Re: [Declude.JunkMail] Help Me Add Weight
Robert Grosshandler wrote: Sounds like a spam headline, doesn't it? Anyway, we're getting obvious spam, but we're not able to weight it enough to block it. Any tests you might suggest. The following came to us BCC'd, I believe. Nothing about it was appropriate for us. snip/ X-RBL-Warning: SNIFFER: Message failed SNIFFER: 60. X-Declude-Sender: scp...@yahoo.com.ar [173.15.150.165] X-Declude-Spoolname: Dccef01a2279a.smd X-Declude-RefID: str=0001.0A010203.498BCCF8.0197,ss=1,fgs=0 X-Declude-Scan: Incoming Score [11] at 23:39:07 on 05 Feb 2009 X-Declude-Fail: UCEPROTECT-1 [4], SNIFFER [12], WEIGHT9 [9], WEIGHTMID [10], ZEROHOUR [0] I'm biased, but you might increase the weight you add for SNF -- I note it did fail the message. Most systems seem to weight SNF so that SNF + any other test will hold a message. Many hold on SNF alone. Given that general practice, adding weight to SNF might solve this problem for you. _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help Me Add Weight
I would add country weight as well. There used to be examples that work. I actually weight yahoo.com.XX as well. At 01:20 PM 2/10/2009 -0500, Pete McNeil wrote: Robert Grosshandler wrote: Sounds like a spam headline, doesnt it? Anyway, were getting obvious spam, but were not able to weight it enough to block it. Any tests you might suggest. The following came to us BCCd, I believe. Nothing about it was appropriate for us. snip/ X-RBL-Warning: SNIFFER: Message failed SNIFFER: 60. X-Declude-Sender: mailto:scp...@yahoo.com.arscp...@yahoo.com.ar [173.15.150.165] X-Declude-Spoolname: Dccef01a2279a.smd X-Declude-RefID: str=0001.0A010203.498BCCF8.0197,ss=1,fgs=0 X-Declude-Scan: Incoming Score [11] at 23:39:07 on 05 Feb 2009 X-Declude-Fail: UCEPROTECT-1 [4], SNIFFER [12], WEIGHT9 [9], WEIGHTMID [10], ZEROHOUR [0] I'm biased, but you might increase the weight you add for SNF -- I note it did fail the message. Most systems seem to weight SNF so that SNF + any other test will hold a message. Many hold on SNF alone. Given that general practice, adding weight to SNF might solve this problem for you. _M - This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or action taken in reliance on the contents of these documents is strictly prohibited. If you have received this information in error, please notify the sender immediately and arrange for the return or destruction of the document(s). Warning: All e-mail sent to or from this address will be received or otherwise recorded by the Corporate e-mail system and is subject to archival, monitoring or review by, and/or disclosure to, someone other than the recipient. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. - This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or action taken in reliance on the contents of these documents is strictly prohibited. If you have received this information in error, please notify the sender immediately and arrange for the return or destruction of the document(s). Warning: All e-mail sent to or from this address will be received or otherwise recorded by the Corporate e-mail system and is subject to archival, monitoring or review by, and/or disclosure to, someone other than the recipient. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help with Regex
Todd, There are 600,426,974,379,824,381,952 ways to spell Viagra (http://www.americanscientist.org/issues/pub/how-many-ways-can-you-spell-v1gra/3) and likewise a similar number of ways to obfuscate other words with 6 letters. It is a better to target other aspects of the message and even the obfuscation techniques themselves than to attempt to go after the actual text. Matt Todd Richards wrote: Hi Everyone - I'm seeing this come through a lot - CH!l.D P.ORN and P!rate S0ftware. So far, the spam filters are catching it ok based on all of the other filters there. However, some of them are barely being caught and I'd like to make sure they don't make it through. I threw a basic CONTAINS filter in for an exact match, but I can already see them doing different things to make it through. Any suggestions on a regular expression? Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Regex
Good point, Matt. Thanks! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, October 29, 2008 1:07 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Help with Regex Todd, There are 600,426,974,379,824,381,952 ways to spell Viagra (http://www.americanscientist.org/issues/pub/how-many-ways-can-you-spell-v1g ra/3) and likewise a similar number of ways to obfuscate other words with 6 letters. It is a better to target other aspects of the message and even the obfuscation techniques themselves than to attempt to go after the actual text. Matt Todd Richards wrote: Hi Everyone - I'm seeing this come through a lot - CH!l.D P.ORN and P!rate S0ftware. So far, the spam filters are catching it ok based on all of the other filters there. However, some of them are barely being caught and I'd like to make sure they don't make it through. I threw a basic CONTAINS filter in for an exact match, but I can already see them doing different things to make it through. Any suggestions on a regular expression? Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
I've downgraded from 4.3.59 to 4.3.46 and declude has started working again; I'll try re-upgrading to the beta and see how it goes.. Randy A. Global Web Solutions, Inc. 804-442-5300 - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
have confirmed declude is still not working; messages pop into proc folder, but nothing going into work folder; --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
just another update - decludeproc process is running (showing in task manager) but at 0% CPU; system sees it but nothing is firing it off...very strange. continuing to look into it further --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:59 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HELP, Declude stoped functioning
We had a similar issue yesterday too at about 3:30 PM(AZ) mail stared building up in the proc folder. Dedecludeproc was running but when I tried to restart it failed to respond to the restart. Killed the process and restart and the mailed started to flow. We had this same thing happen about 20-30 ago thought it was one time thing but guess not. Declude 4.3.7 Smartermail 3.3.2369 Rick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Randy Armbrecht Sent: Saturday, September 29, 2007 7:16 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning just another update - decludeproc process is running (showing in task manager) but at 0% CPU; system sees it but nothing is firing it off...very strange. continuing to look into it further --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:59 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
we're on declude 4.3.59 and imail 8.22;l we had an issue on 8.30.07 where mail was building up in proc/work folders and declude moved us to the new beta at that time; resolved everything and declude seemed to run alot better after that as well. but now the license is showing it's not valid after we renewed our SA yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Rick Baranowski [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:52 AM Subject: RE: [Declude.JunkMail] HELP, Declude stoped functioning We had a similar issue yesterday too at about 3:30 PM(AZ) mail stared building up in the proc folder. Dedecludeproc was running but when I tried to restart it failed to respond to the restart. Killed the process and restart and the mailed started to flow. We had this same thing happen about 20-30 ago thought it was one time thing but guess not. Declude 4.3.7 Smartermail 3.3.2369 Rick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Randy Armbrecht Sent: Saturday, September 29, 2007 7:16 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning just another update - decludeproc process is running (showing in task manager) but at 0% CPU; system sees it but nothing is firing it off...very strange. continuing to look into it further --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:59 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
yes - unfortunately I have realized that over the past few hours... I wish Declude had 24 hour support! --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 11:30 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
Darrell, The Web server at fluidhosting.com that dlanalyzer.com is hosted on is listed in CBL currently and has been before. http://cbl.abuseat.org/lookup.cgi?ip=204.14.91.21 Matt Darrell ([EMAIL PROTECTED]) wrote: You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, Declude stoped functioning
does declude monitor this list off hours? we are receiving complaints by the minute from our customers and I cannot wait until Monday morning for someone to find my emails to support and voice mails. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 11:30 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Re: [Declude.JunkMail] HELP, Declude stoped functioning
Thanks for the heads up Matt. It's a shared hosting environment so this kind of stuff happens every once in a while. They are a good hosting company (pretty responsive on all of the issues). I just checked that link and it appears that they have either expired from the RBL or were removed. IP Address 204.14.91.21 was not found in the CBL. Thanks Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Matt wrote: Darrell, The Web server at fluidhosting.com that dlanalyzer.com is hosted on is listed in CBL currently and has been before. http://cbl.abuseat.org/lookup.cgi?ip=204.14.91.21 Matt Darrell ([EMAIL PROTECTED]) wrote: You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list
RE: [Declude.JunkMail] HELP, Declude stoped functioning
I would at least temporally disable Declude until you can get a hold of support. At least you can get mail flowing. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Randy Armbrecht Sent: Saturday, September 29, 2007 12:42 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning does declude monitor this list off hours? we are receiving complaints by the minute from our customers and I cannot wait until Monday morning for someone to find my emails to support and voice mails. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 11:30 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail
RE: [Declude.JunkMail] HELP, Declude stoped functioning
I believe they have instructions for urgent support, e.g. [EMAIL PROTECTED] (not sure if I remember it right). I would definitely call and leave a message for support with return number! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Baranowski Sent: Saturday, September 29, 2007 4:12 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] HELP, Declude stoped functioning I would at least temporally disable Declude until you can get a hold of support. At least you can get mail flowing. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Randy Armbrecht Sent: Saturday, September 29, 2007 12:42 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning does declude monitor this list off hours? we are receiving complaints by the minute from our customers and I cannot wait until Monday morning for someone to find my emails to support and voice mails. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 11:30 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail
Re: [Declude.JunkMail] HELP, Declude stoped functioning
no problem with mail flowing; that's going fine; just no spam or virus filtering occuring --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Rick Baranowski [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 4:11 PM Subject: RE: [Declude.JunkMail] HELP, Declude stoped functioning I would at least temporally disable Declude until you can get a hold of support. At least you can get mail flowing. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Randy Armbrecht Sent: Saturday, September 29, 2007 12:42 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning does declude monitor this list off hours? we are receiving complaints by the minute from our customers and I cannot wait until Monday morning for someone to find my emails to support and voice mails. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 11:30 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http
Re: [Declude.JunkMail] HELP, Declude stoped functioning
urgent must be only M-F urgent - that was the first thing I did at 9am was send an email to that address. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 4:53 PM Subject: RE: [Declude.JunkMail] HELP, Declude stoped functioning I believe they have instructions for urgent support, e.g. [EMAIL PROTECTED] (not sure if I remember it right). I would definitely call and leave a message for support with return number! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Baranowski Sent: Saturday, September 29, 2007 4:12 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] HELP, Declude stoped functioning I would at least temporally disable Declude until you can get a hold of support. At least you can get mail flowing. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Randy Armbrecht Sent: Saturday, September 29, 2007 12:42 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning does declude monitor this list off hours? we are receiving complaints by the minute from our customers and I cannot wait until Monday morning for someone to find my emails to support and voice mails. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 11:30 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail
Re: [Declude.JunkMail] HELP, Declude stoped functioning
Randy.. this is Linda from Declude. What is your phone number? We are closed today, but i will call you to help. If you have any further questions, please do not hesitate to contact me either by email or call Toll free 1-866-332-5833 Ext.7008 Linda Pagillo Technical Support Engineer | Declude Your Email Security is our business Office: 978.499.2933 x7008 Toll Free: 1-866.332.5833 x7008 Fax: 978.334.0700 Email: [EMAIL PROTECTED] - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 2:41 PM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning does declude monitor this list off hours? we are receiving complaints by the minute from our customers and I cannot wait until Monday morning for someone to find my emails to support and voice mails. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 11:30 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge [EMAIL PROTECTED] To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can
Re: [Declude.JunkMail] HELP, Declude stoped functioning
Linda, Thank you for the response - 804-382-5509; I'll try calling you too. Randy From: Linda Pagillo [EMAIL PROTECTED] Sent: Saturday, September 29, 2007 6:24 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy.. this is Linda from Declude. What is your phone number? We are closed today, but i will call you to help. If you have any further questions, please do not hesitate to contact me either by email or call Toll free 1-866-332-5833 Ext.7008 Linda Pagillo Technical Support Engineer | Declude Your Email Security is our business Office: 978.499.2933 x7008 Toll Free: 1-866.332.5833 x7008 Fax: 978.334.0700 Email: [EMAIL PROTECTED] - Original Message - From: Randy Armbrecht To: Sent: Saturday, September 29, 2007 2:41 PM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning does declude monitor this list off hours? we are receiving complaints by the minute from our customers and I cannot wait until Monday morning for someone to find my emails to support and voice mails. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) To: Sent: Saturday, September 29, 2007 11:30 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) To: Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht To: Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge To: Cc: ; Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just
Re: [Declude.JunkMail] HELP, Declude stoped functioning
Linda , THANK YOU THANK YOU THANK YOU I too am at a loss as to why our existing key wasn't working - THANK YOU for generating the new key and getting declude back up for us!!! Randy A. Global Web Solutions Inc From: Linda Pagillo [EMAIL PROTECTED] Sent: Saturday, September 29, 2007 6:24 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy.. this is Linda from Declude. What is your phone number? We are closed today, but i will call you to help. If you have any further questions, please do not hesitate to contact me either by email or call Toll free 1-866-332-5833 Ext.7008 Linda Pagillo Technical Support Engineer | Declude Your Email Security is our business Office: 978.499.2933 x7008 Toll Free: 1-866.332.5833 x7008 Fax: 978.334.0700 Email: [EMAIL PROTECTED] - Original Message - From: Randy Armbrecht To: Sent: Saturday, September 29, 2007 2:41 PM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning does declude monitor this list off hours? we are receiving complaints by the minute from our customers and I cannot wait until Monday morning for someone to find my emails to support and voice mails. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) To: Sent: Saturday, September 29, 2007 11:30 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning You will need to contact Declude at this point. There is nothing we can do to help you out since the key is showing as expired thus is will not process messages. Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: Darrell, thanks for thew quick response... process is running; but only at 3 threads and 0% CPU. do have a diags.txt file; looking into that it shows at bottom: [81CDE419-BDA4-44DB-9090-89C4A7492A98] IS EXPIRED KEY but we just renewed this yesterday.. --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Darrell ([EMAIL PROTECTED]) To: Sent: Saturday, September 29, 2007 10:10 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning Randy, Is the decludeproc service started? Also, in the declude folder to you have a diags text file? Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Randy Armbrecht wrote: apologixe for false alarm; after re-install of earlier version (4.3.46) I saw messages goinf into proc folder, so assumprtion was made it was working; but apparewntly my mistake for assuming. No declude logs being generated so it still appears to be not functioning --- Randy A. Technical Support Director Global Web Solutions, Inc. 804-442-5300 globalweb.net - Original Message - From: Randy Armbrecht To: Sent: Saturday, September 29, 2007 9:24 AM Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning We have experienced the same issue - as of 1.30pm friday our declude just stopped working; all attempts to restart it are not working - we've rebooted, re-installed, etc. We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if that has anything to do with it. Declude - please contact me! I've emailed urgent at declude and left a voice mail on your support line Randy A. Global Web Solutions Inc 804-442-56300 - Original Message - From: Serge To: Cc: ; Sent: Wednesday, September 26, 2007 3:02 PM Subject: [Declude.JunkMail] HELP, Declude stoped functioning Dear Support, Today my declude stoped functioning Nothing being writen to the logs since 14:00 local time (GMT) Imail smtp delivery still pointing to declude.exe Rebooting did not help what is going on ? Please help, very urgent Serge Dergham Cefib Internet Av de la Nation B.P. E1172 Bamako, Mali --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http
RE: [Declude.JunkMail] HELP with tqmcube.com
I suggest that you always use a different source IP and sender domain name when contacting the admin for a blacklist, because they often filter their own mail with their blacklist, so they won't see your plea. Stupid, but true. Andrew. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Thursday, May 24, 2007 10:18 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] HELP with tqmcube.com Our primary mail server is listed by these guys and I have issued a removal request on their web site over 13 days ago. There web site states they normally have a removal request in 4 hours. I have tried to contact them with the email address on their domain registration and also no reply, the phone number on their domain registration has is disconnected. I have also sent an email using their contact page and also no reply. Does anyone know how to contact them. I see the name David Cary Hart on the site and other places on the net. Does anyone have any idea on how to get him to reply? I would really like to know why we are listed and to see a sample message they received that listed us. It is difficult to correct a problem when the organization that states there is a problem will not reply and within their own stated guidelines. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HELP with tqmcube.com
Thank you for the suggestion. I did that. But ahh still no answer. After reading their site I was actually thinking of using them with Declude. But is this is how they respond to removal requests then I cannot see using them. There would be too much collateral damage. I am guessing that we were listed due to bounce messages. Our gateways did not previously validate the recipients. It now does do that validation thanks to ASSP. Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Thursday, May 24, 2007 10:24 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] HELP with tqmcube.com I suggest that you always use a different source IP and sender domain name when contacting the admin for a blacklist, because they often filter their own mail with their blacklist, so they won't see your plea. Stupid, but true. Andrew. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Thursday, May 24, 2007 10:18 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] HELP with tqmcube.com Our primary mail server is listed by these guys and I have issued a removal request on their web site over 13 days ago. There web site states they normally have a removal request in 4 hours. I have tried to contact them with the email address on their domain registration and also no reply, the phone number on their domain registration has is disconnected. I have also sent an email using their contact page and also no reply. Does anyone know how to contact them. I see the name David Cary Hart on the site and other places on the net. Does anyone have any idea on how to get him to reply? I would really like to know why we are listed and to see a sample message they received that listed us. It is difficult to correct a problem when the organization that states there is a problem will not reply and within their own stated guidelines. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help: Domain not found
BlankIs there really a space in the logs or is that just a formatting issue? philippe @ malivsion.com Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Serge To: declude.junkmail@declude.com ; Imail_Forum@list.ipswitch.com Sent: Monday, February 26, 2007 10:31 PM Subject: [Declude.JunkMail] Help: Domain not found I have a client having problems sending emails to some servers No thank you rejected: Domain not found DNSSTUFF shows no major problem with malivision.com Would appreciate any help to resolve this issue 20070226 183127 127.0.0.1 SMTP (276b023cf3f9) Trying mail.com (0) 20070226 183128 127.0.0.1 SMTP (276b023cf3f9) Connect mail.com [208.36.123.68:25] (1) 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) 220 spf8.us4.outblaze.com ESMTP Postfix 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) EHLO mail.cefib.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-spf8.us4.outblaze.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-PIPELINING 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-SIZE 1024 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-ETRN 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 8BITMIME 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) MAIL FROM:philippe @ malivsion.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 Ok 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) RCPT To:mathioye @ mail.com 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) 550 philippe @ malivsion.com: No thank you rejected: Domain not found 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) QUIT --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Blank Bkgrd.gif Description: GIF image
RE: [Declude.JunkMail] Help: Domain not found
Is the example the same as the original?? Malivision is misspelled, missing an i. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Monday, February 26, 2007 7:32 PM To: declude.junkmail@declude.com; Imail_Forum@list.ipswitch.com Subject: [Declude.JunkMail] Help: Domain not found I have a client having problems sending emails to some servers No thank you rejected: Domain not found DNSSTUFF shows no major problem with malivision.com Would appreciate any help to resolve this issue 20070226 183127 127.0.0.1 SMTP (276b023cf3f9) Trying mail.com (0) 20070226 183128 127.0.0.1 SMTP (276b023cf3f9) Connect mail.com [208.36.123.68:25] (1) 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) 220 spf8.us4.outblaze.com ESMTP Postfix 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) EHLO mail.cefib.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-spf8.us4.outblaze.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-PIPELINING 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-SIZE 1024 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-ETRN 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 8BITMIME 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) MAIL FROM:philippe mailto:philippe@ %20malivsion.com @ malivsion.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 Ok 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) RCPT To:mathioye mailto:mathioye@ %20mail.com @ mail.com 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) 550 philippe mailto:[EMAIL PROTECTED] @ malivsion.com: No thank you rejected: Domain not found 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) QUIT --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. image001.gif Description: GIF image
Re: [Declude.JunkMail] Help: Domain not found
Blank i added the spaces to prevent harvesting should have mentioned this sorry - Original Message - From: Darrell ([EMAIL PROTECTED]) To: declude.junkmail@declude.com Sent: Tuesday, February 27, 2007 3:46 AM Subject: Re: [Declude.JunkMail] Help: Domain not found Is there really a space in the logs or is that just a formatting issue? philippe @ malivsion.com Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: Serge To: declude.junkmail@declude.com ; Imail_Forum@list.ipswitch.com Sent: Monday, February 26, 2007 10:31 PM Subject: [Declude.JunkMail] Help: Domain not found I have a client having problems sending emails to some servers No thank you rejected: Domain not found DNSSTUFF shows no major problem with malivision.com Would appreciate any help to resolve this issue 20070226 183127 127.0.0.1 SMTP (276b023cf3f9) Trying mail.com (0) 20070226 183128 127.0.0.1 SMTP (276b023cf3f9) Connect mail.com [208.36.123.68:25] (1) 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) 220 spf8.us4.outblaze.com ESMTP Postfix 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) EHLO mail.cefib.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-spf8.us4.outblaze.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-PIPELINING 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-SIZE 1024 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-ETRN 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 8BITMIME 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) MAIL FROM:philippe @ malivsion.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 Ok 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) RCPT To:mathioye @ mail.com 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) 550 philippe @ malivsion.com: No thank you rejected: Domain not found 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) QUIT --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Blank Bkgrd.gif Description: GIF image
Re: [Declude.JunkMail] Help: Domain not found
BlankDUH !!! I read this several time and didn't catch it. I think it is time for me to retire. Thanks - Original Message - From: Michael Jaworski To: declude.junkmail@declude.com Sent: Tuesday, February 27, 2007 4:00 AM Subject: RE: [Declude.JunkMail] Help: Domain not found Is the example the same as the original?? Malivision is misspelled, missing an i. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Monday, February 26, 2007 7:32 PM To: declude.junkmail@declude.com; Imail_Forum@list.ipswitch.com Subject: [Declude.JunkMail] Help: Domain not found I have a client having problems sending emails to some servers No thank you rejected: Domain not found DNSSTUFF shows no major problem with malivision.com Would appreciate any help to resolve this issue 20070226 183127 127.0.0.1 SMTP (276b023cf3f9) Trying mail.com (0) 20070226 183128 127.0.0.1 SMTP (276b023cf3f9) Connect mail.com [208.36.123.68:25] (1) 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) 220 spf8.us4.outblaze.com ESMTP Postfix 20070226 183130 127.0.0.1 SMTP (276b023cf3f9) EHLO mail.cefib.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-spf8.us4.outblaze.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-PIPELINING 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-SIZE 1024 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250-ETRN 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 8BITMIME 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) MAIL FROM:philippe @ malivsion.com 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) 250 Ok 20070226 183131 127.0.0.1 SMTP (276b023cf3f9) RCPT To:mathioye @ mail.com 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) 550 philippe @ malivsion.com: No thank you rejected: Domain not found 20070226 183132 127.0.0.1 SMTP (276b023cf3f9) QUIT --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. image001.gif Description: GIF image
RE: [Declude.JunkMail] Help: Domain not found
At least for the night. John T  -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Monday, February 26, 2007 8:19 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Help: Domain not found DUH !!! I read this several time and didn't catch it. I think it is time for me to retire.  Thanks   - Original Message - From: Michael Jaworski To: declude.junkmail@declude.com Sent: Tuesday, February 27, 2007 4:00 AM Subject: RE: [Declude.JunkMail] Help: Domain not found Is the example the same as the original?? Malivision is misspelled, missing an i. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge Sent: Monday, February 26, 2007 7:32 PM To: declude.junkmail@declude.com; Imail_Forum@list.ipswitch.com Subject: [Declude.JunkMail] Help: Domain not found I have a client having problems sending emails to some servers No thank you rejected: Domain not found DNSSTUFF shows no major problem with malivision.com Would appreciate any help to resolve this issue   20070226 183127 127.0.0.1  SMTP (276b023cf3f9) Trying mail.com (0) 20070226 183128 127.0.0.1  SMTP (276b023cf3f9) Connect mail.com [208.36.123.68:25] (1) 20070226 183130 127.0.0.1  SMTP (276b023cf3f9) 220 spf8.us4.outblaze.com ESMTP Postfix 20070226 183130 127.0.0.1  SMTP (276b023cf3f9) EHLO mail.cefib.com 20070226 183131 127.0.0.1  SMTP (276b023cf3f9) 250-spf8.us4.outblaze.com 20070226 183131 127.0.0.1  SMTP (276b023cf3f9) 250-PIPELINING 20070226 183131 127.0.0.1  SMTP (276b023cf3f9) 250-SIZE 1024 20070226 183131 127.0.0.1  SMTP (276b023cf3f9) 250-ETRN 20070226 183131 127.0.0.1  SMTP (276b023cf3f9) 250 8BITMIME 20070226 183131 127.0.0.1  SMTP (276b023cf3f9) MAIL FROM:philippe @ malivsion.com 20070226 183131 127.0.0.1  SMTP (276b023cf3f9) 250 Ok 20070226 183131 127.0.0.1  SMTP (276b023cf3f9) RCPT To:mathioye @ mail.com 20070226 183132 127.0.0.1  SMTP (276b023cf3f9) 550 philippe @ malivsion.com: No thank you rejected: Domain not found 20070226 183132 127.0.0.1  SMTP (276b023cf3f9) QUIT   --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Configuration
Which is what we want to do. I changed my configs and instead of routing to a mailbox, am holding. The only real reason I wanted to separate was because searhing through a mailbox was a PIA. I downloaded the trial of fpReview as suggested by John and will try that (so far it looks like a great utility!). Thanks! Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, November 07, 2006 6:19 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Help with Configuration Unless, as some prefer, you want to mark the subject in addition to holding. In that case, the old weight statements fit perfectly instead of the newer weightrange. Darin. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, November 07, 2006 2:58 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Help with Configuration Look at using weightrange instead of weight to define your weighted tests. It simplifies the weighting and makes it clear on what will happen to the message. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 11:19 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Configuration
What I do is send those grey ones to HOLD and then use fpReview to directly view them and take appropriate action. Much faster and easier than using a mailbox. John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 11:19 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Configuration
Look at using weightrange instead of weight to define your weighted tests. It simplifies the weighting and makes it clear on what will happen to the message. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 11:19 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
re: [Declude.JunkMail] Help with Configuration
Is it because when it reaches WEIGHT19 and does the ROUTETO [EMAIL PROTECTED], the message is delivered? Then when it tries to perform the action of WEIGHT32 the message is already gone? Does Declude allow for multiple instances of the same action where subsequent actions are performed, or does it perform the action of the same type that occurs first? Is there a precedence on actions of the same type or not? The manual describes precedence for actions of different type (HOLD over WARN for example) but what about actions of the same type (one ROUTETO versus another ROUTETO)? Gary Original Message From: Todd Richards [EMAIL PROTECTED] Sent: Tuesday, November 07, 2006 2:47 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Configuration
That's what I was wondering too, but then I wondered why it would make it to the WEIGHT60 and get deleted? I think what Kevin suggested with the weightranges would probably work. Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, November 07, 2006 3:34 PM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] Help with Configuration Is it because when it reaches WEIGHT19 and does the ROUTETO [EMAIL PROTECTED], the message is delivered? Then when it tries to perform the action of WEIGHT32 the message is already gone? Does Declude allow for multiple instances of the same action where subsequent actions are performed, or does it perform the action of the same type that occurs first? Is there a precedence on actions of the same type or not? The manual describes precedence for actions of different type (HOLD over WARN for example) but what about actions of the same type (one ROUTETO versus another ROUTETO)? Gary Original Message From: Todd Richards [EMAIL PROTECTED] Sent: Tuesday, November 07, 2006 2:47 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Configuration
Thanks John. I will look at fpReview. Yeah, browsing the mailbox is a bit slow... :( Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Tuesday, November 07, 2006 2:44 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Help with Configuration What I do is send those grey ones to HOLD and then use fpReview to directly view them and take appropriate action. Much faster and easier than using a mailbox. John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 11:19 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Configuration
Thanks Kevin. This is what I was wondering about, so I will look into how to implement. Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, November 07, 2006 2:58 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Help with Configuration Look at using weightrange instead of weight to define your weighted tests. It simplifies the weighting and makes it clear on what will happen to the message. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 11:19 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help with Configuration
Todd Richards wrote: Thanks Kevin. This is what I was wondering about, so I will look into how to implement. something like this: WEIGHTRANGE.SPAM.LOW weightrange x x 10 12 triggered on a weight of 10 to 12 inclusive WEIGHTRANGE.SPAM.MID weightrange x x 13 15 WEIGHTRANGE.SPAM.HIGH weightrange x x 16 18 WEIGHTRANGE.SPAM.VHIGH weightrange x x 19 26 etc and then subject tag on the hits WEIGHTRANGE.SPAM.LOW SUBJECT [Possible Spam(low)]- WEIGHTRANGE.SPAM.MID SUBJECT [Possible Spam(mid)]- WEIGHTRANGE.SPAM.HIGH SUBJECT [Possible Spam(high)]- WEIGHTRANGE.SPAM.VHIGH SUBJECT [Possible Spam(vhigh)]- WEIGHTRANGE.SPAM.XVHIGH SUBJECT [Possible Spam(Xvhigh)]- etc -Nick Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin Bilbee Sent: Tuesday, November 07, 2006 2:58 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Help with Configuration Look at using "weightrange" instead of weight to define your weighted tests. It simplifies the weighting and makes it clear on what will happen to the message. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 11:19 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the "close calls". I was sending everything between "caught" and "delete" to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED]. What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to "spam2"). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Configuration
This is how we have our server setup SPAM-LOWweightrange x x 8 13 SPAM-MEDweightrange x x 14 24 SPAM-HIGH weight x x 25 0 SPAM-LOWSUBJECT [ SPAM %WEIGHT% ] SPAM-MEDHOLD SPAM-HIGH DELETE So this way we know exactly what will happen for each weight without question? So for your configuration change the weights for your config and change HOLD to ROUTETO... Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 2:50 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Help with Configuration Thanks Kevin. This is what I was wondering about, so I will look into how to implement. Todd -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, November 07, 2006 2:58 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Help with Configuration Look at using weightrange instead of weight to define your weighted tests. It simplifies the weighting and makes it clear on what will happen to the message. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 11:19 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help with Configuration
Unless, as some prefer, you want to mark the subject in addition to holding. In that case, the old weight statements fit perfectly instead of the newer weightrange. Darin. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Tuesday, November 07, 2006 2:58 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Help with Configuration Look at using weightrange instead of weight to define your weighted tests. It simplifies the weighting and makes it clear on what will happen to the message. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, November 07, 2006 11:19 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Help with Configuration Hey Everyone - We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caught and delete to a spam mailbox so that I could check for any false positives. However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones. Here is my weights in my global.cfg file: WEIGHT10 WARN WEIGHT15 WARN WEIGHT19 HOLD WEIGHT32 HOLD WEIGHT60 DELETE Here is the corresponding actions that I have in my $default$.junkmail file: WEIGHT10 WARN WEIGHT15 SUBJECT **SPAM** WEIGHT19 ROUTETO [EMAIL PROTECTED] WEIGHT19a SUBJECT [%WEIGHT%] WEIGHT32 ROUTETO [EMAIL PROTECTED] WEIGHT32a SUBJECT [%WEIGHT%] WEIGHT60 DELETE My plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED] What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing? Thanks! Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Configuration
Yea, but the last line should only be weight WEIGH.SPAM.XHIGH weigh x x 270 With this as your last weight all messages with a weight of 27 or higher will trigger this test. Kevin Bilbee From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, November 07, 2006 3:13 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Help with Configuration Todd Richards wrote: Thanks Kevin. This is what I was wondering about, so I will look into howto implement. something like this: WEIGHTRANGE.SPAM.LOW weightrange x x 10 12triggered on a weight of 10 to 12 inclusive WEIGHTRANGE.SPAM.MID weightrange x x 13 15 WEIGHTRANGE.SPAM.HIGH weightrange x x 16 18 WEIGHTRANGE.SPAM.VHIGH weightrange x x 19 26 etc and then subject tag on the hits WEIGHTRANGE.SPAM.LOW SUBJECT [Possible Spam(low)]- WEIGHTRANGE.SPAM.MID SUBJECT [Possible Spam(mid)]- WEIGHTRANGE.SPAM.HIGH SUBJECT [Possible Spam(high)]- WEIGHTRANGE.SPAM.VHIGH SUBJECT [Possible Spam(vhigh)]- WEIGHTRANGE.SPAM.XVHIGH SUBJECT [Possible Spam(Xvhigh)]- etc -Nick Todd -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of KevinBilbeeSent: Tuesday, November 07, 2006 2:58 PMTo: declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Help with ConfigurationLook at using weightrange instead of weight to define your weighted tests.It simplifies the weighting and makes it clear on what will happen to themessage.Kevin Bilbee -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Todd RichardsSent: Tuesday, November 07, 2006 11:19 AMTo: declude.junkmail@declude.comSubject: [Declude.JunkMail] Help with ConfigurationHey Everyone -We are just getting things tuned to the point where we are truly happy with the results we are seeing. What I am trying to do now is help myself monitor the close calls. I was sending everything between caughtanddelete to a spam mailbox so that I could check for any false positives.However, with my new success, that is getting out of hand. So what I would like to do is set up a new account to help with the overflow and allow me to really monitor the close ones.Here is my weights in my global.cfg file:WEIGHT10 WARNWEIGHT15 WARNWEIGHT19 HOLDWEIGHT32 HOLDWEIGHT60 DELETEHere is the corresponding actions that I have in my $default$.junkmailfile:WEIGHT10 WARNWEIGHT15 SUBJECT **SPAM**WEIGHT19 ROUTETO [EMAIL PROTECTED]WEIGHT19a SUBJECT [%WEIGHT%]WEIGHT32 ROUTETO [EMAIL PROTECTED]WEIGHT32a SUBJECT [%WEIGHT%]WEIGHT60 DELETEMy plan with the above is to send everything with a weight of 19-31 to [EMAIL PROTECTED], and everything from 32-59 to [EMAIL PROTECTED]. What I am hoping to accomplish by this is to keep a closer eye on those email that might accidentally be caught. Right now, 95% of the messages are ending up in the [EMAIL PROTECTED] mailbox even if they are above the WEIGHT32 (which should then go to spam2). However, it does appear that everything over 60 is being deleted. I've checked all of the config files to make sure I have things set up right, and it does appear that way. Am I missing something, or is there something diferent that I should be doing?Thanks!Todd---This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.   ---This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,just send an E-mail to [EMAIL PROTECTED], and type unsubscribeDeclude.JunkMail. The archives can be found athttp://www.mail-archive.com.---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype unsubscribe Declude.JunkMail. The archives can be foundat http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Help: Delivery failures
Everything but the topmost received from header can be forged, so I think that's what your looking at here. So look at that top line, and compare with the Declude REVDNS variable to see where it's really coming from. Note also that the X-Mailer header could be forged too, so it may or may not have actually been sent from that mail client. Darin. - Original Message - From: Serge To: declude.junkmail@declude.com Sent: Friday, September 22, 2006 1:43 AM Subject: Re: [Declude.JunkMail] Help: Delivery failures For those of you who can read headers better than me, here is a more interesting one this time, we have some ips, "Received: from 217.170.144.6 (HELO mail.cefib.com)" can be valid, but 1- there is no traces in my logs of sending this message 2- second part of the header says cwmagic.com received from217.170.144.6, but first part says 196.205.224.128, either i am missing something, or there is contradiction is "the bat" faking the header ? please help Received: from host-196-205-224-128.static.link.com.eg ([196.205.224.128]) by SERVER.Compuwizards.local with Microsoft SMTPSVC(5.0.2195.6713); Thu, 21 Sep 2006 10:52:36 -0700Return-Path: [EMAIL PROTECTED]Received: from 217.170.144.6 (HELO mail.cefib.com) by cwmagic.com with esmtp (DA5X015JX7 X0Z5) id 5K23MB-BX0IOM-7E for [EMAIL PROTECTED]; Tue, 21 Mar 2006 18:33:33 -0120Date:Tue, 21 Mar 2006 18:33:33 -0120From:"Mario Hamlin" [EMAIL PROTECTED].comX-Mailer: The Bat! (v3.51) HomeX-Priority: 3 (Normal)Message-ID: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: THURSDAY.rq MIME-Version: 1.0Content-Type: multipart/mixed; boundary="--6E54096EC8425409"X-Spam: Not detectedX-OriginalArrivalTime: 21 Sep 2006 17:52:37.0671 (UTC) FILETIME=[B9B6C370:01C6DDA6] - Original Message - From: Serge To: declude.junkmail@declude.com Sent: Friday, September 22, 2006 2:13 AM Subject: [Declude.JunkMail] Help: Delivery failures I am beiing bombarded by delivery failures The heading of the returned messages are of the form below Can't find any ip in the headings somename and [EMAIL PROTECTED]are not valid user or adresses on my server in my logs, can't find any "MAIL FROM:[EMAIL PROTECTED] apparently, some spamer is using [EMAIL PROTECTED]in his from address. What is going on ? and how can invetigate this any further ? TIA Message-ID: [EMAIL PROTECTED]From:somename [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: The president's so-called 2Date: Thu, 21 Sep 2006 21:00:07 -0400MIME-Version: 1.0X-Mailer: Internet Mail Service (5.5.2657.72)X-MS-Embedded-Report: X-Mailer: The Bat! (v3.71.04) ProfessionalContent-Type: multipart/mixed;boundary="_=_NextPart_002_01C6DDD7.7CB7171E" ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Help: Delivery failures
For those of you who can read headers better than me, here is a more interesting one this time, we have some ips, "Received: from 217.170.144.6 (HELO mail.cefib.com)" can be valid, but 1- there is no traces in my logs of sending this message 2- second part of the header says cwmagic.com received from217.170.144.6, but first part says 196.205.224.128, either i am missing something, or there is contradiction is "the bat" faking the header ? please help Received: from host-196-205-224-128.static.link.com.eg ([196.205.224.128]) by SERVER.Compuwizards.local with Microsoft SMTPSVC(5.0.2195.6713); Thu, 21 Sep 2006 10:52:36 -0700Return-Path: [EMAIL PROTECTED]Received: from 217.170.144.6 (HELO mail.cefib.com) by cwmagic.com with esmtp (DA5X015JX7 X0Z5) id 5K23MB-BX0IOM-7E for [EMAIL PROTECTED]; Tue, 21 Mar 2006 18:33:33 -0120Date:Tue, 21 Mar 2006 18:33:33 -0120From:"Mario Hamlin" [EMAIL PROTECTED].comX-Mailer: The Bat! (v3.51) HomeX-Priority: 3 (Normal)Message-ID: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: THURSDAY.rq MIME-Version: 1.0Content-Type: multipart/mixed; boundary="--6E54096EC8425409"X-Spam: Not detectedX-OriginalArrivalTime: 21 Sep 2006 17:52:37.0671 (UTC) FILETIME=[B9B6C370:01C6DDA6] - Original Message - From: Serge To: declude.junkmail@declude.com Sent: Friday, September 22, 2006 2:13 AM Subject: [Declude.JunkMail] Help: Delivery failures I am beiing bombarded by delivery failures The heading of the returned messages are of the form below Can't find any ip in the headings somename and [EMAIL PROTECTED]are not valid user or adresses on my server in my logs, can't find any "MAIL FROM:[EMAIL PROTECTED] apparently, some spamer is using [EMAIL PROTECTED]in his from address. What is going on ? and how can invetigate this any further ? TIA Message-ID: [EMAIL PROTECTED]From:somename [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: The president's so-called 2Date: Thu, 21 Sep 2006 21:00:07 -0400MIME-Version: 1.0X-Mailer: Internet Mail Service (5.5.2657.72)X-MS-Embedded-Report: X-Mailer: The Bat! (v3.71.04) ProfessionalContent-Type: multipart/mixed;boundary="_=_NextPart_002_01C6DDD7.7CB7171E" ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - I upgraded to declude 3.0.6.4
I have upgraded to declude 3.0.6.4 , created a declude.cfg add the line INVITEFIX ON , put my footer lines back in the virus.cfg file , the invites work fine , but my footer is not being added , so I tried setting the INVITEFIX OFF , still no footers showing up . Howard Smith N.O.R.A.D. Inc. P.O. Box 680116 Miami, Florida 33168 www.norad.com [EMAIL PROTECTED] Office - (305) NETWORK (638-9675) Sales - (786) 206-0045 Fax1 - (305) 359-5144 Confidentiality Notice: This email message, including any Attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact [EMAIL PROTECTED] by email and destroy all copies of the original message. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, March 31, 2006 5:39 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6 Best to do both if you have the declude.cfg David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, March 31, 2006 5:28 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6 There is a switch in declude.cfg for Declude 3.0.5.21 and up that may help: # Some customers had issues related to Outlook meeting requests appearing as text only. # The default for this directive is OFF. INVITEFIX ON - Original Message - From: Howard Smith (N.O.R.A.D.) To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Sent: Friday, March 31, 2006 4:08 PM Subject: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6 I have clients that are using outlook appointment scheduling but the receipts get the following email error - - Original Message- From: Bruce Kusens [mailto:[EMAIL PROTECTED]] Sent: Thursday, March 30, 2006 9:33 AM To: [EMAIL PROTECTED]; 'Therese Adlhoch Smith'; [EMAIL PROTECTED] Subject: GoToMeeting Invitation - PDC CD call Received: from imf19aec.mail.bellsouth.net [205.152.59.67] by norad06.norad.com with ESMTP (SMTPD32-8.15) id A66ABC8D0026; Thu, 30 Mar 2006 12:33:30 -0500 Received: from ibm60aec.bellsouth.net ([65.8.197.116]) by imf19aec.mail.bellsouth.net with ESMTP id [EMAIL PROTECTED] ; Thu, 30 Mar 2006 12:33:30 -0500 Received: from BedTV ([65.8.197.116]) by ibm60aec.bellsouth.net with ESMTP id [EMAIL PROTECTED]; Thu, 30 Mar 2006 12:33:30 -0500 Reply-To: [EMAIL PROTECTED] From: Bruce Kusens [EMAIL PROTECTED] To: [EMAIL PROTECTED], 'Therese Adlhoch Smith' [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GoToMeeting Invitation - PDC CD call Date: Thu, 30 Mar 2006 12:33:19 -0500 Organization: Atrus Inc MIME-Version: 1.0 Content-Type: text/calendar; method=REQUEST; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 thread-index: AcZUIAkjq1y9Oj2zT7WmqZng/uqKww== Message-Id: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [205.152.59.67] X-Note: This E-mail was scanned by (www.SecureTrek.com) for Spam and Virus. X-Spam-Tests-Failed: Whitelisted [0] X-Note: This E-mail was sent from imf19aec.mail.bellsouth.net ([205.152.59.67]). X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 432016717 BEGIN:VCALENDAR PRODID:-//Microsoft Corporation//Outlook 11.0 MIMEDIR//EN VERSION:2.0 METHOD:REQUEST BEGIN:VEVENT ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ORGANIZER:MAILTO:[EMAIL PROTECTED] DTSTART:20060330T18Z DTEND:20060330T19Z TRANSP:OPAQUE SEQUENCE:0 UID:04008200E00074C5B7101A82E008A0A14A20F653C601 100 01E062A20E3BE2D4881466EED97BFF648 DTSTAMP:20060330T173319Z DESCRIPTION:When: Thursday\, March 30\, 2006 1:00 PM-2:00 PM (GMT-05:00) Eastern Time (US Canada).\n\n*~*~*~*~*~*~*~*~*~*\n\nPlease join my meeting at\n https://www.gotomeeting.com/join/874812145\nConference Call: Dial (319) 256-0210\, access code 874-812-145\nMeeting ID: 874-812-145\n\nGoToMeeting(TM) \nOnline Meetings Made Easy\n SUMMARY:GoToMeeting Invitation - PDC CD call PRIORITY:5 X-MICROSOFT-CDO-IMPORTANCE:1 CLASS:PUBLIC BEGIN:VALARM TRIGGER:-PT15M ACTION:DISPLAY DESCRIPTION:Reminder END:VALARM END:VEVENT END:VCALENDAR --- [This E-mail scanned for viruses
RE: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6
Go into your virus.cfg and comment out the FOOTER lines. David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Howard Smith (N.O.R.A.D.)Sent: Friday, March 31, 2006 5:09 PMTo: Declude.JunkMail@declude.comCc: [EMAIL PROTECTED]Subject: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6 I have clients that are using outlook appointment scheduling but the receipts get the following email error - - Original Message- From: Bruce Kusens [mailto:[EMAIL PROTECTED]] Sent: Thursday, March 30, 2006 9:33 AM To: [EMAIL PROTECTED]; 'Therese Adlhoch Smith'; [EMAIL PROTECTED] Subject: GoToMeeting Invitation - PDC CD call Received: from imf19aec.mail.bellsouth.net [205.152.59.67] by norad06.norad.com with ESMTP (SMTPD32-8.15) id A66ABC8D0026; Thu, 30 Mar 2006 12:33:30 -0500 Received: from ibm60aec.bellsouth.net ([65.8.197.116]) by imf19aec.mail.bellsouth.net with ESMTP id [EMAIL PROTECTED] ; Thu, 30 Mar 2006 12:33:30 -0500 Received: from BedTV ([65.8.197.116]) by ibm60aec.bellsouth.net with ESMTP id [EMAIL PROTECTED]; Thu, 30 Mar 2006 12:33:30 -0500 Reply-To: [EMAIL PROTECTED] From: "Bruce Kusens" [EMAIL PROTECTED] To: [EMAIL PROTECTED], "'Therese Adlhoch Smith'" [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GoToMeeting Invitation - PDC CD call Date: Thu, 30 Mar 2006 12:33:19 -0500 Organization: Atrus Inc MIME-Version: 1.0 Content-Type: text/calendar; method=REQUEST; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 thread-index: AcZUIAkjq1y9Oj2zT7WmqZng/uqKww== Message-Id: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [205.152.59.67] X-Note: This E-mail was scanned by (www.SecureTrek.com) for Spam and Virus. X-Spam-Tests-Failed: Whitelisted [0] X-Note: This E-mail was sent from imf19aec.mail.bellsouth.net ([205.152.59.67]). X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 432016717 BEGIN:VCALENDAR PRODID:-//Microsoft Corporation//Outlook 11.0 MIMEDIR//EN VERSION:2.0 METHOD:REQUEST BEGIN:VEVENT ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ORGANIZER:MAILTO:[EMAIL PROTECTED] DTSTART:20060330T18Z DTEND:20060330T19Z TRANSP:OPAQUE SEQUENCE:0 UID:04008200E00074C5B7101A82E008A0A14A20F653C601 100 01E062A20E3BE2D4881466EED97BFF648 DTSTAMP:20060330T173319Z DESCRIPTION:When: Thursday\, March 30\, 2006 1:00 PM-2:00 PM (GMT-05:00) Eastern Time (US Canada).\n\n*~*~*~*~*~*~*~*~*~*\n\nPlease join my meeting at\n https://www.gotomeeting.com/join/874812145\nConference Call: Dial (319) 256-0210\, access code 874-812-145\nMeeting ID: 874-812-145\n\nGoToMeeting(TM) \nOnline Meetings Made Easy\n SUMMARY:GoToMeeting Invitation - PDC CD call PRIORITY:5 X-MICROSOFT-CDO-IMPORTANCE:1 CLASS:PUBLIC BEGIN:VALARM TRIGGER:-PT15M ACTION:DISPLAY DESCRIPTION:Reminder END:VALARM END:VEVENT END:VCALENDAR --- [This E-mail scanned for viruses by www.SecureTrek.com, a N.O.R.A.D. Company] --- [This E-mail scanned for viruses by www.SecureTrek.com, a N.O.R.A.D. Company] Howard Smith N.O.R.A.D. Inc. P.O. Box 680116 Miami, Florida 33168 www.norad.com [EMAIL PROTECTED] Office - (305) NETWORK (638-9675) Sales - (786) 206-0045 Fax1 - (305) 359-5144 Confidentiality Notice: This email message, including any Attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact [EMAIL PROTECTED] by email and destroy all copies of the original message.
Re: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6
There is a switch in declude.cfg for Declude 3.0.5.21 and up that may help: # Some customers had issues related to Outlook meeting requests appearing as text only. # The default for this directive is OFF. INVITEFIX ON - Original Message - From: Howard Smith (N.O.R.A.D.) To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Sent: Friday, March 31, 2006 4:08 PM Subject: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6 I have clients that are using outlook appointment scheduling – but the receipts get the following email error - - Original Message- From: Bruce Kusens [mailto:[EMAIL PROTECTED]] Sent: Thursday, March 30, 2006 9:33 AM To: [EMAIL PROTECTED]; 'Therese Adlhoch Smith'; [EMAIL PROTECTED] Subject: GoToMeeting Invitation - PDC CD call Received: from imf19aec.mail.bellsouth.net [205.152.59.67] by norad06.norad.com with ESMTP (SMTPD32-8.15) id A66ABC8D0026; Thu, 30 Mar 2006 12:33:30 -0500 Received: from ibm60aec.bellsouth.net ([65.8.197.116]) by imf19aec.mail.bellsouth.net with ESMTP id [EMAIL PROTECTED] ; Thu, 30 Mar 2006 12:33:30 -0500 Received: from BedTV ([65.8.197.116]) by ibm60aec.bellsouth.net with ESMTP id [EMAIL PROTECTED]; Thu, 30 Mar 2006 12:33:30 -0500 Reply-To: [EMAIL PROTECTED] From: "Bruce Kusens" [EMAIL PROTECTED] To: [EMAIL PROTECTED], "'Therese Adlhoch Smith'" [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GoToMeeting Invitation - PDC CD call Date: Thu, 30 Mar 2006 12:33:19 -0500 Organization: Atrus Inc MIME-Version: 1.0 Content-Type: text/calendar; method=REQUEST; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 thread-index: AcZUIAkjq1y9Oj2zT7WmqZng/uqKww== Message-Id: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [205.152.59.67] X-Note: This E-mail was scanned by (www.SecureTrek.com) for Spam and Virus. X-Spam-Tests-Failed: Whitelisted [0] X-Note: This E-mail was sent from imf19aec.mail.bellsouth.net ([205.152.59.67]). X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 432016717 BEGIN:VCALENDAR PRODID:-//Microsoft Corporation//Outlook 11.0 MIMEDIR//EN VERSION:2.0 METHOD:REQUEST BEGIN:VEVENT ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ORGANIZER:MAILTO:[EMAIL PROTECTED] DTSTART:20060330T18Z DTEND:20060330T19Z TRANSP:OPAQUE SEQUENCE:0 UID:04008200E00074C5B7101A82E008A0A14A20F653C601 100 01E062A20E3BE2D4881466EED97BFF648 DTSTAMP:20060330T173319Z DESCRIPTION:When: Thursday\, March 30\, 2006 1:00 PM-2:00 PM (GMT-05:00) Eastern Time (US Canada).\n\n*~*~*~*~*~*~*~*~*~*\n\nPlease join my meeting at\n https://www.gotomeeting.com/join/874812145\nConference Call: Dial (319) 256-0210\, access code 874-812-145\nMeeting ID: 874-812-145\n\nGoToMeeting(TM) \nOnline Meetings Made Easy\n SUMMARY:GoToMeeting Invitation - PDC CD call PRIORITY:5 X-MICROSOFT-CDO-IMPORTANCE:1 CLASS:PUBLIC BEGIN:VALARM TRIGGER:-PT15M ACTION:DISPLAY DESCRIPTION:Reminder END:VALARM END:VEVENT END:VCALENDAR --- [This E-mail scanned for viruses by www.SecureTrek.com, a N.O.R.A.D. Company] --- [This E-mail scanned for viruses by www.SecureTrek.com, a N.O.R.A.D. Company] Howard Smith N.O.R.A.D. Inc. P.O. Box 680116 Miami, Florida 33168 www.norad.com [EMAIL PROTECTED] Office - (305) NETWORK (638-9675) Sales - (786) 206-0045 Fax1 - (305) 359-5144 Confidentiality Notice: This email message, including any Attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact [EMAIL PROTECTED] by email and destroy all copies of the original message.
RE: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6
Best to do both if you have the declude.cfg David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott FisherSent: Friday, March 31, 2006 5:28 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6 There is a switch in declude.cfg for Declude 3.0.5.21 and up that may help: # Some customers had issues related to Outlook meeting requests appearing as text only. # The default for this directive is OFF. INVITEFIX ON - Original Message - From: Howard Smith (N.O.R.A.D.) To: Declude.JunkMail@declude.com Cc: [EMAIL PROTECTED] Sent: Friday, March 31, 2006 4:08 PM Subject: [Declude.JunkMail] HELP - outlook meeting invitations arell not coming through properly. Please See below - Iam using imail 8.15 - declude 2.0.6 I have clients that are using outlook appointment scheduling but the receipts get the following email error - - Original Message- From: Bruce Kusens [mailto:[EMAIL PROTECTED]] Sent: Thursday, March 30, 2006 9:33 AM To: [EMAIL PROTECTED]; 'Therese Adlhoch Smith'; [EMAIL PROTECTED] Subject: GoToMeeting Invitation - PDC CD call Received: from imf19aec.mail.bellsouth.net [205.152.59.67] by norad06.norad.com with ESMTP (SMTPD32-8.15) id A66ABC8D0026; Thu, 30 Mar 2006 12:33:30 -0500 Received: from ibm60aec.bellsouth.net ([65.8.197.116]) by imf19aec.mail.bellsouth.net with ESMTP id [EMAIL PROTECTED] ; Thu, 30 Mar 2006 12:33:30 -0500 Received: from BedTV ([65.8.197.116]) by ibm60aec.bellsouth.net with ESMTP id [EMAIL PROTECTED]; Thu, 30 Mar 2006 12:33:30 -0500 Reply-To: [EMAIL PROTECTED] From: "Bruce Kusens" [EMAIL PROTECTED] To: [EMAIL PROTECTED], "'Therese Adlhoch Smith'" [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GoToMeeting Invitation - PDC CD call Date: Thu, 30 Mar 2006 12:33:19 -0500 Organization: Atrus Inc MIME-Version: 1.0 Content-Type: text/calendar; method=REQUEST; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 thread-index: AcZUIAkjq1y9Oj2zT7WmqZng/uqKww== Message-Id: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [205.152.59.67] X-Note: This E-mail was scanned by (www.SecureTrek.com) for Spam and Virus. X-Spam-Tests-Failed: Whitelisted [0] X-Note: This E-mail was sent from imf19aec.mail.bellsouth.net ([205.152.59.67]). X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 432016717 BEGIN:VCALENDAR PRODID:-//Microsoft Corporation//Outlook 11.0 MIMEDIR//EN VERSION:2.0 METHOD:REQUEST BEGIN:VEVENT ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:[EMAIL PROTECTED] ORGANIZER:MAILTO:[EMAIL PROTECTED] DTSTART:20060330T18Z DTEND:20060330T19Z TRANSP:OPAQUE SEQUENCE:0 UID:04008200E00074C5B7101A82E008A0A14A20F653C601 100 01E062A20E3BE2D4881466EED97BFF648 DTSTAMP:20060330T173319Z DESCRIPTION:When: Thursday\, March 30\, 2006 1:00 PM-2:00 PM (GMT-05:00) Eastern Time (US Canada).\n\n*~*~*~*~*~*~*~*~*~*\n\nPlease join my meeting at\n https://www.gotomeeting.com/join/874812145\nConference Call: Dial (319) 256-0210\, access code 874-812-145\nMeeting ID: 874-812-145\n\nGoToMeeting(TM) \nOnline Meetings Made Easy\n SUMMARY:GoToMeeting Invitation - PDC CD call PRIORITY:5 X-MICROSOFT-CDO-IMPORTANCE:1 CLASS:PUBLIC BEGIN:VALARM TRIGGER:-PT15M ACTION:DISPLAY DESCRIPTION:Reminder END:VALARM END:VEVENT END:VCALENDAR --- [This E-mail scanned for viruses by www.SecureTrek.com, a N.O.R.A.D. Company] --- [This E-mail scanned for viruses by www.SecureTrek.com, a N.O.R.A.D. Company] Howard Smith N.O.R.A.D. Inc. P.O. Box 680116 Miami, Florida 33168 www.norad.com [EMAIL PROTECTED] Office - (305) NETWORK (638-9675) Sales - (786) 206-0045 Fax1 - (305) 359-5144 Confidentiality Notice: This email message, including any Attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact [EMAIL PROTECTED] by email and destroy all copies of the original message.
RE: [Declude.JunkMail] Help with filter
Hi Dave, Look at this thread: http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.html Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 4:03 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY 2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help with filter
There is probably some html coding before that line. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, January 16, 2006 9:02 AM Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY 2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with filter
Scott, No, there was nothing before that line. At least nothing that made it through with the email message. When I did a view source that was the only line in the message. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Monday, January 16, 2006 10:36 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help with filter There is probably some html coding before that line. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, January 16, 2006 9:02 AM Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY 2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with filter
Hi Erik, Thanks for turning me on to that thread. There was some good information in that discussion. The spam I received had a subject of Fax Received Much of the filter discussion, in that topic you directed me to, centered around also checking the contents of the subject line. Apparently, the spammer has changed their subject now to be less predictable. Which cause the filter to fail if it depended upon the subject line. I'm back to my earlier thought that any email message which contains only the img src=CID would be enough to trigger a hold. I can't imagine any legitimate email being coded like that. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 9:10 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Dave, Look at this thread: http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.html Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 4:03 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with filter
Yes, that spam campaign keeps changing subjects. Unfortunately, if you filter only on the CID tag; you will filter some legitimate newsletters as they do use the CID tag. As long as you will be monitoring your HOLD queue; you should fine so you filter out the false positives. Also in that thread was discussion of some variants used to the CID html coding. I believe Scott brought that up in his postings. Another thing Scott brought up is that this spam campaign also fails the CMDSPACE in Declude. We make use of that combo test TESTSFAILED when looking for the CID tag. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 6:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Erik, Thanks for turning me on to that thread. There was some good information in that discussion. The spam I received had a subject of Fax Received Much of the filter discussion, in that topic you directed me to, centered around also checking the contents of the subject line. Apparently, the spammer has changed their subject now to be less predictable. Which cause the filter to fail if it depended upon the subject line. I'm back to my earlier thought that any email message which contains only the img src=CID would be enough to trigger a hold. I can't imagine any legitimate email being coded like that. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 9:10 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Dave, Look at this thread: http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.html Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 4:03 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with filter
Erik, I thought that the beginswith meant that we are testing the very first line of the message? A newsletter would never have just one line -- that being the CID tag. I could see where contains would be a problem though. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 12:01 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Yes, that spam campaign keeps changing subjects. Unfortunately, if you filter only on the CID tag; you will filter some legitimate newsletters as they do use the CID tag. As long as you will be monitoring your HOLD queue; you should fine so you filter out the false positives. Also in that thread was discussion of some variants used to the CID html coding. I believe Scott brought that up in his postings. Another thing Scott brought up is that this spam campaign also fails the CMDSPACE in Declude. We make use of that combo test TESTSFAILED when looking for the CID tag. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 6:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Erik, Thanks for turning me on to that thread. There was some good information in that discussion. The spam I received had a subject of Fax Received Much of the filter discussion, in that topic you directed me to, centered around also checking the contents of the subject line. Apparently, the spammer has changed their subject now to be less predictable. Which cause the filter to fail if it depended upon the subject line. I'm back to my earlier thought that any email message which contains only the img src=CID would be enough to trigger a hold. I can't imagine any legitimate email being coded like that. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 9:10 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Dave, Look at this thread: http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.html Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 4:03 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY 2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with filter
Yes, you are correct with the use of BEGINSWITH. This campaign is and has been lately using html code before the CID tag to throw off spam filters. Your use of BEGINSWITH to detect the CID tag should be effective then as very few email bodies begin with just a CID tag. Below is what we are currently using as a filter in Declude for this spammer (if you use this; adjust your weight according to your HOLD/DELETE weight - our DELETE weight is 125 and our HOLD weight is 80): SKIPIFWEIGHT 125 BODYEND NOTCONTAINS Content-Type: image/gif #MN NOTE - Mark: Removed as this spammer is now using different HELO's #HEADERSEND NOTCONTAINS Received: from unknown (HELO HEADERS END NOTCONTAINS 192.168. TESTSFAILED END NOTCONTAINS CMDSPACE BODY20 CONTAINSimg src=cid: BODY20 CONTAINSimg src=3Dcid: #subjects used in this spam; values used to increase the weight to DELETE based on the above tests SUBJECT 50 STARTSWITH fax received SUBJECT 50 STARTSWITH breaking news SUBJECT 50 STARTSWITH OTC News SUBJECT 50 STARTSWITH press release SUBJECT 50 STARTSWITH news SUBJECT 50 STARTSWITH top news SUBJECT 50 STARTSWITH headline news Hope that helps you. ;-) -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 7:12 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Erik, I thought that the beginswith meant that we are testing the very first line of the message? A newsletter would never have just one line -- that being the CID tag. I could see where contains would be a problem though. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 12:01 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Yes, that spam campaign keeps changing subjects. Unfortunately, if you filter only on the CID tag; you will filter some legitimate newsletters as they do use the CID tag. As long as you will be monitoring your HOLD queue; you should fine so you filter out the false positives. Also in that thread was discussion of some variants used to the CID html coding. I believe Scott brought that up in his postings. Another thing Scott brought up is that this spam campaign also fails the CMDSPACE in Declude. We make use of that combo test TESTSFAILED when looking for the CID tag. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 6:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Erik, Thanks for turning me on to that thread. There was some good information in that discussion. The spam I received had a subject of Fax Received Much of the filter discussion, in that topic you directed me to, centered around also checking the contents of the subject line. Apparently, the spammer has changed their subject now to be less predictable. Which cause the filter to fail if it depended upon the subject line. I'm back to my earlier thought that any email message which contains only the img src=CID would be enough to trigger a hold. I can't imagine any legitimate email being coded like that. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 9:10 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Dave, Look at this thread: http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.ht ml Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 4:03 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML email with only one line. The line is as follows: img src=cid:85ae9b8e79a2548912c0c40ef7709a27 I have a body filter with the following: BODY 2 BEGINSWITH img src=cid: The filter didn't trip on the spam email. Any idea of why this wouldn't work? Thanks, Dave --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
RE: [Declude.JunkMail] Help with filter
I don't know if the BEGINSWITH will work in all cases, but if it does, great. I think you'd do better to mitigate the false positives by checking for text that is missing, e.g. I think this would be a lethal test, and wouldn't require you to track his evolving HELO and SUBJECT lines: BODY END CONTAINS HTML TESTSFAILED END NOTCONTAINS CMDSPACE BODY20 CONTAINSimg src=cid: BODY20 CONTAINSimg src=3Dcid: Of course, conversations on this list about this guy may then get triggered, too. Andrew ;) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 10:33 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Yes, you are correct with the use of BEGINSWITH. This campaign is and has been lately using html code before the CID tag to throw off spam filters. Your use of BEGINSWITH to detect the CID tag should be effective then as very few email bodies begin with just a CID tag. Below is what we are currently using as a filter in Declude for this spammer (if you use this; adjust your weight according to your HOLD/DELETE weight - our DELETE weight is 125 and our HOLD weight is 80): SKIPIFWEIGHT 125 BODY END NOTCONTAINS Content-Type: image/gif #MN NOTE - Mark: Removed as this spammer is now using different HELO's #HEADERS END NOTCONTAINS Received: from unknown (HELO HEADERS END NOTCONTAINS 192.168. TESTSFAILED END NOTCONTAINS CMDSPACE BODY 20 CONTAINSimg src=cid: BODY 20 CONTAINSimg src=3Dcid: #subjects used in this spam; values used to increase the weight to DELETE based on the above tests SUBJECT 50 STARTSWITH fax received SUBJECT 50 STARTSWITH breaking news SUBJECT 50 STARTSWITH OTC News SUBJECT 50 STARTSWITH press release SUBJECT 50 STARTSWITH news SUBJECT 50 STARTSWITH top news SUBJECT 50 STARTSWITH headline news Hope that helps you. ;-) -Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 7:12 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Erik, I thought that the beginswith meant that we are testing the very first line of the message? A newsletter would never have just one line -- that being the CID tag. I could see where contains would be a problem though. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 12:01 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Yes, that spam campaign keeps changing subjects. Unfortunately, if you filter only on the CID tag; you will filter some legitimate newsletters as they do use the CID tag. As long as you will be monitoring your HOLD queue; you should fine so you filter out the false positives. Also in that thread was discussion of some variants used to the CID html coding. I believe Scott brought that up in his postings. Another thing Scott brought up is that this spam campaign also fails the CMDSPACE in Declude. We make use of that combo test TESTSFAILED when looking for the CID tag. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 6:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Erik, Thanks for turning me on to that thread. There was some good information in that discussion. The spam I received had a subject of Fax Received Much of the filter discussion, in that topic you directed me to, centered around also checking the contents of the subject line. Apparently, the spammer has changed their subject now to be less predictable. Which cause the filter to fail if it depended upon the subject line. I'm back to my earlier thought that any email message which contains only the img src=CID would be enough to trigger a hold. I can't imagine any legitimate email being coded like that. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Erik Sent: Monday, January 16, 2006 9:10 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help with filter Hi Dave, Look at this thread: http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.ht ml Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, January 16, 2006 4:03 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help with filter I received a spam email, which was an HTML
RE: [Declude.JunkMail] Help-Reinstall Urgent
Mark, At a minimum I would move to version 1.82. This includes the fix for the broken SPAMHEADER test which may be part of the problem. Barry www.declude.com (978) 499-2933 Declude Inc. 65 Parker Street Suite 5 Newburyport, MA 01950 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Orillia ProNet Administration Sent: Monday, November 07, 2005 8:18 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Help-Reinstall Urgent hello all. had a meltdown yesterday. Need help. have imail back and working, 815hf2. I restored data from backup, all is well. when i reinstalled and restored declude, it seemed to be ok. But whenever i run declude.exe in the imail directory from the Command prompt it just says first time running installing. the diag show it sees all cfg files ok. ver 1.81. email flowing but tones of junk coming in. help Cheers Mark p.s. been up since 7:30am yesterday straight, sorry for the choppy email, thank god for spell check --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help-Reinstall Urgent
Another user had the same problem you are mentions a couple of weeks back - http://www.mail-archive.com/declude.junkmail@declude.com/msg26103.html The user kept running declude.exe until it worked. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Orillia ProNet Administration writes: hello all. had a meltdown yesterday. Need help. have imail back and working, 815hf2. I restored data from backup, all is well. when i reinstalled and restored declude, it seemed to be ok. But whenever i run declude.exe in the imail directory from the Command prompt it just says first time running installing. the diag show it sees all cfg files ok. ver 1.81. email flowing but tones of junk coming in. help Cheers Mark p.s. been up since 7:30am yesterday straight, sorry for the choppy email, thank god for spell check --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help-Reinstall Urgent
Did you check that declude.exe is the mail transport for imail? Just replace smtp32.exe with declude.exe. You will need to stop/start imail. I had that problem too with declude's error message. I just ran it a few times and it just went away on it's own. Then, check the headers of a test email to see if you see declude inserts. Travis - Original Message - From: Orillia ProNet Administration [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, November 07, 2005 7:17 AM Subject: [Declude.JunkMail] Help-Reinstall Urgent hello all. had a meltdown yesterday. Need help. have imail back and working, 815hf2. I restored data from backup, all is well. when i reinstalled and restored declude, it seemed to be ok. But whenever i run declude.exe in the imail directory from the Command prompt it just says first time running installing. the diag show it sees all cfg files ok. ver 1.81. email flowing but tones of junk coming in. help Cheers Mark p.s. been up since 7:30am yesterday straight, sorry for the choppy email, thank god for spell check --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Scott, I agree, unfortunately I do not have that information at present, I have requested this information from the engineers and will post it a soon as this is available. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 5:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Re: [Declude.JunkMail] Help in creating a Filter
Thanks David. It's good to have you monitoring the list. - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, September 19, 2005 10:26 AM Subject: RE: [Declude.JunkMail] Help in creating a Filter Scott, I agree, unfortunately I do not have that information at present, I have requested this information from the engineers and will post it a soon as this is available. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 5:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail
RE: [Declude.JunkMail] Help in creating a Filter
Erik, I have also asked the engineers to look into this for us, ie. A directive to force tests to run in a specific order. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Saturday, September 17, 2005 5:34 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help in creating a Filter It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Wow, that would be great! :-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, September 19, 2005 9:38 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help in creating a Filter Erik, I have also asked the engineers to look into this for us, ie. A directive to force tests to run in a specific order. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Saturday, September 17, 2005 5:34 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help in creating a Filter It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Title: Message Thanks Matt. The variable %COUNTRIES% does not pass to a parm line; nor does %COUNTRY%. But, I've noticed in our config file, we do not have a country test; but I thought this was internal to Declude? Is this what I need to add to my config? At one point we did have this in our config as we still have the ALL_LIST.DAT file. http://support.declude.com/Customer/KBArticle.aspx?articleid=6KBSearchID=1012 I want to be able to detect multiple countries and pass that to our external program. But as Scott mentioned, externals are ran before filters. Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Saturday, September 17, 2005 4:10 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help in creating a FilterErik,Flexibility is a nice thing, but this isn't really practical to do for Declude without a major, major rewrite.The better approach would be to actually introduce the ability to use operators and variables in custom filters so that the exact order didn't matter. That would also be a rather involved new feature, but it would seem more practical and would have a greater overall utility. I'm sure if time wasn't an issue and there weren't more pressing things, they would have leaped to provide this a long time ago.As far as your specific need, some of this could be written in _vbscript_ as an external test in Declude. Note that %COUNTRIES% is definitely preferable to %COUNTRYCHAIN% as the data used for %COUNTRIES% is updated more often if I am not mistaken. The two letter country codes in standardized format are also preferable for filtering. You can then combo a single test with the others and probably have no concern about the order of tests that you can't easily overcome.MattErik wrote: It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help in creating a Filter
Title: Message Erik, The all_list.dat file is required for testing COUNTRIES in a filter file. If you have determined that %COUNTRIES% is not passed to external tests and you have an all_list.dat, that would indicate that Declude doesn't populate that value or expose it to external tests. Not all such variables are available when external tests run, and I am not aware of a list of what is and isn't, but I know that things like %REVDNS%, %REMOTEIP%, %HELO%, %MAILFROM% and %WEIGHT% are. In the case of %WEIGHT% this is something that was enabled after it was asked for, and I would imagine that the %COUNTRIES% variable could also be populated before running external tests. As far as test order goes, I would too like to run external tests sometimes after custom filters, but I also desire to run them before as well, so if Declude does allow for changing the order, maybe they could just simply add an after-filter external program call so you could have them both. It would seem that almost all of the utility in running tests in a customized order would be to have some external tests run after custom filters, and instead of allowing us to rearrange things, it would make sense to just allow us to run external tests before and after custom filters and call it a day. The utility that I see in running tests after everything else would be to create specific external tests that could handle messages in different ways. One way for instance would be to run a test last and if the message was good and looked like personal E-mail, the external test could log the IP and Mail From somewhere and you could use that information for crediting weight on future messages from the same person. You could do the same thing with bad E-mail and build a blacklist. I personally would definitely make use of that functionality, but I wouldn't want to run all external tests last since some of them are deeply important for adding on points and most spam reaches my delete weight before custom filters are run and that saves on processing power when using SKIPIFWEIGHT or STOPALLTESTS. Matt Erik wrote: Thanks Matt. The variable %COUNTRIES% does not pass to a parm line; nor does %COUNTRY%. But, I've noticed in our config file, we do not have a country test; but I thought this was internal to Declude? Is this what I need to add to my config? At one point we did have this in our config as we still have the ALL_LIST.DAT file. http://support.declude.com/Customer/KBArticle.aspx?articleid=6KBSearchID=1012 I want to be able to detect multiple countries and pass that to our external program. But as Scott mentioned, externals are ran before filters. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Saturday, September 17, 2005 4:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik, Flexibility is a nice thing, but this isn't really practical to do for Declude without a major, major rewrite. The better approach would be to actually introduce the ability to use operators and variables in custom filters so that the exact order didn't matter. That would also be a rather involved new feature, but it would seem more practical and would have a greater overall utility. I'm sure if time wasn't an issue and there weren't more pressing things, they would have leaped to provide this a long time ago. As far as your specific need, some of this could be written in _vbscript_ as an external test in Declude. Note that %COUNTRIES% is definitely preferable to %COUNTRYCHAIN% as the data used for %COUNTRIES% is updated more often if I am not mistaken. The two letter country codes in standardized format are also preferable for filtering. You can then combo a single test with the others and probably have no concern about the order of tests that you can't easily overcome. Matt Erik wrote: It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail
RE: [Declude.JunkMail] Help in creating a Filter
From our testing of our new external program, you are right. The external program is being called before our combo filter is being triggered. And the %COUNTRYCHAIN% variable is blank. So this variable is probably being created after Declude is done processing all tests. Now, using %COUNTRY% or %COUNTRIES% returns [UNKNOWN VAR]. It would be nice if an external can be called AFTER all other tests; ordering by how it is in the config file. There is nothing in the manual about %COUNTRYCHAIN% or COUNTRY or COUNTRIES. The only mention of this is in the release notes posted; which was added in version 1.62 in November 2002. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 3:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Re: [Declude.JunkMail] Help in creating a Filter
I believe the order is: IP4R RHSBL, Declude Internal, spamdomains, Extermal, Fromfile, IPFile, Filter Within the filters type the filters are run in the order listed in the global.cfg - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, September 17, 2005 2:05 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter From our testing of our new external program, you are right. The external program is being called before our combo filter is being triggered. And the %COUNTRYCHAIN% variable is blank. So this variable is probably being created after Declude is done processing all tests. Now, using %COUNTRY% or %COUNTRIES% returns [UNKNOWN VAR]. It would be nice if an external can be called AFTER all other tests; ordering by how it is in the config file. There is nothing in the manual about %COUNTRYCHAIN% or COUNTRY or COUNTRIES. The only mention of this is in the release notes posted; which was added in version 1.62 in November 2002. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 3:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail
RE: [Declude.JunkMail] Help in creating a Filter
If Declude could confirm the order of how/which tests are run, it would be nice to know. As far as reading our combo filter of failed tests (%TESTSFAILED%), we can read/code that from our combo filter file (same file that declude is reading) and do our own tests failed combo (since Declude isn't doing this at the point our external program is called; as per our order in the Config file). But, we still need to know the country chain; of which is not passed to our external program... %COUNTRYCHAIN% passes a NULL value. Without knowing the country chain, this program will not work. Upon looking at our CONFIG file for Declude, we do not use any COUNTRY or COUNTRIES test (in the past I believe we did). Do you know if this needs to be in the default config file or is it internal to Declude? Thanks Scott for the thread. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Saturday, September 17, 2005 2:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I believe the order is: IP4R RHSBL, Declude Internal, spamdomains, Extermal, Fromfile, IPFile, Filter Within the filters type the filters are run in the order listed in the global.cfg - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, September 17, 2005 2:05 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter From our testing of our new external program, you are right. The external program is being called before our combo filter is being triggered. And the %COUNTRYCHAIN% variable is blank. So this variable is probably being created after Declude is done processing all tests. Now, using %COUNTRY% or %COUNTRIES% returns [UNKNOWN VAR]. It would be nice if an external can be called AFTER all other tests; ordering by how it is in the config file. There is nothing in the manual about %COUNTRYCHAIN% or COUNTRY or COUNTRIES. The only mention of this is in the release notes posted; which was added in version 1.62 in November 2002. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 3:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe
Re: [Declude.JunkMail] Help in creating a Filter
Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help in creating a Filter
Erik, Flexibility is a nice thing, but this isn't really practical to do for Declude without a major, major rewrite. The better approach would be to actually introduce the ability to use operators and variables in custom filters so that the exact order didn't matter. That would also be a rather involved new feature, but it would seem more practical and would have a greater overall utility. I'm sure if time wasn't an issue and there weren't more pressing things, they would have leaped to provide this a long time ago. As far as your specific need, some of this could be written in _vbscript_ as an external test in Declude. Note that %COUNTRIES% is definitely preferable to %COUNTRYCHAIN% as the data used for %COUNTRIES% is updated more often if I am not mistaken. The two letter country codes in standardized format are also preferable for filtering. You can then combo a single test with the others and probably have no concern about the order of tests that you can't easily overcome. Matt Erik wrote: It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help in creating a Filter
One more comment. The country processing won't occur unless you have the all_list.dat file in the declude folder. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, September 17, 2005 3:42 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter If Declude could confirm the order of how/which tests are run, it would be nice to know. As far as reading our combo filter of failed tests (%TESTSFAILED%), we can read/code that from our combo filter file (same file that declude is reading) and do our own tests failed combo (since Declude isn't doing this at the point our external program is called; as per our order in the Config file). But, we still need to know the country chain; of which is not passed to our external program... %COUNTRYCHAIN% passes a NULL value. Without knowing the country chain, this program will not work. Upon looking at our CONFIG file for Declude, we do not use any COUNTRY or COUNTRIES test (in the past I believe we did). Do you know if this needs to be in the default config file or is it internal to Declude? Thanks Scott for the thread. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Saturday, September 17, 2005 2:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I believe the order is: IP4R RHSBL, Declude Internal, spamdomains, Extermal, Fromfile, IPFile, Filter Within the filters type the filters are run in the order listed in the global.cfg - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, September 17, 2005 2:05 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter From our testing of our new external program, you are right. The external program is being called before our combo filter is being triggered. And the %COUNTRYCHAIN% variable is blank. So this variable is probably being created after Declude is done processing all tests. Now, using %COUNTRY% or %COUNTRIES% returns [UNKNOWN VAR]. It would be nice if an external can be called AFTER all other tests; ordering by how it is in the config file. There is nothing in the manual about %COUNTRYCHAIN% or COUNTRY or COUNTRIES. The only mention of this is in the release notes posted; which was added in version 1.62 in November 2002. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 3:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas
RE: [Declude.JunkMail] Help in creating a Filter
That we do have. ;-) But it appears the %COUNTRYCHAIN% doesn't register with Declude until all other tests have been run (filters and external calls). Declude does not pass this to a command line. We've re-coded our external program to read the combo filter; since declude doesn't read it before hand (per our ordering of tests in the config file). But the problem remains of determining of how the email was received based on bounces from countries. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Saturday, September 17, 2005 10:08 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter One more comment. The country processing won't occur unless you have the all_list.dat file in the declude folder. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, September 17, 2005 3:42 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter If Declude could confirm the order of how/which tests are run, it would be nice to know. As far as reading our combo filter of failed tests (%TESTSFAILED%), we can read/code that from our combo filter file (same file that declude is reading) and do our own tests failed combo (since Declude isn't doing this at the point our external program is called; as per our order in the Config file). But, we still need to know the country chain; of which is not passed to our external program... %COUNTRYCHAIN% passes a NULL value. Without knowing the country chain, this program will not work. Upon looking at our CONFIG file for Declude, we do not use any COUNTRY or COUNTRIES test (in the past I believe we did). Do you know if this needs to be in the default config file or is it internal to Declude? Thanks Scott for the thread. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Saturday, September 17, 2005 2:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I believe the order is: IP4R RHSBL, Declude Internal, spamdomains, Extermal, Fromfile, IPFile, Filter Within the filters type the filters are run in the order listed in the global.cfg - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Saturday, September 17, 2005 2:05 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter From our testing of our new external program, you are right. The external program is being called before our combo filter is being triggered. And the %COUNTRYCHAIN% variable is blank. So this variable is probably being created after Declude is done processing all tests. Now, using %COUNTRY% or %COUNTRIES% returns [UNKNOWN VAR]. It would be nice if an external can be called AFTER all other tests; ordering by how it is in the config file. There is nothing in the manual about %COUNTRYCHAIN% or COUNTRY or COUNTRIES. The only mention of this is in the release notes posted; which was added in version 1.62 in November 2002. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 3:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's
Re: [Declude.JunkMail] Help in creating a Filter
I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Can the %COUNTRYCHAIN% variable be used instead of %COUNTRIES%? Right about be careful... But the MN-COMBO is a mix of 3 to 5 TESTSFAILED combos already. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 12:57 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help in creating a Filter
I don't believe so. I think you have COUNTRY and COUNTRIES. COUNTRY is the last counry in the country chain. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 2:07 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter Can the %COUNTRYCHAIN% variable be used instead of %COUNTRIES%? Right about be careful... But the MN-COMBO is a mix of 3 to 5 TESTSFAILED combos already. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 12:57 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help in creating a Filter
Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help in creating a Filter
Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. It should be - at this point any variable I have messed with has been passable to an external test. Darrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help in creating a Filter
I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help with Whitelisting
Title: Help with Whitelisting Wouldn't mywhitelist entryalso whitelist all senders from .msssupport.microsoft.com and any subdomains of mssupport.microsoft.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Tuesday, August 30, 2005 8:43 AMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help with Whitelisting Because the mail is from @mssupport.microsoft.com, but you're not whitelisting @mssupport.microsoft.com, you're whitelisting .mssupport.microsoft.com. Darin. - Original Message - From: Agid, Corby To: Declude.JunkMail@declude.com Sent: Tuesday, August 30, 2005 11:25 AM Subject: [Declude.JunkMail] Help with Whitelisting Hello, I am attempting to whitelist a couple of sending domains, but my whitelisting doesn't seem to work. I'm including the headers and the corresponding entries from my whitelist. Please help me figure out why the messages are not getting whitelisted. Thanks. From renowhitelist.txt: .mssupport.microsoft.com --- Tests Failed: NOABUSE, HELOBOGUS, REVDNS, MS-CLEAN, WEIGHT10-29A, WEIGHT10-29B, SPAMYELLOW Weight: 10 HeaderCode: f ReverseDNS: [No Reverse DNS] RemoteIP: 202.81.131.9 Testname: WEIGHT10-29B MessageID: [EMAIL PROTECTED] Quename: D474f02e9020cffd6.SMD Sniffer: Headers: Received: from ms-wsm-msg1.MSDSWSM.COM [202.81.131.9] by msx.renoairport.com with ESMTP (SMTPD32-8.15) id A7502E9020C; Mon, 29 Aug 2005 10:35:12 -0700 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_=_NextPart_001_01C5ACC1.25041D5A" Subject: RE: Closing mail : SRX050816603115 X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 Date: Mon, 29 Aug 2005 23:13:19 +0530 Message-ID: [EMAIL PROTECTED] X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Closing mail : SRX050816603115 Thread-Index: AcWH42yU5spqXKmdT2SFj3JlHN81+QAAAw8AAAKO3KAAAF67wAAAPBCgAABWr8AAAKtXgAABfjGgAfd5tMACB6hhgACEslFwAAAjXBAB8+e5EAAGmGcQACEWNuAAAD7YIAA7yIlQATn9IHAAYCLqgAAwv7pwAIb+C9AAA/XrQA== From: "Randeep S. Arora" [EMAIL PROTECTED] To: "Agid, Corby" [EMAIL PROTECTED]
Re: [Declude.JunkMail] Help with Whitelisting
Title: Help with Whitelisting Almost. Your entry would match anything that ends with ".mssupport.microsoft.com", but since "@mssupport.microsoft.com" does not contain the leading period, it doesn't match. In your case, you probably want two lines .mssupport.microsoft.com @mssupport.microsoft.com Darin. - Original Message - From: Agid, Corby To: Declude.JunkMail@declude.com Sent: Tuesday, August 30, 2005 12:02 PM Subject: RE: [Declude.JunkMail] Help with Whitelisting Wouldn't mywhitelist entryalso whitelist all senders from .msssupport.microsoft.com and any subdomains of mssupport.microsoft.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin CoxSent: Tuesday, August 30, 2005 8:43 AMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help with Whitelisting Because the mail is from @mssupport.microsoft.com, but you're not whitelisting @mssupport.microsoft.com, you're whitelisting .mssupport.microsoft.com. Darin. - Original Message - From: Agid, Corby To: Declude.JunkMail@declude.com Sent: Tuesday, August 30, 2005 11:25 AM Subject: [Declude.JunkMail] Help with Whitelisting Hello, I am attempting to whitelist a couple of sending domains, but my whitelisting doesn't seem to work. I'm including the headers and the corresponding entries from my whitelist. Please help me figure out why the messages are not getting whitelisted. Thanks. From renowhitelist.txt: .mssupport.microsoft.com --- Tests Failed: NOABUSE, HELOBOGUS, REVDNS, MS-CLEAN, WEIGHT10-29A, WEIGHT10-29B, SPAMYELLOW Weight: 10 HeaderCode: f ReverseDNS: [No Reverse DNS] RemoteIP: 202.81.131.9 Testname: WEIGHT10-29B MessageID: [EMAIL PROTECTED] Quename: D474f02e9020cffd6.SMD Sniffer: Headers: Received: from ms-wsm-msg1.MSDSWSM.COM [202.81.131.9] by msx.renoairport.com with ESMTP (SMTPD32-8.15) id A7502E9020C; Mon, 29 Aug 2005 10:35:12 -0700 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_=_NextPart_001_01C5ACC1.25041D5A" Subject: RE: Closing mail : SRX050816603115 X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 Date: Mon, 29 Aug 2005 23:13:19 +0530 Message-ID: [EMAIL PROTECTED] X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Closing mail : SRX050816603115 Thread-Index: AcWH42yU5spqXKmdT2SFj3JlHN81+QAAAw8AAAKO3KAAAF67wAAAPBCgAABWr8AAAKtXgAABfjGgAfd5tMACB6hhgACEslFwAAAjXBAB8+e5EAAGmGcQACEWNuAAAD7YIAA7yIlQATn9IHAAYCLqgAAwv7pwAIb+C9AAA/XrQA== From: "Randeep S. Arora" [EMAIL PROTECTED] To: "Agid, Corby" [EMAIL PROTECTED]
RE: [Declude.JunkMail] Help with Whitelisting
Title: Help with Whitelisting
That's what I would have thought, but the manual is a
bit confusing. Here's from the
manual:
=
"The
D:\{MAILSERVER}\Declude\mywhitelist.txt file would then contain either
one E-mail address ("[EMAIL PROTECTED]") or domain ("@example.com") or subdomain
(".example.com") per line. The whitelist files can have unlimited entries in
them."
==
So, I would have thought the leading period would imply
all messages from [EMAIL PROTECTED] as
well as [EMAIL PROTECTED]
My support case with Microsoft is closed, so
unfortunately I don't expect anymore mail from them, but I do want to correctly
understand how to whitelist them.
BTW, does it seem unusual that MS support's reverse DNS
seems to be misconfigured?
Thank you for your help
Darin
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Darin CoxSent: Tuesday, August 30, 2005 9:10
AMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Help with Whitelisting
Almost. Your entry would match anything
that ends with ".mssupport.microsoft.com", but since "@mssupport.microsoft.com" does
not contain the leading period, it doesn't match.
In your case, you probably want two
lines
.mssupport.microsoft.com
@mssupport.microsoft.com
Darin.
- Original Message -
From: Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 12:02 PM
Subject: RE: [Declude.JunkMail] Help with Whitelisting
Wouldn't mywhitelist entryalso whitelist all
senders from .msssupport.microsoft.com and any subdomains of
mssupport.microsoft.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin
CoxSent: Tuesday, August 30, 2005 8:43 AMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] Help with Whitelisting
Because the mail is from
@mssupport.microsoft.com, but you're not whitelisting
@mssupport.microsoft.com, you're whitelisting
.mssupport.microsoft.com.
Darin.
- Original Message -
From: Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 11:25 AM
Subject: [Declude.JunkMail] Help with Whitelisting
Hello,
I am attempting to whitelist a couple of sending
domains, but my whitelisting doesn't seem to work. I'm including
the headers and the corresponding entries from my
whitelist. Please help me figure out why the messages are not
getting whitelisted.
Thanks.
From renowhitelist.txt: .mssupport.microsoft.com ---
Tests Failed: NOABUSE,
HELOBOGUS, REVDNS, MS-CLEAN, WEIGHT10-29A, WEIGHT10-29B, SPAMYELLOW
Weight:
10 HeaderCode: f
ReverseDNS: [No
Reverse DNS] RemoteIP: 202.81.131.9
Testname: WEIGHT10-29B
MessageID:
[EMAIL PROTECTED]
Quename:
D474f02e9020cffd6.SMD Sniffer:
Headers: Received: from
ms-wsm-msg1.MSDSWSM.COM [202.81.131.9] by msx.renoairport.com with
ESMTP (SMTPD32-8.15) id
A7502E9020C; Mon, 29 Aug 2005 10:35:12 -0700 content-class: urn:content-classes:message
MIME-Version: 1.0 Content-Type: multipart/alternative;
boundary="_=_NextPart_001_01C5ACC1.25041D5A" Subject: RE: Closing mail : SRX050816603115
X-MimeOLE: Produced By Microsoft
Exchange V6.0.6603.0 Date: Mon,
29 Aug 2005 23:13:19 +0530 Message-ID:
[EMAIL PROTECTED]
X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Closing mail :
SRX050816603115 Thread-Index:
AcWH42yU5spqXKmdT2SFj3JlHN81+QAAAw8AAAKO3KAAAF67wAAAPBCgAABWr8AAAKtXgAABfjGgAfd5tMACB6hhgACEslFwAAAjXBAB8+e5EAAGmGcQACEWNuAAAD7YIAA7yIlQATn9IHAAYCLqgAAwv7pwAIb+C9AAA/XrQA==
From: "Randeep S. Arora"
[EMAIL PROTECTED] To: "Agid, Corby" [EMAIL PROTECTED]
RE: [Declude.JunkMail] Help with Whitelisting
Title: Help with Whitelisting
Yes, it would help if the manual added something
like:
"The line you create in the whitelist text file will be
usedin a text matchto the MAILFROM address ofeach message that
is received".
That's already wordy and doesn't mention that the match is
a right-hand-side match, but the lack of a description makes it a FAQ on this
mailing list.
Andrew 8)
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Agid,
CorbySent: Tuesday, August 30, 2005 12:28 PMTo:
Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Help
with Whitelisting
That's what I would have thought, but the manual is a
bit confusing. Here's from the manual:
=
"The
D:\{MAILSERVER}\Declude\mywhitelist.txt file would then contain either
one E-mail address ("[EMAIL PROTECTED]") or domain ("@example.com") or
subdomain (".example.com") per line. The whitelist files can have unlimited
entries in them."
==
So, I would have thought the leading period would
imply all messages from [EMAIL PROTECTED]
as well as [EMAIL PROTECTED]
My support case with Microsoft is closed, so
unfortunately I don't expect anymore mail from them, but I do want to
correctly understand how to whitelist them.
BTW, does it seem unusual that MS support's reverse
DNS seems to be misconfigured?
Thank you for your help
Darin
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Darin CoxSent: Tuesday, August 30, 2005 9:10
AMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Help with Whitelisting
Almost. Your entry would match anything
that ends with ".mssupport.microsoft.com", but since "@mssupport.microsoft.com"
does not contain the leading period, it doesn't match.
In your case, you probably want two
lines
.mssupport.microsoft.com
@mssupport.microsoft.com
Darin.
- Original Message -
From: Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 12:02 PM
Subject: RE: [Declude.JunkMail] Help with
Whitelisting
Wouldn't mywhitelist entryalso whitelist
all senders from .msssupport.microsoft.com and any subdomains of
mssupport.microsoft.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin
CoxSent: Tuesday, August 30, 2005 8:43 AMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] Help with Whitelisting
Because the mail is from
@mssupport.microsoft.com, but you're not whitelisting
@mssupport.microsoft.com, you're whitelisting
.mssupport.microsoft.com.
Darin.
- Original Message -
From: Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 11:25 AM
Subject: [Declude.JunkMail] Help with Whitelisting
Hello,
I am attempting to whitelist a couple of
sending domains, but my whitelisting doesn't seem to work. I'm
including the headers and the corresponding entries from my
whitelist. Please help me figure out why the messages are not
getting whitelisted.
Thanks.
From renowhitelist.txt: .mssupport.microsoft.com ---
Tests Failed: NOABUSE,
HELOBOGUS, REVDNS, MS-CLEAN, WEIGHT10-29A, WEIGHT10-29B, SPAMYELLOW
Weight:
10 HeaderCode: f
ReverseDNS:
[No Reverse DNS] RemoteIP: 202.81.131.9
Testname: WEIGHT10-29B
MessageID:
[EMAIL PROTECTED]
Quename:
D474f02e9020cffd6.SMD Sniffer:
Headers: Received: from
ms-wsm-msg1.MSDSWSM.COM [202.81.131.9] by msx.renoairport.com with
ESMTP (SMTPD32-8.15) id
A7502E9020C; Mon, 29 Aug 2005 10:35:12 -0700 content-class:
urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative;
boundary="_=_NextPart_001_01C5ACC1.25041D5A" Subject: RE: Closing mail :
SRX050816603115 X-MimeOLE:
Produced By Microsoft Exchange V6.0.6603.0 Date: Mon, 29 Aug 2005 23:13:19 +0530
Message-ID:
[EMAIL PROTECTED]
X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Closing mail :
SRX050816603115 Thread-Index:
AcWH42yU5spqXKmdT2SFj3JlHN81+QAAAw8AAAKO3KAAAF67wAAAPBCgAABWr8AAAKtXgAABfjGgAfd5tMACB6hhgACEslFwAAAjXBAB8+e5EAAGmGcQACEWNuAAAD7YIAA7yIlQATn9IHAAYCLqgAAwv7pwAIb+C9AAA/XrQA==
From: "Randeep S. Arora"
[EMAIL PROTECTED] To: "Agid, Corby"
[EMAIL PROTECTED]
Re: [Declude.JunkMail] Help with Whitelisting
Title: Help with Whitelisting
All it's saying isto putone entry per
line, and the available entry formats are the three described.
Not surprising that MS may have reverse DNS
misconfigured, but whatleads youto believeit is?
Darin.
- Original Message -
From: Agid, Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 3:28 PM
Subject: RE: [Declude.JunkMail] Help with Whitelisting
That's what I would have thought, but the manual is a
bit confusing. Here's from the manual:
=
"The
D:\{MAILSERVER}\Declude\mywhitelist.txt file would then contain either
one E-mail address ("[EMAIL PROTECTED]") or
domain ("@example.com") or subdomain (".example.com") per line. The whitelist
files can have unlimited entries in them."
==
So, I would have thought the leading period would imply
all messages from [EMAIL PROTECTED] as
well as [EMAIL PROTECTED]
My support case with Microsoft is closed, so
unfortunately I don't expect anymore mail from them, but I do want to correctly
understand how to whitelist them.
BTW, does it seem unusual that MS support's reverse DNS
seems to be misconfigured?
Thank you for your help
Darin
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Darin CoxSent: Tuesday, August 30, 2005 9:10
AMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Help with Whitelisting
Almost. Your entry would match anything
that ends with ".mssupport.microsoft.com", but since "@mssupport.microsoft.com" does
not contain the leading period, it doesn't match.
In your case, you probably want two
lines
.mssupport.microsoft.com
@mssupport.microsoft.com
Darin.
- Original Message -
From: Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 12:02 PM
Subject: RE: [Declude.JunkMail] Help with Whitelisting
Wouldn't mywhitelist entryalso whitelist all
senders from .msssupport.microsoft.com and any subdomains of
mssupport.microsoft.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darin
CoxSent: Tuesday, August 30, 2005 8:43 AMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] Help with Whitelisting
Because the mail is from
@mssupport.microsoft.com, but you're not whitelisting
@mssupport.microsoft.com, you're whitelisting
.mssupport.microsoft.com.
Darin.
- Original Message -
From: Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 11:25 AM
Subject: [Declude.JunkMail] Help with Whitelisting
Hello,
I am attempting to whitelist a couple of sending
domains, but my whitelisting doesn't seem to work. I'm including
the headers and the corresponding entries from my
whitelist. Please help me figure out why the messages are not
getting whitelisted.
Thanks.
From renowhitelist.txt: .mssupport.microsoft.com ---
Tests Failed: NOABUSE,
HELOBOGUS, REVDNS, MS-CLEAN, WEIGHT10-29A, WEIGHT10-29B, SPAMYELLOW
Weight:
10 HeaderCode: f
ReverseDNS: [No
Reverse DNS] RemoteIP: 202.81.131.9
Testname: WEIGHT10-29B
MessageID:
[EMAIL PROTECTED]
Quename:
D474f02e9020cffd6.SMD Sniffer:
Headers: Received: from
ms-wsm-msg1.MSDSWSM.COM [202.81.131.9] by msx.renoairport.com with
ESMTP (SMTPD32-8.15) id
A7502E9020C; Mon, 29 Aug 2005 10:35:12 -0700 content-class: urn:content-classes:message
MIME-Version: 1.0 Content-Type: multipart/alternative;
boundary="_=_NextPart_001_01C5ACC1.25041D5A" Subject: RE: Closing mail : SRX050816603115
X-MimeOLE: Produced By Microsoft
Exchange V6.0.6603.0 Date: Mon,
29 Aug 2005 23:13:19 +0530 Message-ID:
[EMAIL PROTECTED]
X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Closing mail :
SRX050816603115 Thread-Index:
AcWH42yU5spqXKmdT2SFj3JlHN81+QAAAw8AAAKO3KAAAF67wAAAPBCgAABWr8AAAKtXgAABfjGgAfd5tMACB6hhgACEslFwAAAjXBAB8+e5EAAGmGcQACEWNuAAAD7YIAA7yIlQATn9IHAAYCLqgAAwv7pwAIb+C9AAA/XrQA==
From: "Randeep S. Arora"
[EMAIL PROTECTED] To: "Agid, Corby" [EMAIL PROTECTED]
Re: [Declude.JunkMail] Help with Whitelisting
Title: Help with Whitelisting
Microsoft outsourced much of their support to China and India (the
source of this message), and finding a reverse DNS entry in these
countries is like finding a peace activist at a Ted Nugent concert.
Matt
Agid, Corby wrote:
The orginal reason for my
posting was that messages I received from mssupport.microsoft.com were
getting caught in my filter because, among other things, the sending
server had no reverse dns. My headers and diagnostic are at the very
bottom of this posting. I have similar problems with other companies,
but would have thought MS would have reverse DNS set properly.
Thanks for your help.
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Darin
Cox
Sent: Tuesday, August 30, 2005 1:02 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help with Whitelisting
All it's saying isto putone
entry per line, and the available entry formats are the three described.
Not surprising that MS may have
reverse DNS misconfigured, but whatleads youto believeit is?
Darin.
-
Original Message -
From:
Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 3:28 PM
Subject: RE: [Declude.JunkMail] Help with Whitelisting
That's what I would have thought, but the
manual is a bit confusing. Here's from the manual:
=
"The D:\{MAILSERVER}\Declude\mywhitelist.txt
file would then contain either one E-mail address ("[EMAIL PROTECTED]") or domain
("@example.com") or subdomain (".example.com") per line. The whitelist
files can have unlimited entries in them."
==
So, I
would have thought the leading period would imply all messages from [EMAIL PROTECTED]
as well as [EMAIL PROTECTED]
My
support case with Microsoft is closed, so unfortunately I don't expect
anymore mail from them, but I do want to correctly understand how to
whitelist them.
BTW,
does it seem unusual that MS support's reverse DNS seems to be
misconfigured?
Thank
you for your help Darin
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Darin
Cox
Sent: Tuesday, August 30, 2005 9:10 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help with Whitelisting
Almost. Your entry would match
anything that ends with ".mssupport.microsoft.com", but since
"@mssupport.microsoft.com" does not contain the leading period, it
doesn't match.
In your case, you probably want
two lines
.mssupport.microsoft.com
@mssupport.microsoft.com
Darin.
-
Original Message -
From:
Agid, Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 12:02 PM
Subject: RE: [Declude.JunkMail] Help with Whitelisting
Wouldn't mywhitelist entryalso
whitelist all senders from .msssupport.microsoft.com and any subdomains
of mssupport.microsoft.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Darin
Cox
Sent: Tuesday, August 30, 2005 8:43 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help with Whitelisting
Because the mail is from
@mssupport.microsoft.com, but you're not whitelisting
@mssupport.microsoft.com, you're whitelisting .mssupport.microsoft.com.
Darin.
-
Original Message -
From:
Agid, Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 11:25 AM
Subject: [Declude.JunkMail] Help with Whitelisting
Hello,
I am attempting to whitelist a
couple of sending domains, but my whitelisting doesn't seem to work.
I'm including the headers and the corresponding entries from my
whitelist. Please help me figure out why the messages are not getting
whitelisted.
Thanks.
From renowhitelist.txt:
.mssupport.microsoft.com
---
Tests Failed: NOABUSE,
HELOBOGUS, REVDNS, MS-CLEAN, WEIGHT10-29A, WEIGHT10-29B, SPAMYELLOW
Weight: 10
HeaderCode: f
ReverseDNS: [No Reverse
DNS]
RemoteIP: 202.81.131.9
Testname: WEIGHT10-29B
MessageID:
[EMAIL PROTECTED]
Quename:
D474f02e9020cffd6.SMD
Sniffer:
Headers: Received: from
ms-wsm-msg1.MSDSWSM.COM [202.81.131.9] by msx.renoairport.com with ESMTP
(SMTPD32-8.15) id
A7502E9020C; Mon, 29 Aug 2005 10:35:12 -0700
content-class:
urn:content-classes:message
MIME-Version:
RE: [Declude.JunkMail] Help with Whitelisting
Title: Help with Whitelisting
ha!
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
MattSent: Tuesday, August 30, 2005 1:45 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help
with Whitelisting
Microsoft outsourced much of their support to China and India (the
source of this message), and finding a reverse DNS entry in these countries is
like finding a peace activist at a Ted Nugent
concert.MattAgid, Corby wrote:
The orginal reason for my posting was that messages
I received from mssupport.microsoft.com were getting caught in my filter
because, among other things, the sending server had no reverse dns. My
headers and diagnostic are at the very bottom of this posting. I
have similar problems with other companies, but would have thought MS
would have reverse DNS set properly.
Thanks for your help.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Darin CoxSent: Tuesday, August 30, 2005
1:02 PMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] Help with Whitelisting
All it's saying isto putone entry
per line, and the available entry formats are the three
described.
Not surprising that MS may have reverse DNS
misconfigured, but whatleads youto believeit
is?
Darin.
-
Original Message -
From:
Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 3:28 PM
Subject: RE: [Declude.JunkMail] Help with
Whitelisting
That's what I would have thought, but the manual
is a bit confusing. Here's from the
manual:
=
"The
D:\{MAILSERVER}\Declude\mywhitelist.txt file would then contain
either one E-mail address ("[EMAIL PROTECTED]") or domain
("@example.com") or subdomain (".example.com") per line. The whitelist
files can have unlimited entries in them."
==
So, I would have thought the leading
period would imply all messages from [EMAIL PROTECTED]
as well as [EMAIL PROTECTED]
My support case with Microsoft is
closed, so unfortunately I don't expect anymore mail from them, but I do
want to correctly understand how to whitelist
them.
BTW, does it seem unusual that MS
support's reverse DNS seems to be
misconfigured?
Thank you for your help
Darin
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Darin CoxSent: Tuesday, August 30, 2005
9:10 AMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] Help with Whitelisting
Almost. Your entry would match
anything that ends with ".mssupport.microsoft.com", but since
"@mssupport.microsoft.com" does not contain the leading period, it
doesn't match.
In your case, you probably want two
lines
.mssupport.microsoft.com
@mssupport.microsoft.com
Darin.
-
Original Message -
From:
Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 12:02 PM
Subject: RE: [Declude.JunkMail] Help with
Whitelisting
Wouldn't mywhitelist entryalso
whitelist all senders from .msssupport.microsoft.com and any subdomains
of mssupport.microsoft.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Darin CoxSent: Tuesday, August 30, 2005
8:43 AMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] Help with Whitelisting
Because the mail is from
@mssupport.microsoft.com, but you're not whitelisting
@mssupport.microsoft.com, you're whitelisting
.mssupport.microsoft.com.
Darin.
-
Original Message -
From:
Agid, Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 11:25 AM
Subject: [Declude.JunkMail] Help with
Whitelisting
Hello,
I am attempting to whitelist a couple of
sending domains, but my whitelisting doesn't seem to work.
I'm including the headers and the corresponding entries from my
whitelist. Please help me figure out why the messages are
not getting whitelisted.
Thanks.
From renowhitelist.txt: .mssupport.microsoft.com ---
Tests Failed: NOABUSE,
RE: [Declude.JunkMail] Help with Whitelisting
Title: Help with Whitelisting
Great, thanks Matt.
Now I've got Cat Scratch Fever!
Andrew 8)
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
MattSent: Tuesday, August 30, 2005 1:45 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help
with Whitelisting
Microsoft outsourced much of their support to China and India (the
source of this message), and finding a reverse DNS entry in these countries is
like finding a peace activist at a Ted Nugent
concert.MattAgid, Corby wrote:
The orginal reason for my posting was that messages
I received from mssupport.microsoft.com were getting caught in my filter
because, among other things, the sending server had no reverse dns. My
headers and diagnostic are at the very bottom of this posting. I
have similar problems with other companies, but would have thought MS
would have reverse DNS set properly.
Thanks for your help.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Darin CoxSent: Tuesday, August 30, 2005
1:02 PMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] Help with Whitelisting
All it's saying isto putone entry
per line, and the available entry formats are the three
described.
Not surprising that MS may have reverse DNS
misconfigured, but whatleads youto believeit
is?
Darin.
-
Original Message -
From:
Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 3:28 PM
Subject: RE: [Declude.JunkMail] Help with
Whitelisting
That's what I would have thought, but the manual
is a bit confusing. Here's from the
manual:
=
"The
D:\{MAILSERVER}\Declude\mywhitelist.txt file would then contain
either one E-mail address ("[EMAIL PROTECTED]") or domain
("@example.com") or subdomain (".example.com") per line. The whitelist
files can have unlimited entries in them."
==
So, I would have thought the leading
period would imply all messages from [EMAIL PROTECTED]
as well as [EMAIL PROTECTED]
My support case with Microsoft is
closed, so unfortunately I don't expect anymore mail from them, but I do
want to correctly understand how to whitelist
them.
BTW, does it seem unusual that MS
support's reverse DNS seems to be
misconfigured?
Thank you for your help
Darin
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Darin CoxSent: Tuesday, August 30, 2005
9:10 AMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] Help with Whitelisting
Almost. Your entry would match
anything that ends with ".mssupport.microsoft.com", but since
"@mssupport.microsoft.com" does not contain the leading period, it
doesn't match.
In your case, you probably want two
lines
.mssupport.microsoft.com
@mssupport.microsoft.com
Darin.
-
Original Message -
From:
Agid,
Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 12:02 PM
Subject: RE: [Declude.JunkMail] Help with
Whitelisting
Wouldn't mywhitelist entryalso
whitelist all senders from .msssupport.microsoft.com and any subdomains
of mssupport.microsoft.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Darin CoxSent: Tuesday, August 30, 2005
8:43 AMTo: Declude.JunkMail@declude.comSubject:
Re: [Declude.JunkMail] Help with Whitelisting
Because the mail is from
@mssupport.microsoft.com, but you're not whitelisting
@mssupport.microsoft.com, you're whitelisting
.mssupport.microsoft.com.
Darin.
-
Original Message -
From:
Agid, Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 11:25 AM
Subject: [Declude.JunkMail] Help with
Whitelisting
Hello,
I am attempting to whitelist a couple of
sending domains, but my whitelisting doesn't seem to work.
I'm including the headers and the corresponding entries from my
whitelist. Please help me figure out why the messages are
not getting whitelisted.
Thanks.
From renowhitelist.txt: .mssuppor
RE: [Declude.JunkMail] Help investigating abuse complaint
Hi, The mail supposedly took the following route: - cousinssubs.com (mail.cousinssubs.com [216.43.194.27]) - YahooBB218116092015.bbtec.net (Postfix)([218.116.92.15]) - mx4.uniserve.ca ([216.113.192.45]) We can assume that the first receive header is legit: Received: from mx4.uniserve.ca ([216.113.192.45]) by mail-host.uniserve.ca with esmtp (Exim 4.22) id 1CUJoZ-000Jyw-QH for [EMAIL PROTECTED]; Tue, 16 Nov 2004 23:01:15 -0800 However that only shows that the mail was received from YahooBB218116092015.bbtec.net [218.116.92.15]. The question is whether either party manages YahooBB218116092015.bbtec.net [218.116.92.15]. If NOT then it is possible that this server was a hijacked/proxy or otherwise abused server which then inserted a FAKE third received header (in this case: mx4.uniserve.ca [216.113.192.45]) If YahooBB218116092015.bbtec.net [218.116.92.15] can be trusted to insert only valid headers, THEN it would indeed implicate mx4.uniserve.ca ([216.113.192.45]) as the apparent originator of the email Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Ognenoff Sent: Wednesday, November 17, 2004 03:40 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Help investigating abuse complaint Hello all, I just received a complaint at our abuse@ address asking us to stop spamming. The guy sent me the message in question as an attachment and after reviewing the headers and digging into the logs I need some help deciphering what is going on here. Here are the headers for the spam in question: Received: from mx4.uniserve.ca ([216.113.192.45]) by mail-host.uniserve.ca with esmtp (Exim 4.22) id 1CUJoZ-000Jyw-QH for [EMAIL PROTECTED]; Tue, 16 Nov 2004 23:01:15 -0800 Received: from yahoobb218116092015.bbtec.net ([218.116.92.15]) by mx4.uniserve.ca with smtp (Exim 4.22) id 1CUJoY-000HAt-0B for [EMAIL PROTECTED]; Tue, 16 Nov 2004 23:01:14 -0800 Received: from cousinssubs.com (mail.cousinssubs.com [216.43.194.27]) by YahooBB218116092015.bbtec.net (Postfix) with ESMTP id 59B128F2E5 for [EMAIL PROTECTED]; Wed, 17 Nov 2004 06:42:47 + Message-ID: [EMAIL PROTECTED] From: Reach B. Cubbyhole [EMAIL PROTECTED] To: Frankadsl [EMAIL PROTECTED] Subject: RE: Hot Wemon nice pussy Date: Wed, 17 Nov 2004 06:42:47 + The uniserve.ca references are the servers of the guy who complained. The mail.cousinssubs.com (216.43.194.27) is my mail server. The other ones referring to bbtec.net is where I am having trouble figuring out what happened here. Please correct me if my understanding is incorrect but it looks like the message originated on my server, was relayed to the bbtec.net server and then relayed to the uniserve.ca servers. With that as my understanding of the chain, the log files don't make sense to me. In fact, I can't find any reference to 218.116.92.15 in my logs at all for the last 3 days. The references I can find for bbtec.net are SMTPD entries of spam that was delivered to some of my local users but nothing to indicate relaying that I can tell. I have Relay Mail for Address set with my local IPs listed as well as several external server IPs. Can anyone help me figure this out? Does it look like something I can control? I would post log snippets but like I said I can't find anything to indicate we sent this. Andy Ognenoff Online Systems Administrator Direct: (262)250-2860 [EMAIL PROTECTED] - Cousins Submarines, Inc. http://www.cousinssubs.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help investigating abuse complaint
Received: from mx4.uniserve.ca ([216.113.192.45]) by mail-host.uniserve.ca... Received: from yahoobb218116092015.bbtec.net ([218.116.92.15]) by... Received: from cousinssubs.com (mail.cousinssubs.com [216.43.194.27]) by... The uniserve.ca references are the servers of the guy who complained. The mail.cousinssubs.com (216.43.194.27) is my mail server. This one definitely did not come from IMail (if it did, there would be another Received: header -- IMail always adds one to E-mail it processes). The only possibility of a problem on your end would be if your mailserver is compromised (which rarely happens, but still could be a possibility). The other ones referring to bbtec.net is where I am having trouble figuring out what happened here. Please correct me if my understanding is incorrect but it looks like the message originated on my server, was relayed to the bbtec.net server and then relayed to the uniserve.ca servers. If the headers can be trusted, yes. In this case, though, the header that mentions your IP is 218.116.92.15. However, the reverse DNS entry of 218.116.92.15 is YahooBB218116092015.bbtec.net. I believe that is a Japanese subsidiary of Yahoo -- and if so, it definitely isn't trustable (a Yahoo mailserver should have some indication that it is a mailserver). So either the spam came from 218.116.92.15, or the burden of proof lies with them. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help investigating abuse complaint
Thanks for your help Andy and Scott. I thought this looked strange. - Andy -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, November 17, 2004 3:01 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Help investigating abuse complaint Received: from mx4.uniserve.ca ([216.113.192.45]) by mail- host.uniserve.ca... Received: from yahoobb218116092015.bbtec.net ([218.116.92.15]) by... Received: from cousinssubs.com (mail.cousinssubs.com [216.43.194.27]) by... The uniserve.ca references are the servers of the guy who complained. The mail.cousinssubs.com (216.43.194.27) is my mail server. This one definitely did not come from IMail (if it did, there would be another Received: header -- IMail always adds one to E-mail it processes). The only possibility of a problem on your end would be if your mailserver is compromised (which rarely happens, but still could be a possibility). The other ones referring to bbtec.net is where I am having trouble figuring out what happened here. Please correct me if my understanding is incorrect but it looks like the message originated on my server, was relayed to the bbtec.net server and then relayed to the uniserve.ca servers. If the headers can be trusted, yes. In this case, though, the header that mentions your IP is 218.116.92.15. However, the reverse DNS entry of 218.116.92.15 is YahooBB218116092015.bbtec.net. I believe that is a Japanese subsidiary of Yahoo -- and if so, it definitely isn't trustable (a Yahoo mailserver should have some indication that it is a mailserver). So either the spam came from 218.116.92.15, or the burden of proof lies with them. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help on diagnosing issue with IMail and MS SMTP connections
20041013 062659 127.0.0.1 SMTPD (02f3ecee00c465f4) [208.7.179.200] connect 208.7.179.200 port 4767 20041013 062659 127.0.0.1 SMTPD (02f3ecee00c465f4) [208.7.179.200] EHLO mx3.mailpure.com 20041013 062659 127.0.0.1 SMTPD (02f3ecee00c465f4) [208.7.179.200] MAIL FROM:[EMAIL PROTECTED] 20041013 062659 127.0.0.1 SMTPD (02f3ecee00c465f4) [208.7.179.200] RCPT TO:[EMAIL PROTECTED] 20041013 062659 127.0.0.1 SMTPD (02f3ecee00c465f4) [208.7.179.200] F:\\D02f3ecee00c465f4.SMD 41743 Why don't you go to the loopback address, instead of the external IP, to eliminate unnecessary traffic on the NIC and take its driver out of the pic? --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.mailmage.com/products/software/freeutils/exchange2aliases/download/release/ http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, I'm beiing hijacked
How about the sending IP address -- does that match on any of the 'treated as local' lines? On Sat, 4 Sep 2004 03:53:54 -, serge [EMAIL PROTECTED] wrote: Problem is that treated as local lines have different session ids then the smtp lines it would have been so nice to have the same session id numbers, but that is not the case i wonder why - Original Message - From: Scot Desort [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, September 04, 2004 3:11 AM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked search for treated as local in your IMAIL log. Try to find a line with that text, that also contains the same SMTPD session ID of 11AF0190 -- Scot On Sat, 4 Sep 2004 02:21:10 -, serge [EMAIL PROTECTED] wrote: very possible but i am trying to find a way to find which account is beiing used is there a way to find the account that authorized the session ? Also, is there a log analyzer that can show the messages where the both the sender and the recipient are not local ? TIA - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, September 04, 2004 1:33 AM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked Is it possible they guessed a users account/password and are using SMTP Auth to relay through your system? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. - Original Message - From: serge [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 8:26 PM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked 20040903 104237 127.0.0.1 SMTPD (11AF0190) [208.154.200.6] connect 61.144.136.193 port 4124 20040903 104238 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] EHLO sapling these are the only other lines (11AF0190) [208.154.200.6] is my server ip - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 11:47 PM Subject: RE: [Declude.JunkMail] HELP, I'm beiing hijacked You are missing a line. What does connect line show, which is the line before the MAIL FROM? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of serge Sent: Friday, September 03, 2004 4:36 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HELP, I'm beiing hijacked Hi all I have 100's of lines like: 20040903 104526 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] MAIL FROM: [EMAIL PROTECTED] 20040903 104529 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] RCPT TO:[EMAIL PROTECTED] 20040903 104532 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] F:\Imail\spool\D4b4611af01909a4c.SMD 952 All from same IP [61.144.136.193], and all with same SMTPD (11AF0190), also the spool file name is different I have smtp set to relay for addresses, and they do not include 61.144.136.193 i can see no auth from 61.144.136.193 in the logs i added 61.144.136.193 to smtp control access, but how can i prevent this from happening, and how can i find how/why they gained access to my server? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
RE: [Declude.JunkMail] HELP, I'm beiing hijacked
You are missing a line. What does connect line show, which is the line before the MAIL FROM? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of serge Sent: Friday, September 03, 2004 4:36 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HELP, I'm beiing hijacked Hi all I have 100's of lines like: 20040903 104526 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] MAIL FROM: [EMAIL PROTECTED] 20040903 104529 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] RCPT TO:[EMAIL PROTECTED] 20040903 104532 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] F:\Imail\spool\D4b4611af01909a4c.SMD 952 All from same IP [61.144.136.193], and all with same SMTPD (11AF0190), also the spool file name is different I have smtp set to relay for addresses, and they do not include 61.144.136.193 i can see no auth from 61.144.136.193 in the logs i added 61.144.136.193 to smtp control access, but how can i prevent this from happening, and how can i find how/why they gained access to my server? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, I'm beiing hijacked
20040903 104237 127.0.0.1 SMTPD (11AF0190) [208.154.200.6] connect 61.144.136.193 port 4124 20040903 104238 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] EHLO sapling these are the only other lines (11AF0190) [208.154.200.6] is my server ip - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 11:47 PM Subject: RE: [Declude.JunkMail] HELP, I'm beiing hijacked You are missing a line. What does connect line show, which is the line before the MAIL FROM? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of serge Sent: Friday, September 03, 2004 4:36 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HELP, I'm beiing hijacked Hi all I have 100's of lines like: 20040903 104526 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] MAIL FROM: [EMAIL PROTECTED] 20040903 104529 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] RCPT TO:[EMAIL PROTECTED] 20040903 104532 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] F:\Imail\spool\D4b4611af01909a4c.SMD 952 All from same IP [61.144.136.193], and all with same SMTPD (11AF0190), also the spool file name is different I have smtp set to relay for addresses, and they do not include 61.144.136.193 i can see no auth from 61.144.136.193 in the logs i added 61.144.136.193 to smtp control access, but how can i prevent this from happening, and how can i find how/why they gained access to my server? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, I'm beiing hijacked
Is it possible they guessed a users account/password and are using SMTP Auth to relay through your system? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. - Original Message - From: serge [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 8:26 PM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked 20040903 104237 127.0.0.1 SMTPD (11AF0190) [208.154.200.6] connect 61.144.136.193 port 4124 20040903 104238 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] EHLO sapling these are the only other lines (11AF0190) [208.154.200.6] is my server ip - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 11:47 PM Subject: RE: [Declude.JunkMail] HELP, I'm beiing hijacked You are missing a line. What does connect line show, which is the line before the MAIL FROM? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of serge Sent: Friday, September 03, 2004 4:36 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HELP, I'm beiing hijacked Hi all I have 100's of lines like: 20040903 104526 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] MAIL FROM: [EMAIL PROTECTED] 20040903 104529 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] RCPT TO:[EMAIL PROTECTED] 20040903 104532 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] F:\Imail\spool\D4b4611af01909a4c.SMD 952 All from same IP [61.144.136.193], and all with same SMTPD (11AF0190), also the spool file name is different I have smtp set to relay for addresses, and they do not include 61.144.136.193 i can see no auth from 61.144.136.193 in the logs i added 61.144.136.193 to smtp control access, but how can i prevent this from happening, and how can i find how/why they gained access to my server? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, I'm beiing hijacked
very possible but i am trying to find a way to find which account is beiing used is there a way to find the account that authorized the session ? Also, is there a log analyzer that can show the messages where the both the sender and the recipient are not local ? TIA - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, September 04, 2004 1:33 AM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked Is it possible they guessed a users account/password and are using SMTP Auth to relay through your system? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. - Original Message - From: serge [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 8:26 PM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked 20040903 104237 127.0.0.1 SMTPD (11AF0190) [208.154.200.6] connect 61.144.136.193 port 4124 20040903 104238 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] EHLO sapling these are the only other lines (11AF0190) [208.154.200.6] is my server ip - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 11:47 PM Subject: RE: [Declude.JunkMail] HELP, I'm beiing hijacked You are missing a line. What does connect line show, which is the line before the MAIL FROM? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of serge Sent: Friday, September 03, 2004 4:36 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HELP, I'm beiing hijacked Hi all I have 100's of lines like: 20040903 104526 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] MAIL FROM: [EMAIL PROTECTED] 20040903 104529 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] RCPT TO:[EMAIL PROTECTED] 20040903 104532 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] F:\Imail\spool\D4b4611af01909a4c.SMD 952 All from same IP [61.144.136.193], and all with same SMTPD (11AF0190), also the spool file name is different I have smtp set to relay for addresses, and they do not include 61.144.136.193 i can see no auth from 61.144.136.193 in the logs i added 61.144.136.193 to smtp control access, but how can i prevent this from happening, and how can i find how/why they gained access to my server? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, I'm beiing hijacked
search for treated as local in your IMAIL log. Try to find a line with that text, that also contains the same SMTPD session ID of 11AF0190 -- Scot On Sat, 4 Sep 2004 02:21:10 -, serge [EMAIL PROTECTED] wrote: very possible but i am trying to find a way to find which account is beiing used is there a way to find the account that authorized the session ? Also, is there a log analyzer that can show the messages where the both the sender and the recipient are not local ? TIA - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, September 04, 2004 1:33 AM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked Is it possible they guessed a users account/password and are using SMTP Auth to relay through your system? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. - Original Message - From: serge [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 8:26 PM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked 20040903 104237 127.0.0.1 SMTPD (11AF0190) [208.154.200.6] connect 61.144.136.193 port 4124 20040903 104238 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] EHLO sapling these are the only other lines (11AF0190) [208.154.200.6] is my server ip - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 11:47 PM Subject: RE: [Declude.JunkMail] HELP, I'm beiing hijacked You are missing a line. What does connect line show, which is the line before the MAIL FROM? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of serge Sent: Friday, September 03, 2004 4:36 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HELP, I'm beiing hijacked Hi all I have 100's of lines like: 20040903 104526 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] MAIL FROM: [EMAIL PROTECTED] 20040903 104529 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] RCPT TO:[EMAIL PROTECTED] 20040903 104532 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] F:\Imail\spool\D4b4611af01909a4c.SMD 952 All from same IP [61.144.136.193], and all with same SMTPD (11AF0190), also the spool file name is different I have smtp set to relay for addresses, and they do not include 61.144.136.193 i can see no auth from 61.144.136.193 in the logs i added 61.144.136.193 to smtp control access, but how can i prevent this from happening, and how can i find how/why they gained access to my server? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Scot --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HELP, I'm beiing hijacked
Problem is that treated as local lines have different session ids then the smtp lines it would have been so nice to have the same session id numbers, but that is not the case i wonder why - Original Message - From: Scot Desort [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, September 04, 2004 3:11 AM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked search for treated as local in your IMAIL log. Try to find a line with that text, that also contains the same SMTPD session ID of 11AF0190 -- Scot On Sat, 4 Sep 2004 02:21:10 -, serge [EMAIL PROTECTED] wrote: very possible but i am trying to find a way to find which account is beiing used is there a way to find the account that authorized the session ? Also, is there a log analyzer that can show the messages where the both the sender and the recipient are not local ? TIA - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, September 04, 2004 1:33 AM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked Is it possible they guessed a users account/password and are using SMTP Auth to relay through your system? Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers. - Original Message - From: serge [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 8:26 PM Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked 20040903 104237 127.0.0.1 SMTPD (11AF0190) [208.154.200.6] connect 61.144.136.193 port 4124 20040903 104238 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] EHLO sapling these are the only other lines (11AF0190) [208.154.200.6] is my server ip - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, September 03, 2004 11:47 PM Subject: RE: [Declude.JunkMail] HELP, I'm beiing hijacked You are missing a line. What does connect line show, which is the line before the MAIL FROM? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of serge Sent: Friday, September 03, 2004 4:36 PM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HELP, I'm beiing hijacked Hi all I have 100's of lines like: 20040903 104526 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] MAIL FROM: [EMAIL PROTECTED] 20040903 104529 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] RCPT TO:[EMAIL PROTECTED] 20040903 104532 127.0.0.1 SMTPD (11AF0190) [61.144.136.193] F:\Imail\spool\D4b4611af01909a4c.SMD 952 All from same IP [61.144.136.193], and all with same SMTPD (11AF0190), also the spool file name is different I have smtp set to relay for addresses, and they do not include 61.144.136.193 i can see no auth from 61.144.136.193 in the logs i added 61.144.136.193 to smtp control access, but how can i prevent this from happening, and how can i find how/why they gained access to my server? TIA --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- Scot --- [This E-mail was scanned for viruses by Declude Virus (http
