I've gotten serveral of these the past few minutes.
Below are the full headers ..I'm assuming they are trying to relay ???
It's hard to say what spammers are doing when they aren't sending a real
spam to someone. They may be making relay attempts, they may be checking
to see if you have
I've got an IMGate machine in front of my imail/declude, and ive set it up
to drop any connection where anywhere in the SMTP header/banner it claims an
IP or a domain of mine.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Tuesday,
Title: AW: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions
thank you, great news!!
mfg
i.a.
gez. guhl
***
lds nrw
dez. 235
tel.: 0211 9449 2578
fax.: 0211 9449 8344
mailto:[EMAIL PROTECTED]
***
I recommend a simple scheme of simple characters and escape sequences.
Borrowing from our Message Sniffer rule coding, how about _ as a space,
and if you really need the _ character itself then you use \_. Then you
also have to use \\ when you want the \, but that's a small price to pay
and it's
Ha ha ha! plop... (laughs his head off)
|-Original Message-
|From: [EMAIL PROTECTED]
|[mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry
|Sent: Monday, December 01, 2003 6:22 PM
|To: [EMAIL PROTECTED]
|Subject: Re: [Declude.JunkMail] Subject Starts with
|
|
|Oh, yes, now it get it...
Title: Interesting.. Now PGP is used
Hi;
Interesting spam
Now they are using PGP code
Just in case you are adding negative weight for PGP - something to keep in mind.
Regards,
Kami
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hi,
your request for notification for the
It's not worth paying the subscription fee, in my opinion. I have a client
that's paying for it, and it doesn't catch very much that isn't already
caught somewhere else.
I am considering Maps too. But it's $1500/yr. Anyone using them?
---
[This E-mail was scanned for viruses by Declude
Sniffer's well worth the $300.00 per year.
That breaks down to less than $1.00 per day.
It catches content that some RBLs don't catch.
Mark
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Keith Anderson
Sent: Tuesday, December 02, 2003 10:28 AM
I just set up spamchk and was wondering if anyone can share some
fine-tuning info with me? Updated keyword lists and such? I tried
subscribing to their list but all I get back is an Invalid Syntax email
from their mail server.
Cheers,
Matt
It appears that you may have forgotten to mention the TEXT of the error
message that appears in the logs. Knowing what error is reported may be the
key in pin-pointing the cause.
Best Regards
Andy
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This
The messages are as follows:
Error; failure opening (message ID) in the declude junkmail file
Error opening mime file (message ID) in the declude antivirus file
Sorry for the generic message, but the log files are gone.
===
Daniel Ivey
GCR Company / GCR Online
Voice: 434 -
The messages are as follows:
Error; failure opening (message ID) in the declude junkmail file
Error opening mime file (message ID) in the declude antivirus file
Sorry for the generic message, but the log files are gone.
The best way to determine what is happening here is to use the debug mode.
Can there be a way for a filter to fail all or nothing. For instance, everyone seems
to be receiving spam with no subject, and fake tags such as gkslthsjewl. I receive
thousands of these messages a day, all from different spammers. I have been filtering
on the two characteristics, and it
Scott,
The problem seems to have corrected itself. However if the problem occurs
again, this will be the first thing that I do and I will email them to you.
Thanks for the help Scott.
Daniel
===
Daniel Ivey
GCR Company / GCR Online
Voice: 434 - 570 - 1765
Fax: 434 -
Matt:
At what weights do you hold and delete? I will share my config file with
you with the caveat that I am still fine tuning.
I have been running Spamchk in production mode for about a month and have
had excellant results. I turned it off for a day when I was trying to
reduce some of the
If I could somehow define a filter that will only fail if all instances in
the filter are true I could set up...
SUBJECT 0 ISBLANK
BODY0 STARTSWITH g
and delete on this filter file alone.
This is something that we are looking into. :)
Matt -
What I did was in the beta version set a max weight and a min weight
to be returned. [I have it set now at 8 and -2 respectivly.]
Then let it run and check the log file to see what is failing -
adjust accordingly.
I ended up reducing the scores for failures in the ini by ~50+%
I actually noticed ramp up to the holiday, followed by a large increase
over the holiday weekend.
The most popular single spam involved a city in France and a hotel
chain. This even beat out
the ever popular enhancement of body parts category.
Burzin
At 12:09 PM 12/2/2003, you wrote:
BTW,
Matt, I was noticing that you are using END in this file. How is that
feature enabled? When I add END to any of my files, it seems that
JunkMail just skips the entire files. Is there something that you need to
add to the global.cfg to enable this filter feature?
Bill
- Original Message
newbieOooh! Scott, how about you *just* implement in the next interim full
regexp text processing like product X along with MIME decoding like product
Y, MIME error handling like product Z, with a whole new filtering grammar
that lets us specify the layer of decoding at which the text filter line
ROLLING EYES
Of course, I have to take blame for this since I started the thread. NOT!
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Tuesday,
Bill,
I haven't seen an absolute confirmation that this functionality works
yet as I haven't yet integrated this filter into my system using the new
code. The END functionality though is something that Scott said he
would include along with MAXWEIGHT, MINWEIGHT, SKIPIFWEIGHT, and some
MINWEIGHT
How does that work?
- Original Message -
From: Bill Landry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, December 02, 2003 5:12 PM
Subject: Re: [Declude.JunkMail] BODY STARTSWITH
Thanks Matt, I was able to accomplish what I wanted using MINWEIGHT.
Bill
-
Fred,
It's probably best to go back and reference the follow up posts to that
thread. This isn't going to be anywhere near as common as MAXWEIGHT,
but it provides the same sort of functionality for negative weighted
tests (limits total scoring and ends processing of a filter when that
I use it the exact opposite to MAXWEIGHT, which allows me to set a minimum
weight that I do not want a filter weight to go below. For example:
MINWEIGHT-5
will tell JunkMail not to apply a weight lower then -5 to the message, even
if the actual weight is lower then -5.
HTH,
Bill
-
I just set up spamchk and was wondering if anyone can share
some fine-tuning info with me? Updated keyword lists and
such? I tried subscribing to their list but all I get back
is an Invalid Syntax email from their mail server.
hmm... I've tried to un- and the subscribe without any
Scott,
Ok, I have finally gotten around to modifying my filters to use some of
the new features. It definitely is having an impact on my processor
from what I can see. I think I have uncovered a bug or bugs though in
terms of how thresholds are calculated and how it affects processing and
Also it seems that declude is claiming that 216.204.154.7 has no MX.
DnsStuff.com reports:
Actually, that's a server of yours, which you've let Declude JunkMail know
about.
How do I tell it not to know about it and my web servers as well? So they
dont fail the MX test.
This stops some mail from
Also it seems that declude is claiming that 216.204.154.7 has no MX.
DnsStuff.com reports:
Actually, that's a server of yours, which you've let Declude JunkMail know
about.
How do I tell it not to know about it and my web servers as well? So they
dont fail the MX test.
That's not the problem --
Markus wrote:
hmm... I've tried to un- and the subscribe without any problem.
Thats because you're using the link that works :-O. Go to the installation
instructions here
http://www.spamchk.com/modules.php?name=Newsfile=articlesid=2
And try the subscribe link on that page. You'll get a
A couple of posters offered some help on this, where I don't have the original
messages (they're at home and I'm at work). The FP rate is fairly heavy on spamchk so
far... including bagging about half of the traffic on this list today. I'm sure its
something easily fixed.
I'd love to see a
Ok, I have finally gotten around to modifying my filters to use some of
the new features. It definitely is having an impact on my processor from
what I can see. I think I have uncovered a bug or bugs though in terms of
how thresholds are calculated and how it affects processing and logging.
I'm using the attach action rather than holding, bouncing etc. Every month I prepare
a report for my customers that tells them how much mail got delivered, how much got
blocked etc.
If an item is given an ATTACH action, does Imail ever see it? Does Declude attach and
deliver directly?
Hi,
I have a per-user external plus program that I wrote that is very handy
to whitelist or blacklist based on e-mail addresses or subject lines.
The program is very small (54K) and in my case, does not add any
processing time to message delivery. If you would like to take a look
or give it a
Thanks for the clarification, Scott.
Cheers,
--
---
Matt Robertson, [EMAIL PROTECTED]
MSB Designs, Inc. http://mysecretbase.com
---
--
---
[This E-mail was scanned for viruses by Declude Virus
Scott,
I was on 1.76i28 but upgraded as suggested, and I was able to verify
that the filter is now hit when the score is within the difference in
points from the SKIPIFWEIGHT and it is logged. I'm not totally sure if
this perfectly represents the original issue, though I tried to mimic
the
Greetings,
I have been having a little problem since about 2:00 pm yesterday
afternoon. I noticed that the spool directory was a little large. I then
cleaned out the spool. However it started building back up immediately and
I noticed that now, I am constantly getting errors in both my
I am constantly getting errors in both my declude
junkmail and declude antivirus logs.
What errors?
As soon as I delete the logs, they appear again with more errors.
Unfortunately, deleting the log files won't fix a problem.
Is your hard drive full? Are you processing a much higher volume of
Here we go again:
http://www.reuters.co.uk/newsArticle.jhtml?type=internetNewsstoryID=3924996section=news
Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail
A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said
his spool in Imail is loading up and holding all messages..He thinks the
Declude has stopped working...Imail tech support not available..
He has rebooted the server several times with no luck..
Declude log is not showing
possible dns not resolvingtry changing DNS in Imail and restart
smtpworks for mine sometimes...
gb
At 12:06 AM 12/3/2003 -0600, you wrote:
A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said
his spool in Imail is loading up and holding all messages..He thinks the
Give him a ring and tell him to uninstall declude. Only takes a second or
two.
I'd ring him but it would be a very very expensive call :-)
_
Glen Harvy
Aquarius Communications
for all your Internet Needs.
Phone 9977 3788 Fax 9977 3844
-Original
He's OK.
- Original Message -
From: Richard Farris [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 1:06 AM
Subject: [Declude.JunkMail] Server Gone Wild
A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said
his spool in Imail is loading
This is Brian Thompson with an update:
Mail server appears to be back up and running. Thanks for all the help.
Still don't know what the problem was, but my declude log shows no entries
from 4:23 pm until 11:58 pm.
- Original Message -
From: Glen Harvy [EMAIL PROTECTED]
To:
44 matches
Mail list logo
