[Declude.JunkMail] Redirecting spam to different folders
Morning Folks, I am wondering if there is a way to do the following: I currently have the weight20 test action set to HOLD and have been monitoring my spam folder for the last few weeks. I am convinced that the email that this test has been catching and holding is all spam, with no legit email mixed in. I have the weight10 test set to add the SPAM heading in the subject, as well as some other variables such as the weight of the email, the tests it has failed, etc. (Thanks to those who suggested that, it's been a great tool) I have gone through the dec.logs for the past few weeks, and based on what I have found, it looks like most of what I'm flagging from weight16 and up is spam, with just 1 or 2 legit emails mixed in. What I am trying to do now, is create a weight16 test, set it to have a HOLD action, but have the emails failing the weight16 go to a different spam folder than the ones failing a weight20 test. Since I am not 100% confident that EVERY email being flagged with weight16 is really spam (but 99% are), and I *am* 100% sure that every email being flagged with weight20 is really spam, I want to somehow separate the two so I don't have to plow through all the email with weight 20 and up, just the ones with weight 16 to 19. I can't really think of a logical way to do this, since, by default, anything failing weight16 is going to also fail weight20, but perhaps you junkmail guru's out there have figured out a way to do this. Thanks in advance, Sharyn Schmidt Network Specialist Florida Distillers Company (863) 956-1116 x221 We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships, and the artisan tequilas of Porfidio 100% Agave Tequilas, judged Best Tequila four years running by the Wine Enthusiast magazine. For more information, please click (go to) htmla href=http://www.cruzanrums.com;http:///aa href=http://www.cruzanrums;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Redirecting spam to different folders
What I am trying to do now, is create a weight16 test, set it to have a HOLD action, but have the emails failing the weight16 go to a different spam folder than the ones failing a weight20 test. Unfortunately, there isn't a way to have the spam sent to a different hold directory (although that is something that a number of people have requested, and we would like to add). One possibility might be to use the ROUTETO action in the latest beta for the WEIGHT20 test (all the spam would end up getting sent to a mailbox file), while the WEIGHT16 test could use the HOLD action. That way, all the held E-mail would be the E-mail failing the WEIGHT16 test. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Redirecting spam to different folders
How do you use the routeto command? --- Steven Cmajdalka [EMAIL PROTECTED] The Graphics Group 2800 Taylor St Dallas, TX 75226 --- -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, August 13, 2002 9:33 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Redirecting spam to different folders What I am trying to do now, is create a weight16 test, set it to have a HOLD action, but have the emails failing the weight16 go to a different spam folder than the ones failing a weight20 test. Unfortunately, there isn't a way to have the spam sent to a different hold directory (although that is something that a number of people have requested, and we would like to add). One possibility might be to use the ROUTETO action in the latest beta for the WEIGHT20 test (all the spam would end up getting sent to a mailbox file), while the WEIGHT16 test could use the HOLD action. That way, all the held E-mail would be the E-mail failing the WEIGHT16 test. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Redirecting spam to different folders
One possibility might be to use the ROUTETO action in the latest beta for the WEIGHT20 test (all the spam would end up getting sent to a mailbox file), while the WEIGHT16 test could use the HOLD action. That way, all the held E-mail would be the E-mail failing the WEIGHT16 test. -Scott Where do I find the syntax for the correct setup of the routeto action? I am looking at http://www.declude.com/junkmail/manual.htm right now, but I don't see anything about that action, I guess because it's still beta? I'd like to see what I have to do to set that up, before I download the beta, although this does sound like a good workaround for now. Thanks Scott! Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships, and the artisan tequilas of Porfidio 100% Agave Tequilas, judged Best Tequila four years running by the Wine Enthusiast magazine. For more information, please click (go to) htmla href=http://www.cruzanrums.com;http:///aa href=http://www.cruzanrums;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BLARSBL:Spam pretending to be fromspamcop - anyone else get these.
When I reported this to SpamCop, I got the following response: Reply-To: Ellen [EMAIL PROTECTED] From: Ellen [EMAIL PROTECTED] To: System Administrator [EMAIL PROTECTED] Subject: Re: Your site will be shut down Date: Tue, 13 Aug 2002 08:05:30 -0400 Hi -- The email you received did not come from SpamCop. Someone is forging emails/reports to appear like they are coming from SpamCop. It's been going on for more than a week now. Today's deluge appears to be coming from IP: 63.164.145.33, 65.67.149.57 and 64.224.17.31. Please see: www.julianhaight.com/forgery.shtml for updated information. Sorry for the cut and paste response, but we've been dealing with these at the rate of 200 per hour :-( Thanks and our apologies. Ellen At 10:46 AM 8/13/2002, Chuck Schick wrote: My abuse mail boxes all had spam this morning pretending to be from spam cop. These has titles like - Your site will be shut down We will block you from millions of users Your network is being compromised It gave out the phone number for Julian Haight of spam cop. Looks like some spammer is trying to attack spam cop. Maybe spamcop is too effective. Anyone else get these - they all came from IP address 65.67.149.57. I have included a header below. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com Headers of the spam Received: from mx2.spamcop.net [65.67.149.57] by adlime.com (SMTPD32-6.06) id A7C81B060312; Tue, 13 Aug 2002 00:31:36 -0600 X-Mailer: X-Mailer: Mailloop 5.0 MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary==_NextPart_38887646058174503 To: [EMAIL PROTECTED] Date: Tue, 13 Aug 2002 02:32:49 -0500 From: [EMAIL PROTECTED] Subject: We will block you from millions of users Message-Id: [EMAIL PROTECTED] X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?65.67.149.57 X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Note: Total spam weight of this E-mail is 6. X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 320720476 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Common Configurations
Ladies and Gentlemen: Just curious what the best configuration for Declude Junkmail has been for you? I find that a lot of the tests catch a lot of legit mail, but if I release those tests, that Spam increases tenfold. Osirusoft and ORDB seem to be good test. Anyone care to share with me what tests/actions they use? Thanks, Koree A. Smith --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Just a test.
Just a test. Dustin Freeman Rath Information Systems 2822 US Hwy 68 South Bellefontaine OH 43311 Ph: 937-599-5096 Fax: 937-592-4165 Email: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WHITELIST for Client
Is it possible to have a whitelist on an indivdual basis? like in the clientname.junkmail How many whitelist can we have in the global.cfg? Do we need to restart smtp if we add a whitelist? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] BLARSBL:Spam pretending to be from spamcop - anyone else get these.
Hi Chuck- I haven't seen any come through recently, however here is a couple we bounced back on the 6th (from different IP's than yours). (we bounce at 20 weight) /06/2002 12:22:58 Q13fe07470286104e OSSOFT:5 SPAMCOP:17 SBL:15 REVDNS:1 . Total weight = 38 08/06/2002 12:22:58 Q13fe07470286104e Msg failed OSSOFT (http://spamhaus.org/SBL/sbl.lasso?query=SBL3290). 08/06/2002 12:22:58 Q13fe07470286104e Msg failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?206.161.21.66). 08/06/2002 12:22:58 Q13fe07470286104e Msg failed SBL (Listed on SBL - see http://spamhaus.org/SBL/sbl.lasso?query=SBL3290). 08/06/2002 12:22:58 Q13fe07470286104e Msg failed WEIGHT10 (Weight of 38 reaches or exceeds the limit of 10.). 08/06/2002 12:22:58 Q13fe07470286104e Msg failed WEIGHT20 (Weight of 38 reaches or exceeds the limit of 20.). 08/06/2002 12:22:58 Q13fe07470286104e Subject: Your site will be shut down 08/06/2002 12:22:58 Q13fe07470286104e From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] /06/2002 12:22:55 Q13f907470286fa26 OSSOFT:5 SPAMCOP:17 SBL:15 REVDNS:1 . Total weight = 38 08/06/2002 12:22:55 Q13f907470286fa26 Msg failed OSSOFT (http://spamhaus.org/SBL/sbl.lasso?query=SBL3290). 08/06/2002 12:22:55 Q13f907470286fa26 Msg failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?206.161.21.66). 08/06/2002 12:22:55 Q13f907470286fa26 Msg failed SBL (Listed on SBL - see http://spamhaus.org/SBL/sbl.lasso?query=SBL3290). 08/06/2002 12:22:55 Q13f907470286fa26 Msg failed WEIGHT10 (Weight of 38 reaches or exceeds the limit of 10.). 08/06/2002 12:22:55 Q13f907470286fa26 Msg failed WEIGHT20 (Weight of 38 reaches or exceeds the limit of 20.). 08/06/2002 12:22:55 Q13f907470286fa26 Subject: Spamcop.net 2nd warning!!! 08/06/2002 12:22:55 Q13f907470286fa26 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] -Original Message- From: Chuck Schick [mailto:[EMAIL PROTECTED]] Sent: Tuesday, August 13, 2002 8:47 AM To: Declude. JunkMail (E-mail) Subject: [Declude.JunkMail] BLARSBL:Spam pretending to be from spamcop - anyone else get these. My abuse mail boxes all had spam this morning pretending to be from spam cop. These has titles like - Your site will be shut down We will block you from millions of users Your network is being compromised It gave out the phone number for Julian Haight of spam cop. Looks like some spammer is trying to attack spam cop. Maybe spamcop is too effective. Anyone else get these - they all came from IP address 65.67.149.57. I have included a header below. Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com Headers of the spam Received: from mx2.spamcop.net [65.67.149.57] by adlime.com (SMTPD32-6.06) id A7C81B060312; Tue, 13 Aug 2002 00:31:36 -0600 X-Mailer: X-Mailer: Mailloop 5.0 MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary==_NextPart_38887646058174503 To: [EMAIL PROTECTED] Date: Tue, 13 Aug 2002 02:32:49 -0500 From: [EMAIL PROTECTED] Subject: We will block you from millions of users Message-Id: [EMAIL PROTECTED] X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?65.67.149.57 X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Note: Total spam weight of this E-mail is 6. X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 320720476 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.381 / Virus Database: 214 - Release Date: 8/2/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.381 / Virus Database: 214 - Release Date: 8/2/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WhiteList... syntax.
Title: Message Hi; Is this correct? WHITELIST FROM .Microsoft.com This will whitelist any email coming from Microsoft such as: [EMAIL PROTECTED] [EMAIL PROTECTED] or should it be written differently? We are seeing certain whitelist listings being trapped and we are just a bit confused. Regards, Kami
Re: [Declude.JunkMail] WhiteList... syntax.
Is this correct? WHITELIST FROM .Microsoft.com This will whitelist any email coming from Microsoft such as: [EMAIL PROTECTED] [EMAIL PROTECTED] or should it be written differently? We are seeing certain whitelist listings being trapped and we are just a bit confused. That will work fine. Two notes however: [1] It won't catch E-mail with a return address of just @Microsoft.com (since @Microsoft.com doesn't contain .Microsoft.com), and [2] It won't catch E-mail with a From: address of [EMAIL PROTECTED] or [EMAIL PROTECTED] if they are sent with a return address that won't get caught (you need to look at the X-Declude-Sender: header or the IMail SMTP log files to find the return address). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Syntax for the routeto
What is the correct syntax for the routeto command? From my previous post about this: That is correct -- beta features are normally never mentioned in the manual, only on this list. :) For information on beta features, you'll need to check the archives (see the URL below). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Syntax for the routeto
Any idea when the latest beta becomes official? :) Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships, and the artisan tequilas of Porfidio 100% Agave Tequilas, judged Best Tequila four years running by the Wine Enthusiast magazine. For more information, please click (go to) htmla href=http://www.cruzanrums.com;http:///aa href=http://www.cruzanrums;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] nWhiteLists 200 ?
Which version of Declude are you running According to the mail header: X-Declude: Version 1.57 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST for Client
R. Scott Perry wrote: Is it possible to have a whitelist on an indivdual basis? like in the clientname.junkmail No, that is not currently possible. Will it ever be possible? Koree --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST for Client
Is it possible to have a whitelist on an indivdual basis? like in the clientname.junkmail No, that is not currently possible. Will it ever be possible? It is something that we are planning to add in the near future, but have not yet started the work on it. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude Kill list information! -from Image`fx
I will not be posting anymore updates for the Declude kill list, however, I will keep my list up to date. You can download my Declude Kill File from the following URL: http://www.imagefxonline.net/apps/delog/fromfile.txt You can also use the following tool: http://www.nerosoft.com/Files/KillListGenInst.exe to automate the process. Keep in mind, that it is not our tool. The list is ASIS and you should use it at your own risk. If you have any questions and/or comments pertaining to the list or any other Image`fx Production product please send them directly to us, not the Declude junkmail list. Thank you, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Kill list information! -from Image`fx
Do I detect the presence of a lawyer, in between the lines? Tuesday, August 13, 2002, 8:34:56 PM, Tom [EMAIL PROTECTED] wrote: T I will not be posting anymore updates for the T Declude kill list, however, I will keep my list T up to date. You can download my Declude Kill T File from the following URL: T http://www.imagefxonline.net/apps/delog/fromfile.txt T You can also use the following tool: T http://www.nerosoft.com/Files/KillListGenInst.exe T to automate the process. Keep in mind, that it is T not our tool. T The list is ASIS and you should use it at your T own risk. If you have any questions and/or T comments pertaining to the list or any other T Image`fx Production product please send them T directly to us, not the Declude junkmail list. T Thank you, T Tom T Image`fx T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. The archives can be found T at http://www.mail-archive.com. Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
