[Declude.JunkMail] Picking up just User Name in email?
Title: Message Hi: Is there a filter that can only pickup the UserID rather than theentire Mailfrom? [EMAIL PROTECTED] [EMAIL PROTECTED] we are seeing a lot of spam from [EMAIL PROTECTED] and it would be good to be able to have a filter like: USERIDIS * Regards, Kami
RE: [Declude.JunkMail] Picking up just User Name in email?
Title: Message Kami, Why not MAILFROM0STARTSWITH*@ George -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami RazvanSent: Tuesday, August 19, 2003 7:34 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Picking up just User Name in email? Hi: Is there a filter that can only pickup the UserID rather than theentire Mailfrom? [EMAIL PROTECTED] [EMAIL PROTECTED] we are seeing a lot of spam from [EMAIL PROTECTED] and it would be good to be able to have a filter like: USERIDIS * Regards, Kami
RE: [Declude.JunkMail] Picking up just User Name in email?
Title: Message that is a good idea... It would do exactly as I wanted... How come I did not think of that? :) .. It has to be Monday again? Regards, Kami -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of George KulmanSent: Tuesday, August 19, 2003 7:53 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Picking up just User Name in email? Kami, Why not MAILFROM0STARTSWITH*@ George -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami RazvanSent: Tuesday, August 19, 2003 7:34 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Picking up just User Name in email? Hi: Is there a filter that can only pickup the UserID rather than theentire Mailfrom? [EMAIL PROTECTED] [EMAIL PROTECTED] we are seeing a lot of spam from [EMAIL PROTECTED] and it would be good to be able to have a filter like: USERIDIS * Regards, Kami
RE: [Declude.JunkMail] Picking up just User Name in email?
Title: Message Kami, you have already used up your quota of Mondays for the month of August. One more, and you get 50 lashes with a wet noodle. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Tuesday, August 19, 2003 5:28 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Picking up just User Name in email? that is a good idea... It would do exactly as I wanted... How come I did not think of that? :) .. It has to be Monday again? Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of George Kulman Sent: Tuesday, August 19, 2003 7:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Picking up just User Name in email? Kami, Why not MAILFROM0STARTSWITH*@ George -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Tuesday, August 19, 2003 7:34 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Picking up just User Name in email? Hi: Is there a filter that can only pickup the UserID rather than theentire Mailfrom? [EMAIL PROTECTED] [EMAIL PROTECTED] we are seeing a lot of spam from [EMAIL PROTECTED] and it would be good to be able to have a filter like: USERIDIS * Regards, Kami
RE: [Declude.JunkMail] Picking up just User Name in email?
Title: Message Better than awet patch cord I guess. Ow, that almost hurts just thinking about it. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of John Tolmachoff (Lists)Sent: Tuesday, August 19, 2003 8:53 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Picking up just User Name in email? Kami, you have already used up your quota of Mondays for the month of August. One more, and you get 50 lashes with a wet noodle. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com
[Declude.JunkMail] Blocking attachments
Just double checking, but we do NOT have a way to block specific attachments in Declude JM Pro, correct ? Karl Drugge, Systems Network Engineer --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blocking attachments
Here's 2... MESSAGE.ZIP YOUR_DETAILS.ZIP Although they are really viruses. On 8/19/2003 12:30pm you wrote... Just double checking, but we do NOT have a way to block specific attachments in Declude JM Pro, correct ? Correct (because we're not yet aware of spammers that are attaching files that should be blocked). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] sure to be silly question
Here's what I did with the comments: I created the following tests COMMENTS20 comments20 x 10 0 COMMENTS40 comments40 x 10 0 COMMENTS60 comments60 x 10 0 COMMENTS80 comments80 x 10 0 COMMENTS100 comments100 x 10 0 COMMENTS120 comments120 x 10 0 This allows me to increment the penalty by the number of comments in a message. For each of 20 comments, a cumulative weight of 10 is added. Seems to work. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:04 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] sure to be silly question Ok, I've got a question about the COMMENTS test. Since I have a copy of every email I've gotten from this and the AV list since I joined, I looked through them and didn't see my answer. I also looked at the JM revisions page and found nothing either, so here goes. Below is the line from the message source of an email I got this morning. VERY bad idea to spam the guy in charge of email. =) anyway, since the words gen*eric via*gra minus the *s in case of filters, are shoen in the email, but seperated by the junk in the . What's the way to set a block/test for this? I've yet to use the COMMENTS test, but want to know the BEST way to do so. Geinput type=hidden name=zZKIrRcpWfFgeyDneric Vip style=margin-bottom: -20font size=1 color=#FFxvtAXyZLNqZbKsaWiqfpg/font/pagra Any help is appreciated! Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] sure to be silly question
Ok, I've got a question about the COMMENTS test. Since I have a copy of every email I've gotten from this and the AV list since I joined, I looked through them and didn't see my answer. I also looked at the JM revisions page and found nothing either, so here goes. Below is the line from the message source of an email I got this morning. VERY bad idea to spam the guy in charge of email. =) anyway, since the words gen*eric via*gra minus the *s in case of filters, are shoen in the email, but seperated by the junk in the . What's the way to set a block/test for this? I've yet to use the COMMENTS test, but want to know the BEST way to do so. Geinput type=hidden name=zZKIrRcpWfFgeyDneric Vip style=margin-bottom: -20font size=1 color=#FFxvtAXyZLNqZbKsaWiqfpg/font/pagra Any help is appreciated! Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New variation of PayPal Account retrieval
May be a dumb question but how are you setting up JM to block these. Jeff ** TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] ** -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan Sent: Saturday, August 16, 2003 10:35 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] New variation of PayPal Account retrieval Hi; A new variation of the PayPal fraud is going on.. I just got this email in our spam filter... it is asking for Citibank checking account... I just thought it would be good for all to see this... in case you don't catch it.. Regards, Kami Here is the header: = Received: from cgocable.net [24.150.152.123] by foroosh.com (SMTPD32-8.02) id AC6E4C0136; Sat, 16 Aug 2003 12:31:42 -0400 Received: from d150-152-123.home.cgocable.net (d150-152-123.home.cgocable.net [24.150.152.123]) by cgocable.net (8.12.8p1/8.12.8) with ESMTP id aoelr258507 for deleted; Sun, 17 Aug 2003 01:34:12 -0400 (EST) Date: Sun, 17 Aug 2003 01:34:10 -0400 (EST) From: Citibank [EMAIL PROTECTED] X-Mailer: The Bat! (v1.61) Personal Reply-To: [EMAIL PROTECTED] X-Priority: 3 (Normal) Message-ID: [EMAIL PROTECTED] To: deleted Subject: [58~]Your Checking Account at Citibank. MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=--3309750874624 X-IMAIL-SPAM-VALFROM: (4981046) X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: BASE64: A binary encoded text or HTML section was found in this E-mail. X-RBL-Warning: FILTER-HEADER-XMAIL: Message failed FILTER-HEADER-XMAIL test (59) X-RBL-Warning: SPAMDOMAINS: Spamdomain 'juno.com' found: Address of [EMAIL PROTECTED] sent from invalid d150-152-123.home.cgocable.net. X-RBL-Warning: COUNTRY: Message failed COUNTRY test (36) X-RBL-Warning: FREEEMAILS: X-Declude-Sender: [EMAIL PROTECTED] [24.150.152.123] X-Declude-Spoolname: D5c6e004c01364150.SMD X-Note: This E-mail was scanned filtered by Declude [1.75i2] for SPAM virus. X-Spam-Tests-Failed: NOABUSE, IPNOTINMX, NOLEGITCONTENT, BASE64, FILTER-HEADER-XMAIL, SPAMDOMAINS, COUNTRY, WEIGHT20s, WEIGHT20r, FREEEMAILS X-Weight: 58 X-Mailfrom: Fwpreg_Warden.juno.com X-Note: Sent from: [EMAIL PROTECTED] X-Note: Sent from Reverse DNS: d150-152-123.home.cgocable.net ([24.150.152.123]). X-Hello: cgocable.net X-Note: Recipient(s): deleted X-Country-Chain: CANADA-destination X-RCPT-TO: deleted Status: U X-UIDL: 331466365 Dear Citibank customer, We are letting you know, that you, as a Citibank checking account holder, must become acquainted with our new Terms Conditions and agree to it. Please, carefully read all the parts of our new Terms Conditions and post your consent. Otherwise, we will have to suspend your Citibank checking account. This measure is to prevent misunderstanding between us and our valued customers. We are sorry for any inconvinience it may cause. Click here to access our Terms Conditions page and not allow your Citibank checking account suspension. 2003 Citibank. Citibank (West), FSB. Member FDIC. Citibank with Arc Design is a registered service mark of Citicorp. Citi.com Citigroup Privacy Promise Terms Conditions Copyright 2003 Citicorp ECRM_CBNA_NEW_ACTIVE --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New variation of PayPal Account retrieval
Hi; I have setup: BODY20 Contains211.155.234.84 That is the IP address used in the email we received. We hold on 20 This was just made the news... Citigroup Is Latest Victim Of Phishing Expedition Aug. 19, 2003 The financial company's logo is the latest to be stolen by Internet scammers who are trying to steal information from consumers. http://www.informationweek.com/story/showArticle.jhtml;jsessionid=DTWA2ROB2M VLIQSNDBGCKHSCJUMEKJVN?articleID=13100615 It is the top story at InformationWeek.. We have not received anymore of the spam or may be we have and it was deleted due to its high weight. For now that is the only filter we have for this.. Others might have seen more signatures.. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Kratka Sent: Tuesday, August 19, 2003 1:33 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] New variation of PayPal Account retrieval May be a dumb question but how are you setting up JM to block these. Jeff ** TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] ** -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan Sent: Saturday, August 16, 2003 10:35 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] New variation of PayPal Account retrieval Hi; A new variation of the PayPal fraud is going on.. I just got this email in our spam filter... it is asking for Citibank checking account... I just thought it would be good for all to see this... in case you don't catch it.. Regards, Kami Here is the header: = Received: from cgocable.net [24.150.152.123] by foroosh.com (SMTPD32-8.02) id AC6E4C0136; Sat, 16 Aug 2003 12:31:42 -0400 Received: from d150-152-123.home.cgocable.net (d150-152-123.home.cgocable.net [24.150.152.123]) by cgocable.net (8.12.8p1/8.12.8) with ESMTP id aoelr258507 for deleted; Sun, 17 Aug 2003 01:34:12 -0400 (EST) Date: Sun, 17 Aug 2003 01:34:10 -0400 (EST) From: Citibank [EMAIL PROTECTED] X-Mailer: The Bat! (v1.61) Personal Reply-To: [EMAIL PROTECTED] X-Priority: 3 (Normal) Message-ID: [EMAIL PROTECTED] To: deleted Subject: [58~]Your Checking Account at Citibank. MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=--3309750874624 X-IMAIL-SPAM-VALFROM: (4981046) X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: BASE64: A binary encoded text or HTML section was found in this E-mail. X-RBL-Warning: FILTER-HEADER-XMAIL: Message failed FILTER-HEADER-XMAIL test (59) X-RBL-Warning: SPAMDOMAINS: Spamdomain 'juno.com' found: Address of [EMAIL PROTECTED] sent from invalid d150-152-123.home.cgocable.net. X-RBL-Warning: COUNTRY: Message failed COUNTRY test (36) X-RBL-Warning: FREEEMAILS: X-Declude-Sender: [EMAIL PROTECTED] [24.150.152.123] X-Declude-Spoolname: D5c6e004c01364150.SMD X-Note: This E-mail was scanned filtered by Declude [1.75i2] for SPAM virus. X-Spam-Tests-Failed: NOABUSE, IPNOTINMX, NOLEGITCONTENT, BASE64, FILTER-HEADER-XMAIL, SPAMDOMAINS, COUNTRY, WEIGHT20s, WEIGHT20r, FREEEMAILS X-Weight: 58 X-Mailfrom: Fwpreg_Warden.juno.com X-Note: Sent from: [EMAIL PROTECTED] X-Note: Sent from Reverse DNS: d150-152-123.home.cgocable.net ([24.150.152.123]). X-Hello: cgocable.net X-Note: Recipient(s): deleted X-Country-Chain: CANADA-destination X-RCPT-TO: deleted Status: U X-UIDL: 331466365 Dear Citibank customer, We are letting you know, that you, as a Citibank checking account holder, must become acquainted with our new Terms Conditions and agree to it. Please, carefully read all the parts of our new Terms Conditions and post your consent. Otherwise, we will have to suspend your Citibank checking account. This measure is to prevent misunderstanding between us and our valued customers. We are sorry for any inconvinience it may cause. Click here to access our Terms Conditions page and not allow your Citibank checking account suspension. 2003 Citibank. Citibank (West), FSB. Member FDIC. Citibank with Arc Design is a registered service mark of Citicorp. Citi.com Citigroup Privacy Promise Terms Conditions Copyright 2003 Citicorp ECRM_CBNA_NEW_ACTIVE --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus
RE: [Declude.JunkMail] sure to be silly question
That's right. Each is incremental, so if you have 75 comments it will give a weight of 10+10+10=30 You may wish to change the weight assigned for each to suit your circumstances. We use a weight system at approx. twice the default ones in order to arrive at a safe delete point of 100. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:47 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Here's what I did with the comments: I created the following tests COMMENTS20 comments 20 x 10 0 COMMENTS40 comments 40 x 10 0 COMMENTS60 comments 60 x 10 0 COMMENTS80 comments 80 x 10 0 COMMENTS100 comments 100 x 10 0 COMMENTS120 comments 120 x 10 0 Hmmm, ok, so am I reading this right? COMMENTS20 checks for 20 comments? if there are 20 comments, 10 is added to the weight, etc etc. ? Let me know if I'm right and I'll add them in, sounds promising, I think I may give these a HOLD action / zero weight first, to see how they work. Thanks Erik, Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New manuals
Is the new manual baked yet ? -Rock -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Thursday, July 31, 2003 5:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] New manuals Any progress on the new manuals? We are holding off completing a user interface until we can go through the current JM manual, just in case there is something new that will impact it. We're still working on it -- it's just taking a little longer than we thought it would. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] New RHSBL site
We are evaluating this new RHSBL site that SecuritySage is hosting, and it appears to be working well thus far. Info can be found at: http://www.securitysage.com/guides/postfix_uce_rhsbl.html The entry we are using in our global.cfg file is: SECURITYSAGE rhsbl blackhole.securitysage.com 127.0.0.5 2 0 Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sure to be silly question
Another way to scale the weight of this test is to use: COMMENTS comments weight x 5 0 where the test will accumulate the total number of obfuscation comments it finds and add 5 to that number and apply that to the weight result for the test. I don't see the comments test documented on the JunkMail manual site yet, so Scott, please correct me if I am wrong. Bill - Original Message - From: Tandem Group [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 19, 2003 11:46 AM Subject: RE: [Declude.JunkMail] sure to be silly question That's right. Each is incremental, so if you have 75 comments it will give a weight of 10+10+10=30 You may wish to change the weight assigned for each to suit your circumstances. We use a weight system at approx. twice the default ones in order to arrive at a safe delete point of 100. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:47 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Here's what I did with the comments: I created the following tests COMMENTS20 comments 20 x 10 0 COMMENTS40 comments 40 x 10 0 COMMENTS60 comments 60 x 10 0 COMMENTS80 comments 80 x 10 0 COMMENTS100 comments 100 x 10 0 COMMENTS120 comments 120 x 10 0 Hmmm, ok, so am I reading this right? COMMENTS20 checks for 20 comments? if there are 20 comments, 10 is added to the weight, etc etc. ? Let me know if I'm right and I'll add them in, sounds promising, I think I may give these a HOLD action / zero weight first, to see how they work. Thanks Erik, Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] sure to be silly question
That would be cool, but wouldn't that increment from zero, so that even one single comment would score a 6? Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Tuesday, August 19, 2003 12:28 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Another way to scale the weight of this test is to use: COMMENTS comments weight x 5 0 where the test will accumulate the total number of obfuscation comments it finds and add 5 to that number and apply that to the weight result for the test. I don't see the comments test documented on the JunkMail manual site yet, so Scott, please correct me if I am wrong. Bill - Original Message - From: Tandem Group [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 19, 2003 11:46 AM Subject: RE: [Declude.JunkMail] sure to be silly question That's right. Each is incremental, so if you have 75 comments it will give a weight of 10+10+10=30 You may wish to change the weight assigned for each to suit your circumstances. We use a weight system at approx. twice the default ones in order to arrive at a safe delete point of 100. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:47 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Here's what I did with the comments: I created the following tests COMMENTS20 comments 20 x 10 0 COMMENTS40 comments 40 x 10 0 COMMENTS60 comments 60 x 10 0 COMMENTS80 comments 80 x 10 0 COMMENTS100 comments 100 x 10 0 COMMENTS120 comments 120 x 10 0 Hmmm, ok, so am I reading this right? COMMENTS20 checks for 20 comments? if there are 20 comments, 10 is added to the weight, etc etc. ? Let me know if I'm right and I'll add them in, sounds promising, I think I may give these a HOLD action / zero weight first, to see how they work. Thanks Erik, Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sure to be silly question
Another way to scale the weight of this test is to use: COMMENTS comments weight x 5 0 where the test will accumulate the total number of obfuscation comments it finds and add 5 to that number and apply that to the weight result for the test. So which is a preferrable approach? I've added the COMMENTS20,40,60,80,100 lines to Global, and WARN actions in $default$, so I'm guessing it's set now, but if this way is easier, I'd switch. Right now no weight is added, and just warnings are added to the headers. 80 + 100 are set to HOLD for review. Thanks all! Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sure to be silly question
That's correct. However, you can set the value I showed in the example as 5, to anything you want, including zero 0, which would then add a weight exactly matching the number of obfuscated comments found in the message. Bill - Original Message - From: Tandem Group [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 19, 2003 12:52 PM Subject: RE: [Declude.JunkMail] sure to be silly question That would be cool, but wouldn't that increment from zero, so that even one single comment would score a 6? Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Tuesday, August 19, 2003 12:28 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Another way to scale the weight of this test is to use: COMMENTS comments weight x 5 0 where the test will accumulate the total number of obfuscation comments it finds and add 5 to that number and apply that to the weight result for the test. I don't see the comments test documented on the JunkMail manual site yet, so Scott, please correct me if I am wrong. Bill - Original Message - From: Tandem Group [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 19, 2003 11:46 AM Subject: RE: [Declude.JunkMail] sure to be silly question That's right. Each is incremental, so if you have 75 comments it will give a weight of 10+10+10=30 You may wish to change the weight assigned for each to suit your circumstances. We use a weight system at approx. twice the default ones in order to arrive at a safe delete point of 100. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of paul Sent: Tuesday, August 19, 2003 11:47 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sure to be silly question Here's what I did with the comments: I created the following tests COMMENTS20 comments 20 x 10 0 COMMENTS40 comments 40 x 10 0 COMMENTS60 comments 60 x 10 0 COMMENTS80 comments 80 x 10 0 COMMENTS100 comments 100 x 10 0 COMMENTS120 comments 120 x 10 0 Hmmm, ok, so am I reading this right? COMMENTS20 checks for 20 comments? if there are 20 comments, 10 is added to the weight, etc etc. ? Let me know if I'm right and I'll add them in, sounds promising, I think I may give these a HOLD action / zero weight first, to see how they work. Thanks Erik, Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Web based User Configurations
Hi All, Is there anything that will work with I-mail or stand alone that will enable the end user to adjust their declude settings from a web based terminal? Trying not to re-invent the wheel if I do not have to. THANKS Peter -Peter Lent Technology Services Manager Goodwill Industries of Orange County Shop online @ www.shopgoodwill.com www.ocgoodwill.org [EMAIL PROTECTED] 714.547.6308 x 377 714.543.4826 - Fax 714.240.4342 - Cell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Reporting Software, script attached
For anyone who wants this, here's a new script that will sort your delude log files and gives a simple easy to read report. This ones been cleaned up since the last one, and takes into account garbled and corrupt log files. Much easier to use, and no file renaming required. The only thing you have to do is edit your IP for your internal mail server, if you want. Written in PERL. Just put it in a directory with the log files you want checked, and it will do the rest, assuming you have PERL installed. Enjoy ! Sample output below : Log file dates from : 08/02/2003 to 08/19/2003 Lines Processed : 30763 My Mail Server IP : [X.x.x.x] Whitelisted from Internal Server: 2539 CAUTION : You have 83 WARNINGS/ERRORS in your log file CAUTION : You have 2 corrupt lines in your log file Total Messages Logged : 11715 Unique SMTP ID's Logged : 8 * ACTIONS LOGGED * COUNT PERCENTAGE ** White Listed: 339028.9 WEIGHT10: 473440.4 WEIGHT20: 5734.9 WEIGHT202 : 5734.9 WEIGHT40: 298625.5 * TESTS LOGGED *** COUNT PERCENTAGE ** BADHEADERS : 1987 17.0 BASE64 : 119 1.0 BLACKLIST : 493 4.2 FILTERWORDS : 3794 32.4 HELOBOGUS : 2718 23.2 IPBlacklist : 283 2.4 KILLERWORDS : 445 3.8 MAILFROM:44 0.4 NOABUSE : 1183 10.1 NOPOSTMASTER: 1074 9.2 REVDNS : 675 5.8 REVDNSPROBLEM : 1630 13.9 ROUTING : 144 1.2 SPAMCOP : 493 4.2 SPAMHEADERS : 2214 18.9 VirusKill : 1125 9.6 ** declog3.pl Description: declog3.pl
Re: [Declude.JunkMail] New RHSBL site - UPDATE
Even though the replies come back with 127.0.0.5, I had to change my global.cfg entry to: SECURITYSAGE rhsbl blackhole.securitysage.com * 2 0 in order for it to work correctly. Bill - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 19, 2003 12:16 PM Subject: [Declude.JunkMail] New RHSBL site We are evaluating this new RHSBL site that SecuritySage is hosting, and it appears to be working well thus far. Info can be found at: http://www.securitysage.com/guides/postfix_uce_rhsbl.html The entry we are using in our global.cfg file is: SECURITYSAGE rhsbl blackhole.securitysage.com 127.0.0.5 2 0 Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Web based User Configurations
Is there anything that will work with I-mail or stand alone that will enable the end user to adjust their declude settings from a web based terminal? It can be built using the IMail Web Messaging interface, but I don't think anybody's come up with a one-size solution yet. A rather wordy sample is at http://webmail.cypressintegrated.com:8383. See the SPAManager Settings areas. Username: [EMAIL PROTECTED] Password: blue -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Web based User Configurations
We have just put our own web interface on-line. Have a look at https://ss.alberni.net/spamcontrol/Login.asp The userid is 'declude' and the password is 'junkmail'. I'll leave that address up for a couple of days but don't nobody start spamming from it. :-) We have also written a management module which allows us to do per domain configurations for our domain customers. We sell per address service at $2.29 Cdn., and a per domain bundle including junkmail, virus and webmail for $9.95 per month for up to 20 addresses. Have just started this week, so don't know yet where that is going. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Peter Lent Sent: Tuesday, August 19, 2003 15:18 To: '[EMAIL PROTECTED]' Subject: [Declude.JunkMail] Web based User Configurations Hi All, Is there anything that will work with I-mail or stand alone that will enable the end user to adjust their declude settings from a web based terminal? Trying not to re-invent the wheel if I do not have to. THANKS Peter -Peter Lent Technology Services Manager Goodwill Industries of Orange County Shop online @ www.shopgoodwill.com www.ocgoodwill.org [EMAIL PROTECTED] 714.547.6308 x 377 714.543.4826 - Fax 714.240.4342 - Cell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Alligate
Does anyone have any configs they are willing to share that they are using in
production for Alligate with Declude? Thanks for the aid.
Keith
áÁj)pjË jyÞuú+¾*î±ëÈ7ç^V*î²m§ÿðÃ^r[yÊN¬f¢yúèØ^
ç%¹ºy j)fj)b b²Ôèº{.nÇ+·£ºËlzwZI[hf¢Êïuç%¹¢f§vzé ®Þ
ç%¹ºy j)S
æ«r¯zÇ·¢éÝjØm¶ÿà j)ZÈb½ç(
[Declude.JunkMail] Segregating spam by weight
I know there were some posts about this a while back but I cannot find what I am looking for now in my Declude mailbox. We hold all spam, delete nothing. Spam is held in the D:\IMail\spool\spam dir and we use Mail Review to go though looking for FPs. I would like to hold higher weighted spam in the D:\IMail\spool\spam\Hold instead, giving us fewer emails to review as FPs. Anyone doing this? Thanks Todd Hunter
RE: [Declude.JunkMail] Alligate
Do you mean as a Declude ONLY test? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Tuesday, August 19, 2003 7:18 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Alligate Does anyone have any configs they are willing to share that they are using in production for Alligate with Declude? Thanks for the aid. Keith NyuujjrxNrzujryjmrxjqy #Alligate for IMail CONFIGURATION FILE (MINIMUM CONFIGURATION) #PLEASE SEE THE CONFIGURATION INSTRUCTIONS FOR MORE OPTIONS #GENERAL NOTES # A # symbol or // symbol at the beginning of the line indicates a #comment, or when preceeding a configuration value, will undefine that #value. # THE FOLLOWING 2 VALUES MUST BE PROVIDED FOR ALL VERSIONS LICENSE x KEY xx # THE FOLLOWING 2 VALUES NEED REFLECT YOUR EMAIL ADDRESSES # THE POSTMASTER SHOULD BE A NEW, DEDICATED ACCOUNT FOR # SPAM HANDLING ONLY. POSTMASTER REPORTSTO x # THE FOLLOWING VALUE NEEDS TO BE USED IF YOU ARE USING Alligate # WITH IMail ALONE, OR WITH IMail and Declude Virus. #HANDOFFc:\imail\smtp32.exe # IF YOUR ARE USING Declude Junkmail, !!DELETE THE LINE ABOVE!! # AND RUN AlligateAS A Declude TEST. # DECLUDE SPECIFIC OPTIONS WHEN RUNNING AlligateAS # A DECLUDE TEST ONLY DECLUDETESTONLY TRUE SPAMMESSAGE NONE ADULTMESSAGENONE # THE FOLLOWING 4 KEYS NEED TO BE EDITED TO REFLECT YOUR # PREFERENCES **ONLY** IF YOU ROUTE FAILED MESSAGES # TO A PARTICULAR ADDRESS FOR REVIEW #ROUTESPAM [EMAIL PROTECTED] #ROUTESPAMSCORE 40 #ROUTEADULT [EMAIL PROTECTED] #ROUTEADULTSCORE40 # IF NOT RUNNING AS A DECLUDE TEST ONLY THEN THE FOLLOWING # 2 VALUES SHOULD BE USED #SPAMMESSAGEDEFAULT #ADULTMESSAGE DEFAULT # IF YOU WANT THE RECIPIENT OF OUTGOING MAIL TO BE ADDED TO THE # USERS WHITELIST AUTOMATICALLY, CHANGE THE NEXT VALUE TO TRUE AUTOWHITELIST FALSE # THE FOLLOWING 2 VALUES DEFINE WHETHER OR NOT TO SCAN OUTGOING # MAIL AND WILL CAUSE A REJECTION MESSAGE TO BE SENT TO YOUR # USER IF THE OUTGOING MESSAGE FAILS SCANOUTGOINGTRUE SENDREJECTION FALSE # THE BALANCE OF THESE VALUES ARE RECOMMENDED DEFAULTS AND # NEED NOT BE CHANGED REGARDLESS OF THE OPTIONS ABOVE SENDTOTRASH FALSE ALLOWRELAY TRUE NONENGLISH 6 BADROUTING 12 THRESHOLD 4 PATMATCHES 2 SATURATION 5 LOGALLFAILURES TRUE ADULTSCORE 18 #ADULTKILLSCORE 45 SPAMSCORE 18 #SPAMKILLSCORE 65 EXITCODESCORE 22 #KILLSCORE 75 #ADULTSUBJECT [ADULT] #SPAMSUBJECT[SPAM] LOGDETAIL DEBUG MAXSUBJECTSCORE 10 GOODSPAMMER 6 KNOWNSPAMMER8 HIGHASCII 5 SIGNATURE 4 DOHOSTLOOKUPTRUE REPEATIP4 REPEATHOST 4 CHECKREPEATSPAMMERS TRUE MAXREPEATSPAMMERS 500 TRASHBADENCODINGFALSE REPEATSPAMSCORE 30 REPEATADULTSCORE30 LOGFILEPATH E:\Alligate
