Re[2]: [Declude.JunkMail] High % of spam from this IP range:

2003-12-07 Thread Rick Rountree
64.119.192.0/19 = iwayhosting.com covers all those Been in my banned ip list for a while now. Rick Rountree *** REPLY SEPARATOR *** On 12/6/2003 at 3:04 PM George Kulman wrote: Marc Don't forget 64.119.208.0/24 George -Original Message- From: [EMAIL

RE: [Declude.JunkMail] Declude not taking action

2003-12-07 Thread Kami Razvan
I figure that each individual E-mail on my system has about a 0.6% chance of being stolen and delivered by the queue. Matt: I have spent a lot of my years in the field of mathematics. A study done a while back and it is related to data-mining stated.. men buy baby diapers and orange juice

RE: [Declude.JunkMail] Declude not taking action

2003-12-07 Thread Dave Marchette
Apologies if this has already been mentioned, but this may be a quick easy way to find out exactly what messages(and quantity of messages) never got scanned by Declude on a per server basis: If you have Declude configured to add anything consistent to the headers, like an x-note: or whatever

[Declude.JunkMail] Test suggestion request for comments...

2003-12-07 Thread Bill Landry
Scott, you have probably seen requests like this before, however, I think this would be a great way to support most corporate and some ISP e-mail domains with a negative weight based test: HELO RDNS domain match -5 HELO RDNS MAILFROM domain match -10 HELO RDNS domain match IPINMX -10 (yes,

RE: [Declude.JunkMail] Test suggestion request for comments...

2003-12-07 Thread Kami Razvan
Bill.. This goes well along the line of the subject that was discussed a while back and one that could help a great deal. Right now we are concentrating on negative aspects of the email - to minimize FP and even further reduce CPU we should give some attention to some positive aspects as well.

Re: [Declude.JunkMail] Declude not taking action

2003-12-07 Thread Eje Gustafsson
Not related to your problem but do yourself a favor block @mcsi.net only thing I ever seen from there is spam. Best regards, Eje Aya Gustafsson mailto:[EMAIL PROTECTED] The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax :

[Declude.JunkMail] New concept in phishing..

2003-12-07 Thread Kami Razvan
Now this one is an interesting concept... Reverse psychology at its best.. Let us check see if your card is stolen.. IP Listed: 203.126.160.62 Regards, Kami Subject: [55~]ALERT: YOUR PERSONAL INFORMATION HAS BEEN STOLENDate: Thu, 04 Dec 03 05:33:41

[Declude.JunkMail] TESTFAILEDWITHWEIGHTS

2003-12-07 Thread Daniel Grotjan
Would it be possible to have the TESTFAILEDWITHWEIGHTS variable to not show the score for WEIGHT type test such as WEIGHT10 or WEIGHT20? It appears that the WEIGHT10 test has added 10 points to the score by the way the variable appears. -Daniel --- [This E-mail was scanned for viruses by

Re: [Declude.JunkMail] Declude not taking action

2003-12-07 Thread Matthew Bramble
Kami Razvan wrote: I have spent a lot of my years in the field of mathematics. A study done a while back and it is related to data-mining stated.. men buy baby diapers and orange juice on Tuesdays more than any other day of the week. Sure it's useful, what it says is that there is something

Re: [Declude.JunkMail] Declude not taking action

2003-12-07 Thread Matthew Bramble
Dave, It appears that the E-mail getting delivered improperly is the result of IMail stealing a copy and processing it apart from Declude. In the example that I provided, Declude deleted the copy that it got because it scored too high, but IMail delivered a copy before it was scanned by

Re: [Declude.JunkMail] TESTFAILEDWITHWEIGHTS

2003-12-07 Thread Matthew Bramble
Use the HIDETESTS option to remove the weight-based tests from your output. I believe it is used in the Global.cfg as follows: HIDETESTS WEIGHT10 HIDETESTS WEIGHT20 Of course Scott might also want to change the way that weight-based tests are reported, but this will remove some of

Re: [Declude.JunkMail] TESTFAILEDWITHWEIGHTS

2003-12-07 Thread serge
Scott, what we need is %TESTWITHWEIGHT% intead of %TESTFAILEDWITHWEIGHTS% so it will list test like ipnotinmx when they pass, and contribute to the total weight, instead of when they fail. you said i was coming in the next release, did you mean %TESTFAILEDWITHWEIGHTS% ? - Original Message

RE: [Declude.JunkMail] Declude not taking action

2003-12-07 Thread Dave Marchette
Gotcha. But do the headers of the copy that Imail delivered\stole have any Declude markings in the header? -Original Message- From: Matthew Bramble [mailto:[EMAIL PROTECTED] Sent: Sunday, December 07, 2003 4:42 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude not

RE: [Declude.JunkMail] Hijack Question

2003-12-07 Thread John Tolmachoff \(Lists\)
OK, I have an idea. Scott, can we disable HOLD1, and if so would that affect HOLD2 operation? 99.5% of messages held by HOLD1 end up passing. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL

RE: [Declude.JunkMail] Declude not taking action

2003-12-07 Thread John Tolmachoff \(Lists\)
There is only one Q file per message. If Declude locks it, Imail can do nothing with it. In the cases I have seen, there is a line in the log stating could not lock file. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED]

RE: [Declude.JunkMail] TESTFAILEDWITHWEIGHTS

2003-12-07 Thread John Tolmachoff \(Lists\)
That should be as follows per Scott: HIDETESTS WEIGHT10 WEIGHT20 (andsoforth) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Sunday, December 07,

RE: [Declude.JunkMail] Declude not taking action

2003-12-07 Thread John Tolmachoff \(Lists\)
Matthew, I have confirmed that this occurred on my server 4 times on Thursday. That works out to 1/10 of 1%. A lot more than your figure. Like I stated before, this is a concern as it let a virus through. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message-

Re: [Declude.JunkMail] TESTFAILEDWITHWEIGHTS

2003-12-07 Thread Daniel Grotjan
I have tried this and it did not work. I already have IPNOTINMX and NOLEGITCONTENT set up for this and they are not appearing in the TESTFAILEDWITHWEIGHTS variable. I added my weight test to it and they still appear. It is formatted as follows in my global.cfg HIDETESTS IPNOTINMX