Uhhh...why are you blocking SULFNBK.EXE? We've been emailing that file out
all day because of the morons who actually deleted that file from the lil
June Bug hoax. True, it isn't necessary for Windows, but it's pretty
helpful...
Jeff Underwood
[EMAIL PROTECTED]
WestCoastNet
(877)996-9700
-----Original Message-----
From: Len Conrad [mailto:[EMAIL PROTECTED]]
Sent: Thursday, May 31, 2001 1:39 PM
To: [EMAIL PROTECTED]
Subject: Re: OSRELAY: [IMail Forum] spammers (I hate them)
>One option would be to have IMGate ( http://imgate.meiway.com ) sitting in
>front of the IMail server, handling this a bit more gracefully.
That ip is a DUL
http://www.mail-abuse.org/cgi-bin/lookup?216.53.218.171
All those msgs would have been rejected at IMGate, none would have been
seen by Imail
Here�s a piece of today�s report for the latest ISP I�ve just set up with
IMGate:
Grand Totals
------------
messages
21219 received
24409 delivered
223 forwarded
510 deferred (2968 deferrals)
806 bounced
4841 rejected
281696k bytes received
308232k bytes delivered
7118 senders
1902 sending hosts/domains
5910 recipients
982 recipient hosts/domains
Per-Hour Traffic Summary
time received delivered deferred bounced rejected
--------------------------------------------------------------------
0000-0100 1369 1460 67 59 340
0100-0200 1293 1378 222 49 245
0200-0300 1207 1281 206 63 312
0300-0400 1166 1465 203 40 315
0400-0500 1124 1187 141 51 284
0500-0600 1061 1112 209 61 229
0600-0700 1116 1519 255 60 376
0700-0800 1193 1280 212 41 284
0800-0900 1431 1496 73 43 318
0900-1000 1392 1513 214 42 318
1000-1100 1501 1495 188 48 301
1100-1200 1527 2087 219 49 280
1200-1300 1466 1772 169 35 352
1300-1400 1566 2104 241 50 308
1400-1500 1812 1925 243 84 281
1500-1600 995 1335 106 31 298
1600-1700 0 0 0 0 0
1700-1800 0 0 0 0 0
1800-1900 0 0 0 0 0
1900-2000 0 0 0 0 0
A 20% to 25% rejection rate is about average.
Here�s the section for header and body filtering using regular expressions,
notice a few viruses caught without a virus scanner:
body
7 Content-Type: application/octet-stream; name="dwarf4you.exe"
4 Content-Type: application/octet-stream; name="joke.exe"
4 Content-Type: application/octet-stream; name="midgets.scr"
3 Content-Type: application/octet-stream; name="DSSSIG.EXE"
3 Content-Type: application/octet-stream; name="sexy
virgin.scr"
3 ?name="logos.exe"
2 ?name="news_doc.scr"
2 ?name="vmailvid.EXE"
2 Content-Type: image/gif; name="IEXPLORE.EXE"
2 Content-Type: application/octet-stream; name="IE4UINIT.EXE"
2 Content-Type: image/gif; name="DSSSIG.EXE"
2 Content-Type: application/octet-stream; name="116.00.exe"
1 ?name="Card.pif"
1 ?name="SULFNBK.EXE"
1 ?name="README.TXT.pif"
1 ?name="mso380.exe"
1 ?name="dpchameleon_install.exe"
1 Content-Type: application/octet-stream; name="AWADPR32.EXE"
1 Content-Type: application/octet-stream; name="LOADWC.EXE"
1 ?name="special_vacation_sh.exe"
1 Content-Type: application/octet-stream; name="IEXPLORE.EXE"
1 Content-Type: application/octet-stream; name="Mp3Decode.exe"
1 ?name="May Newsletter.exe"
1 Content-Type: application/octet-stream; name="REGSVR32.EXE"
1 ?name="logos2.exe"
1 ?name="lmscans.exe"
1 ?name="3D Wormhole.scr"
1 ?name="Sorry_about_yesterday.DOC.pif"
1 Content-Type: application/octet-stream; name="CDDAE2.exe"
1 ?name="Pics.ZIP.scr"
1 ?name="Sulfnbk.exe"
1 ?name="logos1.exe"
1 Content-Type: application/octet-stream; name="REDIR32.EXE"
header
9 Subject: [atlalist] warning--HOAX! previous URGENT virus
aler...
5 Subject: Virus Alert
5 Subject: FW: URGENT VIRUS ALERT
2 From: DustyC <[EMAIL PROTECTED]>
2 Subject: Virus Alert - REALLY
2 Subject: Fw: Virus Alert
2 Subject: Virus alert I had this read before June 1
2 Subject: Fw: Virus alert, please read before June 1
1 Subject: [AyeoneEmbroideryClub] VIRUS ALERT
1 From: [EMAIL PROTECTED]
1 Subject: Re: Match.com - You've Got Mail: well....
1 Subject: Fwd: new virus alert
1 FROM: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 From: "K4 Global Publishing" <[EMAIL PROTECTED]>,
1 Subject: virus alert
1 Subject: Fw: [Fwd: Fwd: jokes and such]
1 Subject: Fw: Virus alert; I found this one, I've emailed
you;...
1 Subject: filmscanners: Re: [DS] virus alert ?
1 Subject: RE: URGENT Virus Alert This is not a hoax !
1 FROM: [EMAIL PROTECTED]
1 From: Natasha44 <[EMAIL PROTECTED]>
1 Subject: VIRUS ALERT
1 FROM: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 Subject: Re: Virus alert, please read before June 1
1 Subject: Virus Alert!!!!!!!! from Lp
1 Subject: READ THIS FIRST BEFORE MY OTHER E-MAIL Fw: Virus
1 From: "Zonia J. Heath" <[EMAIL PROTECTED]>
1 From: <[EMAIL PROTECTED]>
1 From: Rebecca49 <[EMAIL PROTECTED]>
1 FROM: [EMAIL PROTECTED]
1 Subject: RE: URGENT VIRUS ALERT
1 Subject: [triple_s_embroidery] Re: virus alert
1 From: [EMAIL PROTECTED]
1 Subject: [triple_s_embroidery] virus alert
1 From: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 Subject: IMPORTANT VIRUS ALERT!!!!!!
1 Subject: Fwd: URGENT VIRUS ALERT MESSAGE.....READ IT! Teresa
1 Subject: Re: Virus Alert - REALLY
1 Subject: Re: Virus Alert!!!!!!!! from Lp -- HOAX!!!!
1 FROM: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 Subject: Virus alert/worst ever according to CNN (fwd)
1 From: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 Subject: RE: Virus Alert
1 FROM: [EMAIL PROTECTED]
1 From: <[EMAIL PROTECTED]>
1 From: "K4 Global Publishing" <[EMAIL PROTECTED]>,
1 Subject: Legit Virus Alert!!!!!!
Len
http://MenAndMice.com/DNS-training
http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
