I sure feel this way - not only the releases that are not mentioned but
also the bugs that are described that go unanswered.
I would guess these are some of the reasons this list is so dead now.
oh yea - I started w/ver 1.28 :)
-Nick
John Shacklett wrote:
Hi. Following along with the
in the 80_additional.cf rule set that are very good at tagging these
kinds of image spams.
And finally, Sniffer seems to successfully tag almost 100% of these
image spams, and Razor tags a majority of them, as well.
Bill
- Original Message - From: Nick Hayer [EMAIL PROTECTED
Snort will tell you in a heartbeat
-Nick
Marc Catuogno wrote:
I had my ISP (dsl.net) call and tell me that there was virus activity on our
circuit, namely port scans on 445 (maybe Sasser?). I have asked all my
agents to run the removal tool and do windows update. I have run Ethereal
but it
Hi Sandy,
Sanford Whiteman wrote:
Well, we've lately been running Razor *and* Sniffer and have found no
reason to give up either one.
How do you have Razor configed? eg is it on a win32 box? If so would you
share how you did it?
-Nick
---
This E-mail came from the Declude.JunkMail mailing
you can email info[AT]dnsstuff.com -
-Nick
Mark Reimer wrote:
I cannot access dnsstuff.com from my network. I think my IP may be
banned but I'm not sure how that would happen. How to I get in contact
with someone to see if I've been banned?
Mark Reimer
---
[This E-mail has been scanned
Hi John,
AH, use variables to set the date and then process by date.
simplicity is elegance :)
Now question,
how does that work if say you run the script on 04/01/06? Will it recognize
the day before as 03/31/06 or will it try to say it is 04/00/06?
Well it depends. What files will be
I am
-Nick
[EMAIL PROTECTED] wrote:
If anyone is using Declude with SmarterMail or IMail as a
Gateway could you get in touch with me off the list [EMAIL PROTECTED]
Thanks
Barry
I have trouble deciding if these are generally good or bad lists - do
any of you block them with certainty?
Thanks
-Nick
biglist.com
internetcrusade.com
rmxx.com
edxx.com
[both of the above replace the xx with 01,02,03,etc..]
roving/constantcontact
---
This E-mail came from the
this. Do I need to set
this up as a task, or how will it run?
Thanks for any tips.
Todd
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Nick
Hayer
Sent: Monday, April 03, 2006 3:59 PM
Take that code, adjust the paths/email addresses as need be, save
I would ask the questions on their list - this is the Declude junkmail
list - probably over there folks know it better and would get better info.
-Nick
Todd Richards wrote:
Per suggestions from others, I am looking to implement invURIBL on our mail
server (Imail 8.2x with Declude 4.0.9). I
Actually the grammar reminds me of Matt :)
-Nick
John Carter wrote:
I know some of you have seen such before, but the text below is the most
extreme (useless) attempt to get around filters I've seen. It looks like
something my son would text message.
LOL
John
Your c a redi z t doesn't
Hi Dean -
Dean Lawrence wrote:
First, what thresholds are most of you using, that causes minimal
screaming phone calls from client? 8-)
RELAYTHRESHOLD11020
RELAYTHRESHOLD23040
Secondly, how are you handling non-fixed IP users that may send large
(over the thresholds),
shShell.Run(mCmd , 1, TRUE)
End Function
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Nick Hayer
Sent: Sunday, April 02, 2006 7:59 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Hijack Notification
Hi Craig,
Although yo
]
[mailto:[EMAIL PROTECTED]] On
Behalf Of Nick Hayer
Sent: Monday, April
03, 2006 11:03
AM
To:
Declude.JunkMail@declude.com
Subject: Re:
[Declude.JunkMail]
Hijack Notification
Hi John,
John Doyle wrote:
this guy suggested this.
I'm not sure exactly how. looks like if a count
Hi Craig,
Although you may already do this figured I mention it anyway - this
technique works well to monitor spool traffic eg when a threshold is
reached I get an email - so for example in your code below IF
FFunc.Count 100 [altered path for the spool dir] send me an email...
-Nick
Hi Scott -
I do not quite understand - you could score each line [hit] with the
filter protected with a minweight to fail [to protect against false
positives ] and if necessary to contain the filter from overpowering
the scoring a maxweight to cap. The filter only runs once and will
Hi Dave,
I have one of these that will do what you want I believe. - I've moved
on to a Packeteer and a large Catalyst. If you are interested let me know.
http://www.netsys-direct.com/proddetail.php?prod=NS-2024Scat=12
-Nick
Dave Doherty wrote:
Hi, all-
I'll be providing VOIP and Internet
-DM02.htm
The short version being that if
you make sure that the Q*.SMD file (which can be any filename) contains
the "Q" row and a fully qualified D*.SMD file (which can be any
filename) you can just call:
smtp32.exe Qxxx.SMD and
IMail will queue it up immediately.
Hi Sandy
Sanford Whiteman wrote:
Andrew, I like your workaround with the Program Alias. However, I
think that instead, if people are willing to wait a few weeks to a
month, I can find time to put out a full-fledged external test for
Declude that does much the same thing,
Email customers that forward through me are getting their email bounced
because of the original sending domain's spf policy. I understand this
delima is addressed with Sender Rewriting Scheme
http://www.openspf.org/srs.html
Does anyone have a solution to this w/Declude Imail?
Thanks
PROTECTED]] On Behalf Of Nick Hayer
Sent: Saturday, March 04, 2006 11:40 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] spf breaks email forwarding -
Email customers that forward through me are getting their email bounced
because of the original sending domain's spf policy. I
Matt wrote:
Real-world issues include working around bad implementation, such as
surfglobal.net not configuring their server to reject messages that
fail SPF.
SRS is a work around - and I'm simply asking if anyone has implemented
it on an Imail/Declude platform. Kindly stay on topic I
Hi Todd,
Todd Richards wrote:
I
have adjusted the thresholds in the Hijack.cfg file (this is a common
practice by our members-only clients)
You can do anALLOWIPxxx.xxx.xxx.xxx and that ip will be
whitelisted.
but how do I release his IP address?
well it used to be
Hi John,
What is my best bet - jack up
the score a number of points for any mail coming from 86 87? Many of the
messages hardly trip any of the regular tests.
Wouldn't hurt - use blackholes.us and maybe score 40% of your hold
weight? I would say though blocking a /8 is not a good idea.
Kami Razvan wrote:
Hi;
It
seems like WEIGTRANGE tests are done at the very end.. no other filter
tests run.
Is that right?
this is correct. - no real exact order but the usual is WEIGHTRANGE
runs last...
-Nick
Regards,
- Kami
Excellent.
Thanks Scott!
-Nick
Scott Fisher wrote:
Thanks Bill, that's pretty nice. I've tripped over that page before,
but I never noticed the download link.
They are catching phish already here.
For the purposes of the list, here's the command file I put together
to download updates. I
Thanks Bill,
Bill Landry wrote:
BTW, if you are running ClamAV, and want to take full advantage of
it's phish catching capabilities, you might was to take a look at
adding the phish signature file that Steve Basford put together
I just installed the sigs and within 10 min I had 3 'hits':
Hi Gary,
Gary Steiner wrote:
I've never run ClamAV before. Looking at www.clamav.net, I see there are several Windows ports for it. Is anyone using one of the various Windows ports for ClamAV under W2K3? If so, which one is best?
no idea! But the one I use is
I do not think this would work - WEIGHT and WEIGTRANGE tests run last.
[I think!] As Scott suggested the only way I believe is to use the
SKIPIFWEIGHT directive.
For me it would sure be nice if we could use variables in the filter
files eg IF %WEIGHT% xx ELSE END sort of thingy..
-Nick
X-Note:
X-Note: This email was scanned for spam. [Details at
http://spamstats.madriveraccess.com]
X-Note: This email has been virus scanned by F-Prot,McAfee AV, and ClamAV.
X-Note: Please send abuse reports to [EMAIL PROTECTED]
X-Country-Chain:
X-Hello:
X-Note: SMTP
X-Note:
X-Note: This email was scanned for spam. [Details at
http://spamstats.madriveraccess.com]
X-Note: This email has been virus scanned by F-Prot,McAfee AV, and ClamAV.
X-Note: Please send abuse reports to [EMAIL PROTECTED]
X-Country-Chain:
X-Hello:
X-Note: SMTP
X-Note:
X-Note: This email was scanned for spam. [Details at
http://spamstats.madriveraccess.com]
X-Note: This email has been virus scanned by F-Prot,McAfee AV, and ClamAV.
X-Note: Please send abuse reports to [EMAIL PROTECTED]
X-Country-Chain:
X-Hello:
X-Note: SMTP
Morning..
Below is a sample email - which I classify as Nigerian sales. I am
having a tough time flagging them as the come from generally generally
legit accounts, have no links, etc. I have a filter that kinda works
but no question a lot slips thru. Can anyone suggest a way I can get
these?
Sanford Whiteman wrote:
Has no
one realized that this product is a commercial competitor to IMail or
SmarterMail, with no relevance to Declude?
I missed the post. .I actually had to look in my deleted emails to find
the email to which you were referring.. Obviously you are right - I
Title: Logged spam getting to mailbox
Odd - just because its always the same email. What number do you delete
on? Although the logs will balloon in size running the Declude in DEBUG
may shed some light. I presume this is Declude 3x ver?
-Nick
Agid, Corby wrote:
Hello,
I'm
Hi Jerod,
I use jffnms http://www.jffnms.org/ Its open source [free] runs on all
platforms and is very good.
-Nick
Jerod M. Bennett wrote:
Hey,
I know this is off topic, but I respect the knowledge and opinions of the
people on this list.
What software / services do you guys use to
John T (Lists) wrote:
BTW, what
server did DAD stand for? (It
never made it off the design board, of if it did it never became a
beta, only
an alpha.)
well with family court so prevalent I would guess MOM got all of DAD's
stuff?
-Nick :)
John T
eServices
For
Does anyone block them ?
bcentral.com, bcentralhost.com, linkexchange.com, listbot.com, and
listbuilder.com
Thanks for your input -
-Nick
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe,
, and maybe note the
submission to the Sniffer list, though I'm sure that Pete is seeing
this also.
Matt
Nick Hayer wrote:
What do you think?
I asked Matt and he said for me to try the link :)
-Nick
Received: from mx2.madriveraccess.com [12.152.254.14] by
mx1.vtbass.com with ESMTP
(SMTPD32-8.15
What do you think?
I asked Matt and he said for me to try the link :)
-Nick
Received: from mx2.madriveraccess.com [12.152.254.14] by mx1.vtbass.com
with ESMTP
(SMTPD32-8.15) id A234DC20330; Fri, 20 Jan 2006 20:45:24 -0500
Received: from hugin5.snet.uvm.dk ([195.231.243.86]) by
Matt wrote:
I'm sure that Nick will volunteer to have his server monitored by me
so that I can test this out on another box. I believe that he is also
on 2.0.6.16 as well.
sure and I am. Off list we need to discuss -
-Nick
Matt
David Barker wrote:
FYI Hyperthreading
Markus Gufler wrote:
My
conclusion for this day:
Normaly I should stay in bed
today as I'm more ill then healthy.
Agreed! We need you Markus so get well!
-Nick
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Friday, January
Matt -
So Are you using ORF to tarpit or MS SMTP and if the latter besides the
2 reg tweaks below do you make any other changes? The threads thing is
ok?
Thanks
-Nick
Matt wrote:
I just confirmed that this works properly. If the size limit is
exceeded for the DSN, it strips all
Thanks Sandy!
-Nick
Sanford Whiteman wrote:
--
SPAMC32 Release 0.5.58
1/10/2006
*
Release notes for this version:
[ + Added feature]
[ * Improved/changed feature ]
[ - Bug fix ]
[ ^ Cosmetic/naming change ]
Sanford Whiteman wrote:
I don't think it's me, I think it's Declude. Seems Declude is not even
interpreting these as zero scores, but simply not matching them to any
test definition at all? That's a substantial bug, if so. Can anyone
else,
I cannot get neg values returned I'm running
David,
David Franco-Rocha wrote:
B) Your software is NEVER downgraded
for any reason, either automatically or otherwise
hmm - would you kindly shut down your key server for awhile and monitor
the list in the meantime?
-Nick
We have had a few reports from
customers who
Hi David,
Would you kindly elaborate on the ramifications of such a failure? I am
interested in when its fixed but more importantly its ramifications.
Are you saying that a hardware/network/software issue on your end can
in anyway disarm/defuse/alter/change the way Declude functions on its
I was trying to make a joke but it is hard to do vie email at times.
:) Especially to Windows diehards :)))
I learned the abend term from Novell which is where I presumed
it was coined. I know nothing about mainframe admin so it may have
been born there.
-Nick
Sanford Whiteman wrote:
John T (Lists) wrote:
Is abend
some kind of French word?
AbnormalEnding. - circa 1985 - coined with the introduction of
Microsoft products.
-Nicko
;)
John T
eServices
For You
-Original
Message-
From:
[EMAIL PROTECTED]
[mailto:[EMAIL
I sure do get allot of spam from this ip space - are they legit and are
lacking in their monitoring or ?
Thanks -
-Nick
OrgName:WholeSale Internet
OrgID: WHOLE-125
Address:1102 Grand Ave Suite 905
City: Kansas City
StateProv: MO
PostalCode: 64106
Country:US
Scott Fisher wrote:
Does anyone have software to convert an IPFile to an DNS zone? My
IPFile has poped over 100 kb...
I can do it in a heartbeat for you in foxpro - I need a sample zone and
the ip file. If you have a copy of foxpro I will include the code back
to you.
-Nick
-
Try CONTAINS instead of BEGINSWITH
Make sure you have at least one crlf [a bunch would not hurt] at the
end of the filter file.
-Nick
Todd wrote:
I created a filter with the string
BODY0BEGINSWITHimg src="">
The declude.cfg goes like this
GIFINBODYFILTER filter
News
SUBJECT 50 STARTSWITH press release
SUBJECT 50 STARTSWITH news
SUBJECT 50 STARTSWITH top news
SUBJECT 50 STARTSWITH headline news
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Wednesday, December 07, 2005 1:16 PM
Hi Todd,
Todd wrote:
Quite a bit of spam has been getting
though lately. IPR tests are not stopping it and it only contains gif
as the message body. I am including one of gifs. Any way to stop this?
I use three filters - 2 have to kick off for the third to fire which
The filter will stop processing if "Content-Type:
image/gif " in not contained in the body of the email.
-Nick
Todd wrote:
Scott,
I am looking through the Declude
manualto determine what you are doing. I don't think I understand
NOTCONTAINS. I would think CONTAINS mean
Hi David,
David Lewis-Waller wrote:
If you could put up with
petrol at 93p a litre (which by my calc is approx $5.90 per U.S. gallon)
In the US taxes are based on income - whereas for you it would seem to
be based on consumption - I actually do not know which is 'cheaper' but
it would
Thanks Sandy - very kool!
On a block is any message returned to the sending mta - like a 550 or?
Configurable would be nice but I will not go as far as ask for it to be
a feature - however on the other hand :
For a feature - I need to be able to wild card a domain.
Currently maybe 5-10% of
Matt wrote:
I wouldn't care at all if the year was 3 months shorter.
Well at the expense of 25% shorter lifespan? Come on - its not that bad!.
[ Here in VT the kids have been snowboarding since before Thanksgiving.
Had 8 of snow at the house last night!]
-Nick
Matt
Orin Wells wrote:
Title: OT: Old Imail Forum
Hi Sharyn,
We missed ya! What bring you back to this neck of the woods?
-Nick
Sharyn Schmidt wrote:
I just tried signing up for the IMAIL
forum after a long absence and I'm noticing it is all webbased now?
Is the old Forum still around
Hi Kevin
Lots you could do - to wack this guy you could have a filter that that said
REMOTEIP END NOTCONTAINS 65.249.245.
REVDNS 0 CONTAINS csh.
I am not sure if REMOTEIP or REVDNS or MAILFROM is appropriate but you
get the idea..
In addition you could have an ipfile that you could list
I would suggest you look to add a URI filtering product like out
invURIBL.
David of Declude -
Will this feature be available in a future release?
Thanks
-Nick
All of these domains are listed on SURBL/URIBL. URI filtering is very
effective at capturing these patterns well before these
-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer
Sent: Thursday, December 01, 2005 1:55 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] weighting domains
I would suggest you look to add a URI filtering product like out
invURIBL.
David of Declude
: nick hayer [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, November 28, 2005 5:56 PM
Subject: [Declude.JunkMail] web email detection
I am trying to detect emails that are sent via webmail - be it from
yahoo, hotmail, etc. Can that be reliably done? What do I need to
look
Dan Geiser wrote:
X-Spam-Tests-Failed: IPNOTINMX, NOLEGITCONTENT, WEIGHT-HOLD,
KROPKA-IP, PSBL, UCEPROTECTL1, FILTER-SUBJECT ('olex') [148]
...or something similar to that.
a WARN will give you the line number within the filter that failed. That
has been my solut'n..
-Nick
It would
Matt wrote:
Hi Matt -
I have not had any issues at all - what other clues do you have to
offer? In your logs is there any simularity among the last message
processed before the crash(s). Do you record the 'peak memory usage' -
to see if there is some kind of of memory issue? Run the smtp
that would only add load to my system as a whole. I am in fact
working towards doing virus scanning after all JunkMail processes so
that I can save on processing power.
Matt
nick hayer wrote:
Matt wrote:
Hi Matt -
I have not had any issues at all - what other clues do you have to
offer? In your
Hi Geoff
Geoff Varney wrote:
Hi all,
I now successfully have
JunkMail using SPAMC32 to access a
Linux spamd server for SPAM. I am training the bayes database as the
user that
SPAMC32 is using to contact the spamd server. However, in this setup I
am not
getting any subject
I am trying to detect emails that are sent via webmail - be it from
yahoo, hotmail, etc. Can that be reliably done? What do I need to look
for in the headers?
Thanks!
-Nick
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail
I believe the COUNTRIES test would flag UK in the example below.
COUNTRY would not -
-Nick
Gary Steiner wrote:
Are you saying that if there are multiple countries in the path, it will flag all of them? I haven't seen that. For example, one spam I received today was like this:
Unknown will work as well as I recall..
-Nick
Kevin Bilbee wrote:
As far as I know declude only supports SPFFAIL and SPFPASS.
Please direct me to the release notes/documentation if I am wrong.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Hello -
I have this log entry :
E-mail whitelisted - automatically passing all spam tests [Imail]
I cannot figure out why this occurred - does anyone know what [Imail]
is to cause a whitelist?
Thanks!
-Nick
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just
Travis - I am not clear on what you are asking - the global.cfg is where
'$default.junkmail' lives for outgoing mail - is that it?
-Nick
Travis Sullivan wrote:
I searched, not a lot to be honest, the archive, and manual, but
couldn't find info on setting up outgoing mail scanning with
Right on -
Thanks Matt
-Nick
Matt wrote:
Nick,
This is a WHITELIST SUBJECT filter in your Global.cfg. It is matching
[Imail] in the subject line.
Matt
Nick Hayer wrote:
Hello -
I have this log entry :
E-mail whitelisted - automatically passing all spam tests [Imail]
I cannot figure
Hi John,
What I do in these cases is I have and ip file called
IP_FILE_SUSPICIOUS_NETWORK
(scored 25% of delete weight)
slap this network in there and if it re-occurs I move it to IP_FILE_NETWORK
(scored 40% of delete weight.)
I have the same scenario for the actual hosts themselves -
David Barker wrote:
Christian,
Another way that you could deal with this specific Microsoft Office Outlook
build is to create a filter that contains the following:
HEADERS -8 CONTAINS Microsoft Office Outlook, Build 11.0.5510
As a suggestion to limit the collateral damage I would
Well Matt when I read the link I was figuring you were fessing up to
how far off you were [are] on SPF - it was only until I read the end
that I understood to what you were referring. :)
-Nick
Matt wrote:
Hmm, who would have thunk?
Subject: Re: [Declude.JunkMail] SPF Success
Date
;)
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Nick
Hayer
Sent: Wednesday, November 16, 2005 3:31 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] OT: another SOBERing though
Well Matt when I read the link I was figuring you
Hi David,
David Franco-Rocha [ Declude ] wrote:
Please note that we receive a large amount of spam at our technical
support email address for the ticket system. When I look through the
tickets, I delete whatever looks like spam, as well as all tickets
that do not contain a subject.
Travis Sullivan wrote:
It is my understanding that it's just the sending IP, the last server
that connects to your server.
So can there be a way to filter [detect] on the other ip's contained in
the route? for example:
Host MTA(1)MTA(2) MTA(3).
Now MTA(2) is a forwarder and I would
Would any one know what ip would trigger a listing in the ipfile? Is it
any ip along the route, the connecting ip, or the sending ip?
Thanks -
-Nick
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
There is in declude.cfg the switch DNSOVERRIDE ; I am not clear if this
will take multiple dns boxes or not -
-Nick
Darrell ([EMAIL PROTECTED]) wrote:
Travis,
My understanding is that Declude only uses the first DNS server
specified in IMAIL. This can be overridden in the global.cfg, but
Hi Richard,
You need to rename the files removing the ip address - so each fire
begins with its respective 'Q' or 'D' and put those renamed files in
the spool dir.
-Nick
Richard Farris wrote:
Message
I had some mail stuck in HOLD2 that
I want to let go..I copied it and put it
ernet"
-
Original Message -
From:
Nick Hayer
To:
Declude.JunkMail@declude.com
Sent:
Monday, October 31, 2005 7:45 AM
Subject:
Re: [Declude.JunkMail] Hijack Help
Hi Richard,
You need to rename the files removing the ip address - so each f
Hi Travis -
That looks correct - and is how I do mine. One suggestion though - the
first line in the filter should be
SKIPIFWEIGHTweight that is slightly above your delete weight
The idea is here is to prevent a filter from firing needlessly, Along
that same idea - filters execute in the
email you can see the testing order.
-Nick
Travis
- Original Message - From: Nick Hayer [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Sunday, October 23, 2005 12:09 PM
Subject: Re: [Declude.JunkMail] found something new to me
Hi Travis -
That looks correct - and is how I
Travis -
You are not slow - this is some what confusing until you get the hang of it.
Are you all set? Do you understand now how it works?
-Nick
Travis Sullivan wrote:
I think I got it... I am slow, I know :)
global.cfg contents:
COMBO filter C:\IMail\Declude\lists\combo.txt x 0 0
Hi Travis -
I think most folks use combo's - the idea is to further punish an email
that fails more than one reliable test [like sniffer and xbl or ???.].
This is where Declude really shines - being able to punish emails
further based on previous test results. - you do not have to score
Andy -
Very kool with the script! Thanks for sharing. I can sure use it -
-Nick
Andy Schmidt wrote:
I have done this in two ways.
You can export the registry and then use an editorthat can handle line
breaks and other control characters(such as MS Words) to massage the
text
Here ya go Andy:
http://www.declude.com/tools/header.php
-Nick
[EMAIL PROTECTED] wrote:
Hi,
Can someone point me to detailed info on what the BADHEADERS test looks
at and/or how this error can be remedied? Already looked in the declude
manual, not enough info.
Thanks, Andrew
ISP guy
---
good link. I saw the apache errors as well - but only 168 total.
-Nick
Matt wrote:
Do you think it is possible that this is connected to the rash of
broken spamware that started yesterday (Apache error message from spam
zombies)? I have gotten probably 5,000 of those in the last 24 hours.
Matt wrote:
Are you sure about that?
As sure as I can be -
Since midnight we have received 1,233 of them. Yesterday was even worse.
Today we have received 276.
-Nick
Matt
Nick Hayer wrote:
good link. I saw the apache errors as well - but only 168 total.
-Nick
Matt wrote:
Do
Thanks John!
-Nick
John T (Lists) wrote:
A clarification on how to reset Hijack:
For Declude versions 2.x and below, you need to end the Deccon.exe process.
It is also best to do this with Imail SMTP and Queue Manager service stopped
and no Declude.exe processes running to ensure that no
Dave,
You need to stop/start deccon.exe That wil reset the counter so to speak.
Question to Declude support -
How does this work with Declude 3x?
Thanks!
-Nick
Dave Doherty wrote:
Hi all,
Running Declude version 1.82 with Hijack...
One of my customers go caught by Hijack a couple of
Thanks !
-Nick
David Barker wrote:
Stop/restart the decludeproc service
David B
www.declude.com
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer
Sent: Wednesday, October 12, 2005 12:53 PM
To: Declude.JunkMail@declude.com
Subject: Re
Hi -
Well this is what I do on these -
Right off I put the ip space in my ipfile_suspicious_networks
65.175.2.0/24 Viper Hosting
If I keep getting spam from then then they go to the ipfile_networks
which I score higher.
Same for an entry into ipfile_suspicious_hosts
I then I would
You are always on top of this stuff Matt!
-Nick
Matt wrote:
This is spam from Scott Ricter, Spamhaus's #1 listed spammer. This
particular block is 65.175.2.0/24. Surprisingly it isn't widely
listed, but I did find it in MAILPOLICE, and if you have URIBL
support, it is also in SURBL
John, [or others ]
I use SpamReview to review held email. How does this fit now into the
mix with 3x Declude? I presume SpamReview will dump the 'return to
queue' files back into the /spool dir. Is this ok?
-Nick
John T (Lists) wrote:
I understand that in Declude 2.x and lower
David,
I just want you to know I really appreciate your participation in this
list. I find it very helpful and reassuring!
Thanks!!
-Nick
David Barker wrote:
We have received the ticket and are currently looking into the issues
regarding MAILFROM and COUNTRY
David B
www.declude.com
Well this is more of a question than a stab -
Can we see the full header? Yesterday I had something very similar -
email from Venezuela but the ip was registered in Virginian according
to Arin.
-Nick
Darrell ([EMAIL PROTECTED]) wrote:
Anyone want to take a stab at this one I would
Thank you David - will let you know if I see any issues!
-Nick
David Barker wrote:
2 new Directives
WAITFORTHREADS 1500
Located in the Declude.cfg - Defined in milliseconds eg. 1500 = 1.5 seconds
this can be changed so that when the maximum threads are in use this time
specifics the
101 - 200 of 329 matches
Mail list logo
