-h/forms.asp.htm">CLICK
HERE TO VERIFY YOUR DETAILS</a></b></font><p>
<font face="Verdana">Thank you For Banking With Us<br>
<br>
<font size="2">SECURITY TEAM<br>
Lloyds TSB Bank plc<br>
Products and Services Copyright © 2012 Lloyd</font></font><font><font
style="font-family:trebuchet ms,sans-serif" color="#666666"><br>
</font><font size="1"><b><br>
</b></font>
<img src="http://gfx2.hotmail.com/mail/w4/pr04/ltr/i_safe.gif"
border="0" height="9" width="561" align="bottom"></font></p>

</body>

</html>






On Wed, 18 Apr 2012 20:37:53 +1200, Ralph Fox <-rf-nz-@-.invalid>
wrote:

Bill

[Ralph Fox]

On Tue, 01 May 2012 09:41:02 +0100, in message <c28vp79on4j1o07sf...@4ax.com>
Will wrote:

> Attached are two small jpegs of my filters and one of the
> spam messages received is shown below.

Will, I cannot see your jpegs. As I wrote last time, most news
servers will drop binaries in text groups like this one.

> On Wed, 18 Apr 2012 20:37:53 +1200, Ralph Fox <-rf-nz-@-.invalid>
> wrote:
>
> >5. Can you upload a screenshot of the filter's settings to
> > someplace like www.tinypic.com, and post a link here.
> >
> > Don't post the image here, as most news servers drop binaries
> > in text groups like this one.

--
Kind regards
Ralph

[Geoff]

Please excuse the top-post.

Will,
Attaching binaries in text newsgroups is a bad practice and often gets
the attachment deleted. Images need to be uploaded to an image server
such as Ralph suggested where they can be viewed.

As for your filters failing, the spam message is spoofing the
lloydtsb.co.uk service email address and you probably have a
higher-priority filter for that address that is superceding your spam
filter. There is very little you can do about that if you want to
continue to receive legitimate mail from that address.

What I have found successful is to simply ctrl-J the junk mails I
receive and let Agent figure out its own method of detecting the junk.
This can save you some filter tweaking in the long run. I don't know
if Agent can intelligently filter on fields beyond the return path and
reply-to addresses but I have successfully eliminated many similar
phishing emails such as these by letting Agent do the filtering on its
own.

Another thing I do with my user accounts on my personal banking
accounts is to configure them to send me only TEXT messages, not HTML.
Since Agent prefers text and renders HTML rather poorly anyway, this
way I know that if any correspondence from any of my online accounts
contains HTML it is immediately suspect as likely spam.

Regards,
Geoff

On Tue, 01 May 2012 09:41:02 +0100, Will <m...@tarquin.demon.co.uk>
wrote:

[Will]

My apologies.

Ignorance I'm afraid.

I will know for the future and will post again tomorrow - and
properly.

Will

On Tue, 01 May 2012 09:41:02 +0100, Will <m...@tarquin.demon.co.uk>
wrote:

[Ralph Fox]

On Tue, 01 May 2012 10:38:40 -0700, in message <c870q7d0r3rdk1iv8...@4ax.com>
Geoff wrote:

> What I have found successful is to simply ctrl-J the junk mails I
> receive and let Agent figure out its own method of detecting the junk.
> This can save you some filter tweaking in the long run. I don't know
> if Agent can intelligently filter on fields beyond the return path and
> reply-to addresses but I have successfully eliminated many similar
> phishing emails such as these by letting Agent do the filtering on its
> own.

Yes, it can. Agent's learning junk filter scores an email on "words"
found anywhere in the (raw) headers or (raw) body ***. The overall
score decides whether the email is filtered.

For messages like this one, I expect the junk filter would learn to
score on (among other things) the "1251" in the Content-Type header.
This indicates a Russian character set, and is unlikely to occur in
your normal email.


*** In other words, what the body pane shows when both
"Show All Header Fields" and "Display As Raw Message"
are turned on.



--
Kind regards
Ralph

[h...@h-gee.co.uk]

On Wed, 02 May 2012 19:45:36 +1200, Ralph Fox <-rf-nz-@-.invalid> wrote:


Hey - since when has AGENT'S junk process filtered anything automatically to JUNK?

I keep getting the same JUNK and I use the JUNK button to JUNK the crap and it returns
time and time again.

When I asked why it didn't register the post as Junk automatically Forté said it wasn't
designed to.

Might still have that email somewhere but doubt it.

Hugh of Bognor

--
I used to be an Egotistical Megalomaniac - but now I'm just perfect!

Hugh Gundersen
h...@h-gee.co.uk

Bognor Regis, W.Sussex, England, UK

[Geoff]

On Wed, 02 May 2012 12:01:12 +0100, h...@h-gee.co.uk wrote:

>When I asked why it didn't register the post as Junk automatically Forté said it wasn't
>designed to.

The junk filter only works on email, not news group posts.

[Will]

Ralph,

Thank you for your patience.

I haven't used anything like tinypic before.

However, I believe the following links will show the info. you asked
for:

http://i46.tinypic.com/9gdj09.jpg

http://i49.tinypic.com/zuf1py.jpg


I can confirm that the filter is not putting these messages in the
Junk folder.

As I'm getting between two and eight such spam emails per day getting
the filter right would be a real help.

Thank you.

Will





On Tue, 01 May 2012 21:24:02 +1200, Ralph Fox <-rf-nz-@-.invalid>

[h...@h-gee.co.uk]

I know that but I presumed (HO HO HO) that the JUNK button registered anything dumped as
JUNK would also be classed as JUNK next time and JUNKED but it isn't.

It appears to be either broken or a way of bypassing "delete" - "ok" there is no lasting
filter put in place.

[Tom Cole]

On Wed, 02 May 2012 21:22:22 +0100, Will <m...@tarquin.demon.co.uk>
wrote:

>Ralph,
>
>Thank you for your patience.
>
>I haven't used anything like tinypic before.
>
>However, I believe the following links will show the info. you asked
> for:
>
>http://i46.tinypic.com/9gdj09.jpg
>
>http://i49.tinypic.com/zuf1py.jpg
>
>
>I can confirm that the filter is not putting these messages in the
>Junk folder.
>
>As I'm getting between two and eight such spam emails per day getting
>the filter right would be a real help.
>
>Thank you.
>
>Will
>

The filter shown in the second image is set to delete email that is
*already* in the junk folder. Is that what is required?

Personally, I have found that Agent's inbuilt junk detection
facilities are more than adequate for my needs. Just drag 'n drop the
offending emails to the junk folder (or just press CTRL-J while the
unwanted message is highlighted) and Agent soon learns what is
required.

[Stephen Wolstenholme]

Pilgrim,

Please change your quote character to the default > because your use
of + does not trigger a new colour. The result is that your message is
all black with no obvious quote.

Steve

--
Neural Network Software. http://www.npsl1.com
EasyNN-plus. Neural Networks plus. http://www.easynn.com
SwingNN. Forecast with Neural Networks. http://www.swingnn.com
JustNN. Just Neural Networks. http://www.justnn.com

[h...@h-gee.co.uk]

On Fri, 04 May 2012 11:01:57 +0100, Stephen Wolstenholme <st...@npsl1.com> wrote:

> Pilgrim,
>
> Please change your quote character to the default > because your use
> of + does not trigger a new colour. The result is that your message is
> all black with no obvious quote.
>
> Steve

Or you could add several other quoted text indicators to your version of agent as I have.

[Stephen Wolstenholme]

On Fri, 04 May 2012 12:20:30 +0100, h...@h-gee.co.uk wrote:

>On Fri, 04 May 2012 11:01:57 +0100, Stephen Wolstenholme <st...@npsl1.com> wrote:
>
>> Pilgrim,
>>
>> Please change your quote character to the default > because your use
>> of + does not trigger a new colour. The result is that your message is
>> all black with no obvious quote.
>>
>> Steve
>
>
>Or you could add several other quoted text indicators to your version of agent as I have.
>
>Hugh of Bognor

I once thought the solution was to have lots of quote indicators but I
was getting too many false positives so I returned to just using >

Every poster but one in every group that I read uses >

[Nick Spalding]

pilgrim wrote, in <bqa8q79fdjh7fbhhp...@4ax.com>
on Fri, 04 May 2012 14:19:00 -0500:

>On Fri, 04 May 2012 12:20:30 +0100, h...@h-gee.co.uk wrote:
>

>>On Fri, 04 May 2012 11:01:57 +0100, Stephen Wolstenholme <st...@npsl1.com> wrote:
>>
>>> Pilgrim,
>>>
>>> Please change your quote character to the default > because your use
>>> of + does not trigger a new colour. The result is that your message is
>>> all black with no obvious quote.
>>>
>>> Steve
>>
>>
>>Or you could add several other quoted text indicators to your version of agent as I have.
>>
>>Hugh of Bognor
>

>Hugh,
>Thanks for the tip. What are some of the quoted text indicators?
>pilgrim

At one time or another over the past seventeen years I have seen all of
these:
re sv an aw rv ad ans ang

[h...@h-gee.co.uk]

On Fri, 04 May 2012 14:19:00 -0500, pilgrim <so...@mail.invalid> wrote:

> On Fri, 04 May 2012 12:20:30 +0100, h...@h-gee.co.uk wrote:
>

> >On Fri, 04 May 2012 11:01:57 +0100, Stephen Wolstenholme <st...@npsl1.com> wrote:
> >
> >> Pilgrim,
> >>
> >> Please change your quote character to the default > because your use
> >> of + does not trigger a new colour. The result is that your message is
> >> all black with no obvious quote.
> >>
> >> Steve
> >
> >
> >Or you could add several other quoted text indicators to your version of agent as I have.
> >
> >Hugh of Bognor
>

> Hugh,
> Thanks for the tip. What are some of the quoted text indicators?
> pilgrim

I have had (in the past) + = : < > ? * and even "

But when a line starts as a real quote " is pretty useless and if someone puts a space
before a question mark and the ? fall on a line break you get quoted text as well.

It would be safer for you to simply add + for this one person as the likelihood of the
others arriving is pretty slim

[Ralph Fox]

On Fri, 04 May 2012 12:29:25 +1200, in message <8786q7dvja92q9v1t...@4ax.com>
Tom Cole wrote:

> >
> >http://i46.tinypic.com/9gdj09.jpg
> >
> >http://i49.tinypic.com/zuf1py.jpg

> >

> The filter shown in the second image is set to delete email that is
> *already* in the junk folder.

The filter in the second image is set to retrieve email and route/move
it from any other folder into the Junk folder.

What the filter's folder name is for, is the one of the differences
between email filters and Usenet filters.

For *Usenet* filters,
(a) A Usenet filter's scope can be restricted to a single folder.
The folder name is the folder which the Usenet messages have
to already be in.
(b) Usenet filters can not route messages into a different folder.

For *email* filters'
(a) Email filters apply to email in any folder. An email filter's
scope can not be restricted to a single folder.
(b) Email filters can route/move messages into a different folder.
The folder is the destination folder for routing/moving the
email.


--
Kind regards
Ralph

[Tom Cole]

On Sat, 05 May 2012 14:04:21 +1200, Ralph Fox <-rf-nz-@-.invalid>
wrote:

Thanks for the clarification. I haven't used email filters since Agent
was enhanced with RBI and junk detection, and had forgotten this
difference.

[Ralph Fox]

On Fri, 04 May 2012 14:19:00 -0500, in message <bqa8q79fdjh7fbhhp...@4ax.com>
pilgrim wrote:

> Thanks for the tip. What are some of the quoted text indicators?

These characters

> for quoting the message you are replying to
| for quoting text from someone else, not the person you are replying to

I would suggest not adding : or ; to your "Quoted Text Markers". These are
rarely used today for quoting text, and adding them to your "Quoted Text Markers"
setting can mis-colour lines which begin with smilies.

:-)


--
Kind regards
Ralph

[Ralph Fox]

On Wed, 02 May 2012 21:22:22 +0100, in message <0353q7pf8j6s98oc4...@4ax.com>
Will wrote:

> I haven't used anything like tinypic before.
>
> However, I believe the following links will show the info. you asked
> for:
>
> http://i46.tinypic.com/9gdj09.jpg
>
> http://i49.tinypic.com/zuf1py.jpg
>
>
> I can confirm that the filter is not putting these messages in the
> Junk folder.
>
> As I'm getting between two and eight such spam emails per day getting
> the filter right would be a real help.

Increase the priority of the filter to greater than 600. That should
make it work.

The spam message matched _two_ of your filters. Those two filters are
highlighted here: http://i49.tinypic.com/34e9v0l.png

If a message matches more than one filter then only one filter is
applied, the filter with the highest priority. In this case the filter
with the highest priority was the filter for "william", and not the
filter for a blank "To" field.

To fix, increase the priority of the filter for a blank "To" field, so
that it is greater than the priority of the filter for "william".


--
Kind regards
Ralph

[Nick Spalding]

Ralph Fox wrote, in <9f39q7d9ft37k1d07...@4ax.com>
on Sat, 05 May 2012 14:28:17 +1200:

Maybe it should delete them!

[Stephen Wolstenholme]

On Fri, 04 May 2012 14:16:33 -0500, pilgrim <so...@mail.invalid>

wrote:

>On Fri, 04 May 2012 11:01:57 +0100, Stephen Wolstenholme
><st...@npsl1.com> wrote:
>

>>Pilgrim,
>>
>>Please change your quote character to the default > because your use
>>of + does not trigger a new colour. The result is that your message is
>>all black with no obvious quote.
>>
>>Steve
>

>Steve,
>
>How's this?

Perfect.

[Eagle]

On Wed, 02 May 2012 19:45:36 +1200, Ralph Fox <-rf-nz-@-.invalid>
wrote:

Very interesting.