[Declude.JunkMail] ATTENTION: My E-mail address has changed
Please Change Your Address Book Thank you for emailing me.nbsp; Your email has been received, and I will respond as soon as possible. We are pleased to announce that Rand Realty has recently affiliated with Better Homes and Gardens Real Estate.nbsp; Accordingly, our email addresses have changed from prudentialrand.com to randrealty.com.nbsp; Please update your address book and direct all future messages to marc.catuo...@randrealty.com.nbsp; PLEASE START USING THIS NEW ADDRESS IMMEDIATELY TO ENSURE DELIVERY. There is no need to resend this message as it has been forwarded to the new address, but this will change shortly.nbsp; Thereafter, all E-mail received by this address will be returned without being forwarded to me. So please update your Address Book. [This message is auto-generated] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] mail server software
If you are looking at smartermail I would make sure you don't have too many Blackberry users. I moved off of IMAIL for Smartermail and on the whole it was an improvement BUT with IMAIL people got their BB email. Smartermail has an intermittent issue with BB; some messages just randomly don't appear on the BB. Never had an issue until I moved to SM. I put in a ticket, they suggested an upgrade, the upgrade made even more people miss messages. They did a packet capture that proved that SM sent data to the BB on ONE single missed message, they felt that was enough proof. I am going to have to tell all my users to forward the email to their BB email accounts because that is the only reliable way of getting messages to the BB from Smartermail - unless maybe you disable IMAP. I suspect that it has something to do with IMAP IDLE so I just turned that off, but last time I did there was a 30 minute delay of email delivery. I'm waiting for user complaints. I'm probably going to tell my users to forward, tired of being SM's guinea pig and getting an answer like, well our system sent the data. I wish they had more of an interest in finding/fixing the issue instead of just being right. Their system has been pretty good but with the unreliability of delivery to BB from their software I am going to be looking at another solution in the next few months... Marc From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Michael Graveen Sent: Tuesday, February 03, 2009 8:10 PM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] mail server software I use SmarterMail (www.smartertools.com) and like it a lot. SmarterTools has conversion tools to help you migrate your IMail domains to SmarterMail. Hope this helps. Mike _ I am going to move from Imail soon. Does any one have any recommendations on reasonable Mail Server software. we need maybe 200 users, and we just pop our mail now. I have been using Workgroup Share to add calendar sharing etc to our current config. Has any one used their Mail Server software and what do you think of it? and will my junkmail still work with it? Thanks for any help. Bruce Loughlin --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
I will be out of the office and all day on 8/26/08 with no access to email. If you are having urgent computer issues please contact [EMAIL PROTECTED] or [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
I will be out of the office from 3pm on 7/10/08 and all day on 7/11/08 with limited access to email. If you are having urgent computer issues please contact [EMAIL PROTECTED] or [EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
For today, 4/11/08, I will be out of the office with limited access to email. Please contact [EMAIL PROTECTED] or [EMAIL PROTECTED] for urgent computer issues. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] form spam filter
One thing we did on our domain is to ban pasting so that the scripts couldn't paste their info into our fields. Also I just had an idea and asked the webmaster if he could program the form to perform a different action if the form page was opened for too short of a time period. Like shoot to a second page that would ask for a confirmation click or word to be typed in. This assumes that a person would take significantly more time to fill a form than a program, even if it is a keystroke generator From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Wednesday, April 09, 2008 11:54 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] form spam filter Matt, I did understand. What I'm saying is that it doesn't always work. To clarify, in addition to less sophisticated automated form fillers that would fill out all fields, there are also more sophisticated ones that use keystroke generators to fill out forms. I just saw one in the public domain last month. CAPTCHA doesn't have this problem, would defeat those automated form fillers, and is therefore more reliable with similarly very little effort to implement. Darin. - Original Message - From: Matt mailto:[EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, April 09, 2008 11:45 AM Subject: Re: [Declude.JunkMail] form spam filter No, I understood completely. I've seen forms with fields hidden by DIVs still filled out. Some of the less sophisticated spam form fillers I've seen used simply filled out every field. They were not looking to see what was visible and what wasn't. Actually this is the part that you misunderstood. The DIV's with visibility hidden will never be filled out by real people, but they will get filled out by form spam sending robots. So if they get filled out, you pretend the submission was successful, but you don't generate the E-mail. It's a simple trick, and it works. Matt --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter for Football
Just an FYI, I just got this link claiming this is a trojan downloader
http://antivirus.about.com/b/a/257941.htm
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, September 12, 2007 1:07 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filter for Football
You could create a filter that looks for 2 identifiers in the email then
score the filter in the global.cfg.
1. A phrase or word
2. The fact there is an IP as a URL
Example:
MINWEIGHTTOFAIL 2
ANYWHERE1 PCRE (?i:football|games?)
BODY1 PCRE
(http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9
]|[01]?[0-9][0-9]?))
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mon
Mariola - Rubén
Sent: Wednesday, September 12, 2007 11:28 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Filter for Football
This is only a sample. The IPs are different. At least I have counted about
20 different subjects that declude has detected like spam and for each
subject many combinations of bodies. 40% of the messages blocked by declude
are of this type.
--
Subject: NFL Season Is Here!
Body:
The time has come for... FOOTBALL!
Don't miss a single game because you don't have the info you needed.
Have all the details for every game with our free game tracking system:
http://x.x.x.x/
--
Subject: Do you have your NFL Game List?
Body:
Football is back, Life may resume again!
Let us keep you on top of every game everyday.
Get all the info you need from our online game tracker:
http://x.x.x.x/
--
Subject: NFL Game List
Body:
We interrupt this life to bring you.FOOTBALL!
Know all the games, what time, what channel and the stats.
Stay informed for every game with our free game page:
http://x.x.x.x/
--
Subject: FOOTBALL! Are You ready?
Body:
Season is open and we do mean FOOTBALL!
Know all the games, what time, what channel and the stats.
Stay informed for every game with our free game page:
http://x.x.x.x/
--
Ruben Marti.
Mon Mariola, S.L.
- Original Message -
From: David Barker
To: declude.junkmail@declude.com
Sent: Wednesday, September 12, 2007 4:36 PM
Subject: RE: [Declude.JunkMail] Filter for Football
Can you post an example ?
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] F-Prot 6?
So you have 100 users?
http://www.f-prot.com/products/prices/price_win_ms.html
F-PROT Antivirus for Windows Mail Servers nbsp; Number of Users
nbsp; Annual license fee nbsp; 1-24 nbsp; US$ 269 nbsp; 25-49 nbsp;
US$ 359 nbsp; 50-99 nbsp; US$ 449 nbsp; 100-199 nbsp; US$ 719 nbsp;
200-299 nbsp; US$ 989 nbsp; 300-399 nbsp; US$ 1259 nbsp; 400-499 nbsp;
US$ 1529 nbsp; 500-749 nbsp; US$ 1799 nbsp; 750-999 nbsp; US$ 2069
nbsp; 1000-1999 nbsp; US$ 2519 nbsp; 2000-2999 nbsp; US$ 2969 nbsp;
3000-3999 nbsp; US$ 3419 nbsp; 4000-4999 nbsp; US$ 3869 nbsp; 5000-5999
nbsp; US$ 4499
Marc Catuogno
MIS Director
Prudential Rand Realty
845-825-8025
-Original Message-
From: SJ.Stanaitis lt;[EMAIL PROTECTED]gt;
Sent 8/23/2007 9:04:42 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] F-Prot 6?
v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:*
{behavior:url(#default#VML);} .shape {behavior:url(#default#VML);}
st1\:*{behavior:url(#default#ieooui) }
$500?nbsp; That#8217;s a steal.nbsp; Website answered my questions.
nbsp;
--SJ
nbsp;
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
Sent: Wednesday, August 22, 2007 10:29 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] F-Prot 6?
nbsp;
Don#8217;t know #8211; but it has a hefty price for legit use on a mail
server unless they have changed with the new version
nbsp;
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of SJ.Stanaitis
Sent: Wednesday, August 22, 2007 8:39 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] F-Prot 6?
nbsp;
Anyone here using F-Prot 6 with their Declude antivirus setup?nbsp; Does it
still have the command line scanner?
nbsp;
--SJ
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] F-Prot 6?
Your sarcasm is appreciated - I am used to users that don't listen or pay much attention, like asking anti-virus questions on the junk mail list or asking a question that could be answered by simply going to the website. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of SJ.Stanaitis Sent: Thursday, August 23, 2007 9:53 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] F-Prot 6? Your powers of observation boggle the mind. --SJ _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Thursday, August 23, 2007 9:37 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] F-Prot 6? So you have 100 users? http://www.f-prot.com/products/prices/price_win_ms.html F-PROT Antivirus for Windows Mail Servers Number of Users Annual license fee 1-24 US$ 269 25-49 US$ 359 50-99 US$ 449 100-199 US$ 719 200-299 US$ 989 300-399 US$ 1259 400-499 US$ 1529 500-749 US$ 1799 750-999 US$ 2069 1000-1999 US$ 2519 2000-2999 US$ 2969 3000-3999 US$ 3419 4000-4999 US$ 3869 5000-5999 US$ 4499 Marc Catuogno MIS Director Prudential Rand Realty 845-825-8025 -Original Message- From: SJ.Stanaitis [EMAIL PROTECTED] Sent 8/23/2007 9:04:42 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] F-Prot 6? $500? That's a steal. Website answered my questions. --SJ _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Wednesday, August 22, 2007 10:29 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] F-Prot 6? Don't know - but it has a hefty price for legit use on a mail server unless they have changed with the new version _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of SJ.Stanaitis Sent: Wednesday, August 22, 2007 8:39 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] F-Prot 6? Anyone here using F-Prot 6 with their Declude antivirus setup? Does it still have the command line scanner? --SJ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] F-Prot 6?
Don't know - but it has a hefty price for legit use on a mail server unless they have changed with the new version _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of SJ.Stanaitis Sent: Wednesday, August 22, 2007 8:39 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] F-Prot 6? Anyone here using F-Prot 6 with their Declude antivirus setup? Does it still have the command line scanner? --SJ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
For the week of July 16th through July 23th I will be out of the office with limited access to voice mail and Email. Please contact [EMAIL PROTECTED] or [EMAIL PROTECTED] for immediate computer help. Please contact [EMAIL PROTECTED] for any website issues. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
For the week of July 9th through July 13th I will be out of the office with limited access to voice mail and Email. Please contact [EMAIL PROTECTED] or [EMAIL PROTECTED] for immediate computer help. Please contact [EMAIL PROTECTED] for any website issues. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2006 Upgrade Webmail Problem
I remember that one... You could also have everyone log in with IMAP and subscribe : ) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Tuesday, December 26, 2006 10:31 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] 2006 Upgrade Webmail Problem In the IMAP service, turn off force subscribe and it should be fine. Matt Chris Anton wrote: Hi all. Glad that Ipswitch has the day off... too bad I don't. We upgraded to 2006.1 from 8.22 this weekend. I am now getting a problem with sub mail boxes in web mail... they don't show new messages, and I can't view the messages. Tried removing the .xml, .srt and .uid files to no avail. Checked the perms, and everything seems to be fine there... This isn't affecting main mail boxes, just subs. Found a Object reference not set to an instance of an object. when attempting to reply to these sub mail box emails. The mail boxes don't even show the number of new messages. Any thoughts Please help Best Regards, Chris Anton Web Solutions, Inc. Tel: 203-235- x25 [EMAIL PROTECTED] www.websolutions.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
For Wednesday, November 15th I will be out for most of the day with limited access to Email. Please contact [EMAIL PROTECTED] or [EMAIL PROTECTED] for urgent computer matters. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
For Tuesday, November 14th I will be away for most of the day with limited access to my cell phone and no Email access. Please contact [EMAIL PROTECTED] or [EMAIL PROTECTED] for urgent computer matters. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Goober of the year
? Hmm - I guess my outlook nuked the message, can't even find it in the sent messages... weird. Basically I was thinking that someone smarter than myself should be able to figure out a way to tag the subject of any e-mail auto-forwarded so the 'goobers' know not to report it. I further wondered if the reason I have been blocked from AOL, Yahoo and Hotmail because of the spam leakage being auto forwarded hitting some type of Bayesian filters on those providers. We have agents who are 'grandfathered' into being allowed to forward and won't give it up. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, August 01, 2006 2:40 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Goober of the year Marc, Great point. Very concise :) Darrell Marc Catuogno writes: --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] automated response
For the days of July 25,26 27th I will be out of the office. For urgent computer matters please contact [EMAIL PROTECTED] [EMAIL PROTECTED] or [EMAIL PROTECTED] Thank you, Marc Catuogno --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3
Well then if your profit is negative and they wish to share in it, then they owe you money right?? : ) Marc -- Original Message -- From: Darin Cox [EMAIL PROTECTED] Reply-To: declude.junkmail@declude.com Date: Thu, 20 Jul 2006 09:39:52 -0400 MessageWhile customers are referred to us for our spam/virus filtering capabilities, we do operate it as a cost center, as the labor and other expenses involved are slightly higher than the additional revenue generated from them. Darin. - Original Message - From: Glenn \ WCNet To: declude.junkmail@declude.com Sent: Wednesday, July 19, 2006 8:32 PM Subject: Re: [Declude.JunkMail] Declude 4.3 You're saying that email and spam/virus scanning is a service aspect that specifically draws customers to an ISP. I'm saying it doesn't, that's all. I've not once heard a customer state that email service was the deciding factor in choosing us, and there's no evidence it entices them to stay. - Original Message - From: Kevin Bilbee To: declude.junkmail@declude.com Sent: Wednesday, July 19, 2006 5:01 PM Subject: RE: [Declude.JunkMail] Declude 4.3 Then stop offering mail if it such a burden to the business. Explain to your customer that they can can go to Hotmail or Yahoo. When the addy gets horked by spammers, simply abandon it and create another. Let us know how many customers stay with your service. Of course you will not be able to quantify the lost new business! Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn \ WCNet Sent: Wednesday, July 19, 2006 11:55 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Declude 4.3 Hahahahaha! E-mail hardly keeps or draws customers. Anybody who wants e-mail can go to Hotmail or Yahoo. When the addy gets horked by spammers, simply abandon it and create another. Domain hosting, maybe a little. However, I have domain customers who have never used their included mail service. - Original Message - From: Kevin Bilbee To: declude.junkmail@declude.com Sent: Wednesday, July 19, 2006 11:12 AM Subject: RE: [Declude.JunkMail] Declude 4.3 So then indirectly it does generate revenue. Because without it revenue would be lost. The ISP users need to ask is what level of these services do I need to offer to keep current customers happy and what level of service do I need to land new business? Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, July 19, 2006 4:35 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Declude 4.3 Kevin, Mainly because in order to get other types of business that may bring revenue (hosting, etc) this type of service is expected. Look at any ISP/hosting provider that is offering $5.00 a month hosting plans this is what everyone competes with. Could you imagine yourself (consumer or small business) signing up with a hosting provider and them not handling your email or even better not virus scanning it? Even with yahoo/gmail you get free spam filtering and virus scanning. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Kevin Bilbee To: declude.junkmail@declude.com Sent: Tuesday, July 18, 2006 11:22 PM Subject: RE: [Declude.JunkMail] Declude 4.3 Question to thoes that are saying that spam/virus protestion is a lost leader/not a revenue builder. If it does not generate revenue then why don't you stop offering spam/virus protection? Kevin Bilbee --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at
[Declude.JunkMail] FW: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent and
Is this Broken spamware? Ive gotten a few of these over the past few days. From: LEWIS MUSASIKE [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 28, 2006 4:33 AM To: [EMAIL PROTECTED] Subject: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent and very confidential business proposition. On June 6, 2001,a Foreign Oil consult I have a new email address! You can now email me at: [EMAIL PROTECTED] - LEWIS MUSASIKE ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] can't post again?
I sent a sample of spam that I got to the list yesterday and it never made it on the list... can I not post AGAIN?? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] FW: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent and
Is this from broken spamware? The whole pitch is in the subject What a pain to filter. From: LEWIS MUSASIKE [mailto:[EMAIL PROTECTED] Sent: Thursday, June 22, 2006 3:03 PM To: [EMAIL PROTECTED] Subject: [SPAM]I must apologize for this unsolicited nature of my email. I am Mr. Lewis Musasike, General Manager (Treasury) of Development Bank of Southern Africa. This is an urgent and very confidential business proposition. On June 6, 2001,a Foreign Oil consult I have a new email address! You can now email me at: [EMAIL PROTECTED] - LEWIS MUSASIKE ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] Test - can I post?
Checking to see if I can post... --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Way OT: Find a virus in my network
The sasser worm seems to ignore local networks and was only trying to get to external IPs. I tried ethereal and got no probes on the local net. I did lock down 445 external but the Xincom has really weak logging so I couldn't get any info from it. Thanks though I unplugged one switch at a time till the activity stopped... then I put it back on and unplugged each active connection till the activity stopped. It was a completely unpatched 2000 machine with no anti-virus software... The agent is hanging by his neck in front of the building Thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ncl Admin Sent: Thursday, April 27, 2006 11:04 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Way OT: Find a virus in my network At 10:29 AM 4/27/2006 -0400, you wrote: Marc Catuogno writes: Anyone have any suggestions short of unplugging one Cat5 cable at a time? Marc Why not just scan your network from a XP box using something like Networkactiv.com PIAFCTM. Just lock down and look for 445 activity on the inside of your network. Then you can find the machine most likely. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: Windows update (maybe) breaks mapping to Linux box?
Sorry for the quick OT post, but I don't have time to research it further. But in one of our offices we have windows XP machines mapped to shared drives on a Linux Red Hat box that suddenly couldn't be access. After the latest auto update they could only see the Red Hat PC by IP address. The vendor for our accounting software said they had another client having the same issues. I put an entry in the hosts file of the affected computers and the mapping began to work. Just in case any of you are in a similar situation. Marc --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [OT] Drop Connection On First Invalid User
I don't have the key referred to in the KB article. I even did a search through my reg for MaxInvalid in case I was looking in the wrong place and got nothing. I am running 8.22 with Declude. Does the addition of Declude make a difference? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Evanitsky Sent: Monday, March 27, 2006 9:00 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] [OT] Drop Connection On First Invalid User On Mar 26, 2006, at 2:22 PM, Goran Jovanovic wrote: How are you going to drop the SMTP connection on the first or second invalid recipient? In Imail. http://support.ipswitch.com/kb/IM-20050831-DM01.htm BTW, the support page says it works in 8.1+ but didn't for me. Upgraded to 8.22, works perfectly. Thanks, Greg Evanitsky ACS, Inc. (717) 248-2720 ext. 5113 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Going to junk in Hotmail/ Validating the IP??
Sandy, Thanks for the reply. But if I changed the name to mail.prudentialrand.com - wouldn't that cause any other domain name on the server to fail a HELO-PTR-A roundtrip test? If you don't mind, what would you need to see in the logs and or headers to see if there is an issue? Up until now I thought I was RFC compliant and my server was setup OK Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Wednesday, March 22, 2006 7:05 PM To: Marc Catuogno Subject: Re: [Declude.JunkMail] Going to junk in Hotmail/ Validating the IP?? Has anyone ever heard of validating the IP from the mail client to the server? It's very unlikely that this has anything to do with the initial submission from MUA to your SMTP server. Rather, the fact that your server is HELOing as mail.prudentialrand.com, although its canonical name is la01prudmail01.myrient.net, will cause your mail to fail a HELO-PTR-A roundtrip test. The exact text of the error message also implies that your return-path (envelope MAIL FROM:) does not match your header From: value. I don't know if that's actually true; have to see a log to know. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] email from kelly [EMAIL PROTECTED]
I just got an e-mail asking me to update my info with a form attached: Dear Customer, We are currently in the process of updating our records here at Declude. We are aware that you have purchased product from us in the past and would greatly appreciate your response in regards to thecurrent status of your software. Please use the attached document to advise if you are actively using the product and/or if you are in needof a product upgrade and/or maintenance renewal. We greatly appreciate your attention to this matter and look forward to serving you as our customer. Best Regards, Kelley O'Connell Declude - Internet Security Software I KNOW I am paranoid - but it sounded like one of those scam e-mails. Additionaly, Kelly if you are listening, always create a list or BCC everyone 30-40 people in the TO: field Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Hotmail's Junk folder- ARGH!
Anyone know how to get my domain out of hotmail's Junk filtering? --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ?? Start of phish/virus campaign ??
I got this one: htmlbody Hi!br brJust to inform you that your email is used by a spamer who intendsbrto steal bank account information thru a fake site.br brIf you are not involded, I can bring you additionnal information. Check attached file for a proof.br brIf you are, you're a little son of a bitch.brbr br /body/html --JHYRUPLXCQFFELGFCEOR Content-Type: application/octet-stream; name=proof.exe Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=proof.exe -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Tuesday, February 28, 2006 10:18 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] ?? Start of phish/virus campaign ?? Starting to catch EXE attached messages with following subject lines coming (at least currently) MESWILLEY.org [68.63.231.44]. You steal from innocent people You are a criminal and will be busted! Phshing is illigal Where did you learn to scam? John C 9:15p CST --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: RE: [Declude.JunkMail] New spam tactic???
Same name? Personalized to the agent name? Also through RR in VA? I'm still interested in exactly what the angle is.. seems like a lot of effort. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Saturday, February 04, 2006 1:48 PM To: Declude.JunkMail@declude.com Subject: [HOLD Weight]RE: [Declude.JunkMail] New spam tactic??? I guess it is! We've had 2 reports day about it (and both ARE real estate agents; say he is not on their list). Interesting -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Saturday, February 04, 2006 7:37 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] New spam tactic??? Almost all of my agents received a letter like this: -- Original Message -- From: Joe Anderson [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Fri, 3 Feb 2006 22:21:39 -0500 I believe I received an real estate newsletter from Joseph Moleano in Tarrytown, NY. Please remove me from future emails. Thanks Joe It seems very personal, addressed to the agent and with a reference to the town the agent's office is in or service - but none of the agents sent a newsletter to this guy. I e-mailed him for a copy of it to make sure my agents weren't spamming and very soon after I started to get more than usual Viagra ads directed right to me, almost as if my reply subscribed me to the suckers list. Just wondering if anyone else has seen anything like this. I have included the headers below: Received: from SMTP32-FWD by mail.prudentialrand.com (SMTP32) id A0CE902BD0086B842; Fri, 3 Feb 2006 21:09:47 Received: from rrcs-queue-03.hrndva.rr.com [24.28.200.155] by mail.prudentialrand.com with ESMTP (SMTPD32-8.15) id ACE92BD0086; Fri, 03 Feb 2006 21:09:45 -0500 Received: from rrcs-fep-10.hrndva.rr.com (rrcs-fep-10b.hrndva.rr.com [172.28.200.148]) by rrcs-queue-03.hrndva.rr.com (8.13.5+Sun/8.12.10) with ESMTP id k1429WcM008010 for [EMAIL PROTECTED]; Fri, 3 Feb 2006 21:09:32 -0500 (EST) Received: from ZBDS ([24.199.134.250]) by rrcs-fep-10.hrndva.rr.com with ESMTP id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Fri, 3 Feb 2006 21:08:32 -0500 From: Joe Anderson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Unsubscribe from Realtor Newsletter Date: Fri, 3 Feb 2006 21:03:28 -0500 MIME-Version: 1.0 X-Mailer: Internal Email Service (4.1.1.692) Message-ID: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit X-Declude-Sender: [EMAIL PROTECTED] [24.28.200.155] X-Declude-Spoolname: D0CE902BD0086B842.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: CATCHALLMAILS [0] X-Country-Chain: X-Note: This E-mail was sent from rrcs-mta-03.hrndva.rr.com ([24.28.200.155]). X-RCPT-TO: Status: U X-UIDL: 428126141 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] New spam tactic???
Almost all of my agents received a letter like this: -- Original Message -- From: Joe Anderson [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Fri, 3 Feb 2006 22:21:39 -0500 I believe I received an real estate newsletter from Joseph Moleano in Tarrytown, NY. Please remove me from future emails. Thanks Joe It seems very personal, addressed to the agent and with a reference to the town the agent's office is in or service - but none of the agents sent a newsletter to this guy. I e-mailed him for a copy of it to make sure my agents weren't spamming and very soon after I started to get more than usual Viagra ads directed right to me, almost as if my reply subscribed me to the suckers list. Just wondering if anyone else has seen anything like this. I have included the headers below: Received: from SMTP32-FWD by mail.prudentialrand.com (SMTP32) id A0CE902BD0086B842; Fri, 3 Feb 2006 21:09:47 Received: from rrcs-queue-03.hrndva.rr.com [24.28.200.155] by mail.prudentialrand.com with ESMTP (SMTPD32-8.15) id ACE92BD0086; Fri, 03 Feb 2006 21:09:45 -0500 Received: from rrcs-fep-10.hrndva.rr.com (rrcs-fep-10b.hrndva.rr.com [172.28.200.148]) by rrcs-queue-03.hrndva.rr.com (8.13.5+Sun/8.12.10) with ESMTP id k1429WcM008010 for [EMAIL PROTECTED]; Fri, 3 Feb 2006 21:09:32 -0500 (EST) Received: from ZBDS ([24.199.134.250]) by rrcs-fep-10.hrndva.rr.com with ESMTP id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Fri, 3 Feb 2006 21:08:32 -0500 From: Joe Anderson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Unsubscribe from Realtor Newsletter Date: Fri, 3 Feb 2006 21:03:28 -0500 MIME-Version: 1.0 X-Mailer: Internal Email Service (4.1.1.692) Message-ID: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit X-Declude-Sender: [EMAIL PROTECTED] [24.28.200.155] X-Declude-Spoolname: D0CE902BD0086B842.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: CATCHALLMAILS [0] X-Country-Chain: X-Note: This E-mail was sent from rrcs-mta-03.hrndva.rr.com ([24.28.200.155]). X-RCPT-TO: Status: U X-UIDL: 428126141 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best Sniffer Weights
I have it at just over 1/3 of my delete weight, but I would suggest the you use comment first before you implement any significant weight... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Anton Sent: Monday, January 30, 2006 4:56 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Best Sniffer Weights Hi all. We just installed message sniffer tonight and are working on tweaking it. What are your recommendations for best weights? Also, suggestions on other settings welcomed. Thanks! -Anton --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Adding text to Subject of FORWARDED e-mail
Can Declude, IMAIL (or anything) add text to subject of an e-mail that is being forwarded to an outside e-mail address? I have too many users (that I am not allowed to stop) forwarding their e-mail to AOL. Of course some SPAM slips through and they hit report spam effectively reporting my server as SPAM. I would like to add something to the subject of these e-mails so that they know it was from Prudential Rand and MAYBE, just maybe, they won't hit that stupid useless button Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Domain Keys?
Is there any way to implement Domain Keys with Declude (1.82)or IMAIL (8.15) Or any version? Anyway to put domain keys in any other way? Yahoo is once again delivering any e-mail from my IP to their Bulk folder, I figured if I can use their Domain Keys system I would have a better chance of getting our mail delivered. I have filled out all the Yahoo forms, but I get nothing but generic canned responses. I may change my IP over this Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WAY OT: COVAD VOIP
I have been considering switching many of our office from POTS lines to COVAD voice over IP. Since this is such a diverse and well informed group, I was wonder if anyone has any experience with them or suggestions as to alternate VOIP providers. Off list replies are welcomed. Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Mail sent to Yahoo! address ends up in Bulk folder
There are several places where you can go on the Yahoo site to apply for bulk sender status and so on. The same thing happened to me and they won't tell me why we got put there and we were only removed on a temporary basis. It was very frustrating, I even had contacts higher up in Yahoo because Prudential has a partnership with them and it did me absolutely no good. The e-mails I got back from the techs there were mostly canned useless responses. I almost changed my IP because it would be easier then dealing with them. Here are some of the links to try to help. http://help.yahoo.com/help/us/mail/defer/defer-03.html http://help.yahoo.com/help/us/mail/bulk/bulk-01.html http://help.yahoo.com/help/us/mail/defer/defer-01.html http://help.yahoo.com/help/mail/manage/manage-06.html Good luck~ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, October 04, 2005 3:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Mail sent to Yahoo! address ends up in Bulk folder Thanks John for your reply, I sent an email to my test Yahoo! account and it went into the Bulk email folder. I opened it up and clicked on the option for full headers. There was not anything that gave any indication as to why it had been put there. They probably don't to keep the spammers from figuring out a way around them. Anyone have any other thoughts? Any help would be appreciated, Don - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, October 04, 2005 2:07 PM Subject: RE: [Declude.JunkMail] Mail sent to Yahoo! address ends up in Bulk folder Best place to start is to find out why it is being placed there. I believe Yahoo adds header lines for filtering, so getting the headers from the recipient would be the place to start. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, October 04, 2005 11:53 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Mail sent to Yahoo! address ends up in Bulk folder When any customer sends an email through our server to a Yahoo! address, the email get put into the Bulk mail folder. Has anyone else experienced this behavior and have any suggestions? Does anyone have a phone number for the Yahoo! Postmaster to help resolve this issue Thanks in advance, Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT:AOL report spam - add a tool?
I have an agent who is sending out a stupid e-mail letter every Friday. I have set up the AOL feedback loop and two to three people report her as spam every week. I don't know what AOL's tolerance is, but I really don't want to get listed by them again. SOMEONE at AOL told her this: IT person - add a tool to header to notify use when mail list hits spam - Anyone ever hear of such a thing??? If it is possible I'd like to set it up before I tell her she can't send the messages anymore an piss off one of our top agents. Marc --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] FW: [SPAM]Please Restore Your Account Access
Title: PayPal This actually looks really, real I cant tell anymore.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Friday, September 09, 2005 10:05 PM To: [EMAIL PROTECTED] Subject: [SPAM]Please Restore Your Account Access Account Verification Notice Dear Margaret Kirwan, As part of our security measures, we regularly screen activity in the PayPal system. We recently contacted you after noticing an issue on your account.We requested information from you for the following reason: A recent review of your account determined that we require some additional information from you in order to provide you with secure service. You must click the link below to verify your information below. Thank you for using PayPal! The PayPal Team Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the Help link in the footer of any page. To receive email notifications in plain text instead of HTML, update your preferences here. PayPal Email ID PP059 Protect Your Account Info Make sure you never provide your password to fraudulent websites. To safely and securely access the PayPal website or your account, open a new web browser (e.g. Internet Explorer or Netscape) and type in the PayPal URL (https://www.paypal.com/us/) to be sure you are on the real PayPal site. PayPal will never ask you to enter your password in an email. For more information on protecting yourself from fraud, please review our Security Tips at https://www.paypal.com/us/securitytips Protect Your Password You should never give your PayPal password to anyone, including PayPal employees. --- [This E-mail scanned for viruses by Declude Virus]
[Declude.JunkMail] NOT getting list e-mails AGAIN
Has this list and the virus list dumped anyone else recently? I'd feel better if someone said yes. This is the second time in about two months that I suddenly stopped getting Declde e-mails. Last time they said it had something to do with their DNS but it concerns me that I may also be missing e-mails from other people as well. Thanks, Marc --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WAY OT: Search Companion 2003
The 2003 Search companion in Sever 2003 sucks - I just moved from a 2000 sever. Does anyone know how to modify its default setting? When I used to dig through held e-mails on the 2000 server I would use it to find and delete e-mail by using the containing text field. So when I saw the e-mail was from somespammer.com I would search the spam folder for that and delete all the *smd files containing that text. NOW when I do the same search I get NO results. When I change the file extension to .txt instead of .smd the search then finds all the files. So M$ decided unless it is a file type in KNOWS it isn't going to bother searching for my string. I tried to create .SMD as a new file type, and a text file to no avail. Any suggestions about this??? --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IMAIL 8.2 support?
Just wondering...if the Declude people are close to having this working yet? I'm being forced to jump up to at least 8.1 because IPswitch hasn't patched the IMAP vulnerability in the 8.05 that I am running. As long as I have to renew the SA I wouldn't mind running their most up to date software 8.2 as long as I am paying for it. Not trying to be a nag or anything :) --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How do I stop this ?
I would block 66.234.78.118 in IMAIL'S SMTP control access, I'm guessing it is just a zombie machine. If it a reject message you can complain to the tech responsible for the IP. NetRange: 66.234.64.0 - 66.234.95.255 CIDR: 66.234.64.0/19 NetName:INJU-2BLK NetHandle: NET-66-234-64-0-1 Parent: NET-66-0-0-0-0 NetType:Direct Allocation NameServer: ASLAN.IJ.NET NameServer: NS2.IJ.NET Comment:ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE RegDate:2002-02-22 Updated:2005-05-19 TechHandle: EF233-ARIN TechName: Feinstein, Eric TechPhone: +1-813-855-7793 TechEmail: [EMAIL PROTECTED] Good luck I've been complaining to Road Runner for a month and they still won't admit it is their problem causing the 20+ stupid backscatter e-mails I've been getting daily. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William Stillwell Sent: Tuesday, August 09, 2005 9:22 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How do I stop this ? Header:  Headers of the email message: Received: from ablebody.net [66.234.78.118] by ablebody.net with ESMTP  (SMTPD-8.20) id AC800914; Tue, 09 Aug 2005 09:15:44 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Your password has been successfully updated   There has to be a way to stop this crap from coming thru ? Is there any SPF tests?      --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Strange messages (Subject: 1)
I have received a few of these myself. I have also banned 1.txt - considering a ban on *.txt temporarily because I get the feeling this is some kinda test. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Saturday, July 23, 2005 1:56 PM To: Declude.Virus@declude.com Cc: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Strange messages (Subject: 1) In the last hours a I can see some strange messages (see attached samples) send from different servers and obviously forged mailfrom adresses. Each message has as Subject and as Body 1 and an attached but empty file named 1.txt The mailfrom-adress seems to be the first part of the recipients adress + some random domain name. I've added 1.txt to the Declude Virus BANNAME-List. Markus --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE:RE: [Declude.JunkMail] Bounced viruses or e-mail I'm confused...
Thanks for the explanation. I figured that this is a home user with and infected PC claiming to be prudentialrand.com but I guess where I am confused is that I thought most of the current viruses have their own SMTP engine and didn't use the ISP's mail server. So I didn't expect the ISP mail server to be involved. When I reported this to Road Runner, they said it had nothing to do with them or their network so I thought I was way off the mark. But it is one their users infected machine sending through their SMTP. Um, right? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson Sent: Tuesday, July 12, 2005 10:00 AM To: Declude.JunkMail@declude.com Subject: [OVER DELETE]RE: [Declude.JunkMail] Bounced viruses or e-mail I'm confused... -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Monday, July 11, 2005 11:12 PM To: Declude.JunkMail@declude.com Subject: SV [Declude.JunkMail] Bounced viruses or e-mail I'm confused... Please bear with me. I've been getting bounces that I don't understand, and I do feel stupid. If any one has the time or patience to clear help me this up it would be appreciated: If a virus forges my e-mail address as the from and attempts to send it to a non-existent user on my domain - wouldn't the bounce message simply be coming from my domain? It looks like other servers are answering for prudentialrand.com - am I nuts? Highly confused? Screwed? Unless I'm off the mark, this is backscatter mail. It is common for virus-infected or otherwise spamming computers to claim to be something they are not. What appears to be happening in your case is that an infected computer (claiming to be prudentialrand.com) sends out a message to its ISP's mail server. The ISP's mail server looks up the MX and sends the message to your mail server. As soon as your server receives the RCPT TO information, it rejects the message because the recipient doesn't exist. Since your server rejected the message before actually accepting it (as it should), it is up to the sending server to send the bounce message. Since the original forged message has one of your addresses as the sender, the sending server delivers a bounce there. I see lines like the following in non deliverable messages: Received: from prudentialrand.com (cpe-68-174-20-197.si.res.rr.com [68.174.20.197]) --- the spamming computer claiming to be you by ms-smtp-03.rdc-nyc.rr.com (8.12.10/8.12.7) with ESMTP id j6BMlhGi015287 --- their RoadRunner mail server, most likely for [EMAIL PROTECTED]; Mon, 11 Jul 2005 18:47:44 -0400 (EDT) Message-Id: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Received: from prudentialrand.com (ipn36373-b01578.cidr.lightship.net [216.204.209.74]) by spirit.lightshipmail.net (Postfix) with ESMTP id DD5571D5A6D for [EMAIL PROTECTED]; Mon, 11 Jul 2005 20:58:09 -0400 (EDT) From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] FULL HEADERS BELOW: MESSAGE 1: Received: from spirit.lightshipmail.net [216.204.0.205] by --- ISP's mail server again mail.prudentialrand.com with ESMTP (SMTPD32-8.05) id A70D12200C6; Mon, 11 Jul 2005 21:04:13 -0400 Received: by spirit.lightshipmail.net (Postfix) --- their mail server is running Postfix, which generated the bounce to you id 0B4BE1D5BBC; Mon, 11 Jul 2005 20:58:12 -0400 (EDT) Date: Mon, 11 Jul 2005 20:58:12 -0400 (EDT) From: [EMAIL PROTECTED] (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary=DD5571D5A6D.1121129892/spirit.lightshipmail.net Message-Id: [EMAIL PROTECTED] X-IMAIL-SPAM-VALFROM: (19005638) X-Declude-Sender: [216.204.0.205] X-Declude-Spoolname: D170d012200c613e1.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None [0] X-Country-Chain: X-Note: This E-mail was sent from ([216.204.0.205]). This is a MIME-encapsulated message. --DD5571D5A6D.1121129892/spirit.lightshipmail.net Content-Description: Notification Content-Type: text/plain This is the Postfix program at host spirit.lightshipmail.net. I'm sorry to have to inform you that your message could not be be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program [EMAIL PROTECTED]: host mail.prudentialrand.com[64.63.165.172] said: 550 unknown user [EMAIL PROTECTED] (in reply to RCPT TO command) This is the error your mail server replied with when spirit.lightshipmail.net tried to send the message, so spirit.lightshipmail.net is required
RE: RE: [Declude.JunkMail] Bounced viruses or e-mail I'm confused...
THANK YOU! I am going to forward this to Road Runner support (with your permission). I kept telling them that this was something going on THEIR network and they kept telling me no. I feel a little less like I am going crazy - Thanks- Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, July 12, 2005 11:35 AM To: Declude.JunkMail@declude.com Subject: [OVER DELETE]RE: RE: [Declude.JunkMail] Bounced viruses or e-mail I'm confused... Not all viruses use their own SMTP engine; this was likely one of the recent MyTob variants that tries to use the SMTP server of the current user. The virus can do this with some success because many ISPs use routing or firewalls to allow their users to use their servers as an open relay, because a) that buys them close relay status to the Internet, and b) it's easier than authentication. Also, many ISPs don't do outbound virus scanning on the basis of we don't want a false positive to even possibly interfere with our customers' communications. Here's a writeup on one of the recent viruses that uses the ISP's mail server: http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=43250 Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Tuesday, July 12, 2005 7:43 AM To: Declude.JunkMail@declude.com Subject: RE:RE: [Declude.JunkMail] Bounced viruses or e-mail I'm confused... Thanks for the explanation. I figured that this is a home user with and infected PC claiming to be prudentialrand.com but I guess where I am confused is that I thought most of the current viruses have their own SMTP engine and didn't use the ISP's mail server. So I didn't expect the ISP mail server to be involved. When I reported this to Road Runner, they said it had nothing to do with them or their network so I thought I was way off the mark. But it is one their users infected machine sending through their SMTP. Um, right? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Robertson Sent: Tuesday, July 12, 2005 10:00 AM To: Declude.JunkMail@declude.com Subject: [OVER DELETE]RE: [Declude.JunkMail] Bounced viruses or e-mail I'm confused... -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Monday, July 11, 2005 11:12 PM To: Declude.JunkMail@declude.com Subject: SV [Declude.JunkMail] Bounced viruses or e-mail I'm confused... Please bear with me. I've been getting bounces that I don't understand, and I do feel stupid. If any one has the time or patience to clear help me this up it would be appreciated: If a virus forges my e-mail address as the from and attempts to send it to a non-existent user on my domain - wouldn't the bounce message simply be coming from my domain? It looks like other servers are answering for prudentialrand.com - am I nuts? Highly confused? Screwed? Unless I'm off the mark, this is backscatter mail. It is common for virus-infected or otherwise spamming computers to claim to be something they are not. What appears to be happening in your case is that an infected computer (claiming to be prudentialrand.com) sends out a message to its ISP's mail server. The ISP's mail server looks up the MX and sends the message to your mail server. As soon as your server receives the RCPT TO information, it rejects the message because the recipient doesn't exist. Since your server rejected the message before actually accepting it (as it should), it is up to the sending server to send the bounce message. Since the original forged message has one of your addresses as the sender, the sending server delivers a bounce there. I see lines like the following in non deliverable messages: Received: from prudentialrand.com (cpe-68-174-20-197.si.res.rr.com [68.174.20.197]) --- the spamming computer claiming to be you by ms-smtp-03.rdc-nyc.rr.com (8.12.10/8.12.7) with ESMTP id j6BMlhGi015287 --- their RoadRunner mail server, most likely for [EMAIL PROTECTED]; Mon, 11 Jul 2005 18:47:44 -0400 (EDT) Message-Id: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Received: from prudentialrand.com (ipn36373-b01578.cidr.lightship.net [216.204.209.74]) by spirit.lightshipmail.net (Postfix) with ESMTP id DD5571D5A6D for [EMAIL PROTECTED]; Mon, 11 Jul 2005 20:58:09 -0400 (EDT) From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] FULL HEADERS BELOW: MESSAGE 1: Received: from spirit.lightshipmail.net [216.204.0.205] by --- ISP's mail server again mail.prudentialrand.com with ESMTP (SMTPD32-8.05) id A70D12200C6; Mon, 11 Jul 2005 21:04:13 -0400 Received: by spirit.lightshipmail.net (Postfix) --- their mail server is running Postfix, which generated the bounce to you id 0B4BE1D5BBC; Mon, 11 Jul 2005 20:58:12 -0400 (EDT) Date: Mon, 11
[Declude.JunkMail] Bounced viruses or e-mail I'm confused...
Please bear with me. I've been getting bounces that I don't understand, and I do feel stupid. If any one has the time or patience to clear help me this up it would be appreciated: If a virus forges my e-mail address as the from and attempts to send it to a non-existent user on my domain - wouldn't the bounce message simply be coming from my domain? It looks like other servers are answering for prudentialrand.com - am I nuts? Highly confused? Screwed? I see lines like the following in non deliverable messages: Received: from prudentialrand.com (cpe-68-174-20-197.si.res.rr.com [68.174.20.197]) by ms-smtp-03.rdc-nyc.rr.com (8.12.10/8.12.7) with ESMTP id j6BMlhGi015287 for [EMAIL PROTECTED]; Mon, 11 Jul 2005 18:47:44 -0400 (EDT) Message-Id: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Received: from prudentialrand.com (ipn36373-b01578.cidr.lightship.net [216.204.209.74]) by spirit.lightshipmail.net (Postfix) with ESMTP id DD5571D5A6D for [EMAIL PROTECTED]; Mon, 11 Jul 2005 20:58:09 -0400 (EDT) From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] FULL HEADERS BELOW: MESSAGE 1: Received: from spirit.lightshipmail.net [216.204.0.205] by mail.prudentialrand.com with ESMTP (SMTPD32-8.05) id A70D12200C6; Mon, 11 Jul 2005 21:04:13 -0400 Received: by spirit.lightshipmail.net (Postfix) id 0B4BE1D5BBC; Mon, 11 Jul 2005 20:58:12 -0400 (EDT) Date: Mon, 11 Jul 2005 20:58:12 -0400 (EDT) From: [EMAIL PROTECTED] (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary=DD5571D5A6D.1121129892/spirit.lightshipmail.net Message-Id: [EMAIL PROTECTED] X-IMAIL-SPAM-VALFROM: (19005638) X-Declude-Sender: [216.204.0.205] X-Declude-Spoolname: D170d012200c613e1.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None [0] X-Country-Chain: X-Note: This E-mail was sent from ([216.204.0.205]). This is a MIME-encapsulated message. --DD5571D5A6D.1121129892/spirit.lightshipmail.net Content-Description: Notification Content-Type: text/plain This is the Postfix program at host spirit.lightshipmail.net. I'm sorry to have to inform you that your message could not be be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program [EMAIL PROTECTED]: host mail.prudentialrand.com[64.63.165.172] said: 550 unknown user [EMAIL PROTECTED] (in reply to RCPT TO command) --DD5571D5A6D.1121129892/spirit.lightshipmail.net Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns; spirit.lightshipmail.net X-Postfix-Queue-ID: DD5571D5A6D X-Postfix-Sender: rfc822; [EMAIL PROTECTED] Arrival-Date: Mon, 11 Jul 2005 20:58:09 -0400 (EDT) Final-Recipient: rfc822; [EMAIL PROTECTED] Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; host mail.prudentialrand.com[64.63.165.172] said: 550 unknown user [EMAIL PROTECTED] (in reply to RCPT TO command) --DD5571D5A6D.1121129892/spirit.lightshipmail.net Content-Description: Undelivered Message Content-Type: message/rfc822 Received: from prudentialrand.com (ipn36373-b01578.cidr.lightship.net [216.204.209.74]) by spirit.lightshipmail.net (Postfix) with ESMTP id DD5571D5A6D for [EMAIL PROTECTED]; Mon, 11 Jul 2005 20:58:09 -0400 (EDT) From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: lnsuh Date: Mon, 11 Jul 2005 20:58:37 -0400 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary==_NextPart_000_0001_F70A1BAE.73E16A2C X-Priority: 3 X-MSMail-Priority: Normal Message-Id: [EMAIL PROTECTED] MESSAGE 2: Headers: Received: from SMTP32-FWD by mail.prudentialrand.com (SMTP32) id A047001F2; Mon, 11 Jul 2005 18:57:02 -0400 Received: from ms-smtp-03.rdc-nyc.rr.com [24.29.109.7] by mail.prudentialrand.com with ESMTP (SMTPD32-8.05) id A7E973D0088; Mon, 11 Jul 2005 18:51:21 -0400 Received: from localhost (localhost) by ms-smtp-03.rdc-nyc.rr.com (8.12.10/8.12.7) id j6BMlmGi015336; Mon, 11 Jul 2005 18:47:48 -0400 (EDT) Date: Mon, 11 Jul 2005 18:47:48 -0400 (EDT) From: Mail Delivery Subsystem [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary=j6BMlmGi015336.1121122068/ms-smtp-03.rdc-nyc.rr.com Subject: [OVER DELETE]Returned mail: see transcript for details Auto-Submitted: auto-generated (failure) X-IMAIL-SPAM-VALFROM: (121438344) X-RBL-Warning: ANTI-AV: Message failed ANTI-AV test (line 167, weight 7) X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 153, weight 4) X-RBL-Warning: ANTI-GIBBERISH: Message failed ANTI-GIBBERISH test (line 127, weight -4)
[Declude.JunkMail] Returned message - maybe I'm stupid...
I've contacted RoadRunner's customer care regarding returned messages that I am getting from, what I assume, is them everyday. If someone more learned than I can help I would appreciate it. It looks to me that one of their clients has a virus and somewhere in the loop it is getting repaired and returned to a non-existent user on my domain. Anyone have any ideas? These messages are really annoying me. Here are the headers of the message: Received: from SMTP32-FWD by mail.prudentialrand.com (SMTP32) id A045C178E; Fri, 8 Jul 2005 17:52:08 -0400 Received: from ms-smtp-02.rdc-nyc.rr.com [24.29.109.6] by mail.prudentialrand.com with ESMTP (SMTPD32-8.05) id A585A5A00A6; Fri, 08 Jul 2005 17:52:05 -0400 Received: from localhost (localhost) by ms-smtp-02.rdc-nyc.rr.com (8.12.10/8.12.7) id j68LmfId002241; Fri, 8 Jul 2005 17:48:41 -0400 (EDT) Date: Fri, 8 Jul 2005 17:48:41 -0400 (EDT) From: Mail Delivery Subsystem [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary=j68LmfId002241.1120859321/ms-smtp-02.rdc-nyc.rr.com Subject: Returned mail: see transcript for details Auto-Submitted: auto-generated (failure) X-IMAIL-SPAM-VALFROM: (173670566) X-RBL-Warning: ANTI-AV: Message failed ANTI-AV test (line 167, weight 7) X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 153, weight 4) X-RBL-Warning: ANTI-GIBBERISH: Message failed ANTI-GIBBERISH test (line 127, weight -4) X-RBL-Warning: Y!DIRECTED: Message failed Y!DIRECTED test (line 229, weight 11) X-RBL-Warning: ANTI-Y!DIRECTED: Message failed ANTI-Y!DIRECTED test (line 60, weight -11) X-Declude-Sender: [24.29.109.6] X-Declude-Spoolname: Df5850a5a00a6198c.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: IPNOTINMX, ANTI-AV, GIBBERISH, ANTI-GIBBERISH, Y!DIRECTED, ANTI-Y!DIRECTED, CATCHALLMAILS [7] X-Country-Chain: X-Note: This E-mail was sent from ms-smtp-02-smtplb.rdc-nyc.rr.com ([24.29.109.6]). X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 410406537 Here is the message that I am getting and it has two attachments: The original message was received at Fri, 8 Jul 2005 17:48:38 -0400 (EDT) from rrcs-24-97-203-24.nys.biz.rr.com [24.97.203.24] - The following addresses had permanent fatal errors - [EMAIL PROTECTED] (reason: 550 unknown user [EMAIL PROTECTED]) - Transcript of session follows - ... while talking to mail.prudentialrand.com.: RCPT To:[EMAIL PROTECTED] 550 unknown user [EMAIL PROTECTED] 550 5.1.1 [EMAIL PROTECTED]... User unknown Attachment1 called details.txt: Reporting-MTA: dns; ms-smtp-02.rdc-nyc.rr.com Received-From-MTA: DNS; rrcs-24-97-203-24.nys.biz.rr.com Arrival-Date: Fri, 8 Jul 2005 17:48:38 -0400 (EDT) Final-Recipient: RFC822; [EMAIL PROTECTED] Action: failed Status: 5.1.1 Remote-MTA: DNS; mail.prudentialrand.com Diagnostic-Code: SMTP; 550 unknown user [EMAIL PROTECTED] Last-Attempt-Date: Fri, 8 Jul 2005 17:48:41 -0400 (EDT) Attachment2 called ATT0006.txt: Received: from prudentialrand.com (rrcs-24-97-203-24.nys.biz.rr.com [24.97.203.24]) by ms-smtp-02.rdc-nyc.rr.com (8.12.10/8.12.7) with ESMTP id j68LmbId002217 for [EMAIL PROTECTED]; Fri, 8 Jul 2005 17:48:38 -0400 (EDT) Message-Id: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: You have successfully updated your password Date: Fri, 8 Jul 2005 17:48:39 -0400 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary==_NextPart_000_0013_A45E3A39.04F33EA8 X-Priority: 3 X-MSMail-Priority: Normal X-Virus-Scanned: Symantec AntiVirus Scan Engine X-Virus-Scan-Result: Repaired 15810 [EMAIL PROTECTED] Marc Catuogno MIS Director Prudential Rand Realty Office: 845-770-1279 Cell: 914-906-1126 --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WAY OT: Anti- Identity theft advice
I have a great deal of respect for the people on this list and I hope you don't feel this is a waste of time. I got this e-mail from one of my agents and I am going to share it with the entire company - I thought maybe some of you would care to do the same. I searched Hoasbusters.org first and called the numbers and they are legit. ATTORNEY'S ADVICE -- NO CHARGE Read this and make a copy for your files in case you need to refer to it someday. Maybe we should all take some of his advice! A corporate attorney sent the following out to the employees in his company 1. The next time you order checks have only your initials (instead of first name) and last name put on them. If someone takes your checkbook, they will not know if you sign your checks with just your initials or your first name, but your bank will know how you sign your checks. 2. Do not sign the back of your credit cards. Instead, put PHOTO ID REQUIRED. 3. When you are writing checks to pay on your credit card accounts, DO NOT put the complete account number on the For line Instead, just put the last four numbers. The credit card company knows the rest of the number, and anyone who might be handling your check as it passes through all the check processing channels won't have access to it 4. Put your work phone # on your checks instead of your home phone. If you have a PO Box use that instead of your home address. If you do not have a PO Box, use your work address. Never have your SS# printed on your checks. (DUH!) You can add it if it is necessary. But if you have it printed, anyone can get it. 5. Place the contents of your wallet on a photocopy machine. Do both sides of each license, credit card, etc. You will know what you had in your wallet and all of the account numbers and phone numbers to call and cancel. Keep the photocopy in a safe place. I also carry a photocopy of my passport when I travel either here or abroad. We've all heard horror stories about fraud that's committed on us in stealing a name, address, Social Security number, credit cards. Unfortunately, I, an attorney, have firsthand knowledge because my wallet was stolen last month. Within a week, the thieve(s) ordered an expensive monthly cell phone package, applied for a VISA credit card, had a credit line approved to buy a Gateway computer, received a PIN number from DMV to change my driving record information online, and more. But here's some critical information to limit the damage in case this happens to you or someone you know: 1. We have been told we should cancel our credit cards immediately. But the key is having the toll free numbers and your card numbers handy so you know whom to call. Keep those where you can find them. 2. File a police report immediately in the jurisdiction where your credit cards, etc., were stolen. This proves to credit providers you were diligent, and this is a first step toward an investigation (if there ever is one.) But here's what is perhaps most important of all :  (I never even thought to do this.) 3. Call the 3 national credit reporting organizations immediately to place a fraud alert on your name and Social Security number. I had never heard of doing that until advised by a bank that called to tell me an application for credit was made over the Internet in my name. The alert means any company that  checks your credit knows your information was stolen, and they have to contact you by phone to authorize new credit. By the time I was advised to do this, almost two weeks after the theft, all the damage had been done There are records of all the credit checks initiated by the thieves' purchases, none of which I knew about before placing the alert. Since then, no additional damage has been done, and the thieves threw my wallet away This weekend (someone turned it in). It seems to have stopped them dead in their tracks. Now, here are the numbers you always need to contact about your wallet, etc, has been stolen: 1.) Equifax: 1-800-525-6285 2.) Experian (formerly TRW): 1-888-397-3742 3.) Trans Union: 1-800-680-7289 4.) Social Security Administration (fraud line): 1-800-269-0271 We pass along jokes on the Internet; we pass along just about everything. But if you are willing to pass this information along, it could really help someone that you care about. --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT:MAIL going to YAHOO BULK Folder
I'm not sure why but any e-mail from prudentialrand.com is going to the BULK folder in Yahoo. I am going to check out some stuff on yahoo, but I was wondering if anyone had any insight into this issue. Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Anybody in Northern NJ have space and bandwidth available?
There is a place in Pearl River, NY (right next to Montvale) that used to do T1s and give you a free office when you bought one from them. I don't know what they are doing now, they were ok when I used them for DSL like two years ago. http://www.frontline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Friday, June 17, 2005 2:54 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Anybody in Northern NJ have space and bandwidth available? Hi all, I discovered today that I need to move my hardware to a new location next weekend. Since it takes 30 days to get T1 lines installed, I'm up the creek. I have about a dozen servers to move, all but three rackmounted, and we use about 1.5mbps at peak during the day. At the moment, I'm thinking of a temporary home for a month or so, but we could make it permanent for the right location and price. All suggestions welcomed! -d --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ANOTHER message Declude didn't delete.
Anyone? Anyone? Buehler? Received: from server.tl4s.com [147.202.39.144] by mail.prudentialrand.com with ESMTP (SMTPD32-8.05) id A8F42960114; Thu, 02 Jun 2005 09:26:12 -0400 Received: from [212.35.74.41] (port=2257 helo=comp) by server.tl4s.com with esmtpa (Exim 4.50) id 1DdpeJ-000128-TP; Thu, 02 Jun 2005 08:22:17 -0500 From: eBay [EMAIL PROTECTED] Subject: [SPAM]**eBay Summary Confirmation** To: [EMAIL PROTECTED] Content-Type: text/plain;iso-8859-1 Reply-To: [EMAIL PROTECTED] Date: Thu, 2 Jun 2005 16:22:22 +0300 X-Priority: 3 X-Library: Indy 8.0.25 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - server.tl4s.com X-AntiAbuse: Original Domain - prudentialrand.com X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12] X-AntiAbuse: Sender Address Domain - ebay.com X-Source: X-Source-Args: X-Source-Dir: Message-Id: [EMAIL PROTECTED] X-RBL-Warning: SORBS-SPAM: Spam Received See: http://www.dnsbl.sorbs.net/lookup.shtml?147.202.39.144; X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?147.202.39.144; X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [420f]. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 53. X-RBL-Warning: SUBJECTFILTER: Message failed SUBJECTFILTER test (line 156, weight 0) X-RBL-Warning: WEIGHT10: Weight of 45 reaches or exceeds the limit of 10. X-RBL-Warning: WEIGHT25: Weight of 45 reaches or exceeds the limit of 25. X-RBL-Warning: WEIGHT40: Weight of 45 reaches or exceeds the limit of 40. X-Declude-Sender: [EMAIL PROTECTED] [147.202.39.144] X-Declude-Spoolname: D08f4029601143e0e.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SORBS-SPAM, SPAMCOP, NOABUSE, IPNOTINMX, NOLEGITCONTENT, SPAMHEADERS, SNIFFER, SUBJECTFILTER, WEIGHT10, WEIGHT15, WEIGHT20, WEIGHT25, WEIGHT30, WEIGHT40, CATCHALLMAILS [45] X-Country-Chain: X-Note: This E-mail was sent from ns1.tl4s.com ([147.202.39.144]). Marc Catuogno MIS Director Prudential Rand Realty Office: 845-770-1279 Cell: 914-906-1126 --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ANOTHER message Declude didn't delete.
THANK YOU~ there was one person who had the weight 30 'blank' in their .junkmail file so it skipped the test. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brad Morgan Sent: Thursday, June 02, 2005 11:04 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] ANOTHER message Declude didn't delete. Check your log files to see what config file is being used. I had a similar problem because I updated $default$.junkmail but failed to update all of the per domain / per user .junkmail files, my own in particular! Regards, Brad Morgan IT Manager Horizon Interactive Inc. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Problem with Whitelist
Got any whitelist anywhere entries? It looks like it says IP-Whitelist did it come from a whitelisted IP address? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kyle Fisher Sent: Thursday, June 02, 2005 1:47 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Problem with Whitelist I am trying to figure out why this email transaction started off with the Last Action = "" then went to WHITELIST. My global.cfg has WHITELIST AUTH and AUTOWHITELIST, but I checked the Imail log and this person did not AUTH and the recipients are not in this persons webmail address book. Any ideas Kyle 06/02/2005 10:31:45 Q265E0149717D Subject: FW: Scripture for Thursday 06/02/2005 10:31:45 Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 198.216.117.200 ID: 06/02/2005 10:31:45 Q265E0149717D Tests failed [weight=-192]: CMDSPACE=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE IP-WHITELIST=IGNORE CATCHALLMAILS=IGNORE 06/02/2005 10:31:45 Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=""> 06/02/2005 10:31:45 Q265E0149717D L16 Message OK 06/02/2005 10:31:45 Q265E0149717D Subject: FW: Scripture for Thursday 06/02/2005 10:31:45 Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 198.216.117.200 ID: 06/02/2005 10:31:45 Q265E0149717D Tests failed [weight=-192]: CMDSPACE=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE IP-WHITELIST=IGNORE CATCHALLMAILS=IGNORE 06/02/2005 10:31:45 Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=""> 06/02/2005 10:31:45 Q265E0149717D L17 Message OK 06/02/2005 10:31:45 Q265E0149717D Subject: FW: Scripture for Thursday 06/02/2005 10:31:45 Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 198.216.117.200 ID: 06/02/2005 10:31:45 Q265E0149717D Tests failed [weight=-192]: CMDSPACE=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE IP-WHITELIST=IGNORE CATCHALLMAILS=IGNORE 06/02/2005 10:31:45 Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=""> 06/02/2005 10:31:45 Q265E0149717D L18 Message OK 06/02/2005 10:31:45 Q265E0149717D Subject: FW: Scripture for Thursday 06/02/2005 10:31:45 Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 198.216.117.200 ID: 06/02/2005 10:31:45 Q265E0149717D Tests failed [weight=-192]: CMDSPACE=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE IP-WHITELIST=IGNORE CATCHALLMAILS=IGNORE 06/02/2005 10:31:45 Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=""> 06/02/2005 10:31:45 Q265E0149717D Skipping4 E-mail from [EMAIL PROTECTED] ; whitelisted [EMAIL PROTECTED] ]. 06/02/2005 10:31:45 Q265E0149717D L19 Message OK 06/02/2005 10:31:45 Q265E0149717D Subject: FW: Scripture for Thursday 06/02/2005 10:31:45 Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 198.216.117.200 ID: 06/02/2005 10:31:45 Q265E0149717D Tests failed [weight=0]: CATCHALLMAILS=IGNORE 06/02/2005 10:31:45 Q265E0149717D Action(s) taken for [EMAIL PROTECTED] = WHITELISTED [LAST ACTION=""> 06/02/2005 10:31:45 Q265E0149717D L20 Message OK 06/02/2005 10:31:45 Q265E0149717D Subject: FW: Scripture for Thursday 06/02/2005 10:31:45 Q265E0149717D From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[Declude.JunkMail] Declude NOT deleting overdelete weight messages
I delete at 30 - the X-RBL-Warning weight 30 test is missing from the headers. This message was in the hold directory and it wasn't alone. I also couldn't find Dbb7e005a0052a96c.SMD (or any part of it) in the dec0601.log file. Declude 1.82 - IMAIL 8.05 Anyone have any ideas? Received: from 64.63.165.172 [220.121.168.240] by mail.prudentialrand.com (SMTPD32-8.05) id AB7E5A0052; Wed, 01 Jun 2005 09:43:26 -0400 Received: from localhost ([EMAIL PROTECTED]) by Mklaud.hannah.org (8.12.4/8.121/Submit) with ESMTP id g57KIOGP014981; Wed, 01 Jun 2005 17:35:50 +0300 Message-ID: [EMAIL PROTECTED] Date: Wed, 01 Jun 2005 10:40:50 -0400 From: Hilary Harrell [EMAIL PROTECTED] X-Mailer: GoldMine [5.50.10310] To: [EMAIL PROTECTED] Subject: [SPAM]Marilyn Reed X-Not-Needed: M$ Windows. X-IMAIL-SPAM-VALFROM: (5898322) X-RBL-Warning: BLITZEDALL: Open proxy - see http://opm.blitzed.org/220.121.168.240; X-RBL-Warning: CBL: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=220.121.168.240; X-RBL-Warning: DSBL: http://dsbl.org/listing?220.121.168.240; X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?220.121.168.240; X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. X-RBL-Warning: HELOBOGUS: Domain 64.63.165.172 has no MX or A records [0301]. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 220.121.168.240 with no reverse DNS entry. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 61. X-RBL-Warning: MOREIPS: spam taiwan X-RBL-Warning: FOREIGN: Message failed FOREIGN test (line 823, weight 2) X-RBL-Warning: TLD-ASIAN: Message failed TLD-ASIAN test (line 161, weight 2) X-RBL-Warning: WEIGHT10: Weight of 102 reaches or exceeds the limit of 10. X-RBL-Warning: WEIGHT25: Weight of 102 reaches or exceeds the limit of 25. X-RBL-Warning: WEIGHT40: Weight of 102 reaches or exceeds the limit of 40. X-RBL-Warning: WEIGHT50: Weight of 102 reaches or exceeds the limit of 50. X-Declude-Sender: [EMAIL PROTECTED] [220.121.168.240] X-Declude-Spoolname: Dbb7e005a0052a96c.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: BLITZEDALL, CBL, DSBL, SPAMCOP, CMDSPACE, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, REVDNS, SNIFFER, MOREIPS, HEADERS, FOREIGN, TLD-ASIAN, WEIGHT10, WEIGHT15, WEIGHT20, WEIGHT25, WEIGHT30, WEIGHT40, WEIGHT50, CATCHALLMAILS [102] X-Country-Chain: X-Note: This E-mail was sent from [No Reverse DNS] ([220.121.168.240]). --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Problem forwarding to AOL
I just got about 40-50 returned e-mails from people who have forwarded their e-mails from my domain to AOL. I was able to get an individual e-mail straight through to AOL and a forwarded e-mail through as well. Many people on my server have their e-mail forwarded, to my chagrin, and only the AOL e-mails bounced. This was in the log http://postmaster.info.aol.com/errors/554hvub1.html It gave me a number to AOL that was answered live (I almost fainted) and I gave him the specific error, he told me it was a bad URL in the e-mail I sent. The e-mail I sent was a warning about a scam e-mail - the link in the e-mail triggered their bounce. I'm usually the first to bash AOL but I must admit they handled this one pretty well... Just thought I'd share. I guess this will teach me to break up the scam links --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude 1.82 deleting whitelisted e-mail -
Here are the log entries of the missing message: 05:18 09:11 SMTPD(04B8) Authenticated [EMAIL PROTECTED], session treated as local. 05:18 09:11 SMTPD(0B170142) [68.236.184.7] MAIL FROM: [EMAIL PROTECTED] 05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO: [EMAIL PROTECTED] 05:18 09:11 POP3D (05c8) logoff for david.hoechster R:0, D:0, P:0 05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO: [EMAIL PROTECTED] 05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO: [EMAIL PROTECTED] 05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO: [EMAIL PROTECTED] 05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO: [EMAIL PROTECTED] 05:18 09:11 SMTPD(0B170142) [68.236.184.7] RCPT TO: [EMAIL PROTECTED] D:\IMail\spool\D3ef11bc9009e2c7d.SMD 7389 05:18 09:11 SMTPD(1BC9009E) performing antispam checks 05/18/2005 09:11:17 Q3ef11bc9009e2c7d NOT bypassing whitelisting of E-mail with weight =35 (36) and at least 6 recipients (1). 05/18/2005 09:11:17 Q3ef11bc9009e2c7d Tests failed [weight=36]: AHBL=WARN SBL=WARN BADHEADERS=WARN NOLEGITCONTENT=IGNORE SPFPASS=IGNORE SNIFFER=WARN WEIGHT10=WARN WEIGHT15=SUBJECT WEIGHT20=HOLD WEIGHT25=WARN WEIGHT30=DELETE CATCHALLMAILS=IGNORE If it is NOT bypassing whitelisting, it should be whitelisted and these tests shouldnt run right? Bottom line, this message is not getting delivered and this is the only trace I can find.
RE: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail From Foreign IP Addresses
That is f-ed up right there... The damned lawyers are gonna get rich and every VZ customer will get a coupon for a free day of service. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, May 18, 2005 2:02 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail From Foreign IP Addresses Verizon Communications has been hit with several lawsuits as a result of the company's policy of blocking email from IP addresses in foreign countries in an effort to reduce spam. The complaint asks that Verizon cease blocking email and that it compensate customers for losses on behalf of business customers. A second class action lawsuit was filed on behalf of residential customers. In addition, a New Jersey businessman has filed a lawsuit against Verizon because he says his email has been blocked from getting to his customers. http://www.securitypipeline.com/showArticle.jhtml?articleID=163101524 DLAnalyzer - Comprehensive reporting for Declude Junkmail and Virus. Download a copy today - http://www.invariantsystems.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail From Foreign IP Addresses
[EMAIL PROTECTED] http://www.kohnswift.com/bio_boni.htm Lets sign him up for a lot of spam from Korea, Japan, etc and see how he feels about blocking foreign IPs then... Sorry to go off on a rant here -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, May 18, 2005 2:02 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Verizon Faced With Lawsuits Over Blocking eMail From Foreign IP Addresses Verizon Communications has been hit with several lawsuits as a result of the company's policy of blocking email from IP addresses in foreign countries in an effort to reduce spam. The complaint asks that Verizon cease blocking email and that it compensate customers for losses on behalf of business customers. A second class action lawsuit was filed on behalf of residential customers. In addition, a New Jersey businessman has filed a lawsuit against Verizon because he says his email has been blocked from getting to his customers. http://www.securitypipeline.com/showArticle.jhtml?articleID=163101524 DLAnalyzer - Comprehensive reporting for Declude Junkmail and Virus. Download a copy today - http://www.invariantsystems.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Layman's Explanation of E-Mail Spoofing
Ditto - sometimes I add that if someone wanted to mail objectionable postcards, used your postal return address and chose random address from the phone book the result would be the same. Some people would throw them away (delete), some would complain to you and ask why you would send something like that, the bad addresses would get returned to you by the post office that is simply doing its job. I have sent out this explanation about 5-6 times, they all still ask me why they are getting the undeliverables : ) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Tuesday, May 17, 2005 11:04 AM To: Dan Geiser Subject: Re: [Declude.JunkMail] Layman's Explanation of E-Mail Spoofing Hello Dan, Tuesday, May 17, 2005, 10:57:13 AM, you wrote: Don't know of an outside source, but I always explain it like a normal envelope. You can write ANY address you want as the return address and drop it in a public mailbox. If it isn't delivered, it will be returned to the address that was written on the envelope. The post office doesn't care whose address it is. Try that. -- Best regards, Davidmailto:[EMAIL PROTECTED] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] German political spam
I am seeing randomized addresses, but they seem to be from related industries. We are in real-estate, the address are random then @ other real-estate companies, title companies, etc. All the e-mails that have gotten through have been from conversent.net 204.17.110.18 Probably some genius real-estate agent that got infected - I haven't looked at all the e-mails that get held yet. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Sunday, May 15, 2005 9:51 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] German political spam What are the return/sender addresses looking like? Randomized? Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Marc Catuogno [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, May 15, 2005 9:34 AM Subject: RE: [Declude.JunkMail] German political spam I've added all the phases that I have found in the e-mails that got through to me. I don't do much internationally so my weighting and inclusion may be harsh for those that do. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Sunday, May 15, 2005 3:50 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] German political spam Attached is the updated filter file containing 3 additional subject filter lines. Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Sunday, May 15, 2005 9:25 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] German political spam Anyone else getting hit with massive waves of German spam as a byproduct of modified Sober code continuing from around 2 pm EDT today, or am I 'unique' in this? Yes, I've identified 3 tipical body phrases that can be used to filter for. Se atached zip/txt file. Maybe it's incomplete and so should be updated. Please send additional strings also in zipped ttxt files in order to bypass already existing filters. Markus --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HOAX e-mail filters
When ever I see an e-mail chain letter, virus alert, etc I check it against: http://hoaxbusters.ciac.org/ I was wondering if anyone has a filter for all these don't dial this area code, don't sniff the perfume, the Cancer society will dontate $.05 - Anyone think it is worth the effort to make one? --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT - headers script for Outlook or Express
Anyone have any ideas how to give challenged users a really easy way to get the headers out of Outlook or Outlook express and forward them to my spam account? As soon as I start talking to most of them about right clicking, copying, pasting etc they get this strange blank look on their face... Also I thought a report spam button on the IMAIL web interface that would copy the full headers, and forward them and the e-mail to a pre-determined address wouldn't be to hard, anyone have anything like this? Or any suggestions on how to get the headers from spam that gets through the all the filters? Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Held Kodak easyshare Headers
This is one that actually got held, I don't know how it was sent or from what version: X-RBL-Warning: NEGATIVEHEADERS: Message failed NEGATIVEHEADERS test (line 14, weight -16) X-RBL-Warning: GARBAGE: Message failed GARBAGE test (line 38, weight 8) X-RBL-Warning: SPAMDOMAINS1: Spamdomain 'prudentialrand.com' found: Address of [EMAIL PROTECTED] sent from invalid snj-us-pcwp-701-att.kodak.com. X-RBL-Warning: SUBJECTFILTER: Message failed SUBJECTFILTER test (line 325, weight 10) X-RBL-Warning: SUBJECTSCAM: Message failed SUBJECTSCAM test (line 325, weight 10) X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 137, weight 4) X-RBL-Warning: ANTI-GIBBERISH: Message failed ANTI-GIBBERISH test (line 106, weight -4) X-RBL-Warning: GIBBERISHSUB: Message failed GIBBERISHSUB test (line 99, weight 4) X-RBL-Warning: ANTI-GIBBERISHSUB: Message failed ANTI-GIBBERISHSUB test (line 29, weight -4) X-RBL-Warning: BASE64SUB: Message failed BASE64SUB test (line 86, weight 7) X-RBL-Warning: WEIGHT10: Weight of 25 reaches or exceeds the limit of 10. X-RBL-Warning: WEIGHT25: Weight of 25 reaches or exceeds the limit of 25. X-Declude-Sender: [EMAIL PROTECTED] [63.240.114.196] X-Declude-Spoolname: D9b7f1abb00e84a53.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: IPNOTINMX, NOLEGITCONTENT, NEGATIVEHEADERS, GARBAGE, SPAMDOMAINS1, SUBJECTFILTER, SUBJECTSCAM, GIBBERISH, ANTI-GIBBERISH, GIBBERISHSUB, ANTI-GIBBERISHSUB, BASE64SUB, WEIGHT10, WEIGHT15, WEIGHT20, WEIGHT25 [25] X-Country-Chain: X-Note: This E-mail was sent from snj-us-pcwp-701-att.kodak.com ([63.240.114.196]) --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist anywhere broken?
I am running 1.82 and it seems that the whitelist isn't working. I don't want to post what the phase I am using is, but please be assured it is not working. The person sending the e-mail is using mail2web which is listed in SORBS, comes out of Canada and he is sending from my domain and not authenticating, he also tends to curse a bit in some of his e-mails (he works support). You can see why is mail would get held. It seems as if the code words work only if they LEAD the subject, they don't work anywhere else. I'm still afraid to move to Declude 2.X... Is this broken in 1.82? Or is there another explanation that I am missing? Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist anywhere broken? DISREGARD
Disregard - I'm an idiot. There was a trailing space in my global config file after my phrase. Apologies! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Sunday, March 06, 2005 11:37 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Whitelist anywhere broken? I am running 1.82 and it seems that the whitelist isn't working. I don't want to post what the phase I am using is, but please be assured it is not working. The person sending the e-mail is using mail2web which is listed in SORBS, comes out of Canada and he is sending from my domain and not authenticating, he also tends to curse a bit in some of his e-mails (he works support). You can see why is mail would get held. It seems as if the code words work only if they LEAD the subject, they don't work anywhere else. I'm still afraid to move to Declude 2.X... Is this broken in 1.82? Or is there another explanation that I am missing? Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelist anywhere broken?
Thanks - I have told him to make sure he puts the code in the body of the e-mail under his signature. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Sunday, March 06, 2005 11:53 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Whitelist anywhere broken? If you practice putting the code words in the subject than you could be affected by the subject bug that was in the 1.8.x train. I believe domain that use domain keys like gmail will trigger this bug. Here is a link that first talks about it. http://www.mail-archive.com/declude.junkmail@declude.com/msg21811.html Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Marc Catuogno [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Sunday, March 06, 2005 11:37 PM Subject: [Declude.JunkMail] Whitelist anywhere broken? I am running 1.82 and it seems that the whitelist isn't working. I don't want to post what the phase I am using is, but please be assured it is not working. The person sending the e-mail is using mail2web which is listed in SORBS, comes out of Canada and he is sending from my domain and not authenticating, he also tends to curse a bit in some of his e-mails (he works support). You can see why is mail would get held. It seems as if the code words work only if they LEAD the subject, they don't work anywhere else. I'm still afraid to move to Declude 2.X... Is this broken in 1.82? Or is there another explanation that I am missing? Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Kodak EZ Share
All these get held on my system because you send it from your e-mail address without authenticating, so it never gets whitelisted with Whitelist Auth and it fails my spam domains test. But if you arent seeing them at all, Id guess it is the attachment size. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris Sent: Tuesday, March 01, 2005 6:45 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Kodak EZ Share I have Kodak EZ Share that allows you to take pictures with your digital camera and email them out...when I email them to myself from another computerI never get them unless I tell it to send as is..if I choose Best for email I wont get them. Other customers are telling me they are not getting pictures either... I am trying to figure out why..I have taken out all my Imail rules and all .zip files from the virus config...and by the way...it won't even send them to an account that I have whitelisted.. Does anyone know where I could look to find out why I am not getting them..they go to my yahoo.com account just fine..and I have tried to decipher the log files with no luck. Could it be the virus program is deleting them? I use FPROT.. I am sure there are more customers that are not getting pictures that I have not heard from yet.. Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Tuesday, March 01, 2005 3:36 PM Subject: Re: [Declude.JunkMail] Log Corruption It's the same log format except that all the messages for a specific email are grouped together. Well most of the time they are grouped together. It does make eyeball parsing of the log easier. I load the logs into a database daily. With the 1.8x versions, I'll need to code around a new type of log corruption every one to two months. For the 3 days I was running 2.x, I had to code around 4 new corruption issues. Visually there is also more corruption. Odd things is that I never get log corruption in message sniffer. So somebody is writing out logs that don't get corrupt. - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Tuesday, March 01, 2005 3:16 PM Subject: Re: [Declude.JunkMail] Log Corruption There has always been corruption of the logs. What seems to have changed here is that there is a new log format and the programmed exceptions in DLanalyzer are no longer able to handle the types of corruption as seamlessly as in the past. I haven't seen the new log format, but I would imagine that if they built it in a column format and kept it to a single line, similar to Web logging standards, it should be even easier to parse the data and correct for issues. If they didn't keep to consistent columns, then this could be just as big of an issue to parse as before and a lot of the exception rules would have to be rewritten for the new format. Matt Goran Jovanovic wrote: Yesterday's report on my declude logfile showed=...10.01%02/28/2005..10.01%FF156FB0094D05A.10.01%I00510.01%QCEA370970074D08A...10.01%SET.10.01%SNIFFQCE053ABD0086D062..10.01%This is from Total Messages Processed: 12,316And loglevel set to HIGH and the size of the file is 122 MBI am running 2.0.5 Goran Jovanovic The LAN Shoppe -Original Message-From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-[EMAIL PROTECTED]] On Behalf Of Colbeck, AndrewSent: Tuesday, March 01, 2005 2:33 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Log CorruptionI had the opposite experience. Back at, oh, 1.7x I ran on LOGLEVELHIGH, and had lots of log corruption. I had to drop down to MID. Theincrease in spam volume made it such that at MID, I had lots of logcorruption again.With 2.x and the lines being written in a batch, I noticed an immediate drop in my disk usage and a huge drop in corrupted lines.Andrew 8)-Original Message-From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED]] On Behalf Of Andy SchmidtSent: Tuesday, March 01, 2005 9:22 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Log CorruptionHi,Yesterday was actually a good day (here a snippet):TEST # FAILED Percentage18:51:5810.01%SNIF02/28/2005..10.01%SPA02/28/2005...10.01%WEIG02/28/2005..10.01%Sure, I used to get reports that were clean, but considering it onlyhappens a few times a day, I don't consider it a major issue and I can live with it.Also I used to run in
[Declude.JunkMail] IMAIL ranks last as exchange alternative:
Title: Message http://reviews.zdnet.co.uk/software/internet/0,39024165,39188758,00.htm Sorry for the re-post from Imail forum, but incase any of you dont follow it. Any plans for Declude to integrate with Kerio??? : )
RE: [Declude.JunkMail] Kodak EZ Share
Title: Message Im having someone try to send me something from a dock in a little bit as soon as I have the headers I will post. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, March 02, 2005 11:46 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Kodak EZ Share All these get held on my system because you send it from your e-mail address without authenticating, so it never gets whitelisted with Whitelist Auth and it fails my spam domains test. But if you arent seeing them at all, Id guess it is the attachment size. Marc - can you post the headers from the heldmessage file. You mention it fails the spam domains test - for all we know there are other factors (such as the sending IP, or the HELO string) that cause his Postfix spam gateway to block the messages... Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 - Original Message - From: Marc Catuogno To: Declude.JunkMail@declude.com Sent: Wednesday, March 02, 2005 7:01 AM Subject: RE: [Declude.JunkMail] Kodak EZ Share All these get held on my system because you send it from your e-mail address without authenticating, so it never gets whitelisted with Whitelist Auth and it fails my spam domains test. But if you arent seeing them at all, Id guess it is the attachment size. Marc
RE: [Declude.JunkMail] Kodak EZ Share (headers)
Here are the headers – I have something with Kodak in my negative headers to try to let this stuff through… Received: from snj-us-pcwp-708.us.kodak.com [63.240.114.217] by mail.prudentialrand.com with ESMTP (SMTPD32-8.05) id A37246900BC; Wed, 02 Mar 2005 14:26:42 -0500 Received: from picturecd.kodak.com (ool-182cf376.dyn.optonline.net [24.44.243.118]) by snj-us-pcwp-708.us.kodak.com (8.11.7p2/8.11.7) with SMTP id j22JDa617939 for [EMAIL PROTECTED]; Wed, 2 Mar 2005 19:13:37 GMT Message-Id: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: 3/02/05 Date: Wed, 02 Mar 2005 14:13:38 -0500 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=1_boundary X-RBL-Warning: IPNOTINMX: X-Declude-Sender: [EMAIL PROTECTED] [63.240.114.217] X-Declude-Spoolname: D1372046900bcd817.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: IPNOTINMX, NOLEGITCONTENT, NEGATIVEHEADERS, SPAMDOMAINS1, GIBBERISH, ANTI-GIBBERISH [-10] X-Country-Chain: X-Note: This E-mail was sent from snj-us-pcwp-708-att.kodak.com ([63.240.114.217]). X-IMAIL-SPAM-HTML-FEATURES: (Image Tag) X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 387273370 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, March 02, 2005 11:46 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Kodak EZ Share All these get held on my system because you send it from “your” e-mail address without authenticating, so it never gets whitelisted with Whitelist Auth and it fails my spam domains test. But if you aren’t seeing them at all, I’d guess it is the attachment size.  Marc - can you post the headers from the held message file. You mention it fails the spam domains test - for all we know there are other factors (such as the sending IP, or the HELO string) that cause his Postfix spam gateway to block the messages... Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:   +1 201 934-9206  - Original Message - From: Marc Catuogno To: Declude.JunkMail@declude.com Sent: Wednesday, March 02, 2005 7:01 AM Subject: RE: [Declude.JunkMail] Kodak EZ Share All these get held on my system because you send it from “your” e-mail address without authenticating, so it never gets whitelisted with Whitelist Auth and it fails my spam domains test. But if you aren’t seeing them at all, I’d guess it is the attachment size.  Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] IMAIL ranks last as exchange alternative:
Wow ~ thanks – nice response time! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ralph Krausse Sent: Wednesday, March 02, 2005 5:56 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] IMAIL ranks last as exchange alternative: Marc,    I just spoke with Kerio and though the article says they support 3rd party applications, it is 3rd party applications they have integrated into their application. While talking with them in some depth, as of right now their system wouldn’t allow us to be put in the middle to do that processing we need to do.  I asked them to keep us on a list if they release a API we could write to. Ralph From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Wednesday, March 02, 2005 8:05 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] IMAIL ranks last as exchange alternative: http://reviews.zdnet.co.uk/software/internet/0,39024165,39188758,00.htm   Sorry for the re-post from Imail forum, but incase any of you don’t follow it….  Any plans for Declude to integrate with Kerio??? : )   --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter question
I have my own domain in the spamdomains test and then I have Whitelist Auth so almost anytime something appears to me from [EMAIL PROTECTED] if it isn't whitelisted because of authentication it adds quite a bit of weight. The major down side is that when people send e-mail from websites that have you fill in the from address. Since these don't authenticate they often get caught as well. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Carter Sent: Thursday, February 24, 2005 8:58 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Filter question The following header lines are the basis of my question. The from domain (mine) does not match the from [IP] address (not mine.) Received: from jcjc.edu [65.240.76.232] by bobcat.jcjc.edu with ESMTP (SMTPD32-8.15) id AB4F105B014E; Wed, 23 Feb 2005 17:01:35 -0600 From: Returned mail [EMAIL PROTECTED] To: [EMAIL PROTECTED] This may have been discussed before and I just didn't use the right search words, but ... has anyone worked on a filter/external program/whatever that could check for match/mismatch of the from address and the from IP in the Received: line. Example: One could specify the domains and IP's that must match each other. If they don't, boost the score by whatever makes one happy. My logic: whether it is an uncaught virus (like MyDoom.BE) or junk mail, it doesn't matter. If your users see email supposedly from you, they are going to be more likely to open it and suffer the results. Is this worth working on? Has someone done something on this? Thanks, John --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SmarterMail Held email recovery
Wow any of those scripts available for sale? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Wednesday, February 23, 2005 9:27 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail Held email recovery Aha! That's pretty nifty, Kevin. Well, *if* SmarterMail doesn't have the ability to re-queue without scanning, I'd suggest that you could add a bit more development to your web application to accomodate automatic counterweighting of re-queued messages. You're a programmer, so I don't have to detail a technique for inserting a magic cookie into the header, and have Declude check for the cookie and counterweight/whitelist appropriately. But heck, I figured it was worth mentioning here. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, February 23, 2005 5:55 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail Held email recovery I do not monitor my hold directory manually. I have a program the sends and email to all the users that have held email from the previous day with a recovery link for each message. The user has the option to recover the mesage or not. If they recover the message it is requeued and then delivered. A copy of the message source is also sent to our abuse@ email address to be analyzed and adjusted or to notify the admin of the sending server of the problem. Most of the messages that get held with our configuration fail due to SFP, HELOBOGUS, and RDNS otherwise I have very few false positives from filters to adjust for. I do not adjust for IP4 black list failures a server would have to be in 2 or 3 black lists to be held. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Colbeck, Andrew Sent: Wednesday, February 23, 2005 5:39 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail Held email recovery Well, I guess our goals differ. So although with IMail+Declude you can re-queue without scanning (your way) as well as re-queue with scanning (my way), I choose to re-queue with scanning AND fix the reason why the message was held. Re-queuing with scanning forces me to fix it, and I also try to fix it so that it is also fixed for future messages. So, while we wait for an official answer to your question (Hello, Declude?) can you tell us why you want to re-queue without scanning? Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Wednesday, February 23, 2005 5:04 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SmarterMail Held email recovery SmarterMail executes declude allover again. I never simply re-queue for delivery a message that was held. I always re-queue such that Declude would scan it again. When you requeue a message with Imail the only thing you need to do it move the D and Q files to the spool folder, they will not be rescanned by declude. Which implies that I must also do something about my Declude configuration to counterweight this and future messages from the same sender, e.g. with a REVDNS or a REMOTEIP negative weight. By countreweighting a messages that failed would only cause it to not fail the first time. I want to take a message that failed and was held and requeue it for delivery. When requeueing the message it should not be scanned again by declude. p.s. With IMail, I re-queue a message for scanning and delivery by moving the D*.SMD to the spool folder, and then moving the Q*.SMD file to the spool\overflow folder. I also edit the D*.SMD file before I move it, to remove any previous header additions, so that on the next Declude scan, it gets only the corrected headers. This is not necessary. See above! Kevin Bilbee --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
RE: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering Apps
Here is the site where we purchased some blocks (free for individual users) http://www.spywareguide.com/blockfile.php This was the file that my guy put together - just copy it into a text file and save as .reg, double click and integrate. I have tested it on XP ONLY. This file works to help me stop the agents from screwing up the machines too easily. It is a bit restrictive. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explor er] DisallowRun=dword:0001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explor er\DisallowRun] 1=aim.exe 2=stcloader.exe 3=sahagent.exe 4=wsup.exe 5=wintoolsA.exe 6=wintoolsS.exe 7=datemanager.exe 8=precisiontime.exe 9=gmt.exe 10=ymsgr_tray.exe 11=ypager.exe 12=waol.exe 13=aol.exe 14=YServer.exe 15=Ymsgr_tray.exe 16=yupdater.exe 17=name of app here.exe 18=name of app here.exe 19=name of app here.exe 20=name of app here.exe -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, February 16, 2005 8:06 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering Apps Marc, I would be interested in these keys for some of the workstaions here if you do not mind sharing them. Thanks Stu At 05:46 PM 2/15/2005 -0500, you wrote: If these are machines that the company owns and you can install them... I have some Reg Keys that a guy who works under me wrote for windows XP that blocks AOL-IM download and some others. It also prevents certain selected sites from being accessed and prevents things like my bargain buddy from being installed. Will really frustrate you average user. If you can get away with limited accounts, I can't, I wish I could, but that really makes it tough for them to screw around. If you want I can share them... Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Patrick Childers Sent: Tuesday, February 15, 2005 2:00 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering Apps Sorry for the OT but... It seems we have a lot of goofing off during the work day around here! Therefore, I am looking for recommendations for software (or hardware) based solutions for internet monitoring/filtering in a corporate setting of less than 150 users. Any suggestions? Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering Apps
If these are machines that the company owns and you can install them... I have some Reg Keys that a guy who works under me wrote for windows XP that blocks AOL-IM download and some others. It also prevents certain selected sites from being accessed and prevents things like my bargain buddy from being installed. Will really frustrate you average user. If you can get away with limited accounts, I can't, I wish I could, but that really makes it tough for them to screw around. If you want I can share them... Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Patrick Childers Sent: Tuesday, February 15, 2005 2:00 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Internet Usage - Monitoring and Filtering Apps Sorry for the OT but... It seems we have a lot of goofing off during the work day around here! Therefore, I am looking for recommendations for software (or hardware) based solutions for internet monitoring/filtering in a corporate setting of less than 150 users. Any suggestions? Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AMEX fails routing test
Thanks for 2 cents...I did check why it got held immediately. It got held because of a reverse DNS filter that I have since removed (sometimes I use contains a little over-zealously) I did lower the spamrouting test a little and the nolegit is at 0 (Hmm not sure why I'm running it then) I wasn't complaining that it got held - I was just wondering why something that looked to me like it was from Amex would fail the test. Did they have it routed badly? Or did the test screw up? I've been meaning to seriously tweak my Declude set-up, re-read the manuals and archives and find the best combo test, look into weight range, the stop action. Maybe I'll play with it today and make my server go boom -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Friday, February 11, 2005 2:15 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] AMEX fails routing test YOU may want to chang your config to use weightrange instean of weight. It will difinitivly choose the actio that will happen and avoid confusion. Why was this message held anyway. Based on the failed tests I would not hold this message on our server. I do not know what filter does. But I would not give verymany points to ROUTING and 0 points to NOLEGITCONTENT. Also I have seen many false positives on NOABUSE and would not weight that one either. My 2 cents, Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Thursday, February 10, 2005 4:09 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] AMEX fails routing test X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [210f]. X-Declude-Sender: [EMAIL PROTECTED] [193.32.34.73] X-Declude-Spoolname: D465d077100c4763a.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOABUSE, BONDEDSENDER, NOLEGITCONTENT, ROUTING, SPFPASS, FILTER, WEIGHT10, WEIGHT20, WEIGHT15, WEIGHT25 [27] X-Country-Chain: X-Note: This E-mail was sent from phxamgw01.aexp.com ([193.32.34.73]). Those are the headers from a held e-mail - I just thought it was odd, while possible, that Amex would have poor routing. Was it just because it was from England? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] not getting any list e-mails -
I am getting nothing from Declude (JM or V) or Imail and I checked the archive and there are many messages I haven't received. I don't think I changed anything. Could I just be off the lists somehow??? Anyone else having issues? If someone can contact me with some suggestions off list I'd appreciate it. Thanks - Marc Catuogno --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Having list issues
I'm sorry if you are getting posts from multiple addresses from me. I am just having list issues.
[Declude.JunkMail] AMEX fails routing test
X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [210f]. X-Declude-Sender: [EMAIL PROTECTED] [193.32.34.73] X-Declude-Spoolname: D465d077100c4763a.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOABUSE, BONDEDSENDER, NOLEGITCONTENT, ROUTING, SPFPASS, FILTER, WEIGHT10, WEIGHT20, WEIGHT15, WEIGHT25 [27] X-Country-Chain: X-Note: This E-mail was sent from phxamgw01.aexp.com ([193.32.34.73]). Those are the headers from a held e-mail - I just thought it was odd, while possible, that Amex would have poor routing. Was it just because it was from England? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders - Fix -
Joshua, I don't know if this has been suggested, but to completely rule out the new Declude 1.82 as the culprit could you revert to your previous version of Declude, comment out the spamheaders test, and see if your CPU is still maxed. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 3:28 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix - John, It took me a while to get these stats. I reviewed the SMTP logs for 12/4, 12/5, 12/7, 12/8. I know the server was running fine during this week. Usage is as follows. 12/4 - 83,170 messages 12/5 - 82,065 messages 12/7 - 95,087 messages 12/8 - 95,730 messages I reviewed the SMTP logs for the 1/2, 1/3, 1/4. These are current and usage is as follows. 1/1 - 59,717 messages 1/2 - 63,795 messages 1/3 - 78,945 messages 1/4 - 79,410 messages It appears as if the beginning of last month, when we were running fine, had a lot more messages being delivered. The only things I see in the log disturbing for today are: [EMAIL PROTECTED] 4.63.108.6= 1130 messages = 1068 messages I have an ipfile that I have set to automatically delete anything from the ip 4.63.108.6 because they have been the top sender of the log for three days. However, this messages is still being processed. Matt, Average SMTP log size is between 102MB to 200MB. This appears normal. The drive that the logs were on wasn't severely fragmented however, I de-fragmented it anyway. The drive that the spool directory is on is 86% free but about 60% fragmented. This drive could be de-fragmented however, I'm worried about de-fragmenting while the CPU is at 100%. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, January 05, 2005 12:17 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix The CPU spike is probably do to sheer volume. What is the current volume of messages being processed? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Joshua M. Hughes Sent: Wednesday, January 05, 2005 8:22 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders - Fix I have not upgraded to fix the 2005 spamheaders test as of yet. Our CPU has been maxed out and the server bogged down since my return after the New Year. I have commented out the spamheaders test and the CPU is still maxed. I went into IMAIL and changed the delivery application from declude.exe to smtp32.exe and restarted the SMTP service and the processing dropped from 100% to approximately 13% - 20%. I placed the declude.exe back in as the delivery application and the processor utilization shot right back up. This narrows it down to declude however, I have not yet pin pointed exactly what is causing the increase in processor usage. Under the assumption this was caused by one of my few minor changes before the New Year I reversed all changes made the week before the New Year. Still the processor is maxed out. Any thoughts, any ideas? I don't want to go through and comment out each test one at a time to find which the offender is. Thank you, Joshua Sunline Team (941) 206-7870 http://www.sunline.net/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, January 04, 2005 10:18 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders - Fix Hi, Scott, et.al, I have upgraded to the new Declude.exe v1.82. Within a matter of minutes of doing this upgrade I've noticed that my mail server has started to bog down. I don't know if I'm getting his with a new wave of spam and the server's straining to keep up or if there might be something in the new Declude code which would cause the .EXE to not run as quickly or as efficiently as before. I'm not pointing fingers. I just wanted to know if there's been any possible performance changes because of the bug fix. If not I'll look somewhere else. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail
[Declude.JunkMail] What version am I running?
Does this still work? \IMail\Declude -diag I thought I was on 1.81 and I just D/Led the fix and replaced declude.exe and I wanted to check the version through the diag and it gave me Diagnostics ON (Declude v1.80) I assumed that this would be version 1.82 - did I do something wrong? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] What version am I running? PLEASE IGNORE!
Duh - TOO early for me I must have copied an old .exe - I just did it again and now have 1.82 - Sorry, my bad. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno Sent: Wednesday, January 05, 2005 7:12 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] What version am I running? Does this still work? \IMail\Declude -diag I thought I was on 1.81 and I just D/Led the fix and replaced declude.exe and I wanted to check the version through the diag and it gave me Diagnostics ON (Declude v1.80) I assumed that this would be version 1.82 - did I do something wrong? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] FW: [sniffer] Sniffer Notifications now failing declude spamheaders test
I don't mean to be a nag but this was just posted to the sniffer forum and is exactly what I was talking about. It is almost 48 hours after the first post discussing this bug and there is still no e-mail from Declude that I am aware of that has gone out. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Jim MatuskaSent: Monday, January 03, 2005 11:02 AMTo: sniffer@SortMonster.comSubject: [sniffer] Sniffer Notifications now failing declude spamheaders test Has anything changed recently in the format of the sniffer notification messages? I am noticing all the notifications for the last few days have been failing decludes spamheaders test, this hasn't happened before. Jim Matuska Jr.Computer Tech2, CCNANez Perce TribeInformation Systems[EMAIL PROTECTED]
RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?
Scott, I have been and still am a very satisfied Declude customer. I wasn't looking for a faster fix, or an interim release, I didn't even want to complain, just: 1. An acknowledgement on the list from someone that they knew about the problem - it WAS a holiday and I think people should have lives - but just a hey we know within 24 hours would've been nice. 2. A simple e-mail note to all customers ASAP stating The spamheaders test has a bug causing it to catch and add weight to every e-mail sent in 2005. It is suggested that you comment it out or reduce (or remove) its weight to avoid false positives. We are working on a fix and will post it to the website as soon as possible I don't want to argue numbers or percentages or how significant the test is in scope of catching spam - 15% is significant enough should it cause an e-mail to be held or deleted. I would hate to have to tell someone that their sales lead is gone because of a program glitch. That's all. Maybe a group e-mail bugtrack @ d .com or something that people can subscribe to or something. I just know that I would've been pissed had I not checked the list and shut off the test and was never notified. Maybe I am spoiled by how proactive Declude has been in the past. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, January 03, 2005 4:02 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] 2005 SpamHeaders Glitch? I also agree it would have been nice to have a warning announcement about the Spam Header test being broken officially from Declude, more timely, and along with advice what to do in the interim. This is not the same Declude operation to me as in years past! FWIW, it was handled very similarly to how I would have handled it. I consider the SPAMHEADERS test to be a very minor test, as it did not catch a large amount of spam (about 8% when we last tested), and had a significant amount of false positives. As a result, we only counted SPAMHEADERS towards 15% of the default spam detection weight. The test can easily be commented out to prevent it from running. Yes, in the past, I could have come out with an interim version more quickly. However, it should also be noted that there was always a lot of debate about the interims; many people did not like them. And even so, I would have only come out with an interim for the latest version (in this case, a beta), which would not have provided any options for customers who can only run release versions. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Silence?
I'm a little disturbed that there has been no official e-mail or reply on this list about the 2005 spam headers bug. I understand there was a holiday, but shouldn't someone official have said something by now? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Silence?
Barry, Happy New Year to you as well. I understand that you don't want to have an official response until there is a fix. Wouldn't it be a good practice to send an e-mail to all customers advising them that the spamheaders test is broken and they should reduce the weight or comment out the test to reduce false positives? Personally I had that test as 1/2 half of my hold weight 1/3 my delete weight so if I hadn't checked the list I would've lost some legit e-mails. I'd bet not everyone monitors the list and some people aren't aware that every e-mail is getting extra weight. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barry Simpson Sent: Sunday, January 02, 2005 2:46 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Silence? The reason there has been no official post is that we are currently looking at the issue and will post our position when we have a solution to release to all affected customers. Happy New Year Barry -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno Sent: Sunday, January 02, 2005 2:33 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Silence? I'm a little disturbed that there has been no official e-mail or reply on this list about the 2005 spam headers bug. I understand there was a holiday, but shouldn't someone official have said something by now? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 2005 SpamHeaders Glitch?
Did anyone try loosen spamheaders on? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Saturday, January 01, 2005 12:36 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] 2005 SpamHeaders Glitch? - Original Message - From: Dave Doherty [EMAIL PROTECTED] I set it to zero weight temporarily. I also sent an email direct to Scott and Barry. Why run the test at all if you're going to set the weight to zero anyway - just comment out the test until it's fixed. I can see this causing some major problems for users that are not subscribers of this list, or who do not actively monitor it. I'm wondering if the only fix for this is a new declude.exe file? If that's the case, CPHZ has got their early New Year's work cut out for them... Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] ENDing surbl filter file
I believe it was the more they OVERTAKE the plumbing, the easier it is to stop up the drain Oh geez I need a life -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Monday, December 06, 2004 4:23 PM To: Colbeck, Andrew Subject: Re[2]: [Declude.JunkMail] ENDing surbl filter file On Monday, December 6, 2004, 10:50:19 AM, Andrew wrote: snip/ CA So... I don't know how antispam software in general is adapting to those CA anti-SURBL (or just anti-filtering) techniques, but the short of is that CA your optimization is a good idea to save mail processing time, but not CA against at least one spam gang. I love it when they do things like this. We simply code for the structure of their obfuscation and frequently this is enough to capture whole families of new campaigns. ... what is it that Scotty said about the hyperwarp drive as he was handing parts to McCoy... The more they rethink the plumbing, the easier it is to stop up the works... A good argument for a diversified approach to spam filtering is that one mechanism often creates countermeasures that can be exploited by another. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Suggestion: Most stringent test
Thanks. I will try this. Also thank you for not just flatly referring me to the manual, where I found this documented after you told me the name of the test. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Davidson Sent: Sunday, November 07, 2004 8:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Suggestion: Most stringent test Try this in your global config file, it will cause an email to be unwhitelisted and go through the testing process BYPASSWHITELIST bypasswhitelist x y 0 0 where x is the weight you want to assign where y is the amount of recipients required to skip the whitelist no setting is required in $default$.junkmail works wonders for me Rick Davidson National Systems Manager North American Title Group - - Original Message - From: marc catuogno [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, November 06, 2004 5:38 PM Subject: [Declude.JunkMail] Suggestion: Most stringent test Or some other name if it is possible - I'd like to stop e-mails from being whitelisted because my users have their own name in their address book and someone sends to multiple people as one of my users. Also I'd like to stop e-mails being delivered to multiple recipients because one person has the sender in their address book. SO maybe if there are multiple recipients maybe there could be a test in Declude that causes the most restrictive action (hold, delete, etc) instead of the least restrictive (whitelist) action. This way the user can still get e-mails from [EMAIL PROTECTED] if it is sent directly, but if some idiot tries to use this to get around blocks by sending to a list of address it will be deleted. Is this possible? Is there something like this? Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Suggestion: Most stringent test
Or some other name if it is possible - I'd like to stop e-mails from being whitelisted because my users have their own name in their address book and someone sends to multiple people as one of my users. Also I'd like to stop e-mails being delivered to multiple recipients because one person has the sender in their address book. SO maybe if there are multiple recipients maybe there could be a test in Declude that causes the most restrictive action (hold, delete, etc) instead of the least restrictive (whitelist) action. This way the user can still get e-mails from [EMAIL PROTECTED] if it is sent directly, but if some idiot tries to use this to get around blocks by sending to a list of address it will be deleted. Is this possible? Is there something like this? Thanks - Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] REVERSE DNS TEST BROKEN
I foolishly was creating a test and called it REVDNS - then realized that it was a duplicate test - I changed the name. Now the REVDNS test doesn't work. REVDNS revdnsexistsx x 10 0 That is the line in my global config And this is line in an e-mail this morning: X-Note: This E-mail was sent from ([205.188.157.38]). And there hasn't been a REVDNS failure since I broke it with the duplicate test. How do I get it to work again??? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] REVERSE DNS TEST BROKEN
I don't know what it was but I had named the test REVDNS and it looked like this: REVDNS filter D:\REVDNS.txtx 0 0 This caused a dupe test and didn't work: I then changed it to: DNS filter D:\DNS.txt x 0 0 And the regular REVDNS test didn't run - nothing in the log at normal log level - just wasn't checking REVDNS. Then I changed it to: reverse filter D:\reverse.txt x 0 0 And now Declude is scanning the Reverse DNS. Weird ~ but as long as it is working, I'd just suggest that no one define a test called DNS. not that anyone else would make that silly mistake. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno Sent: Friday, September 17, 2004 8:34 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] REVERSE DNS TEST BROKEN I foolishly was creating a test and called it REVDNS - then realized that it was a duplicate test - I changed the name. Now the REVDNS test doesn't work. REVDNS revdnsexistsx x 10 0 That is the line in my global config And this is line in an e-mail this morning: X-Note: This E-mail was sent from ([205.188.157.38]). And there hasn't been a REVDNS failure since I broke it with the duplicate test. How do I get it to work again??? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How do I get a copy of all messages that fail a certain test?
Or you could use an independent .junkmail file for the account that you are copying to and not have a delete action for any weight so the action would be something other than delete. I have an account that the JM file changes the subject to HOLD WEIGHT and DELETE WEIGHT so I know where I need to tweak. I THINK that may work as well... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of System Administrator Sent: Friday, August 13, 2004 9:35 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] How do I get a copy of all messages that fail a certain test? on 8/13/04 9:18 AM, Bud Durland wrote: I belive the remedy is to create a second test, of the same type with the same criteria, and make COPYTO the action for that new test I'm currently doing that. Apparently, the over the delete weight messages get deleted before the copyto takes place. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities
If you are using LDAP that is completely and horribly hackable and I don't think there is a patch below 7. Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende Sent: Friday, July 16, 2004 9:57 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: iMail 6.06 vulnerabilities Does anyone know of any vulnerabilities in iMail 6.06? Within a minute after turning on iMail's SMTP service my server becomes completely unresponsive and eventually goes down. I've also installed all of the 6.06 related patches from Ipswitch's site. Jose --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.721 / Virus Database: 477 - Release Date: 7/16/2004 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] why/how this was white listed..how to stop it?
I am running Declude 1.79 and Imail 8.05, I have autowhitelist on and whitelist auth. This user (Bernie Cohen) had himself in his address book and it looks like the spammer had the from e-mail to be bernie's e-mail address. I thought it was difficult to fake the x-declude sender? I like the autowhitelist feature because it gives my users the ability to receive jokes and other e-mails that may otherwise be filtered by adding friends and so on to their address books. Should I advise all my users NOT to have themselves in the address book to prevent spammers from exploiting this feature? Is there anything else that I can do? DECLUDE LOG: 06/04/2004 14:05:16 Qb9d22cdb01326288 Skipping4 E-mail from [EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED] 06/04/2004 14:05:16 Qb9d22cdb01326288 Skipping4 E-mail from [EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED] IMAIL LOG: 06:04 14:05 SMTPD(2CDB0132) [69.14.41.135] D:\IMail\spool\Db9d22cdb01326288.SMD 10188 06:04 14:05 SMTPD(2CDB0132) performing antispam checks HEADERS: Received: from SMTP32-FWD by mail.prudentialrand.com (SMTP32) id A06583D2D; Fri, 4 Jun 2004 14:05:17 -0400 Received: from d14-69-135-41.try.wideopenwest.com [69.14.41.135] by mail.prudentialrand.com (SMTPD32-8.05) id A9D22CDB0132; Fri, 04 Jun 2004 14:05:06 -0400 X-Message-Info: G010J836ZEU98eoBqnK02XKX34ePtyaP755 Received: from [54.89.60.212] by [EMAIL PROTECTED] via HTTP; Fri, 04 Jun 2004 21:53:29 +0300 Date: Fri, 04 Jun 2004 12:51:29 -0600 Message-ID: [EMAIL PROTECTED]@prudentialrand.com Reply-To: Jason Morton [EMAIL PROTECTED] From: Jason Morton [EMAIL PROTECTED] To: Bernie.cohen [EMAIL PROTECTED] Subject: Re:Soma,valium,xanax,etc shipped overnight Date: Fri, 04 Jun 2004 14:50:29 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--907020264053734 X-Declude-Sender: [EMAIL PROTECTED] [69.14.41.135] X-Declude-Spoolname: Db9d22cdb01326288.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-Country-Chain: X-Note: This E-mail was sent from d14-69-135-41.try.wideopenwest.com ([69.14.41.135]). X-IMAIL-SPAM-HTML-FEATURES: (Image Tag) X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 378182572 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude headers missing from several e-mails
Thanks - It looks as if it was an aberration. I've checked a few different day's logs and didn't see could not lock file in any other log. Something must have been up. Maybe I should look through the logs more thouroughly and more often : ) Anything out there that could alert me to the fact that Declude hasn't scanned a file (I know that is a broad question) something that would scan the logs and e-mail me immediately if Declude encounters a severe error that causes an e-mail (or e-mails) not to be scanned? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, May 06, 2004 7:17 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude headers missing from several e-mails No backup software, no on access scanning. I am having some other problems with the machine - I'm about to nuke it regardless - I just wanted to make sure that declude was still being called to scan for viruses until I get this box formatted... ugh Unfortunately, if the files can't be locked by Declude, then it is likely that the E-mails would not get scanned for viruses. Declude expects to have exclusive access to those files. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude headers missing from several e-mails
Running IMAIL 8.05 Declude Virus/JM 1.79 beta Headers: Received: from SMTP32-FWD by mail.prudentialrand.com (SMTP32) id A043C; Wed, 5 May 2004 05:32:02 Received: from gurushy.com [207.226.69.162] by mail.prudentialrand.com (SMTPD32-8.05) id A121AA0064; Wed, 05 May 2004 05:17:21 -0400 Content-Type: multipart/alternative; boundary=--=_1083740601-9553-0 Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.411 (Entity 5.404) Return-Path: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Received: from img.gurushy.com by gurushy.com id [EMAIL PROTECTED] for [EMAIL PROTECTED]; Wed, 5 May 2004 21:00:09 GMT From: Clever Consumers [EMAIL PROTECTED] Subject: Please Claim your $50 Best Buy Gift Card Date: Wed, 5 May 2004 21:00:09 GMT Message-Id: [EMAIL PROTECTED] Errors-To: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] List-Unsubscribe: http://www.gurushy.com/unsub.php?id=GJCIFJJJH7IIHD000, mailto:[EMAIL PROTECTED] be X-IMAIL-SPAM-HTML-FEATURES: (Image Tag) X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 378181469 Logentry for that time period - there is a gap? 05/05/2004 05:15:07 Qae350111006606b6 Could not lock D:\IMail\spool\Qae350111006606b6.SMD; timed out (j=2). 05/05/2004 05:33:09 Qae85002a00623cd4 Tests failed [weight=44]: SBL=WARN HELOBOGUS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE MOREIPS=WARN FILTER=WARN WEIGHT10=WARN WEIGHT20=HOLD WEIGHT15=SUBJECT WEIGHT25=WARN WEIGHT30=DELETE WEIGHT40=HOLD --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude headers missing from several e-mails
I guess I was too brief- There were e-mails delivered between 5:15 and 5:33 - This could not lock message should've just effected just that one e-mail. It shouldn't have stopped Declude from being called for 15 minutes. Correct? After a closer look at the logs, this was what I found - what could cause so many errors? 05/05/2004 05:10:32 Qadef010e0066f2d5 Could not lock D:\IMail\spool\Qadef010e0066f2d5.SMD; timed out (j=2). 05/05/2004 05:11:28 Qadf6010f00660d33 Could not lock D:\IMail\spool\Qadf6010f00660d33.SMD; timed out (j=2). 05/05/2004 05:12:15 Qaddc00280062aa71 Could not lock D:\IMail\spool\Qaddc00280062aa71.SMD; timed out (j=2). 05/05/2004 05:13:04 Qae0e009900646c79 Could not lock D:\IMail\spool\Qae0e009900646c79.SMD; timed out (j=2). 05/05/2004 05:14:02 Qae14009a006485ce Could not lock D:\IMail\spool\Qae14009a006485ce.SMD; timed out (j=2). 05/05/2004 05:36:10 Qaf5b011b006680e3 Could not lock D:\IMail\spool\Qaf5b011b006680e3.SMD; timed out (j=2). 05/05/2004 05:36:11 Qaf5a011b00667eef Could not lock D:\IMail\spool\Qaf5a011b00667eef.SMD; timed out (j=2). 05/05/2004 05:36:11 Qaf8d011d0066457c Could not lock D:\IMail\spool\Qaf8d011d0066457c.SMD; timed out (j=2). 05/05/2004 05:36:13 Qaf8d003700624695 Could not lock D:\IMail\spool\Qaf8d003700624695.SMD; timed out (j=2). 05/05/2004 05:36:13 Qafcd00a100643d78 Could not lock D:\IMail\spool\Qafcd00a100643d78.SMD; timed out (j=2). 05/05/2004 05:36:13 Qafd20121006650a2 Could not lock D:\IMail\spool\Qafd20121006650a2.SMD; timed out (j=2). 05/05/2004 05:36:13 Qafcd003a00623d68 Could not lock D:\IMail\spool\Qafcd003a00623d68.SMD; timed out (j=2). 05/05/2004 05:36:13 Qafcd012000663d78 Could not lock D:\IMail\spool\Qafcd012000663d78.SMD; timed out (j=2). 05/05/2004 05:36:13 Qafb900390062eebc Could not lock D:\IMail\spool\Qafb900390062eebc.SMD; timed out (j=2). 05/05/2004 05:36:13 Qb00e012300663db2 Could not lock D:\IMail\spool\Qb00e012300663db2.SMD; timed out (j=2). 05/05/2004 05:36:13 Qb03101250066c4a5 Could not lock D:\IMail\spool\Qb03101250066c4a5.SMD; timed out (j=2). 05/05/2004 05:36:13 Qb56d000d00903753 Tests failed [weight=39]: SBL=WARN SPAMCOP=WARN IPNOTINMX=IGNORE SNIFFER=WARN FILTER=WARN WEIGHT10=WARN WEIGHT20=HOLD WEIGHT15=SUBJECT WEIGHT25=WARN WEIGHT30=DELETE 05/05/2004 05:36:13 Qb05b0127006668a5 Could not lock D:\IMail\spool\Qb05b0127006668a5.SMD; timed out (j=2). 05/05/2004 05:36:13 Qb0520126006644c1 Could not lock D:\IMail\spool\Qb0520126006644c1.SMD; timed out (j=2). 05/05/2004 05:36:15 Qb09e00a500646f76 Could not lock D:\IMail\spool\Qb09e00a500646f76.SMD; timed out (j=2). 05/05/2004 05:36:15 Qb0cd004000622827 Could not lock D:\IMail\spool\Qb0cd004000622827.SMD; timed out (j=2). 05/05/2004 05:36:15 Qb0c2003f0062fd8d Could not lock D:\IMail\spool\Qb0c2003f0062fd8d.SMD; timed out (j=2). 05/05/2004 05:36:15 Qb118004100624cb2 Could not lock D:\IMail\spool\Qb118004100624cb2.SMD; timed out (j=2). 05/05/2004 05:36:15 Qb12100aa00646e63 Could not lock D:\IMail\spool\Qb12100aa00646e63.SMD; timed out (j=2). 05/05/2004 05:36:15 Qb14300430062f2a6 Could not lock D:\IMail\spool\Qb14300430062f2a6.SMD; timed out (j=2). 05/05/2004 05:36:15 Qb118012b00664bb8 Could not lock D:\IMail\spool\Qb118012b00664bb8.SMD; timed out (j=2). 05/05/2004 05:36:15 Qb11800a900644cc2 Could not lock D:\IMail\spool\Qb11800a900644cc2.SMD; timed out (j=2). -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, May 05, 2004 4:40 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude headers missing from several e-mails Logentry for that time period - there is a gap? 05/05/2004 05:15:07 Qae350111006606b6 Could not lock D:\IMail\spool\Qae350111006606b6.SMD; timed out (j=2). 05/05/2004 05:33:09 Qae85002a00623cd4 Tests failed [weight=44]: SBL=WARN HELOBOGUS=WARN IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE MOREIPS=WARN FILTER=WARN WEIGHT10=WARN WEIGHT20=HOLD WEIGHT15=SUBJECT WEIGHT25=WARN WEIGHT30=DELETE WEIGHT40=HOLD Those are log file entries for two separate E-mails. It sounds like the problem E-mail was the first one, and that something interfered with the file so that Declude JunkMail could not lock it -- preventing Declude from altering the file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses
RE: [Declude.JunkMail] Declude headers missing from several e-mails
No backup software, no on access scanning. I am having some other problems with the machine - I'm about to nuke it regardless - I just wanted to make sure that declude was still being called to scan for viruses until I get this box formatted... ugh -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, May 05, 2004 8:07 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Declude headers missing from several e-mails There were e-mails delivered between 5:15 and 5:33 - This could not lock message should've just effected just that one e-mail. It shouldn't have stopped Declude from being called for 15 minutes. Correct? After a closer look at the logs, this was what I found - what could cause so many errors? Was there backup software running during those 15 minutes? It sounds like something was interfering with the files that only Declude should have had access to, and backup software and on-access virus scanners are the 2 common culprits. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Nice declude face lift
Scott, The site looks good, I like the look. Marc --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
