Can Scott or someone explain to me how the weight on this message was
calculated?
The weight is calculated by adding/subtracting every relevant weight for
the E-mail. In almost all cases where the weights do not seem to add up,
it is because the E-mail did *not* fail a spam test that is set
I've been testing a script using an external test and I seem to have come
across a limitation in the length of the line. The script is definitely
being called because it has it's own logging function, but Declude isn't
listening to the result code that it gives. I created a single line
Hi,
I remember reading about the Outlook and space in the header problem a
while ago. I had not seen it until now (I think). Is this that problem?
If I read this correctly it was send via Exchange 2000 but I do not
think you can tell what version of Outlook sent it, can you?
Thanx
Subject:
I'm getting spam from the following netblock, but with zero ip4r tests
triggering.
I haven't seen any legitimate mail coming here, so I'm putting a
conservative weight on this, and you might find it useful too in a filter
file:
REMOTEIP 4 CIDR 69.200.64.0/19
Matt from MailPure.com has a
I remember reading about the Outlook and space in the header problem a
while ago. I had not seen it until now (I think). Is this that problem?
There's a lot of Outlook problems, several of which involve spaces. :)
If I read this correctly it was send via Exchange 2000 but I do not
think you can
Is there a way to configure the cfg file to only do the sniffer test if
below a certain weight?
No, that is not currently possible.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus:
Assuming we wanted to setup a Sat-Sun DOW test with a weight of 2 for the
message hitting on the weekend, I guess we would use:
DOW dow 6 7 2 0
Correct?
Having said that, does anyone have any metrics on what days more spam comes
in?
---
[This E-mail was scanned for
I believe Sunday is day zero, so you would need two tests. For example...
DOW_SUN dow 0 0 2 0
DOW_SAT dow 6 6 2 0
I don't have statistics to show you, but I can say more spam comes in on a
weekday than on weekends, and more on Saturday than Sunday. We weight
Sunday a little higher due to much
Here are my October totals by day.
Day spam totals Date CountOfMessageID DEL SPAM Held SPAM Poss SPAM OK
10/1/2004 4513 2878 57 63 1515
10/2/2004 3169 2915 51 9 194
10/3/2004 2949 2665 57 17 210
10/4/2004 4594 2898 39 42 1615
10/5/2004 4811 3038 41 39 1693
Will a wordfilter BODY pick up text in an email that is in html format?
TIA
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type
Scott, you have far less ham on weekends. Hypothetically, a company like
yours might use the day of week test to add a little weight on the weekend,
on the basis that your false positives from doing so will be fewer.
I have a similar volume pattern.
And to answer Mark's initial question,
Yes, including the html tags themselves
Rick Davidson
National Systems Manager
North American Title Group
-
- Original Message -
From: Danny K [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, October 19, 2004 5:47 PM
Subject: [Declude.JunkMail] WordFilter BODY
Will a wordfilter
Yes. For that matter, a BODY filter could also catch text that is in an
attached document.
Andrew 8)
-Original Message-
From: Danny K [mailto:[EMAIL PROTECTED]
Sent: Tuesday, October 19, 2004 2:47 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] WordFilter BODY
Will a wordfilter
So what does the =IGNORE mean in the logs? Such as this:
CMDSPACE=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE SPFFAIL=IGNORE
LOCALCMDSPACE=IGNORE WEIGHT5=SUBJECT WEIGHT5r=MAILBOX CATCHALLMAILS=IGNORE
And if this is only a list of tests that failed, then is there no list of
tests the passed?
So what does the =IGNORE mean in the logs? Such as this:
CMDSPACE=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE SPFFAIL=IGNORE
LOCALCMDSPACE=IGNORE WEIGHT5=SUBJECT WEIGHT5r=MAILBOX CATCHALLMAILS=IGNORE
Those are the actions that are taken. So the subject was modified since
the E-mail failed
No, you can't do this directly with Declude, but indirectly, heck yes.
I just wrote a piddling batch file that will let you do this. You can use
it for any external test, not just sniffer.
You should read it carefully, and then edit your global.cfg accordingly, in
particular to put in the
Thanks, Scott. Ok, one more: here is the scoring system I use:
BADHEADERS badheaders x x 8 0
BASE64 base64 x x 4 0
CMDSPACE cmdspace x x 8 0
COMMENTS comments x x 7 0
HELOBOGUS helovalid x x 5 0
IPNOTINMX ipnotinmx x x 0 -3
MAILFROMenvfrom x x 12 0
NOLEGITCONTENT nolegitcontent x x 0
I just wrote a piddling batch file that will let you do this. You
can use it for any external test, not just sniffer.
Nothing wrong with your batch, but how about avoiding an external file
entirely:
c:\winnt\system32\cmd.exe /c if %WEIGHT% LSS 20 c:\MessageSniffer...
--Sandy
If this works it's a slick hack!
Well tested Sandy?
_M
On Tuesday, October 19, 2004, 8:48:47 PM, Sanford wrote:
I just wrote a piddling batch file that will let you do this. You
can use it for any external test, not just sniffer.
SW Nothing wrong with your batch, but how about avoiding an
19 matches
Mail list logo
