RE: [Declude.JunkMail] Any ideas on blocking these?
We just installed .Net on the server and loaded the INV-URIbl test and this is working great. Will be getting a license soon. Sincerely, Randy Armbrecht Global Web Solutions, Inc. 804-346-5300 x112 877-800-GLOBAL (4562) x112 http://globalweb.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, October 11, 2005 9:05 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Any ideas on blocking these? Randy, The domain name capichel.com is listed in SURBL and URIBL. I would suggest incorporating a URI detection program like invURIBL to catch these kinds of stuff. URI filtering is very effective as it focuses on the spamvertised domain and not the remote sending party which often changes. Non-authoritative answer: Name:capichel . com . multi . surbl . org Address: 127.0.0.98 GlobalWeb.net Webmaster writes: Anyone have a good method in catching/blocking the latest Pharm aceutical Spam messages? (I've attached a txt file with source code) - these are the messages built in tables with alternating characters in each cell; this bypasses all content filtering we have with Declude and Sniffer isn't picking it up either. Sincerely, Randy Armbrecht Global Web Solutions, Inc. 804-346-5300 x112 877-800-GLOBAL (4562) x112 http://globalweb.net --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Footer32 Question
Hi all, This is a great question for Sandy... We are trying to use the FOOTER32 external test to add footers to incoming and outgoing email... at this point, i can add them to incoming mail just fine... HOWEVER, we have the following settings: PREWHITELISTON WHITELIST AUTH AUTOWHITELIST ON which are preventing the test from running on outbound email... Any suggestions? -Chris Anton --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Footer32 Question
Using PREWHITELIST ON prevents all tests from running. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Chris Anton Sent: Friday, October 14, 2005 8:42 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Footer32 Question Hi all, This is a great question for Sandy... We are trying to use the FOOTER32 external test to add footers to incoming and outgoing email... at this point, i can add them to incoming mail just fine... HOWEVER, we have the following settings: PREWHITELIST ON WHITELIST AUTH AUTOWHITELIST ON which are preventing the test from running on outbound email... Any suggestions? -Chris Anton --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Footer32 Question
You, sir, are a god among men. It works like a charm. Thank you very much!!! -Chris -- Original Message -- From: John T \(Lists\) [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Fri, 14 Oct 2005 08:52:38 -0700 Using PREWHITELIST ON prevents all tests from running. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Chris Anton Sent: Friday, October 14, 2005 8:42 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Footer32 Question Hi all, This is a great question for Sandy... We are trying to use the FOOTER32 external test to add footers to incoming and outgoing email... at this point, i can add them to incoming mail just fine... HOWEVER, we have the following settings: PREWHITELIST ON WHITELISTAUTH AUTOWHITELISTON which are preventing the test from running on outbound email... Any suggestions? -Chris Anton --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Antispam and Antivirus solutions provided by WebSolutions, Inc. (http://www.websolutions.net) Antispam and Antivirus solutions provided by WebSolutions, Inc. (http://www.websolutions.net) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Footer32 Question
Well, I may be good (although the jury is still in deliberation) but I am definitely not God. ;) John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Chris Anton Sent: Friday, October 14, 2005 8:58 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Footer32 Question You, sir, are a god among men. It works like a charm. Thank you very much!!! -Chris -- Original Message -- From: John T \(Lists\) [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Fri, 14 Oct 2005 08:52:38 -0700 Using PREWHITELIST ON prevents all tests from running. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Chris Anton Sent: Friday, October 14, 2005 8:42 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Footer32 Question Hi all, This is a great question for Sandy... We are trying to use the FOOTER32 external test to add footers to incoming and outgoing email... at this point, i can add them to incoming mail just fine... HOWEVER, we have the following settings: PREWHITELIST ON WHITELIST AUTH AUTOWHITELIST ON which are preventing the test from running on outbound email... Any suggestions? -Chris Anton --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Antispam and Antivirus solutions provided by WebSolutions, Inc. (http://www.websolutions.net) Antispam and Antivirus solutions provided by WebSolutions, Inc. (http://www.websolutions.net) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Footer32 Question
Phew. I was just saying to myself, "Matt, if John is God, then maybe I should have been nicer to him." Matt John T (Lists) wrote: Well, I may be good (although the jury is still in deliberation) but I am definitely not God. ;) John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED]] On Behalf Of Chris Anton Sent: Friday, October 14, 2005 8:58 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Footer32 Question You, sir, are a god among men. It works like a charm. Thank you very much!!! -Chris -- Original Message -- From: "John T \(Lists\)" [EMAIL PROTECTED] Reply-To: Declude.JunkMail@declude.com Date: Fri, 14 Oct 2005 08:52:38 -0700 Using "PREWHITELIST ON" prevents all tests from running. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED]] On Behalf Of Chris Anton Sent: Friday, October 14, 2005 8:42 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Footer32 Question Hi all, This is a great question for Sandy... We are trying to use the FOOTER32 external test to add footers to incoming and outgoing email... at this point, i can add them to incoming mail just fine... HOWEVER, we have the following settings: PREWHITELIST ON WHITELIST AUTH AUTOWHITELIST ON which are preventing the test from running on outbound email... Any suggestions? -Chris Anton --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. Antispam and Antivirus solutions provided by WebSolutions, Inc. (http://www.websolutions.net) Antispam and Antivirus solutions provided by WebSolutions, Inc. (http://www.websolutions.net) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] PREWHITELIST ON
OK, Now the subject has been opened up... I've got Declude 3.0.5.7 with these in my global.cfg WHITELIST IP 192.168.200.5 PREWHITELISTON I notice an email from 192.168.200.5 fails these tests (Declude internal and a couple of external tests) MAILFROM-BOGUS:66 nNOLEGITCONTENT:-10 SPAMHEADERS:40 SIZE-LT-1KB:10 MPM-ZOMBIEMETRIC:8 If Prewhitelist is on, it shouldn't be running these tests. Should prewhitelist on be above the whitelist ip in the global.cfg? or is it a bug?
RE: [Declude.JunkMail] PREWHITELIST ON
Log is debug mode is best. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, October 14, 2005 10:19 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] PREWHITELIST ON OK, Now the subject has been opened up... I've got Declude 3.0.5.7 with these in my global.cfg WHITELIST IP 192.168.200.5 PREWHITELISTON I notice an email from 192.168.200.5 fails these tests (Declude internal and a couple of external tests) MAILFROM-BOGUS:66 nNOLEGITCONTENT:-10 SPAMHEADERS:40 SIZE-LT-1KB:10 MPM-ZOMBIEMETRIC:8 If Prewhitelist is on, it shouldn't be running these tests. Should prewhitelist on be above the whitelist ip in the global.cfg? or is it a bug?
Re: [Declude.JunkMail] PREWHITELIST ON
Scott, This is something that I noted in 2.0.6.16 and reported to Declude several months ago. PREWHITELIST ON no longer is interrupting tests when WHITELIST conditions are met that are listed in the Global.cfg. While the messages will get a score of 0 on these conditions, they run through all of the tests and this causes extra processing by one's system, which was the reason for PREWHITELIST ON in the first place. It appears that WHITELIST AUTH is causing tests to be skipped however. Here's an example of a custom filter being run (NULLSENDER) when a WHITELIST IP condition is hit in the Global.cfg: 10/14/2005 12:21:57 QDB1C77110108087F NULLSENDER:4 . Total weight = 4. 10/14/2005 12:21:57 QDB1C77110108087F E-mail whitelisted - automatically passing all spam tests [64.58.168.0/24] 10/14/2005 12:21:57 QDB1C77110108087F Tests failed [weight=0]: CATCHALLMAILS=WARN[0] 10/14/2005 12:21:57 QDB1C77110108087F L1 Message OK 10/14/2005 12:21:57 QDB1C77110108087F Subject: Delivery Status Notification (Failure) 10/14/2005 12:21:57 QDB1C77110108087F From: To: [EMAIL PROTECTED] IP: 64.58.168.80 ID: (used 10/14/2005 12:21:57 QDB1C77110108087F Action(s) taken for [[EMAIL PROTECTED]] = WHITELISTED [LAST ACTION=""> 10/14/2005 12:21:57 QDB1C77110108087F Cumulative action(s) taken on this email = WARN [LAST ACTION=""> Matt Scott Fisher wrote: OK, Now the subject has been opened up... I've got Declude 3.0.5.7 with these in my global.cfg WHITELIST IP 192.168.200.5 PREWHITELISTON I notice an email from 192.168.200.5 fails these tests (Declude internal and a couple of external tests) MAILFROM-BOGUS:66 nNOLEGITCONTENT:-10 SPAMHEADERS:40 SIZE-LT-1KB:10 MPM-ZOMBIEMETRIC:8 If Prewhitelist is on, it shouldn't be running these tests. Should prewhitelist on be above the whitelist ip in the global.cfg? or is it a bug?
re: [Declude.JunkMail] PREWHITELIST ON
3.0.5.7? How did you get that version? When I go to the Declude web page and log in to my account, there is a box there that says Declude Upgrades and in that box it has a link that says Declude 3.0.5.3. When I click on that link, it takes me to another page that has some links on it that allow me to download an install file for 3.0.5.5. I was waiting to upgrade to 3.x until a version came out that resolved some of the issues that were mentioned here on this list concerning 3.0.5.5. Does this mean some or all of those issues were resolved? What is in 3.0.5.7 and when will it be released to the general Declude public? Original Message From: Scott Fisher [EMAIL PROTECTED] Sent: Friday, October 14, 2005 1:20 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] PREWHITELIST ON OK, Now the subject has been opened up... I've got Declude 3.0.5.7 with these in my global.cfg WHITELIST IP 192.168.200.5 PREWHITELIST ON I notice an email from 192.168.200.5 fails these tests (Declude internal and a couple of external tests) MAILFROM-BOGUS:66 nNOLEGITCONTENT:-10 SPAMHEADERS:40 SIZE-LT-1KB:10 MPM-ZOMBIEMETRIC:8 If Prewhitelist is on, it shouldn't be running these tests. Should prewhitelist on be above the whitelist ip in the global.cfg? or is it a bug? --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
