RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer
I find that interesting that the major ISP's fail those kinds of tests. Anyone have any idea's on why they wouldn't have those addresses setup? Dl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker | Netsmith Inc Sent: Friday, July 26, 2002 4:27 PM To: '[EMAIL PROTECTED]' Subject: RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer That is about average, over 50% of our inbound mail fails at least one test (more like 70%)... This is where the weighing system comes into play. Tests like no postmaster and no abuse fail every message from systems like aol.com, msn.com, earhtlink.net, etc,etc... So they will appear as SPAM in your logfiles. You need to use the weighing system / edit your $default$.junkmail and your global.cfg to meet your needs. There is no cut/dry solution to spam, I have definitely learned monitoring this list that everybody has a different solution that fits their setup. The great thing about declude/sniffer is their flexibility, great mailing lists and frequent updates. (ex: we completely disabled the no postmaster/no abuse tests in our system, they are just too inefficient for our setup, but in other setups they are very useful ) -Original Message- From: Jim Rooth [mailto:[EMAIL PROTECTED]] Sent: Friday, July 26, 2002 3:18 PM To: [EMAIL PROTECTED] Subject: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer I must be doing something wrong! I looked at the confirm log and I have caught almost half of the 20,000 emails as spam. I have poured through the logs though and have only found four obviously legitimate emails that should not have been caught. I fixed that with the myfilter file. Either I am doing it wrong or the program is great. I suspect the latter... Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jeff Kratka Sent: Friday, July 26, 2002 3:08 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude and Sniffer Just curious. How many people are using both Declude Junk Mail and the sniffer add-on and has it made a difference if yes. I have been completely pummeled with Spam and am looking for more options. Thanks. Jeff * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer
Monday, July 29, 2002 you wrote: DL Anyone have any idea's on why they wouldn't have those addresses setup? They don't set them up. My guess is because they handle too much volume. I suspect it would take a significant staff to handle what they would get in postmaster and abuse. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Oh gosh!
Thanks! Can't wait to add this one. --Todd. - Original Message - From: Mike Nice [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, July 29, 2002 7:57 AM Subject: Re: [Declude.JunkMail] Oh gosh! This is an excellent free DNS-based blocklist from monkeys.com (infinite monkeys!). The following statements in Global.cfg will activate it - adjust the point value to go with your weighting scheme. monkeyproxies can be rated more than 2/3 the amount needed to hold a message. The good part is that generally, open proxies and legitimate mail servers do not intersect. MONKEYPROXIES ip4rproxies.relays.monkeys.com 127.0.0.1 6 0 MONKEYFORMMAIL ip4rformmail.relays.monkeys.com127.0.0.1 3 0 Back when this was first all the rage with spammers we had a bunch of open proxies on our network. I had fun reporting the spammer's originating IP back to their ISPs, then closed the proxies. - Original Message - From: Todd Ryan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, July 29, 2002 7:26 AM Subject: Re: [Declude.JunkMail] Oh gosh! Pardon the ignorance...what is MONKEYPROXIES? --Todd. - Original Message - From: Mike Nice [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, July 28, 2002 10:36 PM Subject: Re: [Declude.JunkMail] Oh gosh! MessageI've noticed that MONKEYPROXIES has become more effective recently, and I've upped it's point rating! - Original Message - ° True anonymity (using proxy routing - the new wave in bulk email stealth technology). --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] 1.56 Stablility
Actually, the pop-up that I get does not directly reference user32.dll. It says: Sniffer.exe -- Application Error The application failed to initialize properly (0xc142). Click on OK to terminate the application. So this may not have anything to do with Declude at all. Actually, it looks like it may be related to Declude. We expect to have v1.57 (beta) released later today, that looks like it should prevent the pop-up shown above (the one that does not specify .DLL initialization failure). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Another amazing product
I haven't been this amazed at how well a piece of software works since I installed Declude Virus a year ago. With very little configuration done so far, with HOLD turned on, based only on the weight20 test, I am catching TONS of spam, with very little few legit emails being caught. Thanks Scott! Another GREAT product! Can't wait to see what I can do with this after I'm done testing and tweaking! Sharyn Schmidt Network Specialist Florida Distillers Company (863) 956-1116 x221 We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships, and the artisan tequilas of Porfidio 100% Agave Tequilas, judged Best Tequila four years running by the Wine Enthusiast magazine. For more information, please click (go to) htmla href=http://www.cruzanrums.com;http:///aa href=http://www.cruzanrums;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] another newbie question
My apologies in advance if this has already been covered. Is there a way to have an email sent to me by the Junkmail software that tells me, personally, as the administrator, that a spam email has been sent to the spam folder? (same idea as the Declude virus sends me a virus notification when someone's email has been quarantined.) At the moment, I am manually checking every so often to make sure nothing legit has been put in the spam folder, but it would be nice if I received an email telling me that something had been sent there. Thanks in advance, Sharyn Schmidt Network Specialist Florida Distillers Company (863) 956-1116 x221 We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships, and the artisan tequilas of Porfidio 100% Agave Tequilas, judged Best Tequila four years running by the Wine Enthusiast magazine. For more information, please click (go to) htmla href=http://www.cruzanrums.com;http:///aa href=http://www.cruzanrums;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] another newbie question
Based on the ROUTETO theory, what steps would be needed to send the email on to the original destination if it was found to be legitimate? Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Monday, July 29, 2002 12:02 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] another newbie question Is there a way to have an email sent to me by the Junkmail software that tells me, personally, as the administrator, that a spam email has been sent to the spam folder? (same idea as the Declude virus sends me a virus notification when someone's email has been quarantined.) The closest thing is with the latest beta, you can use the COPYTO action. For example, WEIGHT10 ROUTETO [EMAIL PROTECTED]. That would route the E-mail to [EMAIL PROTECTED], rather than quarantine it. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] another newbie question
Based on the ROUTETO theory, what steps would be needed to send the email on to the original destination if it was found to be legitimate? It would need to be forwarded somehow. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] another newbie question
Jim, with Declude, inbound messages are passed directly to Declude by IMail for processing and if clean, then dropped directly into the spool directory for delivery. If a legitimate message is held, you can simply move the Q D files of the legit message into the spool directory and IMail will deliver them. Declude does not check the spool directory after the messages have been placed there. HTH, Bill -Original Message- From: Jim Rooth [mailto:[EMAIL PROTECTED]] Sent: Monday, July 29, 2002 11:33 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] another newbie question Ok, let me rephrase...would I be able to go to that email and hit forward and add the original address or would JunkMail catch it again? I guess my question is what stops JunkMail from catching it the second time? Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Monday, July 29, 2002 12:58 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] another newbie question Based on the ROUTETO theory, what steps would be needed to send the email on to the original destination if it was found to be legitimate? It would need to be forwarded somehow. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?
Post your thoughts on the following addresses... @BOUNCE .BOUNCE BOUNCE. In my research I found these addresses to be typical with spam messages, I'd be curious to hear what your findings are. That is, should we block them or not? would or could it capture legitimate mail? Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?
Periodically we clean the Kill List and start a new based on actual usage, that is why each item on the kill list has an ID. This ID should appear in the Declude log file if the message fails an address from the Kill file. The ID indicates the date of placement along wihth a unique three digit number. In any case, here is our updated list. Even though we check each web site, we do not make any garantees. With that said, use it at your own risk. The list can also be downloaded from the following URL: http://www.imagefxonline.net/apps/delog/fromfile.txt Regards, Tom Image`fx - .1bookstreet.com07282002-027 .1premio.com07282002-040 .2np.net07262002-000 .330w.com 07292002-015 .ADMANMAIL.COM 07262002-001 .COOLSAVINGS.COM07292002-018 .CYNERGEN.NET 07262002-002 .DailyDealDepot.com 07262002-003 .EASYWINNING.COM07262002-004 .TRAKLISTS.COM 07292002-031 .ac-mail.net07282002-005 .afgmedia.com 07282002-047 .aptimusvaluenetwork.com07292002-016 .aweber.com 07282002-032 .azogle.com 07262002-050 .azoogle.com07262002-005 .bb02.net 07262002-006 .bbwgroup.com 07282002-030 .clubshop.com 07282002-028 .consumertoday.net 07292002-017 .currentmail.com07282002-036 .dailydeals4you.com 07292002-019 .darwin.net 07282002-051 .dazenetwork.com07262002-007 .directmethods.net 07262002-008 .e-haus.com 07292002-020 .e-member-services.com 07262002-009 .edirectnetwork.net 07262002-010 .elitedatadirect.net07262002-011 .emailfactory.com 07282002-049 .emailhelo.com 07262002-012 .emailwow.com 07262002-013 .enflyer.com07292002-021 .etracks.com07262002-014 .firstratedeals.com 07292002-022 .focalex.com07262002-015 .free-o-rama.com07262002-016 .gsjs.com 07282002-026 .heresadeal.com 07292002-005 .homesavingsplace.com 07282002-043 .infogeneratorpro.com 07282002-052 .insuresuite.com07282002-029 .intimail.com 07282002-039 .karoo.co.uk07282002-060 .mailstamp.com 07262002-017 .mb00.net 07262002-018 .mm53.com 07262002-019 .moneytips-gazette.com 07262002-020 .mygoodoffers-mail.com 07262002-021 .myroyaltymail.com 07282002-031 .naviantnetwork.net 07262002-022 .offerbymail.com07292002-023 .offermonkey.com07282002-001 .oin60.com 07262002-048 .optamail.com 07282002-038 .optinmailing.com 07262002-023 .orbitz.com 07292002-024 .orientx.net07282002-023 .otcjournal.com 07282002-025 .postmasterdirect.com 07262002-024 .promovalue.us 07282002-010 .pxlg.com 07282002-003 .qves.net 07262002-025 .rbmailsource.com 07262002-026 .regtoday1.net 07262002-027 .roving.com 07292002-025 .rsc01.com 07292002-026 .rtz09.com 07292002-027 .sandbox.com07292002-028 .saverighthere.com 07282002-017 .sendoutmail.com07262002-028 .serveimage.com 07282002-048 .six86.com 07282002-000 .speedi-list.com07282002-024 .stocknight.com 07262002-051 .super-bargains.com 07262002-029 .technoscout.com07292002-029 .techrepublic.com 07292002-030 .top-special-offers.com 07262002-052 .topica.com 07262002-030 .verticalresponse.com 07262002-031 .wstcom.net 07282002-014 .wwindia.com07262002-032 .xenodog.com07282002-053 .yourinterestsonly.com 07262002-033 @42promotions.com 07262002-034 @agepe.it 07282002-002 @america21company.com 07262002-035 @beatthebar.com 07282002-004 @bluedolphin.com07282002-006 @clickthisway.com 07262002-036 @dcs.kcl.ac.uk 07282002-007 @dealsindemand.com 07292002-006 @digital-promotions.com 07282002-008 @dlbdirect.com 07262002-037 @dreamvacationgiveaways.com 07292002-007 @emailoffersdirect.com 07282002-009 @eroticmailcenter.com 07282002-011 @extrememailing.us 07292002-008 @fasterpopmail.com 07282002-012 @forum4mail.com 07292002-009 @fultondirect.com 07282002-013 @gecapital.com 07292002-010 @goodnet.com07292002-011 @hot-info.net 07282002-015 @hydrosila.com 07292002-012 @idgcorporation.com
RE: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?
Oh well, so much for my two cents worth...I'll have to keep an eye on it a little closer I reckon...maybe have to have my eyes open??? LOL Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business Lists Sent: Monday, July 29, 2002 3:08 PM To: Tom Subject: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD? Tom, Monday, July 29, 2002 you wrote: T That is, should we block them or not? You'd have to be careful. T would or could it capture legitimate mail? Yes. Lots of valid mailing lists have bounce in them too. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
DORKZTL:RE: [Declude.JunkMail] another newbie question
Thanks, I was more than a little confused. I am sure Scott had told me that but for some reason it just didn't stick. Hopefully it will this time. Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry Sent: Monday, July 29, 2002 1:40 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] another newbie question Jim, with Declude, inbound messages are passed directly to Declude by IMail for processing and if clean, then dropped directly into the spool directory for delivery. If a legitimate message is held, you can simply move the Q D files of the legit message into the spool directory and IMail will deliver them. Declude does not check the spool directory after the messages have been placed there. HTH, Bill -Original Message- From: Jim Rooth [mailto:[EMAIL PROTECTED]] Sent: Monday, July 29, 2002 11:33 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] another newbie question Ok, let me rephrase...would I be able to go to that email and hit forward and add the original address or would JunkMail catch it again? I guess my question is what stops JunkMail from catching it the second time? Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Monday, July 29, 2002 12:58 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] another newbie question Based on the ROUTETO theory, what steps would be needed to send the email on to the original destination if it was found to be legitimate? It would need to be forwarded somehow. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?
I personally have MAILFROM 10 CONTAINS bounce in myfilter.txt. I have yet to see it where it wasn't associated with some type of spam. However, bounce alone is not enough for me to kick - it creates a weight of 15 as Myfilter adds a weight of 5. I have my kick weight set at 20 so it means something else has to be a catalyst. I can honestly say I have never had one message with bounce in it come in at less that 30 though. My 2 cents. Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Sent: Monday, July 29, 2002 3:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD? Post your thoughts on the following addresses... @BOUNCE .BOUNCE BOUNCE. In my research I found these addresses to be typical with spam messages, I'd be curious to hear what your findings are. That is, should we block them or not? would or could it capture legitimate mail? Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Whitelist Not Working What Am I doing wrong
I add the following line to my global.cfg file WHITELIST IP 66.54.32.* However, messages from the 66.54.32.* subnet are not being WhiteListed. What am I doing wrong? Darrell Received: from [66.54.32.207] by mail1.gannett-tv.com (SMTPD32-7.11) id A3743F003C; Mon, 29 Jul 2002 16:20:04 -0400 From: KSDK Web Form - Muny Contest Entrant To: KSDK Web Form Submission [EMAIL PROTECTED] Subject: [POTENTIAL SPAM] Muny Date: 29 Jul 2002 20:29:19 Importance: Normal X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: ASPXPMail Version: 1.0.0065 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7-bit Message-Id: 200207291620296.SM00624@ X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c042020e]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c042020e]. X-Spam-Tests-Failed: BADHEADERS, SPAMHEADERS, WEIGHT5 X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 327958377 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Whitelist Not Working What Am I doingwrong
I add the following line to my global.cfg file WHITELIST IP 66.54.32.* However, messages from the 66.54.32.* subnet are not being WhiteListed. What am I doing wrong? That's because Declude JunkMail doesn't understand what the * means. You can either use WHITELIST IP 66.54.32., or with the most recent version, you can use WHITELIST IP 66.54.32.0/24. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Whitelist Not Working What Am I doing wrong
I believe my problem was related to lack of reading the docs closely.. It turns out the docs say to not put a * on the end but just leave the trailing .. i.e. WHITELIST IP 66.54.32. Sorry for wasting everyone's time.. dl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell L. Sent: Monday, July 29, 2002 4:34 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Whitelist Not Working What Am I doing wrong I add the following line to my global.cfg file WHITELIST IP 66.54.32.* However, messages from the 66.54.32.* subnet are not being WhiteListed. What am I doing wrong? Darrell Received: from [66.54.32.207] by mail1.gannett-tv.com (SMTPD32-7.11) id A3743F003C; Mon, 29 Jul 2002 16:20:04 -0400 From: KSDK Web Form - Muny Contest Entrant To: KSDK Web Form Submission [EMAIL PROTECTED] Subject: [POTENTIAL SPAM] Muny Date: 29 Jul 2002 20:29:19 Importance: Normal X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: ASPXPMail Version: 1.0.0065 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7-bit Message-Id: 200207291620296.SM00624@ X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c042020e]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c042020e]. X-Spam-Tests-Failed: BADHEADERS, SPAMHEADERS, WEIGHT5 X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 327958377 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Whitelist Not Working What Am I doing wrong
Scott, In the new version is it even able to more refined subnets like 1.1.1.16/28? Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Monday, July 29, 2002 4:41 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelist Not Working What Am I doing wrong I add the following line to my global.cfg file WHITELIST IP 66.54.32.* However, messages from the 66.54.32.* subnet are not being WhiteListed. What am I doing wrong? That's because Declude JunkMail doesn't understand what the * means. You can either use WHITELIST IP 66.54.32., or with the most recent version, you can use WHITELIST IP 66.54.32.0/24. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Whitelist Not Working What Am I doing wrong
Try 66.54.32. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Darrell L. Sent: Monday, July 29, 2002 1:34 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Whitelist Not Working What Am I doing wrong I add the following line to my global.cfg file WHITELIST IP 66.54.32.* However, messages from the 66.54.32.* subnet are not being WhiteListed. What am I doing wrong? Darrell Received: from [66.54.32.207] by mail1.gannett-tv.com (SMTPD32-7.11) id A3743F003C; Mon, 29 Jul 2002 16:20:04 -0400 From: KSDK Web Form - Muny Contest Entrant To: KSDK Web Form Submission [EMAIL PROTECTED] Subject: [POTENTIAL SPAM] Muny Date: 29 Jul 2002 20:29:19 Importance: Normal X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: ASPXPMail Version: 1.0.0065 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7-bit Message-Id: 200207291620296.SM00624@ X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c042020e]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c042020e]. X-Spam-Tests-Failed: BADHEADERS, SPAMHEADERS, WEIGHT5 X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 327958377 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?
Tom, Monday, July 29, 2002 you wrote: T Have you ever seen BOUNCE used in legitimate mail? I haven't kept a running database of them but never expected to have to prove anything. But just from today I can list a few: @bounces.spamcop.net - note that bounce is inside bounces these are sent for incident reports @bounce.forbesdigital.com - used by Forbes for subscribers - the first part is the user id @bounce.quris.net - I forget what list this is but one of our clients is subscribed sparklist - also uses bounce but at the front of the address I forget how it works exactly - maybe bounce-listname-subscriberid There are others as well. Keep in mind we are really low volume so I wouldn't think we'd see as many as some of the high volume providers. Of course these things change too. I've been amazed at how often lists change mailing software. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Whitelist Not Working What Am I doing wrong
Yes Monday, July 29, 2002, 3:51:24 PM, you wrote: DL Scott, DL In the new version is it even able to more refined subnets like DL 1.1.1.16/28? DL Darrell DL -Original Message- DL From: [EMAIL PROTECTED] DL [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry DL Sent: Monday, July 29, 2002 4:41 PM DL To: [EMAIL PROTECTED] DL Subject: Re: [Declude.JunkMail] Whitelist Not Working What Am I doing DL wrong I add the following line to my global.cfg file WHITELIST IP 66.54.32.* However, messages from the 66.54.32.* subnet are not being WhiteListed. What am I doing wrong? DL That's because Declude JunkMail doesn't understand what the * means. DL You can either use WHITELIST IP 66.54.32., or with the most recent DL version, you can use WHITELIST IP 66.54.32.0/24. DL -Scott DL --- DL [This E-mail was scanned for viruses by Declude Virus DL (http://www.declude.com)] DL --- DL This E-mail came from the Declude.JunkMail mailing list. To DL unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DL type unsubscribe Declude.JunkMail. You can E-mail DL [EMAIL PROTECTED] for assistance. You can visit our web DL site at http://www.declude.com . DL --- DL [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] DL --- DL This E-mail came from the Declude.JunkMail mailing list. To DL unsubscribe, just send an E-mail to [EMAIL PROTECTED], and DL type unsubscribe Declude.JunkMail. You can E-mail DL [EMAIL PROTECTED] for assistance. You can visit our web DL site at http://www.declude.com . DL --- DL [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Utils for Declude Log FIles
What are people using to analyze their declude log files? I am looking to see if there are any utils that will break down how many messages its scanned versus which tests it failed the most. You can try Delog. It can be downloaded from the following URL: http://www.imagefxonline.net/apps/delog/delog.zip Best Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Add more to the kill list
Two more added to the list today! The FULL kill file can also be downloaded from the following URL: http://www.imagefxonline.net/apps/delog/fromfile.txt Regards, Tom Image`fx -- .thenetdeals.com07292002-032 .mynetmarketer.com 07292002-033 -- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] KillList Updated
This was a previous post, however, the subject line was incorrect. sorry for the inconvenience. Periodically we clean the Kill List and start a new one based on actual usage, that is why each item on the kill list has an ID. This ID should appear in the Declude log file if the message fails an address from the Kill file. The ID indicates the date of placement along with a unique three digit number. In any case, here is our updated list. Even though we check each web site, we do not make any guarantees. With that said, use it at your own risk. http://www.imagefxonline.net/apps/delog/fromfile.txt Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
DORKZTL:RE: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?
Oh well, open mouth a little wider and put the other foot in it...you gotta love the list...enough diversity that every subject can be covered and recovered. I do believe I will leave my bounce set up for the time being though...already have both feet in my mouth so can't go too far wrong! Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business Lists Sent: Monday, July 29, 2002 3:58 PM To: Tom Subject: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD? Tom, Monday, July 29, 2002 you wrote: T Have you ever seen BOUNCE used in legitimate mail? I haven't kept a running database of them but never expected to have to prove anything. But just from today I can list a few: @bounces.spamcop.net - note that bounce is inside bounces these are sent for incident reports @bounce.forbesdigital.com - used by Forbes for subscribers - the first part is the user id @bounce.quris.net - I forget what list this is but one of our clients is subscribed sparklist - also uses bounce but at the front of the address I forget how it works exactly - maybe bounce-listname-subscriberid There are others as well. Keep in mind we are really low volume so I wouldn't think we'd see as many as some of the high volume providers. Of course these things change too. I've been amazed at how often lists change mailing software. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? Conclusion
Here again, I only look for it in the MAILFROM and not in the body or subject. Maybe that is why I haven't had any problems...yet. Knocking on every piece of wood I can find... Ok, after doing some more research I came up with the following conclusion: I created another FROMFILE called WFILE.TXT and placed the following addresses inside of it: - @BOUNCE BOUNCE1 .BOUNCE BOUNCE2 BOUNCE. BOUNCE3 BOUNCE@ BOUNCE4 - Then I set up a test inside the Declude CFG file with a weight of 10: - BFROM fromfiled:\imail\declude\wfile.txt x 10 0 - And finally I set up the test inside the $default$.junkmail file to warn: - BFROM WARN - This way BOUNCE by itself would not fail completely unless it fails more than one test. Hopefully this helps catch more spam using the BOUNCE from address and doesn't disturb legitimate mail. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD?
Yes sir, I answered before I read all the replies...my bad. Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Smart Business Lists Sent: Monday, July 29, 2002 4:39 PM To: Jim Rooth Subject: Re[2]: [Declude.JunkMail] Adding BOUNCE to your Kill list? GOOD or BAD? Jim, Monday, July 29, 2002 you wrote: JR I only look for it in the MAILFROM and not in the body or The examples I gave were from MAILFROM not body. They may be in the body but I don't have the messages to check them. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[5]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD...
Tom, Monday, July 29, 2002 you wrote: T I see, so there are a few out there. I guess I could use another T list with a weighing system for the BOUNCE address. What are your T thoughts, if any? bounce is less common now in lists than a short time back. I suppose that's why so much spam has it. Lists are a terrible problem. It is really difficult for me to see a good pattern for programmatically determining what constitutes a list and then what constitutes a valid subscription to a list. It is even more of a problem than normal spam because the user frequently has paid money for a subscription and certainly doesn't want it deleted. Most of our false positives continue to be list subscriptions. But they are really important so we continue to manually inspect for them. I've toyed with trying to parse a subscription address and then compare to an imail user. But the parsing is difficult because every conceivable method is used for this and frequently it is just a number with no correlation to anything else. Sometimes it is encoded. I don't have good ideas for you. I just know I see quit a few legitimate subscriptions using bounce in the mailfrom. Terry --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[6]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD?
Oh well, open mouth a little wider and put the other foot in it...you gotta love the list...enough diversity that every subject can be covered and recovered. I do believe I will leave my bounce set up for the time being though...already have both feet in my mouth so can't go too far wrong! I wouldn't worry about it, this list is here for all of us and this is how we learn to use DECLUDE. Hopefully share information and/or create new tools to help us battle this VIRUS they call spam! Best Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
DORKZTL:RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? Conclusion
Basically that is what I have done. I have weight set to 20 before it stops anything so bounce alone cannot do it. Trouble is RVSDNS (5) and spamheaders(5) can. I figure if all three are hit, chances are it is real and not just a poorly run server. Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Sent: Monday, July 29, 2002 4:44 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Adding BOUNCE to your Kill list? Conclusion Here again, I only look for it in the MAILFROM and not in the body or subject. Maybe that is why I haven't had any problems...yet. Knocking on every piece of wood I can find... Ok, after doing some more research I came up with the following conclusion: I created another FROMFILE called WFILE.TXT and placed the following addresses inside of it: - @BOUNCE BOUNCE1 .BOUNCE BOUNCE2 BOUNCE. BOUNCE3 BOUNCE@ BOUNCE4 - Then I set up a test inside the Declude CFG file with a weight of 10: - BFROM fromfiled:\imail\declude\wfile.txt x 10 0 - And finally I set up the test inside the $default$.junkmail file to warn: - BFROM WARN - This way BOUNCE by itself would not fail completely unless it fails more than one test. Hopefully this helps catch more spam using the BOUNCE from address and doesn't disturb legitimate mail. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Re[7]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD...
I don't have good ideas for you. I just know I see quit a few legitimate subscriptions using bounce in the mailfrom. Terry, we appreciate your opinion as we do others in this list. It helps us gather information from your experiences and views. With this information others like Scott can create a better tool to help all of us fight spam without catching legitimate mail. Also, this information helps others tweak their spam settings before someone notices they did not get their mail... (LOL) ;) Anyway, thanks! Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Re[6]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD?
I'm not. Been around fighting with these stupid square headed girl friends since '73 when they were huge boxes with 32 and 64 Kb of ram. I learned a long time ago no matter what you say, someone can justifiably prove you wrong. So I try to beat them to the punch...LOL Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Sent: Monday, July 29, 2002 4:48 PM To: [EMAIL PROTECTED] Subject: Re[6]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD? Importance: Low Oh well, open mouth a little wider and put the other foot in it...you gotta love the list...enough diversity that every subject can be covered and recovered. I do believe I will leave my bounce set up for the time being though...already have both feet in my mouth so can't go too far wrong! I wouldn't worry about it, this list is here for all of us and this is how we learn to use DECLUDE. Hopefully share information and/or create new tools to help us battle this VIRUS they call spam! Best Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: Re[6]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD?
This is the kind of mail I am seeing: Subject: Motorola Cell Phone+ $50 Cash Back X-List-Unsubscribe: [EMAIL PROTECTED] From: Melissa H. [EMAIL PROTECTED] Reply-To: Melissa H. [EMAIL PROTECTED] Return-Path: [EMAIL PROTECTED] So I have bounce listed as well as dealseveryday. Also $ and cash. This particular item had a weight of 35 after spamcop finished with it. I tell most of my subscribers not to try to unsub as it usually ends up putting their names on another list for the spammers to sell. I may be wrong...no cherry there either...LOL Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Monday, July 29, 2002 5:21 PM To: [EMAIL PROTECTED] Subject: RE: Re[6]: [Declude.JunkMail] Adding BOUNCE to your Kill list? BAD? I'm not. Been around fighting with these stupid square headed girl friends since '73 when they were huge boxes with 32 and 64 Kb of ram. I learned a long time ago no matter what you say, someone can justifiably prove you wrong. So I try to beat them to the punch...LOL LOL John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.380 / Virus Database: 213 - Release Date: 7/24/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Hijack Question (somewhat OT)
Sorry if this is a bit off-topic, but I was wondering if you can use the ALLOWIP line in the Hijack.cfg file to allow unlimited SMTP traffic for an entire class C subnet. Occasionally machines in our office send out a lot of internal messages, enough to go over Hijacks second threshold so I'm trying to figure out a work-around without having to add an ALLOWIP line for every machine. For example, would ALLOWIP 2.2.2 allow anyone with a 2.2.2.xx IP address unlimited SMTP traffic? Thanks Bart Lackorn STIC.NET --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Hijack Question (somewhat OT)
Sorry if this is a bit off-topic, but I was wondering if you can use the ALLOWIP line in the Hijack.cfg file to allow unlimited SMTP traffic for an entire class C subnet. Occasionally machines in our office send out a lot of internal messages, enough to go over Hijacks second threshold so I'm trying to figure out a work-around without having to add an ALLOWIP line for every machine. For example, would ALLOWIP 2.2.2 allow anyone with a 2.2.2.xx IP address unlimited SMTP traffic? Yes, you can do exactly that -- the ALLOWIP 2.2.2. format is the best way to do it, and it would allow all E-mail from 2.2.2.x to send unlimited traffic. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Hijack Question (somewhat OT)
But wouldn't that defeat the purpose of protecting against some one in the office sending out bulk junk e-mail, which is the primary purpose of Hijack? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of STIC.NET Sent: Monday, July 29, 2002 4:23 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Hijack Question (somewhat OT) Sorry if this is a bit off-topic, but I was wondering if you can use the ALLOWIP line in the Hijack.cfg file to allow unlimited SMTP traffic for an entire class C subnet. Occasionally machines in our office send out a lot of internal messages, enough to go over Hijacks second threshold so I'm trying to figure out a work-around without having to add an ALLOWIP line for every machine. For example, would ALLOWIP 2.2.2 allow anyone with a 2.2.2.xx IP address unlimited SMTP traffic? Thanks Bart Lackorn STIC.NET --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Hijack Question (somewhat OT)
-- Original Message -- From: John Tolmachoff [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Mon, 29 Jul 2002 16:36:11 -0700 But wouldn't that defeat the purpose of protecting against some one in the office sending out bulk junk e-mail, which is the primary purpose of Hijack? Point taken. But working for an small Internet provider, all of the employees here are well aware of the severe beatings they will receive (from customer and co-worker alike) if they try anything cute like that. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
