Hi Guys,
I am back checking my thousands of emails and catching up. I will get a new
all_list.dat generated over the next couple of days. Happy New Year all!
David Barker
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday
Available from Declude, My Account page.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED
Currently the best way is to email me the Ref-Id's and then I report them
directly to CT.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(lists)
Sent: Saturday, November 24, 2007 2:19 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] CommTouch FP
The older versions of Declude the host name is tied to the key. If you
change your host name you need a new key.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Troy D.
Hilton
Sent: Thursday, November 01, 2007 5:46 PM
To: Declude Junkmail Forum
Subject:
BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, October 15, 2007 9:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option
I will have this resolved this week. Thanks for pointing this out.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Thursday, October 18, 2007 4:03 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] RE: More Confusion - Home
,
Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 4:04 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test
As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.
BYPASSWHITELIST
This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For
that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.
Best,
Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent
PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages
Have you tried using
CATCHALLMAILS catchallmails x x 0 0
4.3.? exactly ?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick
Hogue
Sent: Thursday, October 04, 2007 3:59 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Decludeproc stops for no reason
Yes the service stops. The event viewer
?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Thursday, October 04, 2007 9:52 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Decludeproc stops for no reason
4.3.? exactly ?
-Original Message-
From: [EMAIL PROTECTED
1. Is your user required to authenticate with the server ?
2. Do you have WHITELISTAUTHin your global.cfg ?
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message-
From
You need to have a virus.cfg file which determines the location of the
quarantined files. To help me understand, what is it you would like to do?
Turn off all virus scanning and vulnerability detection ?
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007
You could try commenting out the following:
#WAITFORMAIL100
#WAITFORTHREADS 10
#WAITBETWEENTHREADS 50
Also set your WAITFORMAIL 2500
I think the biggest improvement was the fact you increased your threads.
David
-Original Message-
From: [EMAIL
] Upgrade to version 4 causes processor to
skyrocket
Thank you David.
Does it matter if I set the WAITFORMAIL TO 2500 If it is going to be
commented out anyway?
Kevin
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Thursday, September 20
I would suggest trying the interim 4.3.57 available from you're my Account
page, to see if this resolves your issue.
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heimir
Eidskrem
Sent: Monday, September 17, 2007 2:57 PM
To:
Can you post an example ?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mon
Mariola - Rubén
Sent: Wednesday, September 12, 2007 10:23 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter for Football
Somebody has been able to make a
Mariola, S.L.
- Original Message -
From: David Barker
To: declude.junkmail@declude.com
Sent: Wednesday, September 12, 2007 4:36 PM
Subject: RE: [Declude.JunkMail] Filter for Football
Can you post an example ?
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe
Fixed . tools are now located at http://tools.declude.com
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Thursday, September 06, 2007 12:30 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Knowledgebase Article has broken link
BODY10 PCRE
(href=http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-
4][0-9]|[01]?[0-9][0-9]?)/http://www)
Will catch any IP:
a
href=http://68.183.201.153/;http://www.youtube.com/watch?v=YxmwjEj2TtE/a
David Barker
VP Operations Declude
Your Email security is our
is of that domain.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dean
Lawrence
Sent: Monday, August 27, 2007 10:35 AM
that it only work for @example.com
ALLRECIPS END NOTCONTAINS @example.com
This is the counter weight
TESTSFAILED -8 CONTAINS SPAMCOP
This enables you to exclude certain unwanted scoring.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x
?
Dean
On 8/27/07, David Barker [EMAIL PROTECTED] wrote:
Correct. If you want to exclude specific tests you can negate the weights
by
using a filter eg.
In your global.cfg
--
SPAMCOP ip4rbl.spamcop.net 127.0.0.2
8 0
In your
Olden
David Barker wrote:
This does match M eg ad ik as you have described below
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John
Olden
Sent: Tuesday, August 21, 2007 2:34 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] ED Spam
Updated filter line to:
(?i:(Click|login|link).{0,50}http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?
)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, August 21, 2007 10:14 AM
.
Declude RULES.
Thanks David!
--SJ
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, August 21, 2007 9:39 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] New Spam
Filter Line:
BODY10 PCRE(?i:(Click
Version 4.x has built in AVG which is an additional virus scanner depending
on your previous virus configuration this would be a good place to start.
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin
Stanford
Sent: Tuesday, August 21, 2007
Try this ...
(?i:\b(?!dick?)(m(\W?|_){0,3}e(\W?|_){0,3}g(\W?|_){0,[EMAIL
PROTECTED])?(\W?|_){0,3}d(\
W?|_){0,3}[|li1í!](\W?|_){0,3}[ck]{1,2}\b)
Will match on obfuscated dick (ie. D!ck) but NOT dick, can include mega
obfuscated.
David
-Original Message-
From: [EMAIL PROTECTED]
of the line wrap after the d. Putting it all on one line works. Duh.
Thanks again,
John Olden
David Barker wrote:
This does match M eg ad ik as you have described below
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John
Olden
Sent: Tuesday, August 21
Email your smartermail key and host name so [EMAIL PROTECTED] and we will
get you activated.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto
Available from Declude, My Account page.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of David Barker
Sent: Thursday, August 16, 2007 11:52 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] New All_list.dat 16 Aug 07
Available from Declude, My Account page.
David Barker
VP Operations
Of David
Barker
Sent: Monday, July 02, 2007 12:35 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm?
Create a filter eg FILTER-PDF.txt and use the following lines. Adjust your
weights accordingly. Also ensure you are running Declude 4.3.46
BODY 3
sent you a bunch of samples. If you can update the filter before you
knock off for the day I'd appreciate it. We've probably had 50 of them get
through already today.
Thanks,
Dave
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday
Ok this should hold it over till I can look at it some more tomorrow.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, August 07, 2007 6:45 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm
] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, August 07, 2007 6:23 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm?
Ok this should hold it over till I can look at it some more tomorrow.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL
Of David
Barker
Sent: Tuesday, August 07, 2007 6:23 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm?
Ok this should hold it over till I can look at it some more tomorrow.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent
Todd,
If this is not resolved yet please contact [EMAIL PROTECTED]
Thanks
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Sunday, August 05, 2007 5:19 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] FW: Problems
Available from downloads section under Declude My Account home page.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just
This is what I configured but did not find it to be anything out of the
ordinary.
David
#---
---
#http://www.dnswl.org/
#Categories (127.0.X.y):
# 2 - Financial services
# 3 - Newsletters
# 4 - Organisations
as they could easily be forged.
I did this with the dnsbl test. You could also do it by adding
DUL/DYNA/(there is another one too I think) in the test name.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, July 30, 2007 7:53 AM
,
Dermot
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, July 25, 2007 2:41 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] BADHEADER lookup tool
http://tools.declude.com/ Declude Header Code Test
From
http://tools.declude.com/ Declude Header Code Test
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Troy D.
Hilton
Sent: Wednesday, July 25, 2007 2:19 PM
To: Declude Junkmail Forum
Subject: [Declude.JunkMail] BADHEADER lookup tool
Does Declude still support their BADHEADER
Check your tests in the global for negative weights which bring the value
down, the negative weights are defined in the last column of your tests.
Most common are IPNOTINMX or NOLEGITCONTENT or FROMNOMATCH which are hidden
from the headers. The last column either adds or subtracts weight if the
missed in the addition: ASUNTO. ( 3 + 3
). If hidden, like NOLEGITCONTENT, should subtract '5', not '6'.
Should I stop/start declude after modifying the filters ?
TIA
Andres.
-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de David
Barker
Enviado el: Jueves
Cloudmark is similar to ZEROHOUR the main difference is Cloudmark is user
driven which means that the identity of spam messages comes from their user
base, where as Commtouch uses network traffic analysis and Recurrent Pattern
Detection (RPDT)
David
From: [EMAIL PROTECTED] [mailto:[EMAIL
I have seen these if this is what you referring to the second line is
looking for an IP. You could try this in a filter:
BODYEND NOTCONTAINS SEEING YOUR CARD
BODY20 PCRE
(http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9
]|[01]?[0-9][0-9]?)/)
David
)
BODY20 PCRE(?i:ERMX)
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, July 06, 2007 10:18 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Todd,
Ensure you have version
Todd,
Ensure you have version 4.3.46 of Declude. The format of an expression is:
LOCATIONWEIGHT PCRE(EXPRESSION)
Eg.
BODY5 PCRE(?i:Hello World)
Post some examples that you are using but not getting hits.
David
-Original Message-
Can you provide an IP that had this code ?
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Wednesday, July 04, 2007 12:57 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Country code
I'm detecting a new country code *F.
Can you enlighten
lol, I will have to find out Thursday as the office is closed today. I will
post then.
From: Colbeck, Andrew [EMAIL PROTECTED]
Sent: Wednesday, July 04, 2007 3:37 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Country code
Effing
This would match on all you have provided, the . meaning any character
including a space {0,1} means min of 0 max of 1
(206.{0,1}888.{0,1}2083)
If you wanted to use detect O as well as the 0 [o0] also you could use the ?i:
meaning case insensitive:
(?i:2[o0]6.{0,1}888.{0,1}2[o0]83)
David B
Create a filter eg FILTER-PDF.txt and use the following lines. Adjust your
weights accordingly. Also ensure you are running Declude 4.3.46
BODY 3 PCRE
(JVBERi0xLjMgCjEgMCBvYmoKPDwKPj4KZW5kb2JqCjIgMCBvYmo)
BODY 5 PCRE (-+[0-9]+\r\n(?:[a-zA-Z\-]+:
or is this searhcing for some common
element present in the PDF Spams?
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, July 02, 2007 1:35 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm?
Create a filter eg FILTER
.
Any ideas ?
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
Just a quick question I have noticed that these PDF files all have the
following string in the first line is there something I am missing ? I have
been using it to catch these spams any thoughts ?
BODY 3 PCRE
(JVBERi0xLjMgCjEgMCBvYmoKPDwKPj4KZW5kb2JqCjIgMCBvYmo)
Hi Sam I am able to get to the site. I am in Massachusetts US
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
SJ.Stanaitis
Sent: Wednesday, June 27, 2007 8:41 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] OT - Can you reach my site?
Had a spiffy
(?i:Content-Type:
application/pdf;)
Or if you are using an the older filters
#BODY -10 CONTAINS Content-Type:
application/pdf;
See also http://blogs.zdnet.com/security/?p=325
David Barker
Director of Product Management
Your Email security is our
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] New PDF worm?
Hi David,
What's the CB-ATTACH.txt filter?
Darin.
- Original Message -
From: David Barker mailto:[EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Wednesday, June 27, 2007 11:24 AM
Subject: RE
balance to you.
TESTSFAILED END CONTAINS XBL
TESTSFAILED END CONTAINS SPAMCOP
BODY -10 PCRE (?i:Content-Type: application/pdf;)
etc. ...
Andrew.
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, June
You would have to test this but try:
BODY 0 PCRE (\BODY\(\r|\s){0,}/BODY)
David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED
4.3.53 is available from the interim location which addresses the CMDSPACE
test for SmarterMail.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED
Maximum line length in a filter is 1024 Characters
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
I will have to check out the maximum line length and get back to you, I have
modified most of the 419 filter if anyone (with a valid sa) would like a
copy just let me know.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E
would like a copy.
Mark Reimer
IT System Admin
American CareSource
972-308-6887
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, June 19, 2007 9:15 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE
: Re: [Declude.JunkMail] PCRE and REVDNS
How about adding it to the downloads section? That seems easier than
dealing with a lot of individual requests.
Darin.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Tuesday, June 19, 2007 10:42
in-sensitive
3. As . is a special character meaning any character we use the \ to
indicate that it should just be a .
4. The | represents or
5.The $ is also a special character which used here indicates the end of a
string
The above PCRE will match any of the 3 from the regular filter.
David
Smartermail had made a change to the .hdr file in the way that CMDSPACE was
being reported, I am currently testing the fix for this, I should have an
interim available next week.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
the
\proc directory is empty or reaches 0 files Decludeproc will reset the
winsock.
David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
it with the later versions of Imail
David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Wednesday, May 30, 2007 12:45 PM
it is in the correct
place)
David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Howard
Smith (N.O.R.A.D.)
Sent: Tuesday, May 29, 2007 3:36 PM
To: declude.junkmail
AUTOWHITELIST ON checks your user address book make sure you don’t have your
own address in your address book.
David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
From: [EMAIL PROTECTED] [mailto:[EMAIL
but they
began listing large blocks of IP's I would suggest a weight of no more than
2 or 3 if you wanted to continue to use them.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
From: [EMAIL
Sure, I will see what I can do for early next week.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck
.regions.com.usersetup.io/
05/15/2007 16:56:21.071 23622995 Triggered BODY PCRE filter FILTER-PHISH :
http://session-8434556.nationalcity.com.05server.cn/
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED
]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][
0-9]?)
I guess this is useful for several reasons, currently I am just using it see
if there is an IP in the REVDNS entry. Any thoughts on how this could be
effectivley used ?
David Barker
VP Operations | Declude
Your Email Security is our
at people so that is why an exact match
of on the subject line in CAPS would score higher than a regular case of the
same phrase.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
---
This E-mail came from
at least part of what's making it quieter here...
Darin.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Thursday, May 10, 2007 2:28 PM
Subject: [Declude.JunkMail] PCRE
Ok, either everyone has left or everyone is very happy because
Hi Richard,
Thanks for the post. To clear the IP's you still need to stop/start the
decludeproc service.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
From: [EMAIL PROTECTED] [mailto:[EMAIL
You could try using a filter like this:
#Remote mail hosts connecting and announcing your IP addresses
HELO 10 CONTAINS 208.100.26.91
#Remote mail hosts connection and announcing your hostnames
HELO 10 ENDSWITH igive.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL
You need to email me if you want the location to the interims
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
because of this.
John T
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, April 18, 2007 10:05 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Possible bug after upgrading to 4.3.46
No changes were made to the HELO for IMail, can
I have an interim release 4.3.47 which deals with the HELO - this is
available from the interim download location.
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, April 24, 2007 10:56 AM
To: declude.junkmail@declude.com
Subject: RE
Also if you check our release notes
http://www.declude.com/searchresults.asp?Cat=89 you will see that we had
suggested lowering the weights on UCEPROTECT1 and UCEPROTECT2
David Barker
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED
As we do not overwrite any config files, the \declude\resource directory
contains the latest config templates, so you can do a comparison on changes.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED
will see that we had
suggested lowering the weights on UCEPROTECT1 and UCEPROTECT2
David Barker
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
for example is not worth the performance impact. In other
cases like ORDB they no longer exist. To update your global.cfg just remove
the lines from the file.
We never overwrite config files becuase they are unique to each install.
David Barker
Director of Product Management
Your Email security
The other option depending if the UCEPROTECT-3 is not really to much of a
concern is to use the following:
UCEPROTECT IP4Rdnsbl-1.uceprotect.net * 4
0
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
- CRITICAL VIRUS
SCANNING UPDATE
David,
Do not take all these suggestions personal.
You are our pinata - remember? :)
-Nick
David Barker wrote:
- Pulled out the bad package
Did this.
- Rolled a new package (with an incremented version number) with the
missing DLL, tested
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Warning re: DECLUDE - CRITICAL VIRUS
SCANNING UPDATE
David,
Do not take all these suggestions personal.
You are our pinata - remember? :)
-Nick
David Barker wrote:
- Pulled out the bad package
Did this.
- Rolled a new
No changes were made to the HELO for IMail, can you send some log lines to
verify this so I can look into it ?
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(lists)
Sent: Wednesday, April 18, 2007 11:46 AM
To: declude.junkmail@declude.com
Subject:
From: David Barker [EMAIL PROTECTED]
Sent: Tuesday, April 17, 2007 10:33 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Warning re: DECLUDE - CRITICAL VIRUS
SCANNING UPDATE
The issue was corrected prior to notifying all customers, and therefore we
did
to be sent
through that same distribution.
I only hope that I don't remember wrong and wasn't looking at some older
notice.
Best Regards,
Andy
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, April 17, 2007 9:49 AM
minute time frame, I
think it is unfortunate that perhaps you downloaded the Imail version during
that window, and were upgrading from a version prior to the last release
4.3.40, that being said I do understand that it was annoying :) and I
sincerely apologize for the inconvience.
David Barker
PROTECTED] On Behalf Of Colbeck,
Andrew
Sent: Tuesday, April 17, 2007 1:01 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Warning re: DECLUDE - CRITICAL VIRUS
SCANNING UPDATE
My only two cents on this:
If I were David Barker I would have:
- Pulled out the bad package
- Rolled
a package, install on a real system directly from the
package you about to unleash on the world.
-Dave Doherty
Skywaves, Inc.
97 Webster Street
Worcester, MA 01603
508-425-7176
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Tuesday, April
None of Imails features. But then I am probably biased ;)
David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Chuck,
Just FYI Some of these things can be achieved with SmarterMail they are able
to block connects on the SMTP.
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Wednesday, April 11, 2007 3:27 PM
To: Declude. JunkMail
Subject:
based upon our evaluation at that
time).
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, April 11, 2007 2:21 PM
To: declude.junkmail@declude.com
Subject: RE
201 - 300 of 658 matches
Mail list logo
