Re: [Declude.JunkMail] WHITELIST HABEAS
Do most people use WHITELIST HABEAS? I'm thinking of turning this off since the large majority of spammers have already demonstrated their willingness to ignore the legality of their activities. That's kind of like asking if you should move your store to another town, since the store next to yours was robbed yesterday, and a lot of people in your town drive over the speed limit. Moving out of town would be a very bad business move without further information. One of the key pieces of information would be how the police handle the situation. If they catch the criminal the next day and punish him in a way that is fair but discourages other criminals from robbing stores, would you really want to leave? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST HABEAS
But Scott, do you leave your front door unlocked if there is a bugler actively on the lose? Could you move this from whitelisting to weighting in order to help protect from such things for non-Pro users? That might make a lot of sense. This is just some header code, and that's all it takes. Matt R. Scott Perry wrote: Do most people use WHITELIST HABEAS? I'm thinking of turning this off since the large majority of spammers have already demonstrated their willingness to ignore the legality of their activities. That's kind of like asking if you should move your store to another town, since the store next to yours was robbed yesterday, and a lot of people in your town drive over the speed limit. Moving out of town would be a very bad business move without further information. One of the key pieces of information would be how the police handle the situation. If they catch the criminal the next day and punish him in a way that is fair but discourages other criminals from robbing stores, would you really want to leave? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST HABEAS
It's unsafe to whitelist in general unless you have control over what is sending, or a good relationship with the sender. Habeas is totally not that. This should be a weighted test instead of something that gets whitelisted. Maybe Scott could move this to the same type functionality used in technical tests, where you can apply weights. Other have been using JunkMail Pro with filters to deduct points for a headers search. Personally, I have turned all of that off, and it's most definitely being abused right now. Matt Larry Craddock wrote: Do most people use WHITELIST HABEAS? I'm thinking of turning this off since the large majority of spammers have already demonstrated their willingness to ignore the legality of their activities. Larry Craddock --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST HABEAS
I've turned it off temporarily due to the storm of HABEAS-certified spam this weekend. Hopefully, we will something from Habeas about what caused the problem and what they are doing about it. -Dave Doherty Skywaves, Inc. - Original Message - From: Larry Craddock [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, January 12, 2004 9:12 AM Subject: [Declude.JunkMail] WHITELIST HABEAS Do most people use WHITELIST HABEAS? I'm thinking of turning this off since the large majority of spammers have already demonstrated their willingness to ignore the legality of their activities. Larry Craddock --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST HABEAS
Good point and I do agree with one minor counter point ... we have little to no feedback about how *the police are handling the situation.* I reported the incident to Habeas and here's a snippet from their response: [Please know that at Habeas we take the use of our trademark in spam very seriously, and that while we cannot report back to you directly and individually on the disposition of each submission, know that we will investigate and follow this through to a satisfactory conclusion - either the responsible party ceasing their infringing action, their being appropriately dealt with by their service provider, or, failing any satisfactory remedial action, listing in our Habeas Infringers List.] Larry - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, January 12, 2004 8:26 AM Subject: Re: [Declude.JunkMail] WHITELIST HABEAS Moving out of town would be a very bad business move without further information. One of the key pieces of information would be how the police handle the situation. If they catch the criminal the next day and punish him in a way that is fair but discourages other criminals from robbing stores, would you really want to leave? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST HABEAS
Could you move this from whitelisting to weighting in order to help protect from such things for non-Pro users? That might make a lot of sense. This is just some header code, and that's all it takes. You can use: HABEAS habeas x x -5 0 in the global.cfg file to accomplish this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST HABEAS
on 1/12/04 9:59 AM, Larry Craddock wrote: Good point and I do agree with one minor counter point ... we have little to no feedback about how *the police are handling the situation. Plus how many spam messages will be whitelisted while the police investigate the incident and the courts go through all their motions (if it even gets that far)? We turned Habeas whitelisting off a long time ago. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST HABEAS
Scott, Whatever happened to the feature where Declude spits out a million dollars? Eagerly waiting, but getting frustrated. Matt :) R. Scott Perry wrote: Could you move this from whitelisting to weighting in order to help protect from such things for non-Pro users? That might make a lot of sense. This is just some header code, and that's all it takes. You can use: HABEAS habeas x x -5 0 in the global.cfg file to accomplish this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WHITELIST HABEAS
Declude sure is a Swiss Army Knife... I want to see Habeas succeed, and I think that misuse of their warrant by a spammer through zombies is going to be a real test for them. Their business model is built around suing a SpamHaus or a misbehaved mailing house (like Topica, to pick something at random). Here's what I do: I use their ip4r test to catch mail from any mail host that Habeas has indicated is a problem: HIL ip4r hil.habeas.com 127.0.0.2 40 0 And to proceed with finding their warrant in the header, reward it, and log it, I have: MYHABEAS filter C:\IMail\Declude\MyHabeas.txt x 0 0 which contains: REVDNS END ENDSWITH .habeas.com HEADERS -10 CONTAINS X-Habeas-SWE-3: like Habeas SWE (tm) The reason for the first line in the filter file is that I'm not interested in logging e-mail from Habeas.com that contains their own warrant. Now I can search my log for MYHABEAS to find the good guys and bad guys. And then report the original email from the bad guys to Habeas. What I'm finding is that the bad guys are scoring quite high and that the Habeas counterweight is having relatively little effect on their score. And for the legitimate bulk mailers that are using the warrant, none are scoring high enough to be held in my configuration. So YOU, gentle reader, might find that simply not using any Habeas counterweighting will work for you just fine. Andrew 8) -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Monday, January 12, 2004 7:11 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] WHITELIST HABEAS Could you move this from whitelisting to weighting in order to help protect from such things for non-Pro users? That might make a lot of sense. This is just some header code, and that's all it takes. You can use: HABEAS habeas x x -5 0 in the global.cfg file to accomplish this. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WHITELIST HABEAS
We're getting a LOT of spam with HABEAS headers, presumably because the spammers are using hijacked systems. We have had to turn off that feature. As long as systems can be hijacked, Habeas and SPF won't be worth very much. Do most people use WHITELIST HABEAS? I'm thinking of turning this off since the large majority of spammers have already demonstrated their willingness to ignore the legality of their activities. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WHITELIST HABEAS
We have also turned off the HABEAS whitelist due to large amounts of spam. We are also added pharma court.biz to our body filter. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Keith Anderson Sent: Monday, January 12, 2004 10:31 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] WHITELIST HABEAS We're getting a LOT of spam with HABEAS headers, presumably because the spammers are using hijacked systems. We have had to turn off that feature. As long as systems can be hijacked, Habeas and SPF won't be worth very much. Do most people use WHITELIST HABEAS? I'm thinking of turning this off since the large majority of spammers have already demonstrated their willingness to ignore the legality of their activities. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] WHITELIST HABEAS
I have not seen any spam with HABEAS headers UNTIL I viewed some messages caught by Declude Virus because of the Outlook 'CR' Vulnerability. I am forwarding these to the site. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, January 12, 2004 12:29 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] WHITELIST HABEAS We have also turned off the HABEAS whitelist due to large amounts of spam. We are also added pharma court.biz to our body filter. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Keith Anderson Sent: Monday, January 12, 2004 10:31 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] WHITELIST HABEAS We're getting a LOT of spam with HABEAS headers, presumably because the spammers are using hijacked systems. We have had to turn off that feature. As long as systems can be hijacked, Habeas and SPF won't be worth very much. Do most people use WHITELIST HABEAS? I'm thinking of turning this off since the large majority of spammers have already demonstrated their willingness to ignore the legality of their activities. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST HABEAS
I also found some today, held by Virus. Dunno if there have been others that did get through. Glenn Z. - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, January 12, 2004 5:42 PM Subject: RE: [Declude.JunkMail] WHITELIST HABEAS I have not seen any spam with HABEAS headers UNTIL I viewed some messages caught by Declude Virus because of the Outlook 'CR' Vulnerability. I am forwarding these to the site. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, January 12, 2004 12:29 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] WHITELIST HABEAS We have also turned off the HABEAS whitelist due to large amounts of spam. We are also added pharma court.biz to our body filter. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Keith Anderson Sent: Monday, January 12, 2004 10:31 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] WHITELIST HABEAS We're getting a LOT of spam with HABEAS headers, presumably because the spammers are using hijacked systems. We have had to turn off that feature. As long as systems can be hijacked, Habeas and SPF won't be worth very much. Do most people use WHITELIST HABEAS? I'm thinking of turning this off since the large majority of spammers have already demonstrated their willingness to ignore the legality of their activities. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
