[Declude.JunkMail]
http://danjacoby.de/modules/Search/life.html --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3
On 7/14/06, Scott Fisher [EMAIL PROTECTED] wrote: Another hand raised. End User (business) here. Apparantly I missed the Exchange memo. Put yourr hand down :-) According to the definition you are a service provider. Quoted with emphasis added: definition: a business which provides their customers with delivery of their Email communications AND/OR USERS with access to their own Email I'm curious about CommTouch and coming back to Declude but the implications of what I am seeing are indeed disturbing -- [EMAIL PROTECTED] Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3
On 7/19/06, Kevin Bilbee [EMAIL PROTECTED] wrote: So then indirectly it does generate revenue. Because without it revenue would be lost. Hardly. Carry that argument out to prove how wrong it is. By virtue of the fact that they allow me to be in business in the first place I can expect a knock on the door from Microsoft since they make the server o/s... and Dell since they make the servers. So just being a part of the show lets the pig belly up to the trough. Not in this universe. -- [EMAIL PROTECTED] Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude 4.3
On 7/19/06, Kevin Bilbee [EMAIL PROTECTED] wrote: If revenue would not be lost without it and it costs you money to provide then what is the business case for providing the service? In 2006, for any small operator, nothing insofar as the service itself is concerned. You only do it to provide a complete solution for customers, and you do it at a loss. If I could cut out email I could cut out 50% of the server resources I have in place (and which I just finished tripling). The increasingly difficult model for the small ISP dictated my shift into an emphasis on contract programming and away from design and hosting. So when a company that caters to the small business -- who as a body are pretty much all in the same boat -- and seeks to increase their costs in a market where consumer perception is that they're already an expensive choice (I am cutting fees to existing customers to keep them... not raising them)... well thats going to be a mighty tough sell to anyone who is in the trenches and understands fully what they are up against. I came into this thread a little late and if my read on the posts from Declude is any indication, some of this is sinking in. I'll make a decision after I see what the revenue sharing program looks like. As an aside to Declude to explain where I am coming from: I was a Declude user for a couple of years and left it for an open source solution, which I am still reasonably happy with, but -- since I am already going to the trouble of rebuilding all of my mail services on new servers right now -- am willing to reconsider if I can get a qualitative advantage for a justifiable cost. -- [EMAIL PROTECTED] Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SmarterMail 3.x
I'm looking at going back to Declude with the release of SM 3.0. First thing I saw on the Declude home page is something called a BOUNDRY LAYER Saw the same spelling error repeated on another graphic. I can't be the only guy to have noticed this, I would think. The signature graphic explaining the product's place in the universe, and the first word on it is misspelled. OUCH. How embarrassing. -- --mattRobertson-- Janitor, MSB Web Systems mysecretbase.com N�f����Ƨ��_� ���y�nu� 0u�%�ל�d���j)\jg���r[�x���Ƣ�f��)��+-N�r��z;��ǧu�ę�j)l��^r[�y�jwmʗ��˛���m��r[�x���Ƣ�8^j�!���q��y�.�֭��i��0�f���܆+�r�
Re: [Declude.JunkMail] Declude with SmarterMail 3.0
I'm really surprised. My experience with SmarterTools has been nothing short of stellar. I've had two separate instances over the last year or so where I've had problems that a tech has made it his personal business to work through with me. One was a nightmarish install of a gateway in front of SM (i.e. not really their fault) and another was a mysterious problem where the mail server suddenly started eating bandwidth for no reason (it wasn't sending or receiving anything, and a reinstall eventually fixed the problem) and they wound up walking me thru a safe reinstall. When I gratefully asked if they wanted my cc# as this was a for-pay support call I was told that only comes into play with users who abuse the privilege of tech support and call them over and over. A week or so ago I posted on their forum asking how to migrate a bunch of smartermail domains from one server and integrate them into another one thats already running. They wrote up and posted a special KB article for that circumstance. So it ain't all bad. -- --mattRobertson-- Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] IMail Server Vulnerabilities...
So, question is... will Ipswitch create hotfixes or workarounds for versions before 8.2? Or is everyone forced to upgrade to 8.2? Wanna make a bet on which? :-) -- --mattRobertson-- Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[4]: [Declude.JunkMail] Imail 8.2 / smartermail
On 4/29/05, David Sullivan [EMAIL PROTECTED] wrote: So there is an inherent delay in the delivery of all messages? How long? Whatever you set it to be. Mine is 30 seconds. -- --mattRobertson-- Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail 8.2 / smartermail
My Imail license is relegated to SMTP traffic generated by a ColdFusion server. SmarterMail took over the public-facing mail chores shortly after Ipswitch killed Imail in favor of ICS. Second the comment about the web interface. Its as if grownups designed it versus hobbyists. Sounds harsh but you have to see it in action. I still have a Declude Virus and Spam license. May bring back the Virus as I always liked FProt but my antispam went to an ASSP gateway well over a year ago. It manages the spam... not me. And does a dam fine job of it on its own I might add. -- --mattRobertson-- Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail 8.2 / smartermail
On 4/28/05, Robert Grosshandler [EMAIL PROTECTED] wrote: Why didn't you point your CF server at smartermail? It gave me an entirely separate mail engine. I have customers with (legitimate) association mailing lists and in (small) part this lets me split the load. SM could handle that load, but I also had major issues with my SM configuration, which uses ASSP as an antispam gateway in front of SM, and this complicated my life a fair bit. Bypassing that setup and letting Imail be a ColdFusion-smtp-only engine solved some annoying config problems between with that gateway tucked into the picture. -- --mattRobertson-- Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client
What Don is doing is something thats been around for quite a while, and not just in ColdFusion. In CF its commonly called a FakeURL and the intent of it is to make a url search engine safe by removing the ?'s and 's and replacing them with slashes. Its been around for years. I've never heard of anything like what AOL is doing. If they're serious about blacklisting this sort of thing then it would break zillions of web sites, or more accurately any email pointing to them. -- --mattRobertson-- Janitor, MSB Web Systems mysecretbase.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: File archiving tool
SyncBack is incredible. Spend the $15 for the registered SE version. It has a much better ftp engine, among other things, or so the authors say. In the last week or so I've switched over all of my online synching to it. -- --mattRobertson-- Janitor, MSB Web Systems mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DNSstuff Website
I have been using the backup.dnsstuff.com But is it gone and they just forgot to whack the backup? dnsreport.com was (is?) the best dns report on the planet. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DNSstuff Website
Nick wrote: Scott is on a cruise. No internet. No phone. Ugh. Don't say that. I'm going to Cabo for two weeks next month - first vacation in years - and I am absolutely *praying* that the place we're going is wired up, in case of exactly this kind of scenario. I have a Plan B (int'l cellular modem) but to use it would cost more than the whole vacation if I dare. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] DNSstuff Website
My plan B in those situations is another tech who's still on site :) want a new job? (just kidding :) I'm a 1-man shop. Works great so long as you never take a vacation or get hit by a bus. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] f-prot
Darin Cox wrote: The DOS version is the one with the command line scanner if that isn't obvious. If you buy the Windows version, you get the DOS version as well. I'm pretty sure the Windows version of that command-line scanner is 32-bit and the DOS version is only 16, so there's a big reason to not use the DOS version. Also the Windows version easier to keep upated since you can set the scheduler for hourly updates or whatever. Don't think you can do that in the DOS version but I could be wrong. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Fw: [Declude.JunkMail] Notification to customers of change of ownership
Congratulations, Scott! Looking forward to seeing you get some well-deserved hi-visibility. --Matt Robertson-- MSB Designs, Inc.
[Declude.JunkMail] X-Declude-Status: Waiting for activation code
I have the above header in my mail. Just showed up not too long ago. I have JM Pro and Visur Standard. Virus Standard is running and I have disabled JM Pro by renaming my global.cfg. Whats happening here? I've got a service agreement. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Yahoo, Sendmail to test antispam system
Anyone have any comments on how effective this will be (or not...)? What good is this if *everyone* doesn't use it? Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Remove dns lookups and just do filter/blacklist?
OK, thanks anyway. Is this something realistic to ask for as a new feature? No idea if it's a reasonable request with the current code base. --Matt-- -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, February 20, 2004 9:44 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Remove dns lookups and just do filter/blacklist? Is there a way to get Declude JM Pro to *just* do blacklist lookups and run filters? I have my global.cfg chopped down to this, but loglevel=debug shows Declude is still toing revdns lookups. Can this and anything else 'extra' be switched off? Unfortunately, there is currently no way to turn off the reverse DNS lookups. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Remove dns lookups and just do filter/blacklist?
Is there a way to get Declude JM Pro to *just* do blacklist lookups and run filters? I have my global.cfg chopped down to this, but loglevel=debug shows Declude is still toing revdns lookups. Can this and anything else 'extra' be switched off? Thx, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Vacation Message Dilema
Yes. My solution was to remove the vacation message option from the web mail template menu. One of the few times I've done something like that without polling customers. Vacation messages are eee-ville. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com - - - - - - - - - - - - - - Site Design and ColdFusion Developer Tools --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Domain Registrar recommendation
Go with GoDaddy as a *reseller* thru their Wild West Domains subsidiary. I used to just handle this for clients. Now I make a fair income in commissions. Disgusting that it's a revenue stream I used to ignore. Go to my web site and click 'register domains'. That's their standard reseller page, with my customized prices on it (I bump them up a tad to increase my income... This isn't what I'm paying). I both register stuff for clients and direct them here to buy their own. Commission checks are direct-deposited monthly. I especially like the ability to determine expirations globally across all accounts. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com - - - - - - - - - - - - - - Site Design and ColdFusion Developer Tools --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] evaluating declude
Jim, I think everyone here will agree that Declude is largely a hands-on product, at least until you get it tweaked right. I used to fool around with it almost daily, although in recent weeks this tinkering is much less necessary thanks to the hard work and generosity of some other list members here. I'd be happy to share my global.cfg with you, and how I do updates. Contact me off-list for details. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com - - - - - - - - - - - - - - Site Design and ColdFusion Developer Tools --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Test order of execution? Time taken per test?
Currently I have my ip4r tests running first, then the rhsbl's, then the badheaders, base64, comments (etc.) tests. Then come the fromfiles and last come the filters. Is there a more efficient way to order this, or do I have it wired, more or less? The way its set up now the filters often go untouched as they all have skipifweight and maxweight inside them. Scott, it sure seems like it would be nice if we could do maxweight and skipifweight on EVERYTHING, or would that impose an unacceptable overhead penalty? And is there a way to determine the time taken by each test? Seems like when log mode is debug all I get is a total value, unless I'm missing something. If there are any dogs in there (i.e. slow ip4r and rhsbl tests) I want to try and find 'em. I'm using a Declude build d/l'd yesterday. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com - - - - - - - - - - - - - - Site Design and ColdFusion Developer Tools --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test order of execution? Time taken per test?
Yes, that's the order they are in in global.cfg I had totally forgotten about running those tests in parallel. Thx for the info! Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com - - - - - - - - - - - - - - Site Design and ColdFusion Developer Tools --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail and Spyware Protection
Get yourself a copy of Spybot Search Destroy. Free and the best, imho. Its also the right tool for the job, which I don't think anything associated with email is; if for no other reason than a boatload of intrusive software (i.e. most of it) comes in thru other avenues. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Manual
Markus, Good ideas you have there. If I may comment briefly: Dynamic disabling of resource-intensive tests would be an absolute godsend. Since I have enabled filtering I went from a server that had gobs of extra overhead to one that is taxed and often redlines both processors. A load-smart system would be wonderful. Holding and retesting and possibly requeueing: Same thing. Great idea. No clue whether either is reasonably feasible. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Manual
DITTO! The manual is completely updated right now, unless you have volunteered yourself for the beta program. :-) -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ColdFusion-based filter updater
For those who have asked, here's a link to the ColdFusion-based updater that takes advantage of Kami Razvan's filter repository, along with a copy of my global.cfg. http://mysecretbase.com/deliver.cfm?FN=2247B5E2198F464BA033DD5312D09F69 The app displays its progress onscreen via cfflush, which renders it incompatible with versions of CF prior to CF5. Just remove the cfflush commands and it'll be compatible back to at least v4.5 and probably 4.01. The app updates and uploads one filter at a time, so uploads of individual filters are nearly instant on a fast connection. My server isn't particularly busy and I can get away with uploading directly to my Declude filters folder, but you may not. Set all parameters in application.cfm, including your ftp account info and the list of files you want to revise. I use 32 of Kami's filters and fromfiles. When I get around to scheduling it (I run this manually now) I'll do twice-daily updates. All the routine does at present is revise skipifweight and maxweight settings in filter files. If the file has 'filter' in its filename the weight setting update routine is triggered. One thing I've noticed is that maybe the individual weight settings might need to be adjusted as well. I'm thinking over how to create a generic method doing this to any filter file. Cheers, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Shut down outgoing scanning?
Is there some way to stop Declude from doing outgoing mail scanning? I have Pro and don't need this functionality. Its really kicking my mail server's butt. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Shut down outgoing scanning?
Yep, I'm trying to stop Declude from performing the tests at all on system-generated outgoing mail, so I can indeed determine the originating IP. I had already commented out the tests long ago (thanks for trying to help, Bill). Wasn't aware of prewhitelist. This should really save my bacon. --Matt-- -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Tue, 23 Dec 2003 18:26:47 -0500 Is there some way to stop Declude from doing outgoing mail scanning? I have Pro and don't need this functionality. Its really kicking my mail server's butt. Not directly. But if you are using lots of filters, you may want to consider something like WHITELIST IP 192.0.2.0/24 and use PREWHITELIST ON to bypass scanning of E-mails from your local users. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] GIBBERISH 2.0.1, single file filter with END functionality. functionality.
My quandary now is to decide whether to use the new control functions of SKIPIFWEIGHT, MAXWEIGHT and END to reduce processing overhead or to collect a full set of evaluation data by letting everything run. It's truly a catch-22 situation. I came into this thread late, so my comments may not be strictly on point, but it seems to me the solution to this is to only use filters that work. Duh, right? In other words let the community validate and update Filter X and you simply plug in what you please. That means a centralized filter storage, update and distribution site. We actually aren't so far off that mark now. Look at Kami Razvan's ftp site and you'll find a treasure trove of filters there. A centralized filter repository would turn analysis of filter results into an academic exercise to satisfy curiosity, rather than the general necessity it is today. I implemented most of Kami's stuff last week (supplementing most of the filters already installed that came from Matt Bramble and the result is a massive surge in my attach-to-kill ratio (on the kill side). There are so many I had to aggressively reorganize my global.cfg, but the results have been splendid, with the most processor-intensive filters not kicking in unless needed. I wrote a ColdFusion routine that downloads my selected filters, alters them to suit my skip and max weights, and uploads them to my mail server (the filters are regularly updated). Anyone who wants a copy let me know. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] GIBBERISH 2.0.1, single file filter with END functionality. functionality.
I understand all that stuff, George, but I disagree completely that you can't apply global, updated rules to some aspects of the problem. As such a global filter repository can make a huge dent in virtually everyone's workload. Do we really all need to create our own filters to remove p.en1s pi11z from our inbox? Is having the ability to more quickly react to new spam bad? Think of this as a virus definitiion list, except given Declude's modularity individuals can decide which virii they will allow themselves to be infected with. Nothing in this world is going to be perfect, and certainly you can write your own filters until you're blue in the face. I've been tinkering constantly with Declude for something like two years, and I expect to continue. But I also expect to automate as much of this -- or any other job -- as possible. I have more profitable and less aggravating things to do than this. I'm sure you do too. The community can benefit from some standardization and shared effort. Some here have already gone miles toward this goal, as many on this list know. I'm saying a Next Step should be taken, and anyone who wants to ignore the initiative is welcome to do so. --Matt-- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Getting exec time on less than DEBUG mode?
I think this is a feature request: Is there some way to get the ms exec time on Declude without going to debug log mode? I just revamped my tests (adding a bunch of filters) and it sure would be nice to be able to compare before/after execution times without getting bombed by debug mode. My logs are godzilla-sized as it is. Just a thought. Happy Monday, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com - - - - - - - - - - - - - - Site Design and ColdFusion Developer Tools --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamchk fine tuning?
Thanks Markus. I am using SpamChk with about 70 other tests. One thing that helped solve the fp problem was going to your weight 100 scheme. By adding a zero to every weight it brought spamchk's results into proportion with everything else. I didn't want to mess with the config for precisely the reason you point out; some stuff was clearly threshold values and not weights, but I wasn't 100% on what was what and didn't want to break it. Here are the headers from one of the error messages your list server threw. The mails had no content. Only the subject you see here. I got subscribed just fine with the other link you sent me. It appears that this other link doesn't ask for my name, as that's the only diff I saw between the two links. Received: from mail.spamchk.com [217.199.0.33] by msb1.mysecretbase.net with ESMTP (SMTPD32-8.02) id A58B4050086; Tue, 02 Dec 2003 09:02:03 -0800 Date: Tue, 2 Dec 2003 17:59:15 +0100 Message-Id: [EMAIL PROTECTED] From: [EMAIL PROTECTED] (List Server) To: [EMAIL PROTECTED] Subject: Invalid Syntax! X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 4. X-Declude-Sender: [EMAIL PROTECTED] [217.199.0.33] X-Declude-Spoolname: Dc58b04050086dd14.SMD X-Note: This E-mail was sent from ns1.zcom.it ([217.199.0.33]). X-Note: This E-mail was scanned by MSB Designs Inc. Anti-Spam Services. X-Spam-Tests-Failed: IPNOTINMX, NOLEGITCONTENT, SPAMCHK X-Spam-Message-Weight: 4 X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 369357513 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spamchk fine tuning?
I just set up spamchk and was wondering if anyone can share some fine-tuning info with me? Updated keyword lists and such? I tried subscribing to their list but all I get back is an Invalid Syntax email from their mail server. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamchk fine tuning?
Markus wrote: hmm... I've tried to un- and the subscribe without any problem. Thats because you're using the link that works :-O. Go to the installation instructions here http://www.spamchk.com/modules.php?name=Newsfile=articlesid=2 And try the subscribe link on that page. You'll get a nastygram rather than a subscription :-). Just tried the link you sent and it gave me a different format. I'm sure thats the problem. Thx! -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamchk fine tuning?
A couple of posters offered some help on this, where I don't have the original messages (they're at home and I'm at work). The FP rate is fairly heavy on spamchk so far... including bagging about half of the traffic on this list today. I'm sure its something easily fixed. I'd love to see a config file AND see what exactly the penalty weight spots are so I can halve them (its not clear to me sometimes whether I'm looking at a penalty weight or a thresahold on some things). I understand nobody has perfect answers. Just looking for a leg up on the learning curve. Cheers, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ATTACH action question
I'm using the attach action rather than holding, bouncing etc. Every month I prepare a report for my customers that tells them how much mail got delivered, how much got blocked etc. If an item is given an ATTACH action, does Imail ever see it? Does Declude attach and deliver directly? Knowing this will make a big difference in my log analysis, which seems to show a big drop in mail that I can only explain if the answers to the above are No and Yes, respectively. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH action question
Thanks for the clarification, Scott. Cheers, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filtering on Imail spam tests
Nick wrote: Have you tried SPAMCHK? It takes some configging but for me at least it does a great job - and its free. http://www.spamchk.com Never heard of it, but you can bet I'm going to look it over very closely. Thanks for the tip! Cool site banner. --Matt-- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filtering on Imail spam tests
Nick wrote: These Imail tests occur *after* DJM has run? Yes. I wrote a ColdFusion program that converts the Imail files into Declude filter file and blacklist format, so I can run them from inside Declude as properly weighted tests. You're welcome to them if you can use CF. Cheers, --Matt Robertson-- MSB Designs, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filtering on Imail spam tests
I got the domain list to work fine as a blacklist, with performance times being acceptable at around 250ms for a complete run-thru of all of the 70-odd tests I run in Declude. I also turned it into a body filter file and it was absolutely stellar in its performance. Spam catching performance, that is. It was a disaster in terms of what it did to the server and I had to take it down after a day. Not a big surprise; running 17000 tests on the body of each mail piece. As soon as I can afford it I'm buying Message Sniffer. Running it as a trial, it proved itself to be an obvious winner. --Matt Robertson-- MSB Designs, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] EasyNet Replacements
My experience with NJABL has been its absolutely solid. Not maybe what others have had. Just my 0.02. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] @LINKED IPLINKED v1.0.2 - Great for scam detection
Marc Catuogno wrote: Wouldn't Whitelist Auth stop JMPro from testing outgoing mail? Unless I'm mistaken, whitelisting makes something automatically pass all tests. It doesn't prevent the tests from being run. Besides, the mailing is being generated by ColdFusion 4.5, which doesn't support SMTP AUTH. I have to allow the unauthenticated mail to come in via a whitelisted IP in Imail. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Get JM Pro to NOT scan outgoing mail?
Is there a way I can get JunkMail Pro to not scan outgoing mail? I've already commented out all of the outgoing actions, but I have a client that is a large association, and their outgoing mailers are kicking my server's butt. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] @LINKED IPLINKED v1.0.2 - Great for scam detection
John wrote: The problem with body filters is the big performance hit the server takes in high volumes setups. Comments? Or big filters. As an experiment I took the Imail domain blacklist (17000 entries) and turned it into a mongo BODY CONTAINS filter file. It worked magnificently. The flow of spam was choked almost to death. So was the server. Despite a strong dual-proc box with gobs of memory and moderate mail flow, I had to shut it off after 24 hours. The system was able to handle it until I had a client send out a big mailer of a few thousand individual mailpieces to their membership. Declude spawned a boatload of processes as it scanned all the outgoing mail and gagged the system. If there was a way for JMPro to NOT test outgoing mail that would be great. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
Mark wrote: Isn't the Imail URL Blacklist a list of url's that appear in spam email? You reference it in (2.) below as a sender blacklist. Yes. This converts those urls to a sender blacklist. So if the domain 'buymystuff.com' is in the Imail blacklist, the program converts that to '@buymystuff.com' and blocks mail coming from it. Its not perfect for obvious reasons, but so far my logs show it to be working surprisingly well. The phrase list is going like gangbusters as a filter file. Many more hits than the blacklist. The next thing I'm going to try is making the blacklist into a filter file, where if the domain is in the body of the message it gets dinged. This will be essentially the same behavior as Imail, I believe. Processing time will be the issue to watch on that one. I wonder, though, if I'm really losing any speed. I was doing this in Imail. Now I'm not, so have I just shifted load from something I couldn't effectively measure (Imail) to something I can (Declude)? Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How do you handle held messages??
Chuck, I recently moved to using Attach for spam that hasn't gotten to a delete weight yet. Sender is 'you have spam' and subject is the spam sender's address. This lets the user skim the mail and delete from the list without individual mailpiece scanning. Coupled to that are instructions that tell them how to move mail to folders inside of Outlook, Messenger etc. I thought I'd get complaints, but only a smattering so far. Within a couple of weeks I'll have time to set up an action to route to a specific mailbox, and charge a couple of bucks to set it up. I'm not fond of it but I've had specific requests for that. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blacklist format question
Is this the proper format for a blacklist entry in global.cfg (I use tabs in my actual file instead of spaces) I-BLACKLIST fromfile z:\blah\blah\i-bl.txt x 6 0 And inside that file, are these sample entries properly formatted? @05.pn01.com I-Blacklist @05vvec.gq.nu I-Blacklist @05world.co.kr I-Blacklist Just checking. I installed a new blacklist but it hasn't caught anything yet. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Imail blacklist, phrase list converter
I've written a ColdFusion program that converts Imail blacklist entries to Declude format. The same program takes the Imail phrase list and creates a Declude filter file, where the text of each line in the original file becomes a SUBJECT CONTAINS and BODY CONTAINS test. Don't know how many CF'ers there are out there. If you want a copy let me know. Suggestions for improvement gladly accepted. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
OK, give me a bit to spiff it up a bit. I'm going to add in the ability to download and unzip the source files from the Ipswitch site, and have it check a 'skip list' before adding domains, so you only have to remove unwanted blacklistings once. In response to another off-list query, I have averaged the performance I'm getting, and with logs set to 'debug' I averaged 245ms per mailpiece over several dozen receipts. No idea what it was before I added the phrase and black list checking. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
Scott, Can I set up a blacklist as follows, where the blacklisted url is also the url's description? I want to be able to see the failed url in the logs. @zthub.ct.flasail.com zthub.ct.flasail.com @zthub.oo.flasail.com zthub.oo.flasail.com @zthub.wc.flasail.com zthub.wc.flasail.com @ztjxr.ct.flasail.com ztjxr.ct.flasail.com If so, whats the char limit? Accepts special chars like % ? Thx, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Imail blacklist, phrase list converter
OK, I've completed what I suppose you could call the first version of my Imail-to-Declude black- and phrase-list converter. Get it here: http://foohbar.com/declude_importer.zip It turned into a complete ColdFusion application. The system will 1. Retrieve source files from ftp.ipswitch.com 2. Convert the url blacklist into a Declude sender blacklist (skipping any entries you have placed in a separate skip list) 3. Convert the phrase list into a Declude filter file. Filters will be created for matches in subject and body. 4. FTP the newly minted files to the location you specify. NOTES: a. All settings are made in application.cfm, including filter weights. b. You can use the browser interface (index.cfm) to run all tests in sequence automatically, or individually. c. Since they can be run individually, you can opt to schedule the files to run automatically. d. You have to set up global.cfg and $default$.junkmail to use the new tests and files. e. With these tests in place, all mail tests take about 250ms per email tested. However, this is on MY server with MY configuration. Your mileage may vary. f. On a very fast server (dual 2ghz xeon with gobs of ram, super-duper scsi) the download/conversion/upload process takes just under three minutes. Most of this is the processing of the 17,000-entry url blacklist. On a slow server, it takes a lot longer. External dependencies: 1. The app uses the pkzip Command Line tool to unzip the Imail source files. You can alter the batch file and import01.cfm to use whatever command line unzip program you use. 2. cf_ProgressMeter is used to display a progress bar. This is a $5 tool I *highly* recommend. If you don't own it or don't want to buy it just go in and remove the calls to it in import02.cfm and import03.cfm. I'm in the process of rolling out a new web site in the next couple of days. I'll add this and anything else useful I can think of in the spamfighting section. If anyone has improvements to this, please pass 'em on! Cheers, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Analogs to Imail stuff?
If you couldn't already tell, I'm phasing out my use of some of Imail's anti-spam features by moving them into Declude where they can be run more responsibly. What I want is for Declude to be on the front line, but have Imail bat cleanup if it can do things Declude can't. With that in mind, Imail has the ability to Verify MAIL FROM address Perform a RevDNS on the connecting mail server Verify HELO/EHLO and delete (only :( ) at a threshold I specify. I already use Declude for the reverse DNS. Can it do the other two somehow? If not, I'd be considering dropping the RevDNS test in Declude and running the Imail versions, with a delete if all three hit. Does this sound like a good, bad or awful idea? -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Opinions on web interface
Have you thought of giving users more control over the process? As in a db tie-in to tests, weights and actions? I use CF as well and I'm figuring on doing something that will allow enablement of a particular test, or its disablement, coupled to setting the test weight and action performed. Should be fairly simple to use cffile to write out a Declude file with the dangerous stuff hardcoded into it. Probably 30 days away from having the time to finally do it. I get customization requests daily from this or that user. Nobody wants the same thing. Frankly I'm sick of hearing it and am ready to turn the process over to the user and let them have at it if they want to be the antispam genius. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Do you use ColdFusion?
Ditto here. Solid as a rock if left in capable hands. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
OK, I did what John said last nite (with the logs set to 'high' and the spool name on) and what Scott said (use the interim release) this morning. Here's the log entry. I picked something going to me so I could say for sure it showed up in my inbox (it did, and it most definitely was spam). Set the logs to 'debug' and will follow up with a sample shortly. 11/05/2003 07:46:12 Q1ad9014900d05f2b Triggered CONTAINS filter GIBBERISHSUB on qr [weight-0; qr7]. 11/05/2003 07:46:12 Q1ad9014900d05f2b GIBBERISHSUB:3 NOABUSE:3 NOPOSTMASTER:3 REVDNS:5 . Total weight = 14 11/05/2003 07:46:12 Q1ad9014900d05f2b Using [incoming] CFG file C:\IMail\Declude\$default$.junkmail. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed GIBBERISHSUB (Message failed GIBBERISHSUB test (78)). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed IPNOTINMX (). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed REVDNS (This E-mail was sent from a MUA/MTA 221.196.22.47 with no reverse DNS entry.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/05/2003 07:46:12 Q1ad9014900d05f2b L1 Message OK 11/05/2003 07:46:12 Q1ad9014900d05f2b Subject: hello1nqr7 11/05/2003 07:46:12 Q1ad9014900d05f2b From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 221.196.22.47 ID: 11/05/2003 07:46:12 Q1ad9014900d05f2b Last action = IGNORE. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
I do have an external whitelist, but it consists of stuff like WHITELIST FROM @amazon.com WHITELIST FROM @ebay.com WHITELIST FROM @expedia.com And is a total of 22 entries long. Then I have AUTOWHITELIST ON so my users can make their own white lists. There are only two entries in my book (aliases.txt), and of course this is affecting everyone; not just me. Interestingly, there appears to be a blank line in my address book drop-down; both in the selector in the Compose window and in the addr book editor. I tried deleting it in the editor but no soap. Supposed to be there? The line -- which is on the first position in the webmail drop-down -- is not in the physical file. Looks like its built in to Imail's html select box for some reason. I also have WHITELIST AUTH set in global.cfg. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, November 05, 2003 8:27 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah. Look at last action, Ignore. Is there a White list anywhere that could affect that? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Robertson Sent: Wednesday, November 05, 2003 7:58 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah. OK, I did what John said last nite (with the logs set to 'high' and the spool name on) and what Scott said (use the interim release) this morning. Here's the log entry. I picked something going to me so I could say for sure it showed up in my inbox (it did, and it most definitely was spam). Set the logs to 'debug' and will follow up with a sample shortly. 11/05/2003 07:46:12 Q1ad9014900d05f2b Triggered CONTAINS filter GIBBERISHSUB on qr [weight-0; qr7]. 11/05/2003 07:46:12 Q1ad9014900d05f2b GIBBERISHSUB:3 NOABUSE:3 NOPOSTMASTER:3 REVDNS:5 . Total weight = 14 11/05/2003 07:46:12 Q1ad9014900d05f2b Using [incoming] CFG file C:\IMail\Declude\$default$.junkmail. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed GIBBERISHSUB (Message failed GIBBERISHSUB test (78)). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed IPNOTINMX (). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed REVDNS (This E-mail was sent from a MUA/MTA 221.196.22.47 with no reverse DNS entry.). Action=WARN. 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/05/2003 07:46:12 Q1ad9014900d05f2b L1 Message OK 11/05/2003 07:46:12 Q1ad9014900d05f2b Subject: hello1nqr7 11/05/2003 07:46:12 Q1ad9014900d05f2b From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 221.196.22.47 ID: 11/05/2003 07:46:12 Q1ad9014900d05f2b Last action = IGNORE. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
John wrote: Where was the message sent from? Various spammers all over the planet. Since this morning Scott and I have been trading detailed debug logs, and doing stuff to try to track this down. I had to sit back for a bit while a client of mine did a big mailer to their membership (I throttle down their mail xmit rate via ColdFusion, so the wait was awhile). Can't have a debug log when something like that is passing thru. Just got a reading and am passing it off to Scott. I did find that I had catchallmails enabled, although it wasn't actually doing anything. That may have been the problem. -- Original Message -- From: John Tolmachoff \(Lists\) [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 5 Nov 2003 13:02:04 -0800 I also have WHITELIST AUTH set in global.cfg. Time for a DEBUG log. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ATTACH Still not working. Bah.
John wrote: BTW, the catchallmails has called other problems before. I'm not surprised. I had no idea I was running it. Must've del'd the comment by accident as I've never used the thing. Easy to fix. Unfortunately a short time after I received more of the same, so that wasn't it. :-( -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Action=ATTACH. What am I missing?
OK, I just confirmed that a test I had set to ATTACH (I have Pro) is doing nothing. I have a spamattach.eml in the /declude/ folder, and it is identical to the Declude.com download. I have this in my $default$.junkmail: WEIGHT1319 ATTACH That test is a weight range test that formerly was WEIGHT1319 BOUNCE There is this entry in my Declude log (this was a false positive). It looks like everything is working, but neither I nor anyone else is getting the mail. The imail log is devoid of this sender. Anyone have any ideas as to whats going on? Could Imail's antispam be involved? 11/04/2003 09:14:33 Qde5a001e008e4e8b BADHEADERS:8 REVDNS:5 . Total weight = 13 11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed BADHEADERS (This E-mail was sent from a broken mail client [802c].). Action=WARN. 11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed IPNOTINMX (). Action=WARN. 11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed REVDNS (This E-mail was sent from a MUA/MTA 65.222.115.28 with no reverse DNS entry.). Action=WARN. 11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/04/2003 09:14:33 Qde5a001e008e4e8b L1 Message OK 11/04/2003 09:14:33 Qde5a001e008e4e8b Subject: 11/04/2003 09:14:33 Qde5a001e008e4e8b From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 65.222.115.28 ID: --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Action=ATTACH. What am I missing?
Scott wrote: Does the first line begin with Message-ID:? If not, IE destroyed the file -- in that case, you can right-click the link and choose Save Target As to get the proper file. Cowabunga. Did as suggested and got quite a different file. Thanks! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ATTACH Still not working. Bah.
Per Scott's earlier suggestion I fixed the spamattach.eml. I've gotten three of these in the last several minutes: a completely intact spam with no sign of Declude acting on it except for the headers (below). No proper 'you've got spam' attachment msgs rcvd yet The WEIGHT1319 test is a weight range test that is set to an action of ATTACH. The other tests failed are all set to WARN. As you can see weight was 14; one *over* the trip limit, so this pup should have been worked into an attachment. What am I doing wrong? X-IMAIL-SPAM-VALFROM: (23724132) X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-RBL-Warning: HELOBOGUS: Domain hcimail2.hostcentric.net has no MX or A records. X-RBL-Warning: HEUR10: Heuristic spam detection level 10 [1.00] X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-Declude-Sender: [EMAIL PROTECTED] [216.65.31.208] X-Note: This E-mail was sent from hcimail2.hostcentric.net ([216.65.31.208]). X-Note: This E-mail was scanned by MSB Designs Inc. Anti-Spam Services. X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, HELOBOGUS, HEUR10, IPNOTINMX, NOLEGITCONTENT, WEIGHT1319 X-Spam-Message-Weight: 14 X-RCPT-TO: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
What version of Declude? 1.76b. Downloaded it yesterday. What does the log show? See below for the latest arrival in my inbox. Included are the headers, plus Declude and Imail logs; the latter of which looks pretty normal. If I switch back to bounce they bounce as expected. Complete headers from the mailpiece: Received: from hcimail2.hostcentric.net [216.65.31.208] by msb1.mysecretbase.net with ESMTP (SMTPD32-8.02) id AFC224F002A; Tue, 04 Nov 2003 13:53:06 -0800 Received: from SMTP32-FWD by msbdesigns.com (SMTP32) id A04F4; Tue, 4 Nov 2003 16:45:45 -0500 Received: from 200-208-213-20.papalegua.com.br [200.208.213.20] by hcimail2.hostcentric.net (SMTPD32-7.15) id AE07FBF00E8; Tue, 04 Nov 2003 16:45:43 -0500 Message-ID: [EMAIL PROTECTED] From: Garry Glover [EMAIL PROTECTED] Reply-To: Garry Glover [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Fwd: attention free great offer hxx e ohzsrh Date: Tue, 04 Nov 2003 23:40:03 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=B1DEFA..910.54 X-IMAIL-SPAM-VALFROM: (38731818) X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-RBL-Warning: HELOBOGUS: Domain hcimail2.hostcentric.net has no MX or A records. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63. X-Declude-Sender: [EMAIL PROTECTED] [216.65.31.208] X-Note: This E-mail was sent from hcimail2.hostcentric.net ([216.65.31.208]). X-Note: This E-mail was scanned by MSB Designs Inc. Anti-Spam Services. X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, SNIFFER, WEIGHT1319 X-Spam-Message-Weight: 18 X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 366233215 DECLUDE LOG: --- 11/04/2003 13:54:02 Q1fc2024f002acd29 NOABUSE:3 NOPOSTMASTER:3 HELOBOGUS:5 SNIFFER:7 . Total weight = 18 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOPOSTMASTER (Not supporting [EMAIL PROTECTED]). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed HELOBOGUS (Domain hcimail2.hostcentric.net has no MX or A records.). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed IPNOTINMX (). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed SNIFFER (Message failed SNIFFER: 63.). Action=WARN. 11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=ATTACH. 11/04/2003 13:54:02 Q1fc2024f002acd29 L1 Message OK 11/04/2003 13:54:02 Q1fc2024f002acd29 Subject: Fwd: attention free great offer hxx e ohzsrh 11/04/2003 13:54:02 Q1fc2024f002acd29 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 216.65.31.208 ID: A04F4 IMAIL LOG: - 11:04 13:53 SMTPD(024F002A) [216.198.221.162] connect 216.65.31.208 port 3718 11:04 13:53 SMTPD(024F002A) [216.65.31.208] EHLO hcimail2.hostcentric.net 11:04 13:53 SMTPD(024F002A) [216.65.31.208] MAIL FROM:[EMAIL PROTECTED] 11:04 13:53 SMTPD(024F002A) [216.65.31.208] RCPT To:[EMAIL PROTECTED] 11:04 13:53 SMTPD(024F002A) [216.65.31.208] C:\IMail\spool\D1fc2024f002acd29.SMD 2820 11:04 13:53 SMTPD(024F002A) performing antispam checks 11:04 13:54 SMTP-(111C00F1) processing C:\IMail\spool\Q1fc2024f002acd29.SMD 11:04 13:54 SMTP-(111C00F1) ldeliver mysecretbase.com matt-main (1) [EMAIL PROTECTED] 3551 11:04 13:54 SMTP-(111C00F1) finished C:\IMail\spool\Q1fc2024f002acd29.SMD status=1 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
Yup. Pro Registered jm and std reg virus. Here's the text from the spamattach email. Message-ID: [EMAIL PROTECTED] From: Declude JunkMail [EMAIL PROTECTED] To: %ALLRECIPS% Subject: You have spam Date: %RFCDATETIME% MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=%RANDOMSTRING% This is a multi-part message in MIME format. --%RANDOMSTRING% Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit You have spam! Subject:%SUBJECT% From: %MAILFROM% Tests Failed: %TESTSFAILED% To view the E-mail, just click the attachment. --%RANDOMSTRING% Content-Type: message/rfc822; name=spam.eml Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=spam.eml --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
Paul wrote: How can it be OK and failing at the same time?? Am I misreading something here? No, you aren't missing anything. This isn't supposed to happen. ere's a msg from 11/2, a couple of days ago. This one was a bounce as expected. The only real difference is that in $default$.junkmail the test is set to ATTACH instead of BOUNCE. I'm setting it back to bounce again to see what happens. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 CBL:6 SDERB:3 SPAMCOP:6 . Total weight = 15 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed CBL (Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=62.204.117.193). Action=WARN. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed SDERB (Usenet Message-ID spam source, see URL:http://www.msgid.bl.gweep.ca/.). Action=WARN. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed SPAMCOP (Blocked - see http://www.spamcop.net/bl.shtml?62.204.117.193). Action=WARN. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed IPNOTINMX (). Action=WARN. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed WEIGHT1319 (Total weight between 13 and 19.). Action=BOUNCE. 11/02/2003 00:16:12 Qbd3d0d5500eaf766 Subject: buy vicdoin at homexyxc4j 11/02/2003 00:16:12 Qbd3d0d5500eaf766 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 62.204.117.193 ID: --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ATTACH Still not working. Bah.
I wrote: I'm setting it back to bounce again to see what happens. I did and its back to normal log entries and behavior using 1.79b -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WhiteList option questions
Just upgrading Declude after a fair amount of time. The docs say that the white list file should go into $default$.junkmail. Just wanted to confirm it goes there and not global.cfg. The autowhitelist feature is a godsend. Finally a way to allow clients to manage their own whitelists without me having to write a front end. Is there a downside to whitelist auth? Seems like its purpose is to ensure mail that originates from my server gets delivered to recipients on that same server. Cheers, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Alligate for Declude?
I just signed up for the 30-day trial for Alligate (as a Declude add-in). I'm stopping more spam but the volume is so great that I need some outside help. Imail's anti-spam system is so full of holes I've had to emasculate the thing. What was once a 25% effective rate (i.e. whacks 25% of the mail still around after Declude) is now down to 14%. Anyone have any thoughts on their false positive rate? The service in general? If Alligate flags it how certain should I be that its spam? Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Message Sniifer
Fred wrote: I have been using it for over a year. How do you update it? Is it an automated process? How frequent are the updates? Their site says the system is updated several times a day and, in another area, that updates are emailed. No specifics that I saw, but I didn't scour the site, exactly. Does anyone have the experience to make a comparison between Message Sniffer and Alligate? Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ImageFX Kill List
Title: Message I just checked mine. No entries dated after 8/25. It still caught almost 1 spams between the two lists in September so far. What a bummer. Replacemenst? Matt Robertson [EMAIL PROTECTED]MSB Designs, Inc. http://mysecretbase.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharyn SchmidtSent: Monday, September 29, 2003 4:45 AMTo: Declude Junkmail ListSubject: [Declude.JunkMail] ImageFX Kill List Morning, I know this was sorta mentioned briefly a few weeks ago but I don't think we ever heard from Tom. Is this file not being updated anymore? Thanks, Sharyn
RE: [Declude.JunkMail] Spam lists
Dave Marchette wrote: Sawmill seems enthusiastic snip I use Sawmill to analyze both Imail and Declude logs. The author, Greg Ferrar, is very responsive to adding log formats. I'm not sure how he is about custom test types, though. Can't hurt to ask. Especially if a lot of us are users and approach him. If he can do it I'd certainly pay for an upgrade to my ISP copy. If there's enough of us, mebbe we can pool our wish list and make a group request? No idea how many of us here use Sawmill. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SORBS-SPAM
Keith wrote: Would you post your configuration that works for you? and anyone else that's willing to do so? I'd like to see some examples of successful configurations to learn from. Here's mine. Weights 0-12 are OK, weights 13-19 get bounced and 20+ gets deleted. Neither bounces nor deletes should be done without understanding *exactly* what the consequences are. While I get awfully close to zero false positives, I also wind up bouncing about 20% of the stuff declude bags. That works out to about 11000 bounce messages last month. Maybe a dozen actully reached a person. However those dozen would be angry customers wondering why their mail got deleted. Instead the bounce becomes a positive customer service. I need to experiment and see how many items hit weight 18, 17, 16 etc. to see if I can cut down on the bounces safely. I'll bet I can. You can see my latest stats here: http://mysecretbase.com/mailsystem.html. I also wrote up how the system works for customer information. What I'm describing is Declude Virus, Declude Junkmail and Imail 8 anti-spam working together. Hope this helps, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com BLITZEDALL ip4ropm.blitzed.org * 2 0 CBL ip4rcbl.abuseat.org 127.0.0.2 3 0 COMPU ip4rblackhole.compu.net 127.0.0.4 3 0 DORKS ip4rorbs.dorkslayers.com127.0.0.2 5 DSBLip4rlist.dsbl.org * 5 0 EASYNET-DNSBL ip4rblackholes.easynet.nl 127.0.0.2 5 0 EASYNET-PROXIES ip4rproxies.blackholes.easynet.nl * 2 0 FABEL ip4rspamsources.fabel.dk* 2 0 FIVETEN-SRC ip4rblackholes.five-ten-sg.com 127.0.0.2 2 0 FIVETEN-SPAMSUP ip4rblackholes.five-ten-sg.com 127.0.0.7 2 0 FIVETEN-MISCip4rblackholes.five-ten-sg.com 127.0.0.9 2 0 FIVETEN-FREEip4rblackholes.five-ten-sg.com 127.0.0.12 2 0 INTERSILip4rblackholes.intersil.net 127.0.0.2 5 0 IPWHOIS ip4ripwhois.rfc-ignorant.org127.0.0.6 3 0 LNSGSRC ip4rspamguard.leadmon.net 127.0.0.3 3 0 LNSGBULKip4rspamguard.leadmon.net 127.0.0.4 3 0 LNSGOR ip4rspamguard.leadmon.net 127.0.0.5 3 0 LNSGMULTI ip4rspamguard.leadmon.net 127.0.0.6 3 0 LNSGBLOCK ip4rspamguard.leadmon.net 127.0.0.7 3 0 MONKEYFORMMAIL ip4rformmail.relays.monkeys.com * 3 0 MONKEYPROXIES ip4rproxies.relays.monkeys.com * 3 0 NJABL ip4rdnsbl.njabl.org 127.0.0.2 10 0 NJABLDULip4rdnsbl.njabl.org 127.0.0.3 50 0 ORDBip4rrelays.ordb.org * 5 0 SBL ip4rsbl.spamhaus.org127.0.0.2 10 0 SORBS-HTTP ip4rdnsbl.sorbs.net 127.0.0.2 5 0 SORBS-SOCKS ip4rdnsbl.sorbs.net 127.0.0.3 5 0 SORBS-MISC ip4rdnsbl.sorbs.net 127.0.0.4 5 0 SORBS-SMTP ip4rdnsbl.sorbs.net 127.0.0.5 5 0 SORBS-SPAM ip4rdnsbl.sorbs.net 127.0.0.6 5 0 SORBS-WEB ip4rdnsbl.sorbs.net 127.0.0.7 5 0 SORBS-BLOCK ip4rdnsbl.sorbs.net 127.0.0.8 5 0 SORBS-ZOMBIEip4rdnsbl.sorbs.net 127.0.0.9 10 0 SORBS-BADCONF ip4rdnsbl.sorbs.net 127.0.0.11 3 0 SORBS-NOMAILip4rdnsbl.sorbs.net 127.0.0.12 3 0 SPAMBAG ip4rblacklist.spambag.org * 10 0 SPAMCOP ip4rbl.spamcop.net 127.0.0.2 10 0 UCEBip4rblackholes.uceb.org * 10 0 VOX ip4rvox.schpider.com127.0.0.2 3 0 WIREHUB-DNSBL ip4rblackholes.wirehub.net 127.0.0.2 5 0 YBL ip4rybl.megacity.org127.0.0.2 5 0 DSN rhsbl dsn.rfc-ignorant.org127.0.0.2 5 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 3 0 NOPOSTMASTERrhsbl postmaster.rfc-ignorant.org 127.0.0.3 3 0 SECURITYSAGErhsbl blackhole.securitysage.com * 5 0 MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 5 0 MAILPOLICE-PORN rhsbl porn.rhs.mailpolice.com 127.0.0.2 5 0 BADHEADERS badheaders x x 8 0 HELOBOGUS helovalid x x 5 0 HEUR10 heuristics 10
RE: [Declude.JunkMail] SORBS-SPAM
Phillip wrote: Two words: pink contracts 9 syllables: what the heck are you talking about? I've had nightmares setting up PacBell/SBC DSL that would fill a book, but that was incompetent tech installation and support. Once the service is up its always been just great; for years running. And besides, here in central California you either work with SBC or you work with someone who is leasing from them. Wazzup? Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SORBS-SPAM
Keith wrote: I plugged pink contracts into Google and here's the first link that came up... Well, doesn't that just suck? Hopefully the 2001 date on that post is indicative of a changed landscape, otherwise they're pretty much *all* in league with the devil. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Sobig Assault
Greg wrote I've found that they really don't want to see them at all. I get that a lot myself. However the notices also tell them my value-added service is diligently doing its job. If I don't remind them why they're paying me, they might forget :D With that said, enough is enough. Skipifvirusnamehas went in for sobig midday yesterday. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks Sent: Thursday, August 21, 2003 10:24 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Sobig Assault I've removed my notice .eml template to users... Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Malcolm Kynoch Sent: Thursday, August 21, 2003 1:12 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Sobig Assault Hi, Many of our users are getting plowed by Sobig, Declude and Fprot do there job well, but the users mailbox is getting clogged with the notices of detection. Is there a way to turn off notices for a particular virus? For now I've removed the mail templates. Any ideas? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Interesting spam...
Yes, I got one of those personally. Incredibly cheeky, but no doubt there are people dumb enough to fall for it. If there weren't, we wouldn't still be getting those Nigerian scams. Got one of those yesterday, too. Visited their web site (which offers English and Russian language versions) and they have a not-too-convincing disclaimer saying they had nothing to do with the spam. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Virus Pro and Fprot (DOS)
I've always wondered about this. So how do you desensitize Outlook? i.e. tell it not to break apart attachments as John posted? Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Virus Pro and Fprot (DOS)
Interesting. I've been using email since FidoNet but never messed with that. Ignorance truly is bliss :D So, since I can't find this setting in Outlook XP I'm going to assume its due to an old copy of Outlook 97 or somesuch. Or am I wrong about that? --Matt-- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New spamcop style RBL..
Jason, The mechanism is perhaps there since user-specific ip4r lookups are in place, but this may be a one-way identifier. The implication is they do not, imho, based on their site's overview text. The only way to tell is to individually evaluate email messages, or ask them directly :( Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New spamcop style RBL..
I do a ROUTETO with no problems. At their request I sent them instructions for config'ing Imail 8 and Declude. So if they get put up and they're wrong its probably my fault :D Here's what I sent them: Here is the Imail 8 mail server configuration info: --- 1. Choose the AntiSpam folder for the domain that you want to bounce spam to Trustic 2. Click the Content Filtering tab. 3. For Statistical and Phrase Filtering (assuming they are enabled) set the Action to Forward To and the action address as your Trustic account bounce address. 4. Click Apply. 5. Click the Content Filtering (HTML) tab. 6. For Feature Filtering and URL Domain Black List (assuming they are enabled) set the Action to Forward To and the action address as your Trustic account bounce address. 7. Click Apply. 8. Stop and restart your Imail smtp service. You may need to do this from the Windows control panel Services applet after closing Imail Administrator for the changes to take immediate effect. Here is the Declude configuration info (Declude is a very common Imail anti-spam add-in). -- 1. In the Declude Global.cfg file, create a new ip4r test. For example: TRUSTIC ip4r XXX-X.query.trustic.com * 0 0 Replace the 'X' values with your Trustic account number. This will set up Trustic with a tentative weight of zero. After reviewing the results to ensure they are satisfactory change the first zero to the weight of your choice. 2. To send Trustic your (confirmed!) spam (typically only that which has received very heavy weighting and you are certain contains no false positives) Use the ROUTETO command in your $default$.junkmail file. For example, if ordinarily you have a WEIGHT30 test that deletes the message, i.e. WEIGHT30 DELETE Change it to WEIGHT30 ROUTETO [EMAIL PROTECTED] Where again you replace the 'X' values with your Trustic account number -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Newland Sent: Monday, July 28, 2003 9:05 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] New spamcop style RBL.. has anyone been able to auto-send them your held spam? I have tried using the ROUTETO command, but I get an error when I use the forward address, and an error when I use the bounce address. Can anyone shed some light on the proper way to send them the held e-mails for submission? Thanks Jason - Original Message - From: Matt Robertson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, July 28, 2003 10:42 AM Subject: RE: [Declude.JunkMail] New spamcop style RBL.. As a followup on this, I've been told by Trustic that they are considering discontinuing the use of the positive ip4r test. After about 12 hours of using the proper ip4r test I'm seeing only negative entries, which is what I should be seeing. At the moment I'm sending them all of my super-heavyweight Declude spam that I know isn't a false positive, plus my Imail spam stuff where, again, I know I've got as close to a perfect track record as I can get. Haven't had the chance to look at the logs yet to see what their test is picking up. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New spamcop style RBL..
I've just started forwarding spam to them, but only the stuff that comes in from Imail's content filtering, which is basically just sweeping up after Declude (and it STILL bags about 10% of the survivors!). One thing I was REALLY not happy about was their method of adding default positives (i.e. the originally posted test). Basically if no one has said anything bad about a server it gets an automatic positive. I plugged this into Declude and gave a blast of positives -- all to spam that apparently hadn't made it into their system yet. By the time I got it shut off I'd given out 47 'false' positives. That's not very smart logic and a great way to loosen up your spam rules. Much smarter to control the trusted entries yourself via other means (i.e. Declude whitelist or make your own trusted whitelist in Declude with a negative weight). It seems to me that, with this system at least, what you want to do is 1. Stay MILES away from that auto-positive list to prevent weighting spammer IPs as valid. 2. Forward spam to your account's Trustic bounce address. Put up with the validation messages for a day or so and then let the thing run on its own. 3. Att a test into Declude for the Trustic NEG list. Weight it zero or light until it proves itself. 4. Stay MILES away from that auto-positive list to prevent weighting spammer IPs as valid. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New spamcop style RBL..
I just verified a piece of spam that originated from a dialup IP. Now its in my list and I see Trustic has listed that IP as a trusted server... Its loaded with automatic recommendations from that stupid auto-positive list. In fact the last four spams come from servers marked as 'Trusted'. Looks like the people using automatic whitelisting are overwhelming the blacklisters who actually send mail... A losing battle. ESPECIALLY since I had Declude ROUTETO my high-weight spam to my Trustic bounce address... Where it promptly gave them all positive recommendations until I got it shut off. Beta indeed. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky Sent: Sunday, July 27, 2003 10:54 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] New spamcop style RBL.. - Original Message - From: Matt Robertson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, July 27, 2003 1:35 PM Subject: RE: [Declude.JunkMail] New spamcop style RBL.. One thing I was REALLY not happy about was their method of adding default positives (i.e. the originally posted test). Basically if no one has said anything bad about a server it gets an automatic positive. I plugged this into Declude and gave a blast of positives -- all to spam that apparently hadn't made it into their system yet. By the time I got it shut off I'd given out 47 'false' positives. That's not very smart logic and a great way to loosen up your spam rules. Much smarter to control the trusted entries yourself via other means (i.e. Declude whitelist or make your own trusted whitelist in Declude with a negative weight). You can use the DNS entry that doesn't have POS- on the front and you won't give positives for mail servers that haven't been seen by Trustic before. I am going to suggest to them that there be a neutral setting. I understand they want to build a very complete list of mail servers so admins can take responsibility for their servers. If new servers were added as neutral then they would get a good list of lots of servers and weighting wouldn't be affected. Would also be nice if they gave one result for bad (which they do 127.0.0.2) and another result for positive and yet another for trusted positive. Then I could give positive weights for trusted positives and take away spam points from servers I say are good. -Josh --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New spamcop style RBL..
*I* manually marked them as negatives, and my one manual entry showed up as such correctly But that IP had four more entries showing the automated 'default positive' entries, and apparently that was enough to get this dialup IP listed as 'trusted' within the system... And as I noted its not alone. Yes, I know the address submission is *supposed* to give only negatives, but I got something like 8 positives in before I shut it off (They got plus signs). I keep my Declude entries set to Verbose so I can follow what gets sent out and see what it wound up being when it arrives at Trustic. Mail volume is low today so I can follow along pretty closely. I'd leave this service alone for awhile so they can get their act together. They may call this a beta but it looks like it should still be an alpha. That method of auto-whitelisting is clearly something that wasn't thought through. All you have to do is look at a Trustic log and check out all the 'trusted' dialup and broadband IPs to see that. Sorry to sound so negative, but its just really a frustrating lesson in what happens when I don't think stuff through. The 'positive' list method of theirs is so deeply flawed its hard to see how anyone could put something like that out on the market... Automatically giving positive entries just because something isn't in a blacklist yet. How ridiculous. Most of the anti-spam battle is about discovering new IPs every day, and those IPs will change tomorrow. All their system will do is get server admins to let spam through. Could that have been the idea in the first place? Who knows anything about these guys? Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky Sent: Sunday, July 27, 2003 12:32 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] New spamcop style RBL.. - Original Message - From: Matt Robertson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, July 27, 2003 2:44 PM Subject: RE: [Declude.JunkMail] New spamcop style RBL.. I just verified a piece of spam that originated from a dialup IP. Now its in my list and I see Trustic has listed that IP as a trusted server... Its loaded with automatic recommendations from that stupid auto-positive list. In fact the last four spams come from servers marked as 'Trusted'. Looks like the people using automatic whitelisting are overwhelming the blacklisters who actually send mail... A losing battle. ESPECIALLY since I had Declude ROUTETO my high-weight spam to my Trustic bounce address... Where it promptly gave them all positive recommendations until I got it shut off. It's marked trusted but is it trusted and there is a negative on the left or is it trusted and there is a positive on the left? (In the first column there are plus signs and minus signs.) Also the email address submission only gives negatives... no positives not sure how you could ROUTETO and have positives as a result. -Josh --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New spamcop style RBL..
Omar K. wrote: Indeed, I think you should forward your legit concerns to them if you truly want to make a positive difference. It was precisely the desire to make a positive difference that motivated me to describe my experience to the list. For my part I appreciate it if an early adopter subs his/her toe and warns me about it before I go off and waste my own time making the same mistake. I know what you meant was for me to provide feedback to the trustic people, and I've done that as well. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Omar K. Sent: Sunday, July 27, 2003 2:56 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] New spamcop style RBL.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky Sent: Sunday, July 27, 2003 10:32 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] New spamcop style RBL.. - Original Message - From: Matt Robertson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, July 27, 2003 4:08 PM Subject: RE: [Declude.JunkMail] New spamcop style RBL.. Could that have been the idea in the first place? Who knows anything about these guys? While I can only speak of how I have interacted with them. (I have had a positive experience.) I have to say that your last sentence is just meant to slander them through the implication that they aren't legit. If you look at http://www.trustic.com/about/management you will see they have a real brain on their management team. Mark Fletcher is a smart guy, and a legitimate guy. You shouldn't say something like that last sentence to back up your argument that the service is Beta. It just weakens every point you put in your emails prior to that. -Josh --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New spamcop style RBL..
I can understand how you'd be defensive since you recommended them to the list, but this has nothing to do with sentiment and everything to do with empirical observation of specific results. I'm sorry you feel the way you do, but don't bandy about words like 'slander' when clearly they don't belong in the conversation. The following servers are trusted by Trustic. I only used tested this service for about 1 1/2 hours so I have a pretty short list (90 entries, 47 of which were slammed in via their automated positive procedure). If I had the time to waste I'd go thru the whole list and I'm sure I'd find more jewels. I pulled these out of just the first two screens: 63.149.203.45 5 automated positive recommendations and a trusted server. But here they're listed on THIRTEEN separate lines http://www.dnsstuff.com/tools/ip4r.ch?ip=63.149.203.45 pd9eb978c.dip.t-dialin.net (217.235.151.140) http://www.dnsstuff.com/tools/ip4r.ch?ip=217.235.151.140 Dial-in, huh? Quite a list on the other spam services. Trustic lists them as trusted. user-0can757.cable.mindspring.com (24.171.156.167) another home cable modem listed like crazy but trusted at trustic http://www.dnsstuff.com/tools/ip4r.ch?ip=24.171.156.167 61.99.1.113 same story here http://www.dnsstuff.com/tools/ip4r.ch?ip=61.99.1.113 pcp03063004pcs.newlaf01.mi.comcast.net ( 68.41.175.131 ) home dsl cable IP pcp515079pcs.nash01.tn.comcast.net ( 68.53.145.237 ) home dsl cable IP d.hm02.com ( 207.158.1.214 ) 4 positive *automated* entries, but listed in SpamCop and sent me spam mm12.metamailoffers.com ( 207.134.3.243 ) read the domain name. Wonder what they do. They also have two automated favorable positives user-0can757.cable.mindspring.com ( 24.171.156.167 ) another home dsl service with an automated positive and trusted status. mtiwmhc14.worldnet.att.net ( 204.127.131.114 ) This one sent me 3 spams directly today. Then a 4th came thru relayed by another server thru this one. Trustic's system gives only the last IP a minus rating and all previous ones a positive, so *I* gave it an automatic positive the fourth time it spammed me. What does it all mean? First of all I don't care how smart the guy is who founded this system. Trustic as it presently performs doesn't belong in my production environment, which the Trustic people are up front about, at least (betas after all should be used only in development and staging environments). From what I can see the system should be labeled more of a public alpha, rather than a beta. It has holes which you can drive a mail truck through. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New spamcop style RBL..
http://www.trustic.com/ip?ip=63.149.203.45+ You were one of the positives and you didn't bother to submit spam to make it not trusted. Wrong repeatedly. I sent spam to them as I've already said. All of it at one point. As you later note this is becoming a pi$$ing match and that doesn't belong here. This is a technical discussion and lets keep it that way. Part of what is now clearly confusion here stemmed from the (your?) original recommendation to use the pos ip4r test. A careful reading of the Trustic DNS Query information shows this to be the opposite of what you're supposed to do. My fault for not reading the docs carefully and pulling code out of a list message. If you follow the path of the mail when using that test coupled to a mail filter program like Declude you'll see that mail gets counted twice, assuming you use ROUTETO to send spam back to Trustic. Perhaps when using the proper ip4r test the system isn't so screwed up. Was it you who recommended the pos ip4r test for use with Declude? Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Imail v6 and Windows Update
Jeff Maze wrote: Version 6 works just fine for what we use it for and don't need to spend the $1500 Who told you US$1500? That's the full price. Ipswitch charges US$495 for the upgrade if you buy it directly from them. I went to CDW and got mine for US$349. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] My February Spam Stats So Far
Just in case anyone is interested, I pulled my Top Tests report for the month so far and got this. FYI 1. I use Sawmill to get the info. 2. Weight13 is my trigger weight test 3. delogfile and delogdaily are the blacklists made available from the delog guy. A wonderful and appreciated resource. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com Rank Name Bagged --- 1 WEIGHT13 52,316 2 WIREHUB-DNSBL 37,318 3 SPAMCOP34,308 4 DELOGFILE 25,171 5 NOPOSTMASTER 19,349 6 REVDNS 18,850 7 SBL17,705 8 OSSRC 17,540 9 BADHEADERS 17,422 10OSSOFT 17,059 11DSBL 14,983 12NOABUSE13,680 13INTERSIL 13,610 14HELOBOGUS 12,716 15SORBS-HTTP 9,742 16SPAMHEADERS 6,614 17ROUTING 5,345 18OSPROXY 4,935 19SORBS-SOCKS 4,581 20DSN 4,542 21NJABL 3,892 22OSRELAY 2,528 23COMPU 2,147 24ORDB1,907 25MAILFROM1,471 26DORKS 861 27DELOGDAILY841 28NJABLDUL 805 29OSDIPS507 30SORBS-SPAM437 31SORBS-MISC268 32OSLIST 28 33SORBS-SMTP 5 Total 363,483 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] My February Spam Stats So Far
Sawmill processes logs... Get it? Logs... Hey, I didn't make that up, their marketing guys did. http://sawmill.net. I use it to process my Imail, Declude, web and ColdFusion logs. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Monday, February 24, 2003 2:53 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] My February Spam Stats So Far Hi, Matt, What is Sawmill? Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: Matt Robertson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, February 24, 2003 5:47 PM Subject: [Declude.JunkMail] My February Spam Stats So Far Just in case anyone is interested, I pulled my Top Tests report for the month so far and got this. FYI 1. I use Sawmill to get the info. 2. Weight13 is my trigger weight test 3. delogfile and delogdaily are the blacklists made available from the delog guy. A wonderful and appreciated resource. Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com Rank Name Bagged --- 1 WEIGHT13 52,316 2 WIREHUB-DNSBL 37,318 3 SPAMCOP34,308 4 DELOGFILE 25,171 5 NOPOSTMASTER 19,349 6 REVDNS 18,850 7 SBL17,705 8 OSSRC 17,540 9 BADHEADERS 17,422 10OSSOFT 17,059 11DSBL 14,983 12NOABUSE13,680 13INTERSIL 13,610 14HELOBOGUS 12,716 15SORBS-HTTP 9,742 16SPAMHEADERS 6,614 17ROUTING 5,345 18OSPROXY 4,935 19SORBS-SOCKS 4,581 20DSN 4,542 21NJABL 3,892 22OSRELAY 2,528 23COMPU 2,147 24ORDB1,907 25MAILFROM1,471 26DORKS 861 27DELOGDAILY841 28NJABLDUL 805 29OSDIPS507 30SORBS-SPAM437 31SORBS-MISC268 32OSLIST 28 33SORBS-SMTP 5 Total 363,483 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. This E-mail is scanned and free from viruses. www.nexustechgroup.com This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] f-prot
IMHO you'd be hard pressed to beat f-prot on the server or desktop. I found it to eat fewer resources than the competitors I tested, and so far after maybe a year of using it with Declude it has a 100% success rate in stopping email virii. Gotta love the ability to check for updates at very close intervals. I use 6 hrs. A client of mine uses Norton and it won't check any sooner than once every 15 days. Nice of them to shepherd their server resources like that. An then there's the price... US$40 for 20 computers... can't beat it. --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- Is anyone using f-prot with Imail and Declude ?? I'm presently using Mcafee net shield but I am always looking for alternatives ... TIA Doris --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] how much is junk?
About 35-50%. I'm a very small ISP with about 30 domains and 3000-4000 daily messages. --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- Original Message -- From: Koree A. Smith [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Thu, 13 Feb 2003 14:17:52 -0600 I see around the same amount. Sometimes as much as 98%. I'd say probably 2% of that mail is legit mail that is accidentally caught... Koree Kami Razvan wrote: I read a statistics a month ago... More than 92% of all email in the world is SPAM. So go figure... Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of paul Sent: Thursday, February 13, 2003 2:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] how much is junk? Ok guys, what do you see in ratio of junk vs good mail per day? Do you get more junk than legit? Here I notice we're killing more than 50% of incoming mail. Average messages processed per day range from 13K to 23K. Using the log analyzer I found that January we processed 615,082 messages, and 53% we deleted by Declude, that's alot! Granted, near daily updates to my kill file and filters help boost the number. Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] AOL problem or mine?
This is being discussed on the CF-Talk list as well. Started up yesterday, I believe. Someone on that list got hold of an AOL admin (as if there really are any) and posted this: | I called AOL and their tech advised me to make RDNS entries | for every domain then wait 24 hours and try again --- Matt Robertson, MSB Designs, Inc. http://mysecretbase.com - Retail http://foohbar.org - ColdFusion Tools --- -- Original Message -- From: Dustin Freeman [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Thu, 19 Dec 2002 14:43:33 -0500 Has anyone been having trouble with sending to AOL? I have a lot of users calling because messages to AOL.COM or CS.COM keep getting returned after 3 attempts. It has just started in the last few days. We aren't on AOL's blacklist. I posted this on the Imail list but so far nothing has helped. I seem to get an answer I understand better here usually anyway. Dustin --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] An optional web interface for Declude JunkMail?
If I could give users granular control over their own spam settings, that would get me off the hook for doing it for them. What you're describing, though, sounds almighty complex. On the surface (admittedly :D) It would be fairly straightforward to write in ColdFusion, if all we're talking about is modifying a user's config file. Maybe a reduced feature set and price (a Lite) that just deals with basic per user or per domain settings? Always wanted to do this but never had the time to spare. How much $$$ are we talking about? That'd be the kicker. --- Matt Robertson, MSB Designs, Inc. http://mysecretbase.com - Retail http://foohbar.org - ColdFusion Tools --- -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Mon, 16 Dec 2002 19:49:40 -0500 A lot of our customers seem to want a web interface to Declude JunkMail, mostly so that customers can turn their spam settings on or off. We haven't come up with something in the past, because it is very complicated without a hook into web messaging, and it doesn't look like Ipswitch is planning to add an interface to web messaging any time soon. However, we are at the point where we are considering a web interface. If we do it, it would probably need to be done as an addon to Declude JunkMail, mainly because the development and support costs would be fairly high. It would also have some drawbacks, being separate from web messaging. For example, it would require installing a separate service, using a different port than 80 or 8383 for web access (which may cause firewall problems), and having users enter their username/password a second time (if they are already using web messaging). Is this something that is important enough that it would be worthwhile? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Do spammers rank recipients
John Shacklett wrote: snip I suspect your Veep has similar skeletons in his flipper door. Does this sound familiar? DAY 1: mgmt-type (i.e. drooling idiot) gets 1 spam. Dutifully asks to be removed. DAY 2: 2 spams and 2 happy-go-lucky removal requests. DAY 3: 4 spams, 4 removal clicks. DAY 5: 256 spams and ... Scrag the mailbox and start over. I set the box to 1 byte in size where we have to use 'nobody' aliases. --- Matt Robertson, MSB Designs, Inc. http://mysecretbase.com - Retail http://foohbar.org - ColdFusion Tools --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IPNOTINMX
I just upgraded to 1.64 and found the IPNOTINMX test in global.cfg. Didn't see an explanation in the manual, although I may have missed it. What does it do? --Matt Robertson-- MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.62 (beta) released
Interesting. thx! --- Matt Robertson, MSB Designs, Inc. http://mysecretbase.com - Retail http://foohbar.org - ColdFusion Tools --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Spam Mail Statistics
My server (!) got the porno Messenger service message as well... A LOT of them stacked up. Some research dug up the fact that this is a new form of spam that can be defeated by disabling the messenger service. Under some circumstances disabling the netbios service might also be feasible. But don't do anything until you've RTFM and are confident you know what you're doing ;D --Matt Robertson-- MSB Designs, Inc. http://mysecretbase.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin (Linkbrokers Support) Sent: Monday, October 14, 2002 6:10 AM To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.JunkMail] Spam Mail Statistics Group: As a new person to this Junk mail War on Spam. I'm concerned. I have a topic viewpoint I would like to propose to the group, and get some feed back. How may networks are being attacked? Is this criminal? Or am I just crazy? Here is why I ask this question! Last week our network, a full DS3 was hijacked for about 8 hours. I was sleeping on the JOB, during my 24/7 job., from 11:00 PM to 6:15:am We did discover the the source file. And are able to avoid this in the future. ( I hope) But then, another attack over the weekend using Popup messenger service window on all my servers. Yes. I shut down and disabled that service. But how was that executed? ( Could use help here ) But, what was interesting. Was, the message was a porno message. With a 800 number. ? WOW - On the [IMail Forum] September Spam Statistics. Prone was highest in content. This started me to wonder. I'm curious, could a well distributed junkmail server without filters, that abruptly removes 90% of that delivered junkmail be subject to pissed off mail spammers. And if you really pissed them off, how far are they willing to go? For some reason my network is now being hammed from incoming request. Sharp spikes and long periods of use, with abnormal usage up and down . I'm just wondering. I know from working with the criminal mind, that one need to think like one to catch one. Has anyone ever had or knows anyone who may have a similar opinion or thought on this topic? Anyone willing to hypothesis? Kevin - Original Message - From: eddie pang [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, October 14, 2002 6:46 AM Subject: RE: [Declude.JunkMail] Spam Mail Statistics EXCELLENT!! :) Many thanks :) Atleast now I aint going in blind, although I still dont know what to do, but thats another issue :) Cheers! eddie. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Smart Business Lists Sent: Monday, October 14, 2002 12:24 AM To: eddie pang Subject: Re: [Declude.JunkMail] Spam Mail Statistics eddie, Monday, October 14, 2002 you wrote: EP New user to JunkMail here.. Welcome to the war. EP I know that declude has a spam trap. Is there data available on EP this to determine how effective each test is? Scott posts his monthly spam stats to the IMAIL forum - see http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ search for Spam Statistics or for September see http://www.mail-archive.com/imail_forum@list.ipswitch.com/msg58649.html I think a lot of others keep stats on test results but I don't think I've seen them widely posted. There are 3rd party programs to help you monitor tests and results. See http://www.declude.com/tools/index.html EP I am very interested in expanding our definitions from the current EP defaults, but before i can do that, i kinda would like to see how EP the each test compares at a bigger sampling.. Or is everyone going EP on different pathways... My experience indicates that communities are sufficiently different to require research and subsequent changes. The September and August report from Scott referenced above will certainly give you a larger picture. The problem is not so much trapping messages as that is easy but not trapping legitimate (and wanted) messages that fail tests. There are a good many blacklists of IP's and addresses posted all over the web and there are contributors both here and on the IMAIL list that post such lists. But for the most part where I have tried these in the past I just end up having to weed out more false spam messages. EP Also, how can i create a spam trap, discussed at http://www.mail-archive.com/declude.junkmail@declude.com/msg02642.html and try a google on the phrase create a spam trap EP to evaluate how effective each test is to properly setup each EP weights e.g. Is there a test that is 100% effective in EP identifying spam like helobogus There is really nothing that 100% of spam fails and 100% of non-spam doesn't fail as far as I know. I fail on the single tests: ORDB, MAILFROM, PERCENT, SNIFFER, and one IP blacklist. All other tests have to accumulate to a fail
