Re[2]: [Declude.JunkMail] Mark vs Hold vs Delete
Statistically speaking it's a very accurate generalization and I see little reason to ignore such things based on what might be more politically correct. Please show me the IT-industry-wide statistics that show that your profiled user is the _only_ notable recipient of spam (as this was the _only_ supposed profile you mentioned). I'm sure that our male-dominated financial clients that do business in South and Latin America, for one of many examples, would be delighted to find that their business connections _never_ use spam-friendly ISPs to send legitimate mail, including some governments. And our manufacturing clients, where men overwhelmingly set policy, would also be happy to find that their inability to give any weight to basic EHLO and PTR errors because their critical business partners are rampantly misconfigured would be pleasantly counterbalanced if they just replaced all of the 40+ female employees drawing in all that spam. And--I almost forgot!--the porn floods that testosterone-soaked trading desks and mailrooms mysteriously receive must be getting rerouted...better open a support ticket for that one. As a result of this women, and especially women over the age of 30 represent a disporportionally large number of the accounts that receive over 100 spams a day. Is it 30, or is it 40? Is it the age at which ageism is, federally recognized (the latter), or is that not actually sound? Does your figure actually hold up after controlling for class, age, race, gender, industry, job title, personal/business primary use, et al.? Can you possibly have a valid sample? I doubt it. You can classify this in many different ways and get many different answers. You can indeed. Seems you chose the one that was most juicy for a male-dominated space. Let me get this straight, you didn't like my association of a particular demographic with spam, but you feel that it is appropriate to then classify young men as what created the Internet bubble? No, I specifically said that they blew hot air into the bubble. To attempt to say that young entrepreneurs were not the technical idea men behind the bubble is to rewrite history. I was there on the inside of eight or nine such nightmares and know so intimately. ...the young Internet entrepreneurs were just patsies in the game... ROFLOL. You might have prospered and lived to gloat about it, but you never worked in a dotcom, clearly (or not in more than one lucky exception). Hey, yeah, without the VCs and IBs, it couldn't have been what it was, but if you think that kewl and the accompanying upselling of utter non-implementable nonsense were the work of patsies, come on. It took two to tango. Whatever, everyone has their grudges. But targeting a distinctly disempowered demographic is infinitely more dangerous than laying into young, educated men. The last thing IT communities need is more sexism. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamdomains.txt file
Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Mark vs Hold vs Delete
Sandy, I really hate taking things to a personal level, but I digress in this instance. First, if you read my original post, I used two examples to show how spam patterns can be very different based on the type of domain not knowing what sort of traffic Goran was seeing and how he might modify his approach. If you want to focus on the second example as being inaccurate, obviously YMMV, however this is my experience and it's stayed true as I've added more domains. Zombie spam is of course different because people don't "opt-in" to zombie spam and while it appears to not be gender or age biased based on who receives it, it is gender and age biased in terms of content because illegal products sold and illegal marketing is often performed, and pills and sex are highly targeted at the male demographic. Regarding your assertion about my experience... http://www.informationweek.com/703/03sskno.htm Been there, done that :) Matt Sanford Whiteman wrote: Statistically speaking it's a very accurate generalization and I see little reason to ignore such things based on what might be more politically correct. Please show me the IT-industry-wide statistics that show that your profiled user is the _only_ notable recipient of spam (as this was the _only_ supposed profile you mentioned). I'm sure that our male-dominated financial clients that do business in South and Latin America, for one of many examples, would be delighted to find that their business connections _never_ use spam-friendly ISPs to send legitimate mail, including some governments. And our manufacturing clients, where men overwhelmingly set policy, would also be happy to find that their inability to give any weight to basic EHLO and PTR errors because their critical business partners are rampantly misconfigured would be pleasantly counterbalanced if they just replaced all of the 40+ female employees drawing in all that spam. And--I almost forgot!--the porn floods that testosterone-soaked trading desks and mailrooms mysteriously receive must be getting rerouted...better open a support ticket for that one. As a result of this women, and especially women over the age of 30 represent a disporportionally large number of the accounts that receive over 100 spams a day. Is it 30, or is it 40? Is it the age at which ageism is, federally recognized (the latter), or is that not actually sound? Does your figure actually hold up after controlling for class, age, race, gender, industry, job title, personal/business primary use, et al.? Can you possibly have a valid sample? I doubt it. You can classify this in many different ways and get many different answers. You can indeed. Seems you chose the one that was most juicy for a male-dominated space. Let me get this straight, you didn't like my association of a particular demographic with spam, but you feel that it is appropriate to then classify young men as what created the Internet bubble? No, I specifically said that they "blew hot air into the bubble." To attempt to say that young entrepreneurs were not the technical "idea men" behind the bubble is to rewrite history. I was there on the inside of eight or nine such nightmares and know so intimately. ...the young Internet entrepreneurs were just patsies in the game... ROFLOL. You might have prospered and lived to gloat about it, but you never worked in a dotcom, clearly (or not in more than one lucky exception). Hey, yeah, without the VCs and IBs, it couldn't have been what it was, but if you think that "kewl" and the accompanying upselling of utter non-implementable nonsense were the work of patsies, come on. It took two to tango. Whatever, everyone has their grudges. But targeting a distinctly disempowered demographic is infinitely more dangerous than laying into young, educated men. The last thing IT communities need is more sexism. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
[Declude.JunkMail] OT: Scripting batch files
Hello everyone. I have created a batch file that runs Bill's log analyzer that was made available last week. What I would like to do is have the DOS batch file e-mail this each night at midnight using the previous days declude log file. I do not know much about date scripting in DOS batch files so any help would be appreciated. Here is the batch I have (very basic): wamlog c:\imail\spool\dec0418.log Stats.txt imail1 -s Daily Spam Stats -t [EMAIL PROTECTED] -u Spam -h domain.com -f Stats.txt Thanks, Jason --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New test
... when many of the tests could be wrapped by SpamAssassin custom rules ... The only thing I fear, is that as soon as SA will have such a rule spammers will immediatly rewrite their SW (or bether said email worms) and don't use anymore IP-like HELO strings. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] New test
The only thing I fear, is that as soon as SA will have such a rule spammers will immediatly rewrite their SW (or bether said email worms) and don't use anymore IP-like HELO strings. This would be reasonable if it were in the standard SA distro, but I'm talking about community sharing of custom rules. They could track either case, but even standard SA has remarkable accuracy given its visibility. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Mark vs Hold vs Delete
First, if you read my original post, I used two examples to show how spam patterns can be very different based on the type of domain not knowing what sort of traffic Goran was seeing and how he might modify his approach. Do you mean where you say-- Domains used exclusively for business and don't have much legit advertising or newsletters being sent are incredibly easy to manage --? The reason that profile didn't provoke comment one way or the other is that it's basically tautological. What you're saying is that a domain that doesn't get too much legit envelope-only mail doesn't get too many FPs on envelope-only mail. That may be informative to someone who knows little about SMTP, but it doesn't need valid statistics to prove it. (Shades of when someone asked on the IMail Forum, Can I safely disable envelope-only sending? I think it's realy helpful? Sure, if your users know what that will mean, it'll score a knockout.) On the other hand, a _human_ demographic without a valid sample is a very different type of claim. Eschewing comment on the company profile to point out the biases of the human profile shouldn't be surprising, since I sympathize more with humans than with companies. [zombie spam] is gender and age biased in terms of content because illegal products sold and illegal marketing is often performed, and pills and sex are highly targeted at the male demographic. Yes, a disproportionate amount of spam that has an explicit gender target (say, a pharmaceutical product to be applied to or ingested by men, or porn to be consumed by men of any orientation) targets men. This is not only because spammers (a) _assume_ a significant positive reception of these items by male readers, but also (b) because the products and services offered already existed in disproportionate quantity in the physical world (and, of course, the two factors now fertilize each other in the marketplace). There's also an _implicit_ gendering of other types of spam in the other direction; a social scientist would say that there is no product marketing that is not gendered. But this is essentially off-topic: again, I doubt you will find that the age and gender grouping you mention achieves a _preeminence_ (say, a supermajority) in a valid sample of (American?) e-mail users that explains its being used as the sole human profile in your tutorial. http://www.informationweek.com/703/03sskno.htm Good coverage! But I don't see working for a hundred-year-old company as comparable to working for a start-up during the bubble; I guess if that advances your side of the bubble argument, I'm not feeling it. I never said or meant to imply that you didn't have bricks-and-mortar experience. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Mark vs Hold vs Delete
Sandy, I thought you were an east-coaster...you should get some sleep! grin Darin. - Original Message - From: Sanford Whiteman [EMAIL PROTECTED] To: Matt [EMAIL PROTECTED] Sent: Monday, April 19, 2004 3:43 AM Subject: Re[2]: [Declude.JunkMail] Mark vs Hold vs Delete First, if you read my original post, I used two examples to show how spam patterns can be very different based on the type of domain not knowing what sort of traffic Goran was seeing and how he might modify his approach. Do you mean where you say-- Domains used exclusively for business and don't have much legit advertising or newsletters being sent are incredibly easy to manage --? The reason that profile didn't provoke comment one way or the other is that it's basically tautological. What you're saying is that a domain that doesn't get too much legit envelope-only mail doesn't get too many FPs on envelope-only mail. That may be informative to someone who knows little about SMTP, but it doesn't need valid statistics to prove it. (Shades of when someone asked on the IMail Forum, Can I safely disable envelope-only sending? I think it's realy helpful? Sure, if your users know what that will mean, it'll score a knockout.) On the other hand, a _human_ demographic without a valid sample is a very different type of claim. Eschewing comment on the company profile to point out the biases of the human profile shouldn't be surprising, since I sympathize more with humans than with companies. [zombie spam] is gender and age biased in terms of content because illegal products sold and illegal marketing is often performed, and pills and sex are highly targeted at the male demographic. Yes, a disproportionate amount of spam that has an explicit gender target (say, a pharmaceutical product to be applied to or ingested by men, or porn to be consumed by men of any orientation) targets men. This is not only because spammers (a) _assume_ a significant positive reception of these items by male readers, but also (b) because the products and services offered already existed in disproportionate quantity in the physical world (and, of course, the two factors now fertilize each other in the marketplace). There's also an _implicit_ gendering of other types of spam in the other direction; a social scientist would say that there is no product marketing that is not gendered. But this is essentially off-topic: again, I doubt you will find that the age and gender grouping you mention achieves a _preeminence_ (say, a supermajority) in a valid sample of (American?) e-mail users that explains its being used as the sole human profile in your tutorial. http://www.informationweek.com/703/03sskno.htm Good coverage! But I don't see working for a hundred-year-old company as comparable to working for a start-up during the bubble; I guess if that advances your side of the bubble argument, I'm not feeling it. I never said or meant to imply that you didn't have bricks-and-mortar experience. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] Mark vs Hold vs Delete
Sandy, I thought you were an east-coaster...you should get some sleep! grin Right you are. Actually, I'm supposed to be coding, but it's so easy to get distracted... --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
Thanks.. I've received a couple so far, so if you don't wish to send it, it's ok.. But I do have another question for the list.. Pretty much the entries for Global.CFG and the junkmail config for the spamdomains tests.. Which weight seems to work best, etc. This weekend, I've seen A LOT of spam that wasn't caught that would if SPAMDOMAINS was being run (messages from Argentina but listing Yahoo as the e-mail account).. Thanks... -Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Ignore all tests
Is there a way to IGNORE all tests on outbound customer mail. Outgoing actions are determined by the settings in the \IMail\Declude\global.cfg file. If you set all the actions in that file to IGNORE, then no action will be taken on outgoing E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
Todd, Would you mind sending me a copy of the spamdomain.txt file as well? I would like to see what you have as a starting point. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New test
Matt wrote: I have a few suggestions that you might want to consider. The first one would be to skip processing of the message and just have Declude pass off the HELO as an argument to your script. This can be done with %HELO%. This will speed processing and ensure that the HELO comes in the proper context. Declude can be configured for IPBYPASS settings which are used to skip over gateway mail servers and forwarding servers so that you have the HELO of the computer that is actually sending the E-mail. That's a great idea! Not sure why I didn't think of that in the initial implementation Combining both of your tests into one program instead of two would also be useful. You can use any code over 10 for this. Declude also will only call the script once if the command is the same, and it will determine which test would be failed based on the result code that is returned. For a non-zero test, I thought any non-zero result evaluates the same. I have considered configuring it to take a parameter to determine if the X test should be used. The last thing that I'm not very clear about is the logic of the detection. Fairly straight forward: for HELOISIP, convert dashes (-) to dots ., strip out anything that's not a number or a dot, see if there's 4 octets of numbers = 255. I'm not sure why Serge's example failed, I'll test later today. It is possible that there would be a FP from a host name like host11.rack2.location3.bldg4.example.com. His example (alias-1.c10-ave-mta1.cnet.com) should have become 1.10.1, and not failed the test -- only 3 numbers. The HELOISIPX test only does the last step -- no tinkering with the content first. I have a custom filter called DYNAMIC listed in the beta section of my site Unfortunately, I don't have JM pro, so... It's extremely unlikely that you would miss detecting a zombie using the reverse DNS entry as the HELO if you ignored hits below 20 because there aren't many ISP class A's in use below that level (I think just IBM), an you have 4 chances to hit a number above 20. You're right, although ATT is in there as well, and they have a few internet customers, I think. The pattern that you identified is of course a very nice addition to spam fighting. Thanks! We all try to do our part; thanks for the kind words and good suggestions! -- --- illigitimi non carborundum --- Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
Me too, Thanks, Doug -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic Sent: Monday, April 19, 2004 7:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Todd, Would you mind sending me a copy of the spamdomain.txt file as well? I would like to see what you have as a starting point. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] NOTENDSWITH problem
My favorite new filter has been the NOTENDSWITH... But I've found a problem. COUNTRY 5 NOTENDSWITH US Using the above line, every country including the US gets five points. May I also suggest a NOIS filter test? Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
Me too. Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Doug McKee Sent: Monday, April 19, 2004 8:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me too, Thanks, Doug -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic Sent: Monday, April 19, 2004 7:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Todd, Would you mind sending me a copy of the spamdomain.txt file as well? I would like to see what you have as a starting point. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
I have 3 different Spamdomains.txt weights. Outblaze, mail2world, and everyone.net domain's get 15 points (tag at 20, hold at 35) Strong spamdomains get 10 points (rare false positives, MX servers with only one domain name). Weak spamdomains get 7 points (domains more likely to false positive, MX servers with different domain names). If you end up using more than one, beware of double-dipping with domains like: online.de and worldonline.de Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/19/04 07:09AM Thanks.. I've received a couple so far, so if you don't wish to send it, it's ok.. But I do have another question for the list.. Pretty much the entries for Global.CFG and the junkmail config for the spamdomains tests.. Which weight seems to work best, etc. This weekend, I've seen A LOT of spam that wasn't caught that would if SPAMDOMAINS was being run (messages from Argentina but listing Yahoo as the e-mail account).. Thanks... -Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
Me three. ;) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Rick Hogue Sent: Monday, April 19, 2004 6:56 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me too. Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Doug McKee Sent: Monday, April 19, 2004 8:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me too, Thanks, Doug -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic Sent: Monday, April 19, 2004 7:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Todd, Would you mind sending me a copy of the spamdomain.txt file as well? I would like to see what you have as a starting point. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SBL-XBL Question
Many thanks, I couldn't find that info anywhere (else). Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/16/04 05:33PM Not surprising that you missed this one, based on the subject line: http://www.mail-archive.com/[EMAIL PROTECTED]/msg17684.html Sorry if this has already been answered here. My inbound messages on this list have been highly out of sort order. Andrew 8) -Original Message- From: Scott Fisher [mailto:[EMAIL PROTECTED] Sent: Friday, April 16, 2004 9:11 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SBL-XBL Question I see that the Spamhaus XBL returns values 127.0.0.4-6. I'm currently using 127.0.0.4. Can anyone tell me what return values 127.0.0.5 and 127.0.0.6 refer to? Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
Me too! Kevin -- Original Message -- From: John Tolmachoff \(Lists\) [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Mon, 19 Apr 2004 07:09:27 -0700 Me three. ;) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Rick Hogue Sent: Monday, April 19, 2004 6:56 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me too. Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Doug McKee Sent: Monday, April 19, 2004 8:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me too, Thanks, Doug -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic Sent: Monday, April 19, 2004 7:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Todd, Would you mind sending me a copy of the spamdomain.txt file as well? I would like to see what you have as a starting point. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at
[Declude.JunkMail] Global.CFG file for separate domains
Hello, I was wondering if it's possible with the standard version to create a Global.cfg file or that type of file (whitelist and other configs) for separate domains (like the $default$.junkmail file).. Thanks.. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] NOTENDSWITH problem
My favorite new filter has been the NOTENDSWITH... But I've found a problem. COUNTRY 5 NOTENDSWITH US Using the above line, every country including the US gets five points. It seems that there is an issue with the code where NOTENDSWITH will not work properly if the length of the data you are looking at (COUNTRY, which might be FR if the E-mail was sent from France) is the same as what you are comparing it to (US). This will be fixed in the next release. In the meantime, you could: COUNTRY -5 ENDSWITHUS and then adding 5 points some other way (in the test definition, perhaps, or a line such as COUNTRY 5 ISBLANK). That way, 0 points will be added for E-mail from the United States, but 5 points will be added for E-mail not from the United States. May I also suggest a NOIS filter test? That does sound like a good idea -- it has been added to the suggestion database. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spamdomains.txt file
I'd post the one I received off list, but am not sure if the original person who sent it to me would like if I did.. I'll contact them and see if it would be ok.. Just don't want to make anyone angry.. I'm sure they won't care, but it would stink to post it and then have them come back bitchin' that I did.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Monday, April 19, 2004 10:09 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me three. ;) John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Rick Hogue Sent: Monday, April 19, 2004 6:56 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me too. Rick Hogue www.intent.net Web Hosting 1-800-866-2983 www.prosperity.com Featured web site -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Doug McKee Sent: Monday, April 19, 2004 8:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Me too, Thanks, Doug -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic Sent: Monday, April 19, 2004 7:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spamdomains.txt file Todd, Would you mind sending me a copy of the spamdomain.txt file as well? I would like to see what you have as a starting point. Thanx Goran Jovanovic The LAN Shoppe -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Todd Sent: Monday, April 19, 2004 2:19 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Spamdomains.txt file Jeff, I see no one has answered you on this. Spamdomains is a very useful test and I think you will like the results. We get an average of 14% weekdays and 26% on weekends of our email fail Spamdomains and there are not a lot of FPs. I will send you a spamdomains file tomorrow. Todd Hunter Smart Mail - Original Message - From: Jeff Maze - Hostmaster [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 16, 2004 11:15 AM Subject: RE: [Declude.JunkMail] Spamdomains.txt file Anyone? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jeff Maze - Hostmaster Sent: Friday, April 16, 2004 8:26 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spamdomains.txt file Hello, I think I'm going to implement the spam domains tests. Anyone have a file they would like to share that works well for them? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [South Texas Internet scanned this E-mail for viruses using Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
RE: [Declude.JunkMail] Spamdomains.txt file
Here's the spamdomains.txt file I received off-list (for our setup, I left out the outblaze domains).. Don't forget to add the needed entries to the Global.cfg file and the $default$.junkmail files (see below).. Global.cfg _ SPAMDOMAINS spamdomains C:\IMail\Declude\spamdomains.txtx 15 0 $default$.junkmail _ SPAMDOMAINS WARN spamdomains.txt _ @paypal.com .paypal. citibank.com.ssmb.com fleet.com .bkb.com wellsfargo.com .norwest.com .ebay.com .emailebay.com @ebay.com .ebay.com amazon.com att.net attbi.com bellatlantic.netverizon.net bellsouth.net charter.net china.com comcast.net compuserve.com concentric..cnchost.com cox.net earthlink. excite.com excitenetwork.com gte.net verizon.net hotmail.com msn.com juno.com untd.com @lycos.co.uklycos. @lycos.com mac.com apple.com mailcity.comlycos.com mindspring. earthlink. msn.com hotmail.com netscape.netaol.com netzero.com untd.com prodigy.net qwest.net .rr.com sympatico.cabellnexxia.net usa.net mx.net wanadoo.fr yahoo. rocketmail.com yahoo.com zzn.com mailcentro.com shaw.ca shawcable.net icq.com google.com @2die4.com outblaze.com @accountant.com outblaze.com @adexec.com outblaze.com @africamail.com outblaze.com @allergist.com outblaze.com @alumnidirector.com outblaze.com @archaeologist.com outblaze.com @arcticmail.com outblaze.com @artlover.com outblaze.com @asia.com outblaze.com @australiamail.com outblaze.com @berlin.com outblaze.com @bikerider.com outblaze.com @catlover.com outblaze.com @cheerful.com outblaze.com @chemist.comoutblaze.com @clerk.com outblaze.com @cliffhanger.comoutblaze.com @columnist.com outblaze.com @comic.com outblaze.com @consultant.com outblaze.com @counsellor.com outblaze.com @cutey.com outblaze.com @deliveryman.comoutblaze.com @diplomats.com outblaze.com @doctor.com outblaze.com @doglover.com outblaze.com @dr.com outblaze.com @dublin.com outblaze.com @earthling.net outblaze.com @email.com outblaze.com @engineer.com outblaze.com @europe.com outblaze.com @execs.com outblaze.com @financier.com outblaze.com @gardener.com outblaze.com @geologist.com outblaze.com @graphic-designer.com outblaze.com @hairdresser.netoutblaze.com @hot-shot.com outblaze.com @iname.com outblaze.com @inorbit.comoutblaze.com @insurer.comoutblaze.com @japan.com outblaze.com @journalist.com outblaze.com @lawyer.com outblaze.com @legislator.com outblaze.com @lobbyist.com outblaze.com @london.com outblaze.com @loveable.com outblaze.com @mad.scientist.com outblaze.com @madrid.com outblaze.com @mail.com outblaze.com @mindless.com outblaze.com @minister.com outblaze.com @moscowmail.com outblaze.com @munich.com outblaze.com @musician.org outblaze.com @myself.com outblaze.com @nycmail.comoutblaze.com @optician.com outblaze.com @paris.com outblaze.com @pediatrician.com outblaze.com @playful.comoutblaze.com @poetic.com outblaze.com @popstar.comoutblaze.com @post.com outblaze.com @presidency.com outblaze.com @priest.com outblaze.com @programmer.net outblaze.com @publicist.com outblaze.com @realtyagent.comoutblaze.com @registerednurses.com outblaze.com @repairman.com outblaze.com @representative.com outblaze.com @rescueteam.com outblaze.com @rome.com outblaze.com @saintly.comoutblaze.com @samerica.com outblaze.com @sanfranmail.comoutblaze.com @scientist.com outblaze.com @seductive.com outblaze.com @singapore.com outblaze.com @sociologist.comoutblaze.com @soon.com outblaze.com @teacher.comoutblaze.com @techie.com outblaze.com @tokyo.com outblaze.com @umpire.com outblaze.com @usa.comoutblaze.com @whoever.comoutblaze.com @winning.comoutblaze.com @witty.com outblaze.com @writeme.comoutblaze.com @yours.com outblaze.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Global.CFG file for separate domains
I was wondering if it's possible with the standard version to create a Global.cfg file or that type of file (whitelist and other configs) for separate domains (like the $default$.junkmail file).. Thanks.. No, the settings in the global.cfg file are global settings, and cannot be used on a per-user/per-domain basis. For whitelisting, though, there is a new WHITELISTFILE option that allows you to create per-user (Pro version) or per-domain (Standard/Pro versions) whitelists. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Making stuff do what it's not supposed to
Using existing methods in Imail and Declude, is there any way to get the revdns info to show on the from: or the subj: line? I had someone ask, didn't know and I did not see it in the archives, and said I would try to find out. So ... ~~ ~ Timm Jasper ~ ~ Systems Administrator, TQCI ~ ~ 22861 Three Notch Road Suite 3 ~ ~ California, Maryland 20619 ~ ~ Phone: 301-863-6121 ~ ~ Fax: 301-863-7544~ ~~ --- [This E-mail scanned for viruses by tqci.net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Scripting batch files
Responding to my own post:
Here is the final batch file with date scripting included. It is
probably too basic, but if anyone can use it here it is:
for /F tokens=1-4 delims=/- %%A in ('date/T') do wamlog
c:\imail\spool\dec%%B%%C.log Stats.txt
imail1 -s Daily Spam Stats -f Stats.txt -t [EMAIL PROTECTED] -u Spam -h
domain.com
Jason
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jason
Sent: Monday, April 19, 2004 2:05 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] OT: Scripting batch files
Hello everyone.
I have created a batch file that runs Bill's log analyzer that was made
available last week. What I would like to do is have the DOS batch file
e-mail this each night at midnight using the previous days declude log
file. I do not know much about date scripting in DOS batch files so any
help would be appreciated. Here is the batch I have (very basic):
wamlog c:\imail\spool\dec0418.log Stats.txt
imail1 -s Daily Spam Stats -t [EMAIL PROTECTED] -u Spam -h domain.com -f
Stats.txt
Thanks,
Jason
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail. The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
RE: [Declude.JunkMail] New test
These headers didn't trigger the HELOISIP test. It looks to me like they should have. Any Ideas? Received: from adsl-63-202-107-44.dsl.lsan03.pacbell.net [63.202.107.44] by areatech.com (SMTPD32-7.14) id A37557AB0118; Mon, 19 Apr 2004 10:42:45 -0500 Received: from iowiekwaoakkwjehckckw.com (iowiekwaoakkwjehckckw.com [20.214.235.110]) by adsl-63-202-107-44.dsl.lsan03.pacbell.net (Postfix) with ESMTP id 24CB5D66BE for [EMAIL PROTECTED]; Mon, 19 Apr 2004 11:36:16 -0400 Date: Mon, 19 Apr 2004 11:36:16 -0400 From: Counsellors T. Dissenters [EMAIL PROTECTED] X-Mailer: The Bat! (v2.00.0) Personal Reply-To: [EMAIL PROTECTED] X-Priority: 3 Message-ID: [EMAIL PROTECTED] To: Newlandj [EMAIL PROTECTED] Subject: A|D|V 1adies tthat wannt to encounter 5trangers MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-milter (http://amavis.org/) X-RBL-Warning: MAILFROM: Domain iowiekwaoakkwjehckckw.com has no MX or A records [0301]. [2-26-d000] X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 10. [2-37-12800] X-RBL-Warning: WEIGHT10: Weight of 32 reaches or exceeds the limit of 10. [2-38-13000] X-RBL-Warning: WEIGHT20: Weight of 32 reaches or exceeds the limit of 28. [2-41-14800] X-Declude-Sender: [EMAIL PROTECTED] [63.202.107.44] X-Spam-Tests-Failed: SORBS-DUHL, MAILFROM, SPAMCHK, WEIGHT10, WEIGHT20 [32] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] New test
Sandy, already awake? I've tried to configure spamc32. After installing cygwin under c:\cygwin your readme states to open a DOS prompt, cd \cygwin\bin and type cygwin. This wouldn't work with cygwin 1.5.9-1 In can find a cygwin.bat on c:\cygwin Starting this batch I can see a unix like command prompt and a bash: /etc/profile: Permission denied (Admin user, not NTFS restrictions) Trying to start cpan results in: bash-2.05b$ cpan bash: cpan: command not found Starting the batch file will open the cygwin prompt and cd into the bin folder, so I'm already where cpan can be called directly. In \cygwin\bin I can find a file cpan but seems to be one without an extension. (Most other files has a .exe extension) Any ideas? Before I continue with this work. How good are SA results? I believe several tests run's twice if configured in SA and Declude. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Making stuff do what it's not supposed to
Thanks for beaming me the info Scotty :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, April 19, 2004 12:09 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Making stuff do what it's not supposed to Using existing methods in Imail and Declude, is there any way to get the revdns info to show on the from: or the subj: line? I had someone ask, didn't know and I did not see it in the archives, and said I would try to find out. I believe that you could use: CATCHALLMAILS SUBJECT [%REVDNS%] to accomplish this. You should then see the reverse DNS entry at the beginning of the subject, in brackets. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by tqci.net] --- [This E-mail scanned for viruses by tqci.net] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New test
Jason wrote: These headers didn't trigger the HELOISIP test. It looks to me like they should have. Any Ideas? Received: from adsl-63-202-107-44.dsl.lsan03.pacbell.net [63.202.107.44] by areatech.com (SMTPD32-7.14) id A37557AB0118; Mon, 19 Apr 2004 10:42:45 -0500 Because of the 'lsan03', the numeric characters in the host name boil down to 63.202.107.44.03. I'm thinking about how best to make this type of entry fail, without jacking up the risk of a false positive. -- --- illigitimi non carborundum --- Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New test
You should be fine as long as you don't do matches on numbers below 20, or at least that is my experience. I'm thinking that you created this exception in order to head off that problem. Minimally it's worth a try. Matt Bud Durland wrote: Jason wrote: These headers didn't trigger the HELOISIP test. It looks to me like they should have. Any Ideas? Received: from adsl-63-202-107-44.dsl.lsan03.pacbell.net [63.202.107.44] by areatech.com (SMTPD32-7.14) id A37557AB0118; Mon, 19 Apr 2004 10:42:45 -0500 Because of the 'lsan03', the numeric characters in the host name boil down to 63.202.107.44.03. I'm thinking about how best to make this type of entry fail, without jacking up the risk of a false positive. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS - Netscape.com
Hello, I got a message that was from [EMAIL PROTECTED] but came from RoadRunners networks. There isn't a netscape entry in my SPAMDOMAINS.TXT file. I was just wondering what I would enter to make it so. I did a NSLOOKUP on netscape.com and the MX record points to mail.nescape.everyone.net. So the entry I would enter would be: netscape.comnetscape.everyone.net Is this correct? Just want to make sure if there are more later. I want to understand this so I don't keep asking. Thanks.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New test
Will Heloisp run on NT ...I do not see any activity in task manager or in the declude logslog level MID At 01:57 PM 4/19/2004 -0400, you wrote: You should be fine as long as you don't do matches on numbers below 20, or at least that is my experience. I'm thinking that you created this exception in order to head off that problem. Minimally it's worth a try. Matt Bud Durland wrote: Jason wrote: These headers didn't trigger the HELOISIP test. It looks to me like they should have. Any Ideas? Received: from adsl-63-202-107-44.dsl.lsan03.pacbell.net [63.202.107.44] by areatech.com (SMTPD32-7.14) id A37557AB0118; Mon, 19 Apr 2004 10:42:45 -0500 Because of the 'lsan03', the numeric characters in the host name boil down to 63.202.107.44.03. I'm thinking about how best to make this type of entry fail, without jacking up the risk of a false positive. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New test
Don't know about NT4, but we are running it on Win2k using log level low and it is working well. I don't see it come up in the task manager either, but it is running. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn Brooks Sent: Monday, April 19, 2004 1:10 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] New test Will Heloisp run on NT ...I do not see any activity in task manager or in the declude logslog level MID At 01:57 PM 4/19/2004 -0400, you wrote: You should be fine as long as you don't do matches on numbers below 20, or at least that is my experience. I'm thinking that you created this exception in order to head off that problem. Minimally it's worth a try. Matt Bud Durland wrote: Jason wrote: These headers didn't trigger the HELOISIP test. It looks to me like they should have. Any Ideas? Received: from adsl-63-202-107-44.dsl.lsan03.pacbell.net [63.202.107.44] by areatech.com (SMTPD32-7.14) id A37557AB0118; Mon, 19 Apr 2004 10:42:45 -0500 Because of the 'lsan03', the numeric characters in the host name boil down to 63.202.107.44.03. I'm thinking about how best to make this type of entry fail, without jacking up the risk of a false positive. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blackholes.us Resolution Problems
To save some trouble shooting time, see below ==Original message text=== On Apr 19, 2004, at 7:29 AM, Don Brown wrote: Are you having issues with your DNS servers or are you getting DOS'ed? We have noticed several connection failures in our log, starting yesterday morning. Thanks, Don Brown - Dallas, Texas USA Internet Concepts, Inc. Date: Monday, April 19, 2004, 12:57:59 PM Subject: DNS Issues? My poor servers are very overworked - just about everyone providing secondary service had to quit recently due to DDoS attacks or poor connectivity. However, someone has just donated two older Sun boxes to help with the problem and hopefully things will improve very soon. - Matthew ===End of original message text=== Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED]http://www.inetconcepts.net PGP Key ID: 04C99A55(972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMDOMAINS - Netscape.com
Ok.. Makes sense.. Thanks.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Monday, April 19, 2004 2:29 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Jeff, the main problem with figuring out spamdomains entries is that you really have to receive valid mail from the domain to really know. If they have an SPF record, that's the easiest way to research them, but you can also try the website at http://www.SenderBase.org to see what they've noticed. They've noticed one more host: dust.netscape.com The problem with checking the MX record is that it is only for recording inbound mail to Netscape.com, it doesn't necessarily say anything about outbound mail from them, which is what you're after. I suspect that your suggestion will work fine, as I think that they keep their corporate domain for netscape.com separate from the customer business as netscape.net ... Andrew 8) -Original Message- From: Jeff Maze - Hostmaster [mailto:[EMAIL PROTECTED] Sent: Monday, April 19, 2004 11:07 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Hello, I got a message that was from [EMAIL PROTECTED] but came from RoadRunners networks. There isn't a netscape entry in my SPAMDOMAINS.TXT file. I was just wondering what I would enter to make it so. I did a NSLOOKUP on netscape.com and the MX record points to mail.nescape.everyone.net. So the entry I would enter would be: netscape.comnetscape.everyone.net Is this correct? Just want to make sure if there are more later. I want to understand this so I don't keep asking. Thanks.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS - Netscape.com
Andrew and Jeff, Unfortunately Netscape.net is actually handled by aol.com when it is outgoing (which is what matters in this case). I sometimes search my known good E-mail for outgoing servers, or Google for it by looking for header code along with the address and keeping in mind that a lot of that stuff is forged especially in newsgroups. Here are the headers from a test of my own account: Received: from imo-d01.mx.aol.com [205.188.157.33] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id AE31AB9B0140; Mon, 19 Apr 2004 14:45:05 -0400 Received: from [EMAIL PROTECTED] by imo-d01.mx.aol.com (mail_out_v37_r1.2.) id j.1b5.a579353 (16239) for [EMAIL PROTECTED]; Mon, 19 Apr 2004 14:45:00 -0400 (EDT) Received: from netscape.net (mow-d23.webmail.aol.com [205.188.139.164]) by air-in03.mx.aol.com (v98.19) with ESMTP id MAILININ33-3f6f40841e2c327; Mon, 19 Apr 2004 14:45:00 -0500 Date: Mon, 19 Apr 2004 14:45:00 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: test MIME-Version: 1.0 Message-ID: [EMAIL PROTECTED] X-Mailer: Atlas Mailer 2.0 X-AOL-IP: 24.195.119.188 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-MailPure: X-MailPure: RFC-NOABUSE: Failed, listed in abuse.rfc-ignorant.org (weight 1). X-MailPure: RFC-NOPOSTMASTER: Failed, listed in postmaster.rfc-ignorant.org (weight 1). X-MailPure: X-MailPure: Spam Score: 2 X-MailPure: Scan Time: 14:45:12 on 04/19/2004 X-MailPure: Spool File: D1e31ab9b01404b3e.SMD X-MailPure: Server Name: imo-d01.mx.aol.com X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: imo-d01.mx.aol.com [205.188.157.33] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Colbeck, Andrew wrote: Jeff, the main problem with figuring out spamdomains entries is that you really have to receive valid mail from the domain to really know. If they have an SPF record, that's the easiest way to research them, but you can also try the website at http://www.SenderBase.org to see what they've noticed. They've noticed one more host: dust.netscape.com The problem with checking the MX record is that it is only for recording inbound mail to Netscape.com, it doesn't necessarily say anything about outbound mail from them, which is what you're after. I suspect that your suggestion will work fine, as I think that they keep their corporate domain for netscape.com separate from the customer business as netscape.net ... Andrew 8) -Original Message- From: Jeff Maze - Hostmaster [mailto:[EMAIL PROTECTED] Sent: Monday, April 19, 2004 11:07 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Hello, I got a message that was from [EMAIL PROTECTED] but came from RoadRunners networks. There isn't a netscape entry in my SPAMDOMAINS.TXT file. I was just wondering what I would enter to make it so. I did a NSLOOKUP on netscape.com and the MX record points to mail.nescape.everyone.net. So the entry I would enter would be: netscape.com netscape.everyone.net Is this correct? Just want to make sure if there are more later. I want to understand this so I don't keep asking. Thanks.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMDOMAINS - Netscape.com
Well, Matt, that's a great example for Netscape.net, but Jeff was asking about Netscape.com So I guess to round out the conversation, here's the two entries in spamdomains that everybody seems to have, to cover Netscape.net: aol.com netscape.net netscape.netaol.com I'm pretty sure that we have Bill Landry to thank for the seminal work on sd.txt from which everyone has benefitted (hey, credit where credit is due!) Andrew 8) -Original Message- From: Matt [mailto:[EMAIL PROTECTED] Sent: Monday, April 19, 2004 11:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Andrew and Jeff, Unfortunately Netscape.net is actually handled by aol.com when it is outgoing (which is what matters in this case). I sometimes search my known good E-mail for outgoing servers, or Google for it by looking for header code along with the address and keeping in mind that a lot of that stuff is forged especially in newsgroups. Here are the headers from a test of my own account: Received: from imo-d01.mx.aol.com [205.188.157.33] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id AE31AB9B0140; Mon, 19 Apr 2004 14:45:05 -0400 Received: from [EMAIL PROTECTED] by imo-d01.mx.aol.com (mail_out_v37_r1.2.) id j.1b5.a579353 (16239) for [EMAIL PROTECTED]; Mon, 19 Apr 2004 14:45:00 -0400 (EDT) Received: from netscape.net (mow-d23.webmail.aol.com [205.188.139.164]) by air-in03.mx.aol.com (v98.19) with ESMTP id MAILININ33-3f6f40841e2c327; Mon, 19 Apr 2004 14:45:00 -0500 Date: Mon, 19 Apr 2004 14:45:00 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: test MIME-Version: 1.0 Message-ID: [EMAIL PROTECTED] X-Mailer: Atlas Mailer 2.0 X-AOL-IP: 24.195.119.188 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-MailPure: X-MailPure: RFC-NOABUSE: Failed, listed in abuse.rfc-ignorant.org (weight 1). X-MailPure: RFC-NOPOSTMASTER: Failed, listed in postmaster.rfc-ignorant.org (weight 1). X-MailPure: X-MailPure: Spam Score: 2 X-MailPure: Scan Time: 14:45:12 on 04/19/2004 X-MailPure: Spool File: D1e31ab9b01404b3e.SMD X-MailPure: Server Name: imo-d01.mx.aol.com X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: imo-d01.mx.aol.com [205.188.157.33] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Colbeck, Andrew wrote: Jeff, the main problem with figuring out spamdomains entries is that you really have to receive valid mail from the domain to really know. If they have an SPF record, that's the easiest way to research them, but you can also try the website at http://www.SenderBase.org to see what they've noticed. They've noticed one more host: dust.netscape.com The problem with checking the MX record is that it is only for recording inbound mail to Netscape.com, it doesn't necessarily say anything about outbound mail from them, which is what you're after. I suspect that your suggestion will work fine, as I think that they keep their corporate domain for netscape.com separate from the customer business as netscape.net ... Andrew 8) -Original Message- From: Jeff Maze - Hostmaster [mailto:[EMAIL PROTECTED] Sent: Monday, April 19, 2004 11:07 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Hello, I got a message that was from [EMAIL PROTECTED] but came from RoadRunners networks. There isn't a netscape entry in my SPAMDOMAINS.TXT file. I was just wondering what I would enter to make it so. I did a NSLOOKUP on netscape.com and the MX record points to mail.nescape.everyone.net. So the entry I would enter would be: netscape.com netscape.everyone.net Is this correct? Just want to make sure if there are more later. I want to understand this so I don't keep asking. Thanks.. -Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This
Re: [Declude.JunkMail] New test
Glenn Brooks wrote: Will Heloisp run on NT ...I do not see any activity in task manager or in the declude logslog level MID It should run on NT just fine, although I couldn't test it on that platform. No surprise that it's not on the task manager -- it does it's thing very quickly an probably doesn't stick around long enough to show up. -- --- illigitimi non carborundum --- Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Blocking on attachment name
I want to hold email that has an attachment with a given file name. I know the exact file name and size. It seems like a saw some posts about this in the past but searches of my archived Declude folder didn't come up with anything. Thank, Todd Hunter --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS - Netscape.com
Oops, sorry. I'm not sure about netscape.com, but E-mail from that domain has been quite rare in the past since they don't have hardly any employees, and even if you had their primary reverse DNS entries, it's quite possible that they send out as netscape.com from third-parties just like symantec.com does (which is quite boneheaded for an AV/Anti-Spam provider). This is what I'm using for netscape.com: @netscape.com .aol. This might be a good example of a domain though that really needs benefit of two columns, i.e.: netscape.com .aol. I have no idea what they are doing for their new ISP service as far as E-mail goes, but I would expect for them to channel everything through aol.com just as they have with netscape.net. I don't see why they would seek to establish a new network exclusively for this new service. FYI, I never found a reason for the following entry: aol.com netscape.net Omitting it hasn't caused any problems that I am aware of. I did of course though use Bill's original list as the starting point for mine and for the most part it remains intact except that I got anal about the @ thing :) Matt Colbeck, Andrew wrote: Well, Matt, that's a great example for Netscape.net, but Jeff was asking about Netscape.com So I guess to round out the conversation, here's the two entries in spamdomains that everybody seems to have, to cover Netscape.net: aol.com netscape.net netscape.netaol.com I'm pretty sure that we have Bill Landry to thank for the seminal work on sd.txt from which everyone has benefitted (hey, credit where credit is due!) Andrew 8) -Original Message- From: Matt [mailto:[EMAIL PROTECTED]] Sent: Monday, April 19, 2004 11:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Andrew and Jeff, Unfortunately Netscape.net is actually handled by aol.com when it is outgoing (which is what matters in this case). I sometimes search my known good E-mail for outgoing servers, or Google for it by looking for header code along with the address and keeping in mind that a lot of that stuff is forged especially in newsgroups. Here are the headers from a test of my own account: Received: from imo-d01.mx.aol.com [205.188.157.33] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id AE31AB9B0140; Mon, 19 Apr 2004 14:45:05 -0400 Received: from [EMAIL PROTECTED] by imo-d01.mx.aol.com (mail_out_v37_r1.2.) id j.1b5.a579353 (16239) for [EMAIL PROTECTED]; Mon, 19 Apr 2004 14:45:00 -0400 (EDT) Received: from netscape.net (mow-d23.webmail.aol.com [205.188.139.164]) by air-in03.mx.aol.com (v98.19) with ESMTP id MAILININ33-3f6f40841e2c327; Mon, 19 Apr 2004 14:45:00 -0500 Date: Mon, 19 Apr 2004 14:45:00 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: test MIME-Version: 1.0 Message-ID: [EMAIL PROTECTED] X-Mailer: Atlas Mailer 2.0 X-AOL-IP: 24.195.119.188 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-MailPure: X-MailPure: RFC-NOABUSE: Failed, listed in abuse.rfc-ignorant.org (weight 1). X-MailPure: RFC-NOPOSTMASTER: Failed, listed in postmaster.rfc-ignorant.org (weight 1). X-MailPure: X-MailPure: Spam Score: 2 X-MailPure: Scan Time: 14:45:12 on 04/19/2004 X-MailPure: Spool File: D1e31ab9b01404b3e.SMD X-MailPure: Server Name: imo-d01.mx.aol.com X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: imo-d01.mx.aol.com [205.188.157.33] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Colbeck, Andrew wrote: Jeff, the main problem with figuring out spamdomains entries is that you really have to receive valid mail from the domain to really know. If they have an SPF record, that's the easiest way to research them, but you can also try the website at http://www.SenderBase.org to see what they've noticed. They've noticed one more host: dust.netscape.com The problem with checking the MX record is that it is only for recording inbound mail to Netscape.com, it doesn't necessarily say anything about outbound mail from them, which is what you're after. I suspect that your suggestion will work fine, as I think that they keep their corporate domain for netscape.com separate from the customer business as netscape.net ... Andrew 8) -Original Message- From: Jeff Maze - Hostmaster [mailto:[EMAIL PROTECTED]] Sent: Monday, April 19, 2004 11:07 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Hello, I got a message that was "from" [EMAIL PROTECTED] but came from RoadRunners networks. There isn't a netscape entry in my SPAMDOMAINS.TXT file. I was
Re: [Declude.JunkMail] Blocking on attachment name
For Declude Virus BANNAME fileattachment.ext example: BANNAME deleted0.txt I know it came up that file names with spaces weren't being blocked properly. I don't know if Scott had fixed that yet. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/19/04 03:27PM I want to hold email that has an attachment with a given file name. I know the exact file name and size. It seems like a saw some posts about this in the past but searches of my archived Declude folder didn't come up with anything. Thank, Todd Hunter --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] NOTENDSWITH problem
Just for curiosity's sake, what does fixed in the next release mean? Fixed in the next alpha interim release or fixed in the next beta release? It's tough to know since unless there is big news, we don't know what changes there are in the interim releases. I'm not pushing the fix, I've done a work around. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/19/04 09:18AM My favorite new filter has been the NOTENDSWITH... But I've found a problem. COUNTRY 5 NOTENDSWITH US Using the above line, every country including the US gets five points. It seems that there is an issue with the code where NOTENDSWITH will not work properly if the length of the data you are looking at (COUNTRY, which might be FR if the E-mail was sent from France) is the same as what you are comparing it to (US). This will be fixed in the next release. In the meantime, you could: COUNTRY -5 ENDSWITHUS and then adding 5 points some other way (in the test definition, perhaps, or a line such as COUNTRY 5 ISBLANK). That way, 0 points will be added for E-mail from the United States, but 5 points will be added for E-mail not from the United States. May I also suggest a NOIS filter test? That does sound like a good idea -- it has been added to the suggestion database. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] NOTENDSWITH problem
Just for curiosity's sake, what does fixed in the next release mean? If something is referred to as fixed, that means that we have changed the code to fix it, and any future interim/beta/release will have the change in it. Fixed in the next alpha interim release or fixed in the next beta release? We only have one code tree, which means that once a change is made, it's made. So if a change is made on April 19, then any interim, beta, or after April 19 will include the change. Once things have settled down a bit, we'll go back to the normal interim release schedule. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMDOMAINS - Netscape.com
Title: Message astonishmentWhat, Matt, you get anal about your work!?/astonishment Don't worry, I won't make you the butt of any jokes. Andrew 8) -Original Message-From: Matt [mailto:[EMAIL PROTECTED] Sent: Monday, April 19, 2004 1:47 PMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] SPAMDOMAINS - Netscape.comOops, sorry. I'm not sure about netscape.com, but E-mail from that domain has been quite rare in the past since they don't have hardly any employees, and even if you had their primary reverse DNS entries, it's quite possible that they send out as netscape.com from third-parties just like symantec.com does (which is quite boneheaded for an AV/Anti-Spam provider). This is what I'm using for netscape.com:@netscape.com .aol.This might be a good example of a domain though that really needs benefit of two columns, i.e.:netscape.com .aol.I have no idea what they are doing for their new ISP service as far as E-mail goes, but I would expect for them to channel everything through aol.com just as they have with netscape.net. I don't see why they would seek to establish a new network exclusively for this new service.FYI, I never found a reason for the following entry:aol.com netscape.netOmitting it hasn't caused any problems that I am aware of. I did of course though use Bill's original list as the starting point for mine and for the most part it remains intact except that I got anal about the @ thing :)MattColbeck, Andrew wrote: Well, Matt, that's a great example for Netscape.net, but Jeff was asking about Netscape.com So I guess to round out the conversation, here's the two entries in spamdomains that everybody seems to have, to cover Netscape.net: aol.com netscape.net netscape.netaol.com I'm pretty sure that we have Bill Landry to thank for the seminal work on sd.txt from which everyone has benefitted (hey, credit where credit is due!) Andrew 8) -Original Message- From: Matt [mailto:[EMAIL PROTECTED]] Sent: Monday, April 19, 2004 11:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SPAMDOMAINS - Netscape.com Andrew and Jeff, Unfortunately Netscape.net is actually handled by aol.com when it is outgoing (which is what matters in this case). I sometimes search my known good E-mail for outgoing servers, or Google for it by looking for header code along with the address and keeping in mind that a lot of that stuff is forged especially in newsgroups. Here are the headers from a test of my own account: Received: from imo-d01.mx.aol.com [205.188.157.33] by mx1.mailpure.com with ESMTP (SMTPD32-8.05) id AE31AB9B0140; Mon, 19 Apr 2004 14:45:05 -0400 Received: from [EMAIL PROTECTED] by imo-d01.mx.aol.com (mail_out_v37_r1.2.) id j.1b5.a579353 (16239) for [EMAIL PROTECTED]; Mon, 19 Apr 2004 14:45:00 -0400 (EDT) Received: from netscape.net (mow-d23.webmail.aol.com [205.188.139.164]) by air-in03.mx.aol.com (v98.19) with ESMTP id MAILININ33-3f6f40841e2c327; Mon, 19 Apr 2004 14:45:00 -0500 Date: Mon, 19 Apr 2004 14:45:00 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: test MIME-Version: 1.0 Message-ID: [EMAIL PROTECTED] X-Mailer: Atlas Mailer 2.0 X-AOL-IP: 24.195.119.188 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-MailPure: X-MailPure: RFC-NOABUSE: Failed, listed in abuse.rfc-ignorant.org (weight 1). X-MailPure: RFC-NOPOSTMASTER: Failed, listed in postmaster.rfc-ignorant.org (weight 1). X-MailPure: X-MailPure: Spam Score: 2 X-MailPure: Scan Time: 14:45:12 on 04/19/2004 X-MailPure: Spool File: D1e31ab9b01404b3e.SMD X-MailPure: Server Name: imo-d01.mx.aol.com X-MailPure: SMTP Sender: [EMAIL PROTECTED] X-MailPure: Received From: imo-d01.mx.aol.com [205.188.157.33] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: Colbeck, Andrew wrote: Jeff, the main problem with figuring out spamdomains entries is that you really have to receive valid mail from the domain to really know. If they have an SPF record, that's the easiest way to research them, but you can also try the website at http://www.SenderBase.org to see what they've noticed. They've noticed one more host: dust.netscape.com The problem with checking the MX record is that it is only for recording inbound mail to Netscape.com, it doesn't necessarily say anything about outbound mail from them, which is what you're after. I suspect that your suggestion will work fine, as I think that they keep their corporate domain for netscape.com separate from the customer business as netscape.net ... Andrew 8)
RE: [Declude.JunkMail] New test
Below is an example of headers taken from a false positive using this new test. For the most part, its a great new test and is working well. However, i've noticed that Entourage seems to be getting caught. This is the second customer of mine that i've noticed getting caught by this and both are using Entourage. Is anyone else seeing this? Thanks for any ideas Received: from [10.0.0.11] [208.37.231.210] by ilfmedia.com with ESMTP (SMTPD32-7.07) id A0A0C7F0140; Mon, 19 Apr 2004 14:12:00 -0700 User-Agent: Microsoft-Entourage/10.1.4.030702.0 Date: Mon, 19 Apr 2004 14:16:46 -0700 Subject: Phone message From: Rick Delker [EMAIL PROTECTED] To: Richard Katz [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] Mime-version: 1.0 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7bit X-RBL-Warning: INTRUDERS: This E-mail came from 208.37.231.210, a potential spam source listed in INTRUDERS. [2-14-7000] X-Declude-Sender: [EMAIL PROTECTED] [208.37.231.210] X-Declude-Spoolname: D40a00c7f0140a17c.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: INTRUDERS, HELOISIP [4] X-Note: This E-mail was sent from w210.z208037231.nyc-ny.dsl.cnc.net ([208.37.231.210]). X-Note: Total Weight for this email is [4] David Dresler Choicenet Internet Network Administrations 509.252.3939 -- Outgoing mail is certified Virus Free. Checked by AVG Anti-Virus (http://www.grisoft.com). Version: 7.0.230 / Virus Database: 262.8.3 - Release Date: 4/15/2004 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blocking on attachment name
Scott, I have DJM Pro, not the AV. I want to block emails with specific attachments in DJM. Thanks, Todd At 04:06 PM 4/19/2004 -0500, you wrote: For Declude Virus BANNAME fileattachment.ext example: BANNAME deleted0.txt I know it came up that file names with spaces weren't being blocked properly. I don't know if Scott had fixed that yet. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/19/04 03:27PM I want to hold email that has an attachment with a given file name. I know the exact file name and size. It seems like a saw some posts about this in the past but searches of my archived Declude folder didn't come up with anything. Thank, Todd Hunter --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blocking on attachment name
I have DJM Pro, not the AV. I want to block emails with specific attachments in DJM. Unfortunately, Declude Virus is necessary to properly block attachments (since attachment names/extensions can indicate security risks, whereas they are not yet indicative of spam). You could try writing a filter to do this, but it could have false positives. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blocking on attachment name
Matt has a file size filter that he has generously contributed to the community...you should be able to find it easily in the archives. For filename, use BANEXT in Declude Virus. I don't believe there is a combined test, but you could structure your weighting as a binary system (result of 1 for one test, 2 for another, 4, 8, 16, 32, etc) in order to get the AND and OR operators for combination tests. Regardless, you're still talking about tests in multiple products, Virus vs. Junkmail. Is the filename specific enough that filename alone will do the job for you? Darin. - Original Message - From: Todd Hunter [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, April 19, 2004 4:27 PM Subject: [Declude.JunkMail] Blocking on attachment name I want to hold email that has an attachment with a given file name. I know the exact file name and size. It seems like a saw some posts about this in the past but searches of my archived Declude folder didn't come up with anything. Thank, Todd Hunter --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spamc32 installation
After installing the latest release of cygwin (1.5.9-1) I can open the command prompt but I cant start cpan I've tried: bash-2.05b$ ls egrep egrep Ok, egrep is in the current directory bash-2.05b$ egrep Usage: egrep [OPTION]... PATTERN [FILE]... Try `egrep --help' for more information. Ok, executing this file is working fine. bash-2.05b$ ls cpan cpan So as I can understand cpan is in the current directory in the same manner as egrep. bash-2.05b$ cpan bash: cpan: command not found Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] NOTENDSWITH problem
My humble opinion on terminology, Scott, is that: fixed in the next build would better reflect what you meant. Otherwise us folks out here in the list start to wonder whether you mean release or Release. Just another tip for the Declude communications style book. Andrew 8) -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Monday, April 19, 2004 2:25 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] NOTENDSWITH problem Just for curiosity's sake, what does fixed in the next release mean? If something is referred to as fixed, that means that we have changed the code to fix it, and any future interim/beta/release will have the change in it. Fixed in the next alpha interim release or fixed in the next beta release? We only have one code tree, which means that once a change is made, it's made. So if a change is made on April 19, then any interim, beta, or after April 19 will include the change. Once things have settled down a bit, we'll go back to the normal interim release schedule. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Feature request possibility
How about an option where Declude Junkmail would de-space and de-punctuate the subject and then we could apply a filter on the results. In theory, the subject line would be parsed removing all characters other than a-z, A-Z and 0-9 and foreign alphabetical characters. We could then apply a filter on that. CLEANSUBJECT 10 CONTAINS VIAGARA which would stop the V I.AG A,RA variants. Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New test
David (and Bud), An exception could probably be made for proper usage of the IP being used as the HELO (when enclosed in brackets). Also, a while back in an effort to reduce the processing power required for my @LINKED and IPLINKED filters, I removed all of the IP space that was reserved which amounted to about half of the Class A's. Both of these things might be good exclusions since the real-world use of this by zombie spammers won't be impacted by either change. Matt David Dresler wrote: Below is an example of headers taken from a false positive using this new test. For the most part, its a great new test and is working well. However, i've noticed that Entourage seems to be getting caught. This is the second customer of mine that i've noticed getting caught by this and both are using Entourage. Is anyone else seeing this? Thanks for any ideas Received: from [10.0.0.11] [208.37.231.210] by ilfmedia.com with ESMTP (SMTPD32-7.07) id A0A0C7F0140; Mon, 19 Apr 2004 14:12:00 -0700 User-Agent: Microsoft-Entourage/10.1.4.030702.0 Date: Mon, 19 Apr 2004 14:16:46 -0700 Subject: Phone message From: Rick Delker [EMAIL PROTECTED] To: Richard Katz [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] Mime-version: 1.0 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7bit X-RBL-Warning: INTRUDERS: This E-mail came from 208.37.231.210, a potential spam source listed in INTRUDERS. [2-14-7000] X-Declude-Sender: [EMAIL PROTECTED] [208.37.231.210] X-Declude-Spoolname: D40a00c7f0140a17c.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: INTRUDERS, HELOISIP [4] X-Note: This E-mail was sent from w210.z208037231.nyc-ny.dsl.cnc.net ([208.37.231.210]). X-Note: Total Weight for this email is [4] David Dresler Choicenet Internet Network Administrations 509.252.3939 -- Outgoing mail is certified Virus Free. Checked by AVG Anti-Virus (http://www.grisoft.com). Version: 7.0.230 / Virus Database: 262.8.3 - Release Date: 4/15/2004 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamc32 installation
- Original Message - From: Markus Gufler [EMAIL PROTECTED] bash-2.05b$ cpan bash: cpan: command not found Markus, I haven't used Spamc32, but when I want to connect to CPAN from my Linux servers this is the command syntax I use: perl -MCPAN -e shell HTH, Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Scripting batch files
Try blat as a win32 command line mailer. It supports attachements and runs very stable: http://sourceforge.net/projects/blat Adrian - - Original Message - From: Jason [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, April 19, 2004 5:05 PM Subject: [Declude.JunkMail] OT: Scripting batch files Hello everyone. I have created a batch file that runs Bill's log analyzer that was made available last week. What I would like to do is have the DOS batch file e-mail this each night at midnight using the previous days declude log file. I do not know much about date scripting in DOS batch files so any help would be appreciated. Here is the batch I have (very basic): wamlog c:\imail\spool\dec0418.log Stats.txt imail1 -s Daily Spam Stats -t [EMAIL PROTECTED] -u Spam -h domain.com -f Stats.txt Thanks, Jason --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Strange loop, actions skipped
Scott, I'm very confused by what's happening with the following message apart from it looping 5 times and getting killed. The original scored 36 points, which on my system would get it to ROUTETO a sub-mailbox on my own domain and the subject should have shown the weight in square brackets, an additional line should have been added showing the %RECIPIENTS%, and a slew of WARN actions to mark the headers, however none of those actions were taken and it appears like my server attempted delivery of this message to an address that didn't exist, then it loops. My primary concern is why the proper actions aren't being taken, the secondary concern is how to stop the looping which probably has something to do with it sending notifications to itself since I host the MX, though the HOSTS file settings are supposed to override this (if IMail works properly). I've been seeing this a couple times a week if I recall correctly, and there were no reboots around the time of this message. Thanks, Matt - $Default$.JunkMail Actions of Note for Domain in Question - # Hold Settings MED-SUBJECT SUBJECT [%WEIGHT%] MED-RECIPS WARN X-MailPure: RECIPIENTS: %ALLRECIPS% MED-CAPTURE COPYTO [EMAIL PROTECTED] MED-MAILPURE ROUTETO [EMAIL PROTECTED] MED-COPYFILE COPYFILE I:\ # Drop Settings DROP-SUBJECT SUBJECT [%WEIGHT%] DROP-RECIPS WARN X-MailPure: RECIPIENTS: %ALLRECIPS% DROP-CAPTURE ROUTETO [EMAIL PROTECTED] - Log Snippet for Original Message - 04/18/2004 19:50:21 Q1438058c015c53d7 RFC-BOGUSMX:1 RFC-DSN:1 RFC-NOPOSTMASTER:1 SORBS-BADCONF:3 DSBL(DYNA):5 DSBL(ALL):2 SPAMCOP(DYNA):4 SPAMCOP(ALL):2 XBL(DYNA):6 XBL(ALL):2 BADFROM:6 CMDSPACE:3 . Total weight = 36. 04/18/2004 19:50:21 Q1438058c015c53d7 R1 Message OK 04/18/2004 19:50:21 Q1438058c015c53d7 Subject: =?ISO-8859-1?b?UmU6Q2hlYXAgUHJpY2VzIEZvciBWL2lhZ3Jh?= 04/18/2004 19:50:21 Q1438058c015c53d7 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 24.210.79.228 ID: 04/18/2004 19:50:21 Q1438058c015c53d7 Tests failed [weight=36]: CATCHALLMAILS=IGNORE RFC-BOGUSMX=IGNORE RFC-DSN=IGNORE RFC-NOPOSTMASTER=IGNORE SORBS-BADCONF=IGNORE LNSG-DUL=IGNORE NJABL-DYNA=IGNORE SORBS-DUL=IGNORE DSBL(DYNA)=IGNORE DSBL(ALL)=IGNORE SPAMCOP(DYNA)=IGNORE SPAMCOP(ALL)=IGNORE XBL(DYNA)=IGNORE XBL(ALL)=IGNORE IPNOTINMX=IGNORE NOLEGITCONTENT=IGNORE BADFROM=IGNORE CMDSPACE=IGNORE DROP-MAILPURE=IGNORE DROP-CAPTURE=IGNORE DROP-DELIVER=IGNORE DROP-SUBJECT=IGNORE DROP-RECIPS=IGNORE 04/18/2004 19:50:21 Q1438058c015c53d7 Last action = ""> - D1456059d015cca01.SMD - Received: from mail.mailpure.com [208.7.179.20] by mail.mailpure.com with ESMTP (SMTPD32-8.05) id A45659D015C; Sun, 18 Apr 2004 19:50:46 -0400 Received: from mail.mailpure.com [208.7.179.20] by mail.mailpure.com with ESMTP (SMTPD32-8.05) id A451597015C; Sun, 18 Apr 2004 19:50:41 -0400 Received: from mail.mailpure.com [208.7.179.20] by mail.mailpure.com with ESMTP (SMTPD32-8.05) id A44C50B0234; Sun, 18 Apr 2004 19:50:36 -0400 Received: from mail.mailpure.com [208.7.179.20] by mail.mailpure.com with ESMTP (SMTPD32-8.05) id A446593015C; Sun, 18 Apr 2004 19:50:30 -0400 Received: from mail.mailpure.com [208.7.179.20] by mail.mailpure.com with ESMTP (SMTPD32-8.05) id A4425050234; Sun, 18 Apr 2004 19:50:26 -0400 Received: from mx1.mailpure.com [208.7.179.100] by mail.mailpure.com with ESMTP (SMTPD32-8.05) id A43D5010234; Sun, 18 Apr 2004 19:50:21 -0400 Date: Sun, 18 Apr 2004 19:50:21 -0400 Message-Id: [EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: "Postmaster" [EMAIL PROTECTED] Sender: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Undeliverable Mail X-Mailer: SMTP32 v8.05 X-MailPure: X-MailPure: Spam Score: 0 X-MailPure: Scan Time: 19:50:26 on 04/18/2004 X-MailPure: Spool File: D143d050102346aca.SMD X-MailPure: Server Name: mx1.mailpure.com X-MailPure: SMTP Sender: X-MailPure: Received From: mx1.mailpure.com [208.7.179.100] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: X-MailPure: X-MailPure: Spam Score: 0 X-MailPure: Scan Time: 19:50:30 on 04/18/2004 X-MailPure: Spool File: D1442050502347c3f.SMD X-MailPure: Server Name: mail.mailpure.com X-MailPure: SMTP Sender: X-MailPure: Received From: mail.mailpure.com [208.7.179.20] X-MailPure: Country Chain: UNITED STATES-destination X-MailPure: X-MailPure: Spam and virus blocking services provided by MailPure.com X-MailPure: X-MailPure: X-MailPure: Spam Score: 0 X-MailPure: Scan Time:
RE: [Declude.JunkMail] Blocking on attachment name
Scott, If you have both JunkMail and Virus are you able to block/delete an incoming mail message if the attachment had a virus? Actually do you need JunkMail at all in this condition? Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Per-Domain Config
Scott, I am starting to see a maintenance issue with the way I am doing things. I want to have per-domain config files primarily so that I can white and black list separately. Now when I setup a new test I have to go in through each domain's $default$.junkmail file and add the test with the action. Is it possible to have the per-domain file's simply add tests that the GLOBAL.CFG file does not specify in the incoming or outgoing section? In this way I would put all the tests in the two GLOBAL.CFG sections and then I would add to the per-domain files something like WHITELISTFILE d:\imail\declude\lanshop.com\whitelist.txt BL-LANSHOP DELETE Not sure if this has been asked before or if I am just doing things the hard way. Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
