[Declude.JunkMail] WANTED: your kill lists
anyone willing to send me a copy of their kill list? I am far behind in the filtering spam war, and would appreciate a 'cheat sheet' to update our kill list here at Primate. I'm tired of sifting through held emails via Spam Review. Thanks for your help. Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
email provided by netscape.net is at least partly based from AOL instant messenger accounts, which partly correspond to some peoples' real aol.com email addresses. when you do a full install of Netscape 6 and above, it links w/ your AIM account for messaging, and provides you a *free*, spammed, email account in the netscape.net domain, under your username as defined in AIM. That may be the connection. At 08:02 05.30.2003, you wrote: Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? Please forgive my ignorance here, I have nearly every message from this list for the past 6 months on my machine, so I have looked, but missed it I guess. Anyway, what's the deal with this in the spamdomains list?? earthlink.com earthlink.net earthlink.net earthlink.com Does this mean if the address comes in as [EMAIL PROTECTED] - it's rev DNS can be either earthlink.net or earthlink.com ??? and the other way around if it's [EMAIL PROTECTED] - ? What confuses me are these: aol.com netscape.net netscape.net aol.com My feeling here is why would a netscape user be sending with an AOL address and vice-versa. So am I off here? Thanks for any help Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Q: syntax for blacklisting
Is that all? Do I enter something like: TESTNAME WARN **(or HOLD or DELETE) somewhere in the body of the global.cfg? It seems like it still isn't filtering out messages that should have been pulled. At 12:39 05.27.2003, you wrote: Hello - what is the proper syntax for using a blacklist (i.e. the 'fromfile.txt')? For the sender blacklist, you first need to add a line such as the following to your \IMail\Declude\global.cfg file to define the test: TESTNAME fromfile C:\IMail\Declude\badaddresses.txt x 5 0 Here, TESTNAME is the name that you choose for the test and fromfile indicates the type of test. Then, you have the full path to the blacklist file, x as a placeholder, and then the weight for the test (5 in this case), followed by a 0 (used for negative weighting, which is not common, as it would apply to E-mails that did NOT fail this test). The actual file (C:\IMail\Declude\badaddresses.txt in this case) consists of lines in one of the following formats: [EMAIL PROTECTED]- Will only catch E-mail from [EMAIL PROTECTED] @example.com- Will catch any E-mail from any E-mail address @example.com .example.com- Will catch any E-mail in subdomains of example.com (such as [EMAIL PROTECTED]). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Q: syntax for blacklisting
Hello - what is the proper syntax for using a blacklist (i.e. the 'fromfile.txt')? Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Help filtering
I have a few users whose email is auto-forwarded from UCD to our email server - and UCD puts it through an anti-virus server prior to sending out - consequently, the email below and others like it get through. Is it possible that this email below is NOT in the spam dB? Received: from frankfurt.ucdavis.edu [169.237.104.161] by primate.ucdavis.edu with ESMTP (SMTPD32-7.13) id AF9ADF1025C; Thu, 27 Mar 2003 11:23:06 -0800 Received: from mail69.myvirtualdeals.com (mail69.myvirtualdeals.com [65.61.189.95]) by frankfurt.ucdavis.edu (8.11.6/8.11.0/virus-scan-4.0.1) with SMTP id h2RJN4T07244 for [EMAIL PROTECTED]; Thu, 27 Mar 2003 11:23:04 -0800 (PST) Message-Id: [EMAIL PROTECTED] Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Type: text/plain; boundary=_--=_9254203679925839903695 MIME-Version: 1.0 X-Mailer: MIME::Lite 2.117 (F2.6; B2.12; Q2.03) Date: Thu, 27 Mar 2003 19:23:03 UT X-Fun: H4F%N9]M25;FA;RIF=*1I5CAFL$0_-;!YQU/4H$N[H=#5,8'BF``` Subject: You've Won X-List-Unsubscribe: [EMAIL PROTECTED] From: Cool Bargains [EMAIL PROTECTED] Reply-To: Cool Bargains [EMAIL PROTECTED] To: N N [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [169.237.104.161] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: IPNOTINMX [0] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 346919667 Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help filtering
Where on the global.cfg file do I enter that? Thanks for the quick reply. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, March 27, 2003 13:37 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Help filtering I have a few users whose email is auto-forwarded from UCD to our email server - and UCD puts it through an anti-virus server prior to sending out - consequently, the email below and others like it get through. Is it possible that this email below is NOT in the spam dB? Received: from frankfurt.ucdavis.edu [169.237.104.161] by primate.ucdavis.edu with ESMTP (SMTPD32-7.13) id AF9ADF1025C; Thu, 27 Mar 2003 11:23:06 -0800 Received: from mail69.myvirtualdeals.com (mail69.myvirtualdeals.com [65.61.189.95]) by frankfurt.ucdavis.edu (8.11.6/8.11.0/virus-scan-4.0.1) with SMTP id h2RJN4T07244 for [EMAIL PROTECTED]; Thu, 27 Mar 2003 11:23:04 -0800 (PST) In this case, you can add a line IPBYPASS 169.237.104.161 to your \IMail\Declude\global.cfg file. That way, Declude JunkMail will work as though it is actually running on the AV server, so it will scan the IP 65.61.189.95 (rather than the 169.237.104.161 IP, which is yours). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help filtering
One more thing - what about multiple entries? How would that look (UCD uses multiple antivirus servers)? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, March 27, 2003 13:37 To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Help filtering I have a few users whose email is auto-forwarded from UCD to our email server - and UCD puts it through an anti-virus server prior to sending out - consequently, the email below and others like it get through. Is it possible that this email below is NOT in the spam dB? Received: from frankfurt.ucdavis.edu [169.237.104.161] by primate.ucdavis.edu with ESMTP (SMTPD32-7.13) id AF9ADF1025C; Thu, 27 Mar 2003 11:23:06 -0800 Received: from mail69.myvirtualdeals.com (mail69.myvirtualdeals.com [65.61.189.95]) by frankfurt.ucdavis.edu (8.11.6/8.11.0/virus-scan-4.0.1) with SMTP id h2RJN4T07244 for [EMAIL PROTECTED]; Thu, 27 Mar 2003 11:23:04 -0800 (PST) In this case, you can add a line IPBYPASS 169.237.104.161 to your \IMail\Declude\global.cfg file. That way, Declude JunkMail will work as though it is actually running on the AV server, so it will scan the IP 65.61.189.95 (rather than the 169.237.104.161 IP, which is yours). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help filtering
Any way of doing an IP range bypass? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, March 27, 2003 14:05 To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Help filtering Where on the global.cfg file do I enter that? Anywhere you want. One more thing - what about multiple entries? How would that look (UCD uses multiple antivirus servers)? You can have up to 20 separate IPBYPASS lines (each with a single IP on it). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Reference documents needed
I second that. At 08:15 03.26.2003, you wrote: Hi Scott, I am a fairly new user of Declude JunkMail Pro and I'm reading the messages on this list on a daily basis. Excellent discussions and I have already learned a lot. In order to make the most use of Declude's power in the shortest time possible, I would need a couple of documents (hopefully they exist): 1. A reference list (beyond the HTML manual at www.declude.com/JunkMail/manual.html) that lists every single variable available and what it represents (eventually with a short example). 2. A complete list of all the tests available in Declude junk mail with a detailed description of their use? Thanks in advance, PS: If Declude doesn't have such documents, then maybe one of the list subscribers have compiled them. Any help would be much appreciated. -- Regards, Adrian Titei Director of IT Jumbo Entertainment Inc. p: 905-634-4244 x 232 f: 905-632-2964 e: [EMAIL PROTECTED] === Confidentiality Notice: This e-mail message and any attachment to same contains confidential information intended only for the person(s) to whom the said e-mail is intended to be sent. Any review, retransmission, dissemination or other use of or the taking of any action and reliance upon this information by persons or entities other than the intended recipient violates confidentiality and is prohibited. If you have received this e-mail message in error, please notify the sender immediately and delete the e-mail message from your computer. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Q: help with fixing client-side?
What follows is the header from an email sent from a valid account to another valid account, here at UCD. The recipient was concerned that this message would be tagged as 'consistent with spam' and/or 'bad headers'. My thoughts were that perhaps its because the user is on an older Macintosh, running an old version of Quick Mail, which perhaps doesn't follow standard email protocol/form? Any ideas? Thanks, joe X-POP3-Rcpt: [EMAIL PROTECTED] Return-Path: [EMAIL PROTECTED] Received: from salzburg.ucdavis.edu (salzburg.ucdavis.edu [169.237.104.162]) by orvieto.ucdavis.edu (8.11.6/8.11.0/IT4.6.2) with ESMTP id h2L2M1p20970 for [EMAIL PROTECTED]; Thu, 20 Mar 2003 18:22:01 -0800 (PST) Received: from primate.ucdavis.edu (blackhole.primate.ucdavis.edu [169.237.80.10]) by salzburg.ucdavis.edu (8.11.6/8.11.0/virus-scan-4.0.1) with ESMTP id h2L2Lwd08932 for [EMAIL PROTECTED]; Thu, 20 Mar 2003 18:21:59 -0800 (PST) Received: from 169.237.80.51 [169.237.80.51] by primate.ucdavis.edu (SMTPD32-7.13) id A7451A730278; Thu, 20 Mar 2003 18:21:57 -0800 Date: 20 Mar 03 18:30:01 -0800 From: Alice Tarantal [EMAIL PROTECTED] Subject: RE: Pilot call To: John Capitanio [EMAIL PROTECTED] X-Mailer: QuickMail Pro 1.5.4 (Mac) X-Priority: 3 MIME-Version: 1.0 Reply-To: Alice Tarantal [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1 Message-Id: [EMAIL PROTECTED] X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [c014020e]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [c014020e]. X-RBL-Warning: WEIGHT10: Weight of 11 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [169.237.80.51] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by orvieto.ucdavis.edu id h2L2M1p20970 Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
