RE: [Declude.JunkMail] Imail blacklist, phrase list converter
Matt- Isn't the Imail URL Blacklist a list of url's that appear in spam email? You reference it in (2.) below as a sender blacklist. Thanks for clarification, MB -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Robertson Sent: Monday, November 17, 2003 5:05 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Imail blacklist, phrase list converter OK, I've completed what I suppose you could call the first version of my Imail-to-Declude black- and phrase-list converter. Get it here: http://foohbar.com/declude_importer.zip It turned into a complete ColdFusion application. The system will 1. Retrieve source files from ftp.ipswitch.com 2. Convert the url blacklist into a Declude sender blacklist (skipping any entries you have placed in a separate skip list) 3. Convert the phrase list into a Declude filter file. Filters will be created for matches in subject and body. 4. FTP the newly minted files to the location you specify. NOTES: a. All settings are made in application.cfm, including filter weights. b. You can use the browser interface (index.cfm) to run all tests in sequence automatically, or individually. c. Since they can be run individually, you can opt to schedule the files to run automatically. d. You have to set up global.cfg and $default$.junkmail to use the new tests and files. e. With these tests in place, all mail tests take about 250ms per email tested. However, this is on MY server with MY configuration. Your mileage may vary. f. On a very fast server (dual 2ghz xeon with gobs of ram, super-duper scsi) the download/conversion/upload process takes just under three minutes. Most of this is the processing of the 17,000-entry url blacklist. On a slow server, it takes a lot longer. External dependencies: 1. The app uses the pkzip Command Line tool to unzip the Imail source files. You can alter the batch file and import01.cfm to use whatever command line unzip program you use. 2. cf_ProgressMeter is used to display a progress bar. This is a $5 tool I *highly* recommend. If you don't own it or don't want to buy it just go in and remove the calls to it in import02.cfm and import03.cfm. I'm in the process of rolling out a new web site in the next couple of days. I'll add this and anything else useful I can think of in the spamfighting section. If anyone has improvements to this, please pass 'em on! Cheers, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
Mark wrote: Isn't the Imail URL Blacklist a list of url's that appear in spam email? You reference it in (2.) below as a sender blacklist. Yes. This converts those urls to a sender blacklist. So if the domain 'buymystuff.com' is in the Imail blacklist, the program converts that to '@buymystuff.com' and blocks mail coming from it. Its not perfect for obvious reasons, but so far my logs show it to be working surprisingly well. The phrase list is going like gangbusters as a filter file. Many more hits than the blacklist. The next thing I'm going to try is making the blacklist into a filter file, where if the domain is in the body of the message it gets dinged. This will be essentially the same behavior as Imail, I believe. Processing time will be the issue to watch on that one. I wonder, though, if I'm really losing any speed. I was doing this in Imail. Now I'm not, so have I just shifted load from something I couldn't effectively measure (Imail) to something I can (Declude)? Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Robertson Sent: Tuesday, November 18, 2003 7:44 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Imail blacklist, phrase list converter The next thing I'm going to try is making the blacklist into a filter file, where if the domain is in the body of the message it gets dinged. This will be essentially the same behavior as Imail, I believe. Processing time will be the issue to watch on that one. I tried this. It was VERY detrimental to the processing speed of emails. Was averaging 10-15 seconds PER email. Let me know if you get the same results. This is a P4 XEON with 1G Memory too. :) Mark --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
I'm a CFer; I'd like to see a copy of that. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Robertson Sent: Monday, November 17, 2003 1:22 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Imail blacklist, phrase list converter I've written a ColdFusion program that converts Imail blacklist entries to Declude format. The same program takes the Imail phrase list and creates a Declude filter file, where the text of each line in the original file becomes a SUBJECT CONTAINS and BODY CONTAINS test. Don't know how many CF'ers there are out there. If you want a copy let me know. Suggestions for improvement gladly accepted. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
I would be interested. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matt Robertson Sent: Monday, November 17, 2003 11:22 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Imail blacklist, phrase list converter I've written a ColdFusion program that converts Imail blacklist entries to Declude format. The same program takes the Imail phrase list and creates a Declude filter file, where the text of each line in the original file becomes a SUBJECT CONTAINS and BODY CONTAINS test. Don't know how many CF'ers there are out there. If you want a copy let me know. Suggestions for improvement gladly accepted. Cheers, Matt Robertson [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
OK, give me a bit to spiff it up a bit. I'm going to add in the ability to download and unzip the source files from the Ipswitch site, and have it check a 'skip list' before adding domains, so you only have to remove unwanted blacklistings once. In response to another off-list query, I have averaged the performance I'm getting, and with logs set to 'debug' I averaged 245ms per mailpiece over several dozen receipts. No idea what it was before I added the phrase and black list checking. -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
Scott, Can I set up a blacklist as follows, where the blacklisted url is also the url's description? I want to be able to see the failed url in the logs. @zthub.ct.flasail.com zthub.ct.flasail.com @zthub.oo.flasail.com zthub.oo.flasail.com @zthub.wc.flasail.com zthub.wc.flasail.com @ztjxr.ct.flasail.com ztjxr.ct.flasail.com If so, whats the char limit? Accepts special chars like % ? Thx, -- --- Matt Robertson, [EMAIL PROTECTED] MSB Designs, Inc. http://mysecretbase.com --- -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Imail blacklist, phrase list converter
Can I set up a blacklist as follows, where the blacklisted url is also the url's description? I want to be able to see the failed url in the logs. @zthub.ct.flasail.com zthub.ct.flasail.com @zthub.oo.flasail.com zthub.oo.flasail.com @zthub.wc.flasail.com zthub.wc.flasail.com @ztjxr.ct.flasail.com ztjxr.ct.flasail.com If so, whats the char limit? Accepts special chars like % ? That would work fine -- I believe there is a limit of 1000 characters on the line, and any standard (non-high-bit and non-control) characters can be used. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
