Hi David
I just upgraded from 4.10.72 to 4.10.78 and noticed a build-up of files in the
/IMail/Declude/SNF directory with names
p59us2lf.20110801.log.xml
Before after the upgrade, my diag.txt file shows that SNF is OFF (see below).
Have I done something wrong to cause these files to be built?
On 8/5/2011 11:13 AM, Ferrell Ard wrote:
Hi David
Â
I just upgraded from 4.10.72 to
4.10.78 and noticed a build-up of files in the
/IMail/Declude/SNF directory with
names
We are seeing some viruses that are getting thru IMail/Declude
and wonder if anyone might have suggestions for a way for
Declude to catch/delete them.
Trojan Horse
Backdoor.Paproxy
Trojan.Wsnpoem
Backdoor.Trojan
Downloader.Diliv
Thanks very much
Ferrell
---
: Tuesday, August 19, 2008 2:06 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Question about Declude
We are seeing some viruses that are getting thru IMail/Declude
and wonder if anyone might have suggestions for a way for
Declude to catch/delete them.
Trojan Horse
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Question about Declude
We are seeing some viruses that are getting thru IMail/Declude
and wonder if anyone might have suggestions for a way for
Declude to catch/delete them.
Trojan Horse
Backdoor.Paproxy
Trojan.Wsnpoem
Backdoor.Trojan
Downloader.Diliv
.
Ferrell
- Original Message -
From: John Doyle
To: declude.junkmail@declude.com
Sent: Tuesday, August 19, 2008 4:05 PM
Subject: RE: [Declude.JunkMail] Question about Declude
Are you running the Declude AVG or other virus scanner and you are getting
leakage?
Or do you not have
From: Ferrell Ard [EMAIL PROTECTED]
Sent: Tuesday, August 19, 2008 8:44 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Question about Declude
We have Declude AVG (sure hope I have it configured
correctly).
We also have Symantec
-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Tuesday, April 29, 2008 5:36 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Question on mailbox action...
If I institute a mailbox action like
WEIGHT10 MAILBOX spam
Will Imail automatically
30, 2008 10:47 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Question on mailbox action...
I am not trying to re route the messages. What I want to do is place the
email in a spam folder for each user if the message exceeds a certain
weight. The mailbox action in declude
The answer to your question is yes, the mailbox is created automatically.
We use it all the time.
Ben
- Original Message -
From: Chuck Schick [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Wednesday, April 30, 2008 7:47 AM
Subject: RE: [Declude.JunkMail] Question on mailbox
Schick
Sent: Tuesday, April 29, 2008 2:36 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Question on mailbox action...
If I institute a mailbox action like
WEIGHT10 MAILBOX spam
Will Imail automatically create the folder spam for the user if it
does not already exist
If I institute a mailbox action like
WEIGHT10 MAILBOX spam
Will Imail automatically create the folder spam for the user if it does
not already exist?
Thanks
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
---
This E-mail came from the Declude.JunkMail mailing list. To
] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck
Schick
Sent: Tuesday, April 29, 2008 5:36 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Question on mailbox action...
If I institute a mailbox action like
WEIGHT10 MAILBOX spam
Will Imail automatically create the folder spam
Hi All;
We have a couple customers that we used to host mail for that now have
their own Exchange servers. However, we still filter their mail using
the Smartermail 4.3 Domain Forwarding feature.
We normally mark mail with 15 spam points and delete at 40. They have
asked us to no longer
I have a problem I have been trying to solve. When a contains filter comairs
abainst the body of the email where does that body begin? Does it begin at
the mime segment or does it begin at actual content?
For example If I have something like this
Received: from ns1.ssc-isp.net [12.9.25.242] by
I believe it starts immediately following the first double CFLF. I'm
not sure if the STARTSWITH filter for BODY is tweaked in any way, but if
it is it only ignores CRLF's and not other characters.
Matt
Kevin Bilbee wrote:
I have a problem I have been trying to solve. When a contains
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Question about filtering
I believe it starts immediately following the first double CFLF. I'm
not sure if the STARTSWITH filter for BODY is tweaked in any way, but if
it is it only ignores CRLF's and not other characters.
Matt
Kevin
I thought it replaced CRLF's with a space.
- Original Message -
From: Matt [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, December 12, 2005 3:36 PM
Subject: Re: [Declude.JunkMail] Question about filtering
I believe it starts immediately following the first double
@declude.com
Subject: Re: [Declude.JunkMail] Question about filtering
I thought it replaced CRLF's with a space.
- Original Message -
From: Matt [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, December 12, 2005 3:36 PM
Subject: Re: [Declude.JunkMail] Question about
PROTECTED]]On Behalf Of Matt
Sent: Monday, December 12, 2005 1:37 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Question about filtering
I believe it starts immediately following the first double CFLF. I'm
not sure if the STARTSWITH filter for BODY is tweaked in any way,
, December 12, 2005 4:43 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail]
Question about filteringLet's clarify a couple of things
that might have been confused here.The original question was asking
where the BODY begins. That is what my response was
addressing.When
-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Monday, December 12, 2005 4:43 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Question about filtering
Let's clarify a couple of things that might have been confused here
We have 3 declude gateway servers that sit in front of our Exchange system.
We want to move the three round-robin DNS servers to a VIP on our Foundry
Load Balancers.
The load balancers can be setup in a source NAT configuration (which is
easier) or DSR (Direct Server Return).
In source NAT the
Use SKIPIP
John T
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Mark E. Smith
Sent: Saturday, June 25, 2005 3:02 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Question about load balancers
Subject: [Declude.JunkMail] Question about load balancers
and source
IP
We have 3 declude gateway servers that sit in front of our Exchange
system.
We want to move the three round-robin DNS servers to a VIP on our
Foundry Load Balancers.
The load balancers can be setup in a source NAT
OOPS!
IPBYPASS
John T
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Mark E. Smith
Sent: Saturday, June 25, 2005 4:45 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Question about load
Does Declude/IMAIL care about the IP address that's making the
connection?
In other words, does it use that IP address for its tests? If
so, will HOP=1 fix this?
I have never used a Foundry Load Balancer so my response may be way off. I
am assuming it is not functioning as a MTA, but is
I have never used a Foundry Load Balancer so my response may
be way off. I am assuming it is not functioning as a MTA, but
is simply rewriting the source IP portion of packets.
Correct but it only does this at the IP level, not at the SMTP protocol
level.
In other words, Windows IP gets the
Hi All,
Hope you don't mind another simple question...
I have a spam message with a weight of 2:
X-Spam-Tests-Failed: SNIFFER [2]
The problem with this line was that we have sniffer weighted at 7. So I
went to the Declude JM log and came up with this:
03/01/2005 13:17:46 Qdbca042102961063
Could it be the NOLEGITCONTENT test?
- Original Message -
From: Imail Admin [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Tuesday, March 01, 2005 3:33 PM
Subject: [Declude.JunkMail] question on calculating weights
Hi All,
Hope you don't mind another simple question...
I have
On Tuesday, December 14, 2004, 6:23:58 PM, Chris wrote:
CU Thanks all for the info. Went ahead, bought it, seems to be working well
CU and is helping to catch a lot of what is out there.
CU I've updated the script (AutoSNF.cmd) which is used to fetch the latest
CU definitions. I've got it
: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Katie
LaSalle-Lowery
Sent: Monday, December 13, 2004 10:57 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Question on SortMonster/MessageSniffer
Hi Chris,
I suspect that you'll find that many of the Declude users are this list
Chris,
Sniffer will catch ~96% of all spam with 99.8% accuracy (on my system at
least). While building redundancies is important in any system, it is
the single most effective tool that is available to Declude users, and
it fulfills a large part of the content filtering that you have been
It looks like it scores pretty well...
http://www2.spamchk.com/public.html
Yes I can confirm this. (The results you can see on the link above are
results on my Mailserver)
I can highly recommend Messagesniffer because the rules are always up to
date (2 - 4 each day) and as you can see
(Business)
Fax:+1 201 934-9206
http://www.HM-Software.com/
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Chris Ulrich
Sent: Monday, December 13, 2004 12:45 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Question on SortMonster/MessageSniffer
Is anyone using this product as part of their filtering?
http://www.sortmonster.com/MessageSniffer
Any feedback?
Does it download definition updates or something similar, or is it purely
rules based and the only update would be to the program itself?
How would you integrate this in to the config
I've never heard of it.
- Original Message -
From: Chris Ulrich [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, December 13, 2004 12:45 PM
Subject: [Declude.JunkMail] Question on SortMonster/MessageSniffer
Is anyone using this product as part of their filtering?
http
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Chris Ulrich
Sent: Monday, December 13, 2004 10:45 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Question on SortMonster/MessageSniffer
Is anyone using this product as part of their filtering?
http
Ulrich
Sent: Monday, December 13, 2004 10:03 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Question on SortMonster/MessageSniffer
It looks like it scores pretty well...
http://www2.spamchk.com/public.html
That said, and I'm embarrassed to ask two questions in one day, but what
] On Behalf Of Chris Ulrich
Sent: Monday, December 13, 2004 12:45 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Question on SortMonster/MessageSniffer
Is anyone using this product as part of their filtering?
http://www.sortmonster.com/MessageSniffer
Any feedback?
Does it download definition
: Monday, December 13, 2004 10:45 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Question on SortMonster/MessageSniffer
Is anyone using this product as part of their filtering?
http://www.sortmonster.com/MessageSniffer
Any feedback?
Does it download definition updates or something similar
] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Chris Ulrich
Sent: Monday, December 13, 2004 11:17 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Question on SortMonster/MessageSniffer
Do you have to configure a service with FireDaemon to check every hour or
does it do
We only use Imail as a Gateway.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of sbsi lists
Sent: Tuesday, November 09, 2004 5:01 PM
To: Markus Gufler
Subject: Re[2]: [Declude.JunkMail] Question on Dell Poweredge 1750
Hi Markus,
Interested
Hello Markus,
Tuesday, November 9, 2004, 10:31:27 AM, you wrote:
MG I've to set up Imail/Declude on a Dell Poweredge 1750 with Dual 3 GHz Xeon
MG CPUs and 4 Ethernet Ports.
MG 2 x Intel NICs
MG 2 x Broadcom NetXtreme Gbit NICs
MG Now I have two questions:
MG 1.) Anyone has had the known
Absolutely put your spool on it's own partition and have Declude and any
other related application log to that partition. Both the IMail and
Declude logs cause an unbelievable amount of fragmentation, and if you
put these on your system partition, you will quickly diminish your
system's
]
To: [EMAIL PROTECTED]
Sent: Tuesday, November 09, 2004 10:31 AM
Subject: [Declude.JunkMail] Question on Dell Poweredge 1750
I've to set up Imail/Declude on a Dell Poweredge 1750 with Dual 3 GHz Xeon
CPUs and 4 Ethernet Ports.
2 x Intel NICs
2 x Broadcom NetXtreme Gbit NICs
Now I have two questions
MG 1.) Anyone has had the known Imail-NIC problems with this
Ethernet ports?
Yep.
And your solution? Installing another NIC card (3Com) beside the other four
existing ethernet ports?
Don't do that. Create 2 more partitions with the rest of your
69G. One for Imail program files and one
Hello Markus,
Tuesday, November 9, 2004, 11:20:16 AM, you wrote:
MG And your solution? Installing another NIC card (3Com) beside the other four
MG existing ethernet ports?
Yea, that's what we reluctantly did. This is our most annoying Imail
issue. We restart SMTP and Queue service as well.
Hello Markus,
Tuesday, November 9, 2004, 10:20:16 AM, you wrote:
MG 1.) Anyone has had the known Imail-NIC problems with this
Ethernet ports?
Yep.
MG And your solution? Installing another NIC card (3Com) beside the other four
MG existing ethernet ports?
Don't do that. Create 2 more
Hello Charles,
Tuesday, November 9, 2004, 11:42:56 AM, you wrote:
CF Just as a note, you can use Kiwi Syslog as your syslog server (it's free if
CF you don't want to use the more advanced features), then write the log
CF files from Kiwi to anywhere on the system you want, you can even run
CF it
1.) Anyone has had the known Imail-NIC problems with this
Ethernet ports?
We have 4 1750's using adapter teaming without any problem.
Although I've never heard of an application level issue with a NIC (in
WinNT+)
2.) The system is preconfigured with Win2003 Server on 2 x 80
GB RAID 1 SCSI
Hello sbsi,
Tuesday, November 9, 2004, 5:00:39 PM, you wrote:
sl How do you handle larger mail boxes/webmail/imap if you are
sl keeping your /imail/ main directory/program files down to a lower
sl disk space?
sl I understand keeping the disk space down to a minimum but
Disks generally maintain throughput in 20 GB chunks these days, which
leaves you with plenty of wiggle room. When creating partitions, the
system obviously goes first, then followed by your IMail Users and then
your Spool. The other partitions on your system shouldn't be accessed
with any
, November 02, 2004 1:43 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Question about Filters
After reviewing my Debug log, I found that the FromFiles are run first.
Obviously, most email is spoofed and therefore will not show up,
however, does Declude actually check fromfile for the mailfrom
Can you use the SKIPIFWEIGHT and MAXWEIGHT in the fromfiles?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson
Sent: Wednesday, November 03, 2004 2:38 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Question about Filters
Scott
Is there any size limitation (# of entries per file) imposed on
fromfiles or the number or fromfiles you can have listed in the
Global.cfg?
No.
Can you use the SKIPIFWEIGHT and MAXWEIGHT in the fromfiles?
No.
-Scott
---
Declude JunkMail:
.
- Original Message -
From: Keith Johnson [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, November 03, 2004 2:30 PM
Subject: RE: [Declude.JunkMail] Question about Filters
Can you use the SKIPIFWEIGHT and MAXWEIGHT in the fromfiles?
-Original Message-
From: [EMAIL PROTECTED
After reviewing my Debug log, I found that the FromFiles are run first.
Obviously, most email is spoofed and therefore will not show up,
however, does Declude actually check fromfile for the mailfrom line or
what it shows up as the X-Declude-Sender line? If it is indeed the
X-Declude-Sender, it
After reviewing my Debug log, I found that the FromFiles are run first.
Obviously, most email is spoofed and therefore will not show up,
however, does Declude actually check fromfile for the mailfrom line or
what it shows up as the X-Declude-Sender line?
Both. The X-Declude-Sender: header
Title: Message
I
think this will do
Thank you all
Alex
V
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Scott FisherSent: Friday, October 15, 2004 1:33
PMTo: [EMAIL PROTECTED]Subject: Re:
[Declude.JunkMail] Question
You could
Title: Message
I
would like to have a test
that
checks if a message has been found on 3 or more black lists
Then
if that is the case, assign more points to it...
Is
this posible ??
Thanks...
Alex
Valenzuela
On 15 Oct 2004 at 12:49, Alejandro Valenzuela wrote:
Alex -
I would like to have a test
that checks if a message has been found on 3 or more black lists
Then if that is the case, assign more points to it...
Is this posible ??
Well I do not know how to count the number of failed tests but
Hi,
I subscribed to this list yesterday afternoon at
3:40pm and have not received a single message from anyone. Is there nobody
on this list??
Thanks,
Melissa
The list gets 4-12 messages a day, sometimes goes a couple
of days with nothing.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Melissa
SheldonSent: Thursday, October 07, 2004 1:50 PMTo:
[EMAIL PROTECTED]Subject: [Declude.JunkMail]
Question
Hi,
I
Message -
From: Melissa
Sheldon
To: [EMAIL PROTECTED]
Sent: Thursday, October 07, 2004 2:50 PM
Subject: [Declude.JunkMail] Question
Hi,
I subscribed to this list yesterday afternoon at
3:40pm and have not received a single message from anyone. Is there nobody
on this list??
Thanks
[EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Sunday, September 19, 2004 9:42 AM
Subject: Re: [Declude.JunkMail] Question about END operation
I ran into an unexpected behavior with END statements that I could use
some clarification on if you don't mind. Could you tell me which one
and Scott Fisher)
Andrew 8)
-Original Message-
From: Scott Fisher [mailto:[EMAIL PROTECTED]
Sent: Monday, September 20, 2004 7:17 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Question about END operation
Now that we've had two people wanting END to End with weight
I ran into an unexpected behavior with END statements that I could use
some clarification on if you don't mind. Could you tell me which one of
the following is the intended behavior:
* When an END condition is matched, the processing of the file will
stop and the current score of the
Thanks.
Matt
R. Scott Perry wrote:
I ran into an unexpected behavior with END statements that I could
use some clarification on if you don't mind. Could you tell me which
one of the following is the intended behavior:
* When an END condition is matched, the processing of the file
will
For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Saturday, September 18, 2004 5:48 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail]
Question about END operation
Scott,
I ran into an unexpected behavior with END statements
DANGER WILL ROBINSON!
Scott, that might not be good newbie advice to implement that config,
but thanks for the credit :)
I think what Matt should probably look first at what would be how to
configure the tests to do lookups from the same domain for all three
tests in order to be a tad bit
Hello All,
I am new to declude and trying to figure all of this
out. So far things have been going very well.
I have been reading the mail archives and seen a few
global.config examples and have pulled a few tests out to run.
In my global.config I am running these two tests:
SBLl is a subset of SBL-XBL
sbl-xbl return code 127.0.0.2 = SBL
sbl-xbl return-code 127.0.0.6 = XBL from Blitzed-all
sbl-xbl return-code 127.0.0.4 = XBL from CBL
The blitzedall + CBL are referred to as the XBL
I use some of the ideas laid out by Matt with his configuration. He posted it in early
Matt,
Check this out http://www.spamhaus.org/xbl/index.lasso
The sbl-xbl.spamhaus.org is a combination of both the sbl.spamhaus.org data and
xbl.spamhaus.org data
You are checking some of the same data twice.
Stu
At 02:55 PM 07/06/2004 -0400, you wrote:
Hello All,
I am new to
But Imail doesn't understand port 587 Or does it? I can't find a thing
on their kbase about it.
-d
What I do think would work much better in the near term would be for
every mail server to support and require SMTP AUTH through port 587 as
proposed, and then have every ISP out there block
This brings up a good point, if I client is located in another part of the
US and we have no way to know what IP Address they might be using. How can
this be setup? For example, our server has around 16 IP's, 12.177.8.48 to
12.177.8.63, but we have clients that will not be connected within this
This brings up a good point, if I client is located in another part of the
US and we have no way to know what IP Address they might be using. How can
this be setup? For example, our server has around 16 IP's, 12.177.8.48 to
12.177.8.63, but we have clients that will not be connected within this
:44 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Question on SPF Setup. Was under You
**May** etc **May** etc
This brings up a good point, if I client is located in another part of the
US and we have no way to know what IP Address they might be using. How can
this be setup
If someone sends an email and it shows up on our server as a 64. address.
What about when the message is delivered to someone at AOL? Will it also
see the 64. address, therefore fail the SPF test on their end also?
No. AOL will only see the IP address of your server, and use that for
Sorry to butt in on this one...Yes, SPF would fail on other systems as
well in that situation.
If the client connects directly to AOL, SPF would fail. But if it is sent
through the mailserver, it should not fail.
As far as I can tell, SPF-PASS is not useful because there is nothing
stopping
R. Scott Perry wrote:
In this case, what you should do is use v=spf1 mx ?all. That says
If the E-mail is coming from an IP in our MX record, we authorize
it. If it is coming from any other IP, we can't say whether or not it
is legitimate -- treat it the same as if we have no SPF record.
In
: Matt [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, June 30, 2004 11:24 AM
Subject: Re: [Declude.JunkMail] Question on SPF Setup. Was under You **May**
etc **May** etc
Grant Griffith - Declude JM wrote:
If someone sends an email and it shows up on our server as a 64. address.
What about
The text filters check on BODY or SUBJECT,
What about the text on the HEADERS ??
Also, how can I put wildcards on filters ??
Couldn't find the manual at declude.com
www.declude.com\manual.htm
Anybody have the correct link ??
Thanks
AV
---
[This E-mail was scanned for viruses by Declude Virus
The text filters check on BODY or SUBJECT,
What about the text on the HEADERS ??
Yes, the filters work fine on headers, such as:
HEADERS 5 CONTAINS EvilWord
Also, how can I put wildcards on filters ??
You cannot, but you can do things such as:
HEADERS 5 STARTSWITH EvilWord
to catch EvilWord*.
Scott,
I'm finding this difficult to test and thought that I would ask it
instead. I've found some heavy obfuscation in some Nigerian stuff that
has be scratching my head about how to filter it. One such messages
contains the following:
THE OWNER OF THIS ACCOUNT LATE MR.DENNIS BR=
OWN ,HE
I'm finding this difficult to test and thought that I would ask it
instead. I've found some heavy obfuscation in some Nigerian stuff that
has be scratching my head about how to filter it. One such messages
contains the following:
THE OWNER OF THIS ACCOUNT LATE MR.DENNIS BR=
OWN ,HE DIED
Thanks.
. I'm sure it goes without saying that MIME decoding would be a nice
addition whenever that pops to the top of your to-do list. This one
message was clearly obfuscated using that technique, and the sender was
careful to find a free mail provider that would send quoted-printable
I tripped across an e-mail from February where you put together a combo test for the
DULs. Of course, I can't find that message again.
I considering one for PROXY-COMBO with a maxweight so I can avoid the piling on too
many points from multiple databases, yet I can still score the -DYNA and
Scott,
The idea behind DUL-COMBO is that a dynamic/residential IP is a
dynamic/residential IP, so it doesn't make sense to variably score the
IP based on how many DUL tests it hits. What I did was test something
like 9 different DUL tests and I excluded the ones that had false
positives,
I seem to be having issues trying to filter subject or body lines for the = symbol.
In my wordfilter file, there is a line such as:
BODY 8 CONTAINS style=font-size:1p
Is this just me, or am I really missing something.
What are the restricted characters in these files?
I checked the manual
I seem to be having issues trying to filter subject or body lines for the
= symbol.
In my wordfilter file, there is a line such as:
BODY 8 CONTAINS style=font-size:1p
I'm not aware of any problems using the = sign in filters. I believe the
only restricted characters are the % sign (which are
, MCSE², CCNA, Security+, A+
Network Security Engineer
ASysTech, Inc.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Monday, April 05, 2004 5:13 PM
To: [EMAIL PROTECTED]
Subject:Re: [Declude.JunkMail] Question about using an equal sign
PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Monday, April 05, 2004 5:13 PM
To: [EMAIL PROTECTED]
Subject:Re: [Declude.JunkMail] Question about using an equal sign in the wordfilter in
Declude
I seem to be having issues trying to filter subject or body lines for
the = symbol
Hello all,
I just received an email with the following headers...
Received: from mx1.myoffer2u.com [205.138.96.41] by mail.pepperlink.net with
ESMTP
(SMTPD32-8.05) id A8B120AA00BA; Tue, 09 Mar 2004 17:44:01 -0500
Received: from centramedia.net (205.138.96.41) by mx1.myoffer2u.com
(PowerMTA(TM)
The first message's source is well listed and should have been tagged
better if your tests were in the default configuration, and many would
probably have thrown every more at it.
http://www.dnsstuff.com/tools/ip4r.ch?ip=205.138.96.41
The second E-mail looks to be severely munged and has no
: [Declude.JunkMail] Question about MAILBOX action.
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Saturday, January 31, 2004 9:14 AM
Subject: Re: [Declude.JunkMail] Question about MAILBOX action.
Received: from SMTP32-FWD by joshie.com
(SMTP32) id A047C0052
Since that change I've noticed that spam (like the attached) that is to
[EMAIL PROTECTED] can end up in my inbox (I have jlevitsk as an alias to root
on the server) rather than it going in to my JunkMail folder.
Received: from SMTP32-FWD by joshie.com
(SMTP32) id A047C0052; Fri, 30 Jan 2004
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Saturday, January 31, 2004 9:14 AM
Subject: Re: [Declude.JunkMail] Question about MAILBOX action.
Received: from SMTP32-FWD by joshie.com
(SMTP32) id A047C0052; Fri, 30 Jan 2004 20:31:00
Scott or anyone else that knows...
Weird thing. I just started using
MAILBOX JunkMail
As an action for mail and I use the imail util that purges old messages to
make it so junk stays for 7 days max in the JunkMail folder for any user.
Since that change I've noticed that spam (like the
Hey Josh,
MAILBOX follows the alias to the final destination. I believe that
IMail writes this to the Q* file when the E-mail is received. It would
not be a good idea to have it only work with the To address because
these things don't always point to real accounts (think nobody alias
and the
1 - 100 of 201 matches
Mail list logo
