[Declude.JunkMail] Blacklisting bounce
If I add bounce@ and bounce- to my blacklist file, will it block all mail from [EMAIL PROTECTED] and [EMAIL PROTECTED] ? Cris Porter Jvc America --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] New Test?
Scott, I was wondering if you could add a new test to Declude JunkMail? This test could be called similar addresses. If someone sends a message to multiple addresses and the to, cc or bcc of all the addresses contain helpdesk@ then I'd think it's a pretty good bet that it's a spam message. For example I just received a spam message to [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Any thoughts? Later, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Spamcop Dead.
Sapmcop does not seem to be working this morning. Anyone know what is up. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Spamcop Dead.
No specific idea, but I did just watch a HUGE network instability pass through the UUNet network... Took the last half hour or so to stabilize (knock wood). Maybe that's part of it. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Chuck Schick | Sent: Thursday, April 25, 2002 10:19 AM | To: Declude. JunkMail (E-mail) | Subject: [Declude.JunkMail] Spamcop Dead. | | | Sapmcop does not seem to be working this morning. Anyone | know what is up. | | Chuck Schick | Warp 8, Inc. | 303-421-5140 | www.warp8.com | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Bad Headers / Spam Headers
We have a customer who is (legitimately) sending mail from an .asp script or some kind of custom CGI on his hosted server. I have already verified to a high level of confidence that this is not any form of spam and that his mailings are properly checked (double opt-in, etc.) before sending. His mail is being flagged on our server as failing the badheaders and spamheaders tests. Is it possible to find out exactly *what* portion of the headers are being malformed or are not in compliance in order that he can correct the problem. I realize that this is a potentially sensitive issue as it involves the release of information that might be useful to the enemy. On the other hand, we need to educate and assist those who *do* make the effort to play by the rules. Thanks in advance for any information anyone may be able to provide. (By the way, we get the same error on the email invoices generated by our billing software. That one is a bit of an embarrassment.) --- elp2 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Blacklisting bounce
If I add bounce@ and bounce- to my blacklist file, will it block all mail from [EMAIL PROTECTED] and [EMAIL PROTECTED] ? Yes, it will. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Bad Headers / Spam Headers
Is it possible to find out exactly *what* portion of the headers are being malformed or are not in compliance in order that he can correct the problem. Yes. You can take the code (8202, for example) from the headers (if you use the WARN action), or from the Declude JunkMail log file, and look them up at http://www.declude.com/tools using the BADHEADERS Lookup. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] SpamCop Dead.
http://spamcop.net/ is reachable. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Madscientist Sent: Thursday, April 25, 2002 7:46 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamcop Dead. No specific idea, but I did just watch a HUGE network instability pass through the UUNet network... Took the last half hour or so to stabilize (knock wood). Maybe that's part of it. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Chuck Schick | Sent: Thursday, April 25, 2002 10:19 AM | To: Declude. JunkMail (E-mail) | Subject: [Declude.JunkMail] Spamcop Dead. | | | Sapmcop does not seem to be working this morning. Anyone | know what is up. | | Chuck Schick | Warp 8, Inc. | 303-421-5140 | www.warp8.com | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] ATTACH action and the spamattach.eml file...
A number of people have reported issues with the new ATTACH action that are actually an issue with Internet Explorer. Unfortunately, Microsoft thinks that any file ending in .eml is a file in their own unique proprietary format. Normally, when Internet Explorer alters the .eml files, it does so in a way where it is quite obvious that they have been altered (taking out all the headers, for example, leaving just the message body). However, with the spamattach.eml file, it seems that IE can cut the file about halfway through, causing the ATTACH action not to work properly. If you are using the ATTACH action, you should check to make sure that your \IMail\Declude\spamattach.eml file starts with a line beginning with Message-ID: . If not, you should re-download the file (from http://www.declude.com/release/149/spamattach.eml ), but right-click on the link and choose Save target as, which will bypass the problems with IE altering the file. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] UUnet Backbone Trouble
http://www1.worldcom.com/us/tools/noc/status.xml 10:17 AM EST. 4/25/02: Routing instabilities on the Backbone. NOC is working issue. No ETR at this time. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 No specific idea, but I did just watch a HUGE network instability pass through the UUNet network... --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] New Test?
I was wondering if you could add a new test to Declude JunkMail? This test could be called similar addresses. If someone sends a message to multiple addresses and the to, cc or bcc of all the addresses contain helpdesk@ then I'd think it's a pretty good bet that it's a spam message. It is something that we have been considering, but haven't made a decision on yet. Note that the Bcc:'s won't be visible to Declude, so only the To: or Cc: header could be used. Looking at our spamtraps, it looks like only a small portion (perhaps 5% to 10%) of the spam is sent with the multiple addresses in the To:/Cc: headers. Making it less useful is that often they are similar-but-not-exact names -- such as john123@, john128@, johnny@, ... which would either minimize the usefulness of the feature, or require somewhat sophisticated testing to determine if the addresses were similar (which could result in too many false positives if not done well). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] New Test?
One problem, I recieve very legitimate email to [EMAIL PROTECTED], that is sent to abuse@ for all domains thought to be involved for spammers and other issues. There are cases where someone is just trying to get ahold of several parties using standard addresses like abuse, hostmaster, postmaster, etc. Chuck Frolick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Helpdesk Sent: Thursday, April 25, 2002 8:22 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] New Test? Scott, I was wondering if you could add a new test to Declude JunkMail? This test could be called similar addresses. If someone sends a message to multiple addresses and the to, cc or bcc of all the addresses contain helpdesk@ then I'd think it's a pretty good bet that it's a spam message. For example I just received a spam message to [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Any thoughts? Later, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] ATTACH action and the spamattach.eml file...
When viewing Scott's e-mail in Outlook 2002, you do not have the option on that link. You can only click on it. But if you view Scott's e-mail in the web interface, then you can right click on the link and use save target as. Scott, can you place that link on one of your web pages on declude.com? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, April 25, 2002 8:19 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] ATTACH action and the spamattach.eml file... A number of people have reported issues with the new ATTACH action that are actually an issue with Internet Explorer. Unfortunately, Microsoft thinks that any file ending in .eml is a file in their own unique proprietary format. Normally, when Internet Explorer alters the .eml files, it does so in a way where it is quite obvious that they have been altered (taking out all the headers, for example, leaving just the message body). However, with the spamattach.eml file, it seems that IE can cut the file about halfway through, causing the ATTACH action not to work properly. If you are using the ATTACH action, you should check to make sure that your \IMail\Declude\spamattach.eml file starts with a line beginning with Message-ID: . If not, you should re-download the file (from http://www.declude.com/release/149/spamattach.eml ), but right-click on the link and choose Save target as, which will bypass the problems with IE altering the file. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] New Test?
on 4/25/02 11:40 AM, R. Scott Perry wrote: Looking at our spamtraps, it looks like only a small portion (perhaps 5% to 10%) of the spam is sent with the multiple addresses in the To:/Cc: headers. Making it less useful is that often they are similar-but-not-exact names -- such as john123@, john128@, johnny@, ... which would either minimize the usefulness of the feature, or require somewhat sophisticated testing to determine if the addresses were similar (which could result in too many false positives if not done well). I think you shouldn't worry about the similar-but-not-exact names case, only the exact names case. If all the addresses are the same name (and there is 3 or more) then I think it would have to be a spam message (unless someone can think of a case where that wouldn't be true). Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] ATTACH action and the spamattach.eml file...
Ok .. So where does one learn on how to use the ATTACH action .. I must be looking in all the wrong places .. Also can someone tell us why you would want to use SKIPIFVIRUSNAMEHAS .. Brian -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Thursday, April 25, 2002 9:29 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH action and the spamattach.eml file... When viewing Scott's e-mail in Outlook 2002, you do not have the option on that link. You can only click on it. But if you view Scott's e-mail in the web interface, then you can right click on the link and use save target as. Scott, can you place that link on one of your web pages on declude.com? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, April 25, 2002 8:19 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] ATTACH action and the spamattach.eml file... A number of people have reported issues with the new ATTACH action that are actually an issue with Internet Explorer. Unfortunately, Microsoft thinks that any file ending in .eml is a file in their own unique proprietary format. Normally, when Internet Explorer alters the .eml files, it does so in a way where it is quite obvious that they have been altered (taking out all the headers, for example, leaving just the message body). However, with the spamattach.eml file, it seems that IE can cut the file about halfway through, causing the ATTACH action not to work properly. If you are using the ATTACH action, you should check to make sure that your \IMail\Declude\spamattach.eml file starts with a line beginning with Message-ID: . If not, you should re-download the file (from http://www.declude.com/release/149/spamattach.eml ), but right-click on the link and choose Save target as, which will bypass the problems with IE altering the file. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Security Scan Operations Center] BEGIN:VCARD VERSION:2.1 N:Watters;Brian;Richard FN:Brian Richard Watters ([EMAIL PROTECTED]) ORG:Totlcom Broad Band Services LLP;IS TITLE:Senior Director of IS TEL;WORK;VOICE:559-297-5000 TEL;CELL;VOICE:559-351-2603 TEL;PAGER;VOICE:[EMAIL PROTECTED] TEL;WORK;FAX:559-454-7634 ADR;WORK:;Fresno;5718 East Shields Ave;Fresno;CA;93720;USA LABEL;WORK;ENCODING=QUOTED-PRINTABLE:Fresno=0D=0A5718 East Shields Ave=0D=0AFresno, CA 93720=0D=0AUSA URL;WORK:http://www.totlcombroadband.com EMAIL;PREF;INTERNET:[EMAIL PROTECTED] REV:20011129T222113Z END:VCARD
Re: [Declude.JunkMail] New Test?
I think you shouldn't worry about the similar-but-not-exact names case, only the exact names case. If all the addresses are the same name (and there is 3 or more) then I think it would have to be a spam message (unless someone can think of a case where that wouldn't be true). In a manual review of 20 E-mails from our spamtrap, only 1 had multiple instances of the same or similar E-mail accounts. It looks like about 1/3 of the spams with multiple same-or-similar addresses are ones where there are multiple copies of the same account name; the other 2/3rds are similar. So we're talking about maybe 1-2% of spam that could get caught. Still, aside from the abuse@/postmaster@ issue (which could easily be dealt with), it would likely have an extremely low false positive rate. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] examples and samples ?
In mid-March, a Decluder asked for sample global.cfg default.junkmail files. He was referred to this list. I was not a subscriber to this list then. Can some one direct me to some customized example files that work well? We are catching some legits that fail badheaders spamheaders. I have all tests set to HOLD right now. any suggestions or links to an archive of the list? Thanks, Scott Boggs, MCSE Information Systems Manager United Bank, Zebulon GA 770-567-2531 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] examples and samples ?
http://www.mail-archive.com/declude.junkmail@declude.com/ John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott Boggs Sent: Thursday, April 25, 2002 1:37 PM To: Declude. JunkMail (E-mail) Subject: [Declude.JunkMail] examples and samples ? In mid-March, a Decluder asked for sample global.cfg default.junkmail files. He was referred to this list. I was not a subscriber to this list then. Can some one direct me to some customized example files that work well? We are catching some legits that fail badheaders spamheaders. I have all tests set to HOLD right now. any suggestions or links to an archive of the list? Thanks, Scott Boggs, MCSE Information Systems Manager United Bank, Zebulon GA 770-567-2531 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
