RE: [Declude.JunkMail] Server Recommendation
That's killer horsepower, We are running dual 800's right now with a gig of ram and other than the spam we receiving the other day our server setup has never had a hiccup. Even then they only hiccupped at receiving over 1,000,000 spam in a 12 hour period. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Aaron J. Caviglia Sent: Friday, March 12, 2004 11:44 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Server Recommendation Isaias, We currently receive about 70-80% of SPAM. Are servers are a little bit overkill for our needs, about 3,000 - 4,000 e-mails a day. But the server has never hiccuped in over a year now. Only need to reboot to patch windows. Its also weathered a couple of SPAM floods as well, (10,000 emails an hour). Dual Xeon 2.55GHz 533 Bus 4GB DDR RAM RAID 5+HOTFIX Array (All 250GB Serial ATA HDs 7200RPM) Its way overkill, but I love horsepower! Aaron On Mar 12, 2004, at 8:35 AM, TC Online Support wrote: We are currently looking to upgrade our mail server. Lately the processing of the CPU has causing the SMTP to be working real slow, causing a lot of timeouts. We currently we are running a P3 1.133GHz with 512MB RAM. We are looking to upgrade to a dual processor. I was wondering if anybody was willing to share what type of server hardware they are using and if anybody had any recommendations on the CPU power and RAM to have optimal performance. Also I was wondering what amount of SPAM is being received by other ISPs. Currently over 90% of all incoming mail to our server is SPAM. I just wanted to see if this is normal for an ISP. Isaias Hernandez Internet Tech Support [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Server Recommendation
Because of what happened this week we were forced to look at our tests etc more than we have had in the past. We could not understand why our CPU was always so damn high. Once we looked at the tests and compared that to our DNS log files we noticed that there were a lot of DNS errors. It turns out that several of the tests provided in the original config have since been turned off (no this is not Scotts or Decludes fault, its our fault/problem for just not having enough time to read up everything for every single server we have). So we removed all of the monkeylists etc and just left on ORDB and spamcop for DNS tests. Or CPU dropped dramatically it might help you if your anything like us and done have tons of time to spend on a config file. Speaking of this, since I don't have the time to dedicate to this like I really wish I did and I am sure there are a couple of sysadmins on this list who have tweaked this to get amazing results would anyone be willing to share their tests or config files with us (off list of course)... Darryl Koster -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, March 12, 2004 1:05 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Server Recommendation We currently send and receive about 40,000 to 50,000 e-mails daily. The processes that are taking up the most CPU are multiple instances of declude.exe and NTVDM.exe. NTVDM.exe is used for 16-bit processes, and can indeed cause some servers to slow down to a crawl. Are you using F-Prot.exe with Declude Virus? If so, you should switch to the 32-bit fpcmd.exe version. We tried to comment out some of our SPAM test to see if it would help and it has freed up some CPU. The SPAM test that were commented out were the ones provided by mailpure.com (Gibberish, Y!directed, etc). Are these tests really worth having to test for SPAM or can they be removed? Any filter with many BODY filters in it can be very CPU intensive. If you don't have much CPU power to spare, you may want to weigh the benefits of the filters versus the CPU usage. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 2,000,000 + emails today
So I have received over 2,000,000 emails today for just one domain name, its been interesting and I have been trying to stop this myself and am having little or no luck at all figuring out what to do. After looking at the headers of the e-mails I have found that he/she/basturd has many many ip's (or spoofing of IP's) at their disposal. Any suggestions on what to do? Basically this person, nay jacka** is sending a dictionary/whatevertheywanttoputin to the company (particular domain). Frustrated Darryl Koster --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2,000,000 + emails today
I actually have 10 megs worth of them, small emails all of them with just many many many ips for them, rarely ever from the same address. Seems to be from (which we can pretty much ensure are spoofed) bellsouth, sprintpcs, aol, studmail.com (laff) and a couple of others. Did you want to see lots of them (which means I will send the file off list (I will par it down to a meg or so)) or do you want me to just send them to this list. Darryl Koster -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Wednesday, March 10, 2004 6:03 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] 2,000,000 + emails today Hi Darryl: Do you have a sample of the email and the header you can send? Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darryl Koster Sent: Wednesday, March 10, 2004 5:49 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] 2,000,000 + emails today So I have received over 2,000,000 emails today for just one domain name, its been interesting and I have been trying to stop this myself and am having little or no luck at all figuring out what to do. After looking at the headers of the e-mails I have found that he/she/basturd has many many ip's (or spoofing of IP's) at their disposal. Any suggestions on what to do? Basically this person, nay jacka** is sending a dictionary/whatevertheywanttoputin to the company (particular domain). Frustrated Darryl Koster --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2,000,000 + emails today
I will definitely be contacting you off list. The problem I am running into now is that the imail cannot support the shear number of emails that are being put through. We are creating log files that are in the 300+ meg range and the server can no longer keep up with the smtp requests. We also have a spool server which is running at about 100,000 e-mails behind (so the iMail server cant keep up to this level of attack and there are over 100,000 emails sitting in the queue on another server waiting to be delivered). I have just removed this client from our dns servers (no more mx records etc) as we have over 1000 other sites on our servers who can no longer get their forms working from their sites either (ARGH). Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Wednesday, March 10, 2004 6:43 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] 2,000,000 + emails today Hi Darryl- We've been going through the same thing since early January - although not to the extent you're seeing it. We get 350,000 to 650,000 a day for one domain. Exactly the same pattern, though. Widely distributed IP addresses that indicate that the sender controls zombies or has placed these addresses in a million addresses CD. We have quarantined the recipient domain onto a standby server, and we are collecting log files to use as evidence. I am in the process of fine-tuning the message parsing software I wrote, and I am extracting linked domain names from about 5,000 sample messages now. Hopefully, we will find a common beneficiary and be able to go after him. I have found no good technical way to stop the attack. The positive side to this type of attack is that sending back a user-not-found error takes almost no bandwidth or server resources and prevents the actual message from being sent - all you get is a short SMTP dialog with the sender. Until you download some samples, then things really clog up. Contact me off-list if you want to share specifics. -Dave Doherty Skywaves, Inc. - Original Message - From: Darryl Koster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, March 10, 2004 5:48 PM Subject: [Declude.JunkMail] 2,000,000 + emails today So I have received over 2,000,000 emails today for just one domain name, its been interesting and I have been trying to stop this myself and am having little or no luck at all figuring out what to do. After looking at the headers of the e-mails I have found that he/she/basturd has many many ip's (or spoofing of IP's) at their disposal. Any suggestions on what to do? Basically this person, nay jacka** is sending a dictionary/whatevertheywanttoputin to the company (particular domain). Frustrated Darryl Koster --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2,000,000 + emails today
We generally do not have nobody alias's set on the domains we have, this was set up to capture some of the emails that were being held by the server so we could look at the headers. Once we knew we had enough of them to work with we removed the nobody alias. Basically those 10 Megs worth of emails span about 10 minutes worth of time. Here are a couple sample headers. The IP range found within some of the (207.164.190.***) is our IP Range. Take a look, there are two of them I have not been able to find any similarities between them. There are hundreds like this. Darryl Koster ---HEADER ONE -- From [EMAIL PROTECTED] Wed Mar 10 15:30:58 2004 Received: from mx2.statusconcepts.com [207.164.190.21] by mail.statustechnologies.com (SMTPD32-7.07) id AAF069B8010C; Wed, 10 Mar 2004 15:30:40 -0500 Received: (qmail 32104 invoked from network); 10 Mar 2004 16:44:32 - Received: from spr1-brig5-3-0-cust133.lond.broadband.ntl.com (80.3.72.133) by mx2.statusconcepts.com with SMTP; 10 Mar 2004 16:44:32 - Received: from (HELO idif) [126.202.95.91] by spr1-brig5-3-0-cust133.lond.broadband.ntl.com SMTP id T5WrKU8YPux1cX; Sat, 13 Mar 2004 15:38:00 -0600 Message-ID: [EMAIL PROTECTED] From: Lakisha Woody [EMAIL PROTECTED] Reply-To: Lakisha Woody [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: turn your Spud into a stud!! m Date: Sat, 13 Mar 04 15:38:00 GMT X-Mailer: Microsoft Outlook Express 6.00.2462. MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=B0DD5_.B3._EBFDDB0 X-Priority: 3 X-MSMail-Priority: Normal X-Declude-Sender: [EMAIL PROTECTED] [207.164.190.21] X-Declude-Spoolname: D7af069b8010ca4e1.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Note: If there are problems please contact [EMAIL PROTECTED] X-Note: http://www.statustechnologeis.com X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, BADHEADERS, IPNOTINMX, NOLEGITCONTENT, ROUTING, BODYFILTER, SPAM-DOMAINS, WEIGHT10, WEIGHT30 [55] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 378950659 --B0DD5_.B3._EBFDDB0 Content-Type: text/html; Content-Transfer-Encoding: quoted-printable HEADER TWO --- From [EMAIL PROTECTED] Wed Mar 10 16:00:13 2004 Received: from mx2.statusconcepts.com [207.164.190.21] by mail.statustechnologies.com (SMTPD32-7.07) id ADD9621B00AE; Wed, 10 Mar 2004 15:43:05 -0500 Received: (qmail 1595 invoked from network); 10 Mar 2004 16:48:27 - Received: from c-24-12-20-130.client.comcast.net (24.12.20.130) by mx2.statusconcepts.com with SMTP; 10 Mar 2004 16:48:27 - Received: from [218.175.132.210] by c-24-12-20-130.client.comcast.net with ESMTP id 05811379 for [EMAIL PROTECTED]; Sat, 13 Mar 2004 17:37:56 -0400 Message-ID: [EMAIL PROTECTED] From: Melissa Funk [EMAIL PROTECTED] Reply-To: Melissa Funk [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: This email is for Men! uukvx xga pxd hclt Date: Sat, 13 Mar 04 17:37:56 GMT X-Mailer: The Bat! (v1.52f) Business MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=B0DD5_.B3._EBFDDB0 X-Priority: 3 X-MSMail-Priority: Normal X-Declude-Sender: [EMAIL PROTECTED] [207.164.190.21] X-Declude-Spoolname: D7dd9621b00ae0338.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Note: If there are problems please contact [EMAIL PROTECTED] X-Note: http://www.statustechnologeis.com X-Spam-Tests-Failed: NOPOSTMASTER, BADHEADERS, IPNOTINMX, NOLEGITCONTENT, BODYFILTER, GIBBERISHSUB, SPAM-DOMAINS, WEIGHT10, WEIGHT30, WEIGHT100 [149] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 378952512 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Tom's Kill List
Hrm, Had to remove that from our list as well. Darryl Koster -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Tom Sent: Tuesday, February 17, 2004 7:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Tom's Kill List Importance: High Your blacklist includes @Optonline.com @optonline.net ID-20040211-002132 Please be advised: This was an oversight and was removed. A new list was generated, sorted and re-formatted. Best Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Manual
Scott, I have been away for some time and have been trying to get caught up on the declude list (its the most active list I have). Seems that there is a lot of chatter on the mailing list right now with tests etc that are not in the manual. I am curious will a new manual be released, or does anyone have any good explanations of some of these tests on their sites? Hope someone can help. Darryl Koster --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HOTMAIL ?
How exactly do I set up the spamdomains test in my system. I know I need to create /imail/declude/spamdomains.txt file (I added the domains from below) but I am unsure of how to set it up in the GLOBAL.CFG file. Could someone give me a quick how to. Thanks Darryl Koster -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Thursday, December 18, 2003 2:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] HOTMAIL ? I haven't updated my spamdomains file for quite some time, but this has been working well for me, thus far: altavista. .av.com amazon.com .forevermail.com ameritech.net .sbc.com .aol.com @aol.com .aol.com .apple.com @apple.com .apple.com .att. .cdpd.airdata.com @att. .att. attbi.com .comcast. bellatlantic.net .verizon.net .bellsouth.net @bellsouth.net .bellsouth.net .btinternet. @btinternet. .btinternet. .buy.com .dartmail.com @buy.com .buy.com .charter.net @charter.net .charter.net .cisco.com @cisco.com .cisco.com .comcast. @comcast. .comcast. .compaq.com @compaq.com .compaq.com compuserve.com .aol.com concentric.com .cnchost.com concentric.net .cnc.net .cox. @cox. .cox. @cs.com .aol.com .dell.com @dell.com .dell.com earthlink. .mindspring. .ebay.com .emailebay.com @ebay.com .ebay.com excite.com .excitenetwork.com .gateway.com .dartmail.net @gateway.com .gateway.com geocities.com .yahoo.com gte. .verizon. .hotmail.com @hotmail.com .hotmail.com hp.com .compaq.com juno.com .untd.com .lycos.com @lycos.com .lycos.com .microsoft.com @microsoft.com .microsoft.com mindspring. .earthlink. msn.com .hotmail.com netscape. .aol.com netzero. .untd.com .paypal.com @paypal.com .paypal.com prodigy.net .yahoo. psi. .cogentco.com qwest. .uswest. .rr.com @rr.com .rr.com .sbc.com @sbc.com .sbc.com sprint. .sprintlink.net swbell.net .prodigy.net uswest. .qwest. verio. .veriomail.com verizon.com .gte.com verizon.net .bellatlantic. .yahoo. @yahoo. .yahoo. Bill - Original Message - From: Rich [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, December 18, 2003 8:07 AM Subject: Re: [Declude.JunkMail] HOTMAIL ? Spamdomains works, and we've been building a list of common sources of spam, cable modem IP's and such. Bill has a spamdomains list that works pretty good, if there's an update to it he might read this and post the link to it. I haven't had a lot of false postives on Spamdomains. Rich - Original Message - From: Ron Rushing [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, December 18, 2003 6:48 AM Subject: [Declude.JunkMail] HOTMAIL ? Greetings-- Would someone please share a strategy to identify or block junk coming from spoofed/relayed hotmail addys, while letting legit mail originating from the real hotmail host(s) through ? -- ==Ron Rushing== CCNA CCDA Network Manager- ESC7Net Region VII Education Service Center 1909 N. Longview St. Kilgore, Texas 75662 903-988-6955 FX 903-988-6965 [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HOTMAIL ?
I had pretty much everything correct except the SPAM-DOMAINS (I had SPAMDOMAINS). Thank you very much for clearing this up for me, it has truly knocked the level of spam down significantly in just over an hour. Darryl Koster -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Thursday, December 18, 2003 4:42 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] HOTMAIL ? Add an entry to your global.cfg like: SPAM-DOMAINS spamdomains M:\IMail\Declude\SpamDomains.txt x 10 0 setting the weight test to whatever you want (reflected as a weight 10 above). Bill - Original Message - From: Darryl Koster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, December 18, 2003 1:31 PM Subject: RE: [Declude.JunkMail] HOTMAIL ? How exactly do I set up the spamdomains test in my system. I know I need to create /imail/declude/spamdomains.txt file (I added the domains from below) but I am unsure of how to set it up in the GLOBAL.CFG file. Could someone give me a quick how to. Thanks Darryl Koster -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Thursday, December 18, 2003 2:37 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] HOTMAIL ? I haven't updated my spamdomains file for quite some time, but this has been working well for me, thus far: altavista. .av.com amazon.com .forevermail.com ameritech.net .sbc.com .aol.com @aol.com .aol.com .apple.com @apple.com .apple.com .att. .cdpd.airdata.com @att. .att. attbi.com .comcast. bellatlantic.net .verizon.net .bellsouth.net @bellsouth.net .bellsouth.net .btinternet. @btinternet. .btinternet. .buy.com .dartmail.com @buy.com .buy.com .charter.net @charter.net .charter.net .cisco.com @cisco.com .cisco.com .comcast. @comcast. .comcast. .compaq.com @compaq.com .compaq.com compuserve.com .aol.com concentric.com .cnchost.com concentric.net .cnc.net .cox. @cox. .cox. @cs.com .aol.com .dell.com @dell.com .dell.com earthlink. .mindspring. .ebay.com .emailebay.com @ebay.com .ebay.com excite.com .excitenetwork.com .gateway.com .dartmail.net @gateway.com .gateway.com geocities.com .yahoo.com gte. .verizon. .hotmail.com @hotmail.com .hotmail.com hp.com .compaq.com juno.com .untd.com .lycos.com @lycos.com .lycos.com .microsoft.com @microsoft.com .microsoft.com mindspring. .earthlink. msn.com .hotmail.com netscape. .aol.com netzero. .untd.com .paypal.com @paypal.com .paypal.com prodigy.net .yahoo. psi. .cogentco.com qwest. .uswest. .rr.com @rr.com .rr.com .sbc.com @sbc.com .sbc.com sprint. .sprintlink.net swbell.net .prodigy.net uswest. .qwest. verio. .veriomail.com verizon.com .gte.com verizon.net .bellatlantic. .yahoo. @yahoo. .yahoo. Bill - Original Message - From: Rich [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, December 18, 2003 8:07 AM Subject: Re: [Declude.JunkMail] HOTMAIL ? Spamdomains works, and we've been building a list of common sources of spam, cable modem IP's and such. Bill has a spamdomains list that works pretty good, if there's an update to it he might read this and post the link to it. I haven't had a lot of false postives on Spamdomains. Rich - Original Message - From: Ron Rushing [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, December 18, 2003 6:48 AM Subject: [Declude.JunkMail] HOTMAIL ? Greetings-- Would someone please share a strategy to identify or block junk coming from spoofed/relayed hotmail addys, while letting legit mail originating from the real hotmail host(s) through ? -- ==Ron Rushing== CCNA CCDA Network Manager- ESC7Net Region VII Education Service Center 1909 N. Longview St. Kilgore, Texas 75662 903-988-6955 FX 903-988-6965 [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can
[Declude.JunkMail] attachment problems
I am having a real problem with clients not getting attachments. Is there a test I can do that will help with this? Darryl Koster --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] attachment problems
Scott, I never ever thought this was a problem with Declude. I assumed it was something that I honestly had done on my end to cause this. I just want to know how to fix it as I have a client who is acting like they are maybe 3, no wait too old, 2. Thanks Matt, Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Friday, September 19, 2003 3:02 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] attachment problems I am having a real problem with clients not getting attachments. Is there a test I can do that will help with this? There are a lot of reasons for this, but usually it is not caused by Declude. The first step is to check the log files, to see where the E-mail was blocked, or whether it was actually delivered (which is often the case, such as Outlook blocking .exe's). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Internal Mail
The hosting business I run deals mainly with business and I have no dial up or dsl customers that use my services. Saying this it means we get a lot of internal mail going between clients. Is there a way to ensure that e-mails sent from an address (say statustechnologies to statustechnologies) will be allowed through? I know that there is the whitelist from, its hard to list over 1000 clients on there with only 200 whitelist options available. Having something like this would definitely cut down on the amount of held mail we get on a daily basis. Thanks Darryl Koster ~~ Status Technologies Inc. President/Owner Let Us Help You Get The Status You Deserve! http://www.statustechnologies.com P: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] tailing a log file
Does anyone on this know of or have a tool that will allow me to tail my system files or my declude log files while they are building? Something like the tail command on a linux machine? I just loaded (this has nothing to do with above) 1.75 with the comments filter, most of the mail that I was having to sort through before is no-longer. Love this. Darryl Koster ~~ Status Technologies Inc. President/Owner Let Us Help You Get The Status You Deserve! http://www.statustechnologies.com P: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Bogus comments
Same here, When is the new manual going to be put out Scott? Darryl Koster -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of interactiveaustria Sent: Friday, September 12, 2003 7:24 AM To: [EMAIL PROTECTED] Subject: AW: [Declude.JunkMail] Bogus comments Hi, is there a possibility to test for (bogus) comments with Declude.Junkmail (I'm using the lite version)? Something like As I know JM has a COMMENTS test from v1.67beta on. Is it an undocumented feature? I can't find anything in the manual... How do I setup this? Best wishes Michael +--+ | interactiveaustria | | Michael Tobisch EDV-Dienstleistungen | | Wiesengasse 12, A-8160 Weiz | | Tel +43 3172 4930| | GSM +43 664 2126941 | | EMail [EMAIL PROTECTED]| | Web http://www.iaa.at| +--+ | Kundeninformationen per E-Mail: | | http://www.iaa.at/kundeninfo.asp | +--+ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.69 (beta) released
Scott, I am confused, How do I find out about SPAMDOMAINS test? DOSENDERACTIONS etc..I cannot find anything about any of this in the manual. Darryl Koster ~~ Status Technologies Inc. President/Owner Let Us Help You Get The Status You Deserve! http://www.statustechnologies.com P: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, May 28, 2003 5:06 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude JunkMail v1.69 (beta) released We have just released Declude JunkMail v1.69 (beta). See http://www.declude.com/junkmail/manual.htm . Notable changes since the last beta include: o COMMENTS test will now also work with any made-up tag beginning with !. o SPAMDOMAINS test will now allow an alias (IE hotmail.com msn.com to check @hotmail.com, but allows either hotmail.com or msn.com in reverse DNS entry). o Filters will now process 8-bit characters. o DOSENDERACTIONS ON option to allow for actions based on the sender of the E-mail (in Declude Junkmail Pro). o PREWHITELIST ON option to automatically bypass spam tests for E-mail from whitelisted IPs or whitelisted return address. Other additions and fixes can be found in the release notes, at http://www.declude.com/relnotes.htm . Anyone with an up-to-date Service Agreement is entitled to free upgrades (see http://www.declude.com/agree.htm for information on the Declude Service Agreement). --- Quick Resource Reference: Tech Support: [EMAIL PROTECTED] Mailing List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.junkmail your name in the body New Releases List: Send E-mail to [EMAIL PROTECTED] with subscribe declude.releases your name in the body Troubleshooting: See manual URL above; look at Troubleshooting section Emergency Uninstall: See manual URL above; look at Emergency Uninstall section Urgent Support: urgent @declude.com (for urgent/time-sensitive issues only) Declude Addons/Tools URL: http://www.declude.com/tools Manual: http://www.declude.com/junkmail/manual.htm --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Removing mails by the subject
Is there a test I can create that goes by the subject. I get tons that say He Hit Me that are porn etc. Darryl Koster ~~ Status Technologies Inc. President/Owner Let Us Help You Get The Status You Deserve! http://www.statustechnologies.com P: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Removing mails by the subject
It absolutely does, Now does that remove just He hit me or would that also remove help me mom, he hit me Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan Sent: Sunday, March 09, 2003 12:56 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Removing mails by the subject Hi; Only in the Pro version you can have custom filters. SUBJECT 10 CONTAINS He hit Me Hope this helps. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darryl Koster Sent: Sunday, March 09, 2003 11:36 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Removing mails by the subject Is there a test I can create that goes by the subject. I get tons that say He Hit Me that are porn etc. Darryl Koster ~~ Status Technologies Inc. President/Owner Let Us Help You Get The Status You Deserve! http://www.statustechnologies.com P: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Removing mails by the subject
Never mind, I should listen to my own support sometimes...RTFM. Reading now. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan Sent: Sunday, March 09, 2003 12:56 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Removing mails by the subject Hi; Only in the Pro version you can have custom filters. SUBJECT 10 CONTAINS He hit Me Hope this helps. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darryl Koster Sent: Sunday, March 09, 2003 11:36 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Removing mails by the subject Is there a test I can create that goes by the subject. I get tons that say He Hit Me that are porn etc. Darryl Koster ~~ Status Technologies Inc. President/Owner Let Us Help You Get The Status You Deserve! http://www.statustechnologies.com P: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Removing mails by the subject
They fail a bunch of tests on my system. I am still in the set up phases though and am looking into dif. possible fixes for this type of thing. Its nice to know that I can filter for certain words. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Smart Business Lists Sent: Sunday, March 09, 2003 1:29 PM To: Darryl Koster Subject: Re: [Declude.JunkMail] Removing mails by the subject Darryl, Sunday, March 9, 2003 you wrote: DK I get tons that say DK He Hit Me that are porn etc. I've seen a bunch of those recently but they've failed the following tests on my system: OSSOFT, SPAMCOP, WIREHUB-DNSBL, DORKZTL, SBL, SORBS-HTTP, CN-KR, NOABUSE, NOPOSTMASTER, BADHEADERS, REVDNS, SNIFFER Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
I would love to use this as well. Darryl Koster~~Status Technologies Inc. President/Owner"Let Us Help You Get The Status You Deserve!"http://www.statustechnologies.comP: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Neal MathewsSent: Friday, February 28, 2003 10:37 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Log Analyzer - Comments NeededMe too!!! [EMAIL PROTECTED]At 10:28 AM 2/28/2003, you wrote: Count me in : [EMAIL PROTECTED] -Original Message-From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED]] On Behalf Of John ShacklettSent: Friday, February 28, 2003 9:44 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Log Analyzer - Comments NeededYes, me too please.-Original Message-From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED] Behalf Of John TolmachoffSent: Friday, 28 February 2003 9:25 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed I have a beta available and I am looking for individuals to test itout. If you are interested the beta will be made available as early as Monday.I would be interested.John Tolmachoff MCSE, CSSAIT Manager, Network EngineerRelianceSoft, Inc.Fullerton, CA 92835www.reliancesoft.com---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.* If you are not the intended addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. Please advise immediately if you or your employer do not consent to Internet email for messages of this kind.===Neal R. MathewsNetwork Systems EngineerEmail: [EMAIL PROTECTED]Phone: 1-716-673-1000 ext 8321Direct: 1-716-673-8321The Carriage House Companies, Inc. 196 Newton StreetFredonia, NY 14063
[Declude.JunkMail] Spam Kill.lst
Quick question, the list of spam address's at http://www.imagefxonline.net/apps/delog/fromfile.txt have an id number at the end of them. Will this affect the kill list by leaving them in? Darryl Koster ~~ Status Technologies Inc. President/Owner Let Us Help You Get The Status You Deserve! http://www.statustechnologies.com P: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New User -- Quick Question
Thats cleared that up, Thanks Scott. Darryl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Sunday, February 16, 2003 9:02 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] New User -- Quick Question I have Declude up now for about 7 hours now and am very quickly getting used to it. I am wondering though, I have the pro version and I am trying to get a sub folder (C:\Imail\Declude\mail.scubaont.com) to hold the spam it gets. If you copy the \IMail\Declude\$default$.JunkMail file to C:\IMail\Declude\mail.scubaont.com\$default$.JunkMail, and then use the HOLD action in there (for example, changing the WEIGHT20 WARN line to WEIGHT20 HOLD), that should do the trick. Note that if mail.scubaont.com is a host alias for scubaont.com, you would need to use a directory C:\IMail\Declude\scubaont.com\. Also, if you use aliases, you need a directory with the exact same domain as the alias -- so if you have an alias that points to [EMAIL PROTECTED], you would need a directory C:\IMail\Declude\scubaont.com\. If that doesn't explain it, I can explain how to use the debug mode, which will pinpoint the problem. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
