RE: Re[2]: [sniffer] Lot of Drugs Spam getting through sniffer....
It is not slowing down out here. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Friday, May 05, 2006 9:32 AM To: Darin Cox Subject: Re[2]: [sniffer] Lot of Drugs Spam getting through sniffer On Friday, May 5, 2006, 11:02:00 AM, Darin wrote: DC> Not just drugs, but some others too have been slipping through the DC> past couple of days. We've reported a little under 40 in the past DC> couple of days. We saw a bit of a lull, then a rash of new campaigns bunched together with some new obfuscation techniques. We're getting a handle on it now. Looks like the burst started about 30 hours ago and is tailing off now. Attached image - new arrival rates last 2 days. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Lot of Drugs Spam getting through sniffer....
Well, I am at the point that I could care less about geocities false positives. If GeoCities is going to allow this much spam junk then I could care less about allowing them. John T eServices For You "Seek, and ye shall find!" > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Friday, May 05, 2006 9:09 AM > To: John T (Lists) > Subject: Re[2]: [sniffer] Lot of Drugs Spam getting through sniffer > > We've had that rule before and had to pull it for false positives. > > _M > > > On Friday, May 5, 2006, 11:41:50 AM, John wrote: > > JTL> FYI, I created a Declude Filter: > > JTL> Subject END NOTCONTAINS news > JTL> BODY25 CONTAINShttp://geocities.com/ > > JTL> Been catching every one like that. > > JTL> John T > JTL> eServices For You > > JTL> "Seek, and ye shall find!" > > > >> -Original Message- > >> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > JTL> On > >> Behalf Of Daniel Bayerdorffer > >> Sent: Friday, May 05, 2006 7:38 AM > >> To: sniffer@SortMonster.com > >> Subject: RE: [sniffer] Lot of Drugs Spam getting through sniffer > >> > >> Here too. > >> > >> -- > >> Daniel Bayerdorffer [EMAIL PROTECTED] > >> Numberall Stamp & Tool Co., Inc. > >> PO Box 187 Sangerville, ME 04479 USA > >> TEL 207-876-3541 FAX 207-876-3566 > >> www.numberall.com > >> > >> > >> > >> > -Original Message- > >> > From: [EMAIL PROTECTED] > >> > [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick > >> > Sent: Friday, May 05, 2006 10:34 AM > >> > To: sniffer@sortmonster.com > >> > Subject: [sniffer] Lot of Drugs Spam getting through sniffer > >> > > >> > The last few days tons on Drus spam is coming in and sniffer > >> > is catching > >> > none of it. > >> > > >> > Chuck Schick > >> > Warp 8, Inc. > >> > (303)-421-5140 > >> > www.warp8.com > >> > > >> > > >> > > >> > This E-Mail came from the Message Sniffer mailing list. For > >> > information and (un)subscription instructions go to > >> > http://www.sortmonster.com/MessageSniffer/Help/Help.html > >> > > >> > >> > >> > >> > >> This E-Mail came from the Message Sniffer mailing list. For information > JTL> and > >> (un)subscription instructions go to > >> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > JTL> This E-Mail came from the Message Sniffer mailing list. For > JTL> information and (un)subscription instructions go to > JTL> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Lot of Drugs Spam getting through sniffer....
I thought it had been a bit quiet of late . Appreciate the efforts, Pete. Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" Sent: Friday, May 05, 2006 11:32 AM Subject: Re[2]: [sniffer] Lot of Drugs Spam getting through sniffer On Friday, May 5, 2006, 11:02:00 AM, Darin wrote: DC> Not just drugs, but some others too have been slipping through the past DC> couple of days. We've reported a little under 40 in the past couple of DC> days. We saw a bit of a lull, then a rash of new campaigns bunched together with some new obfuscation techniques. We're getting a handle on it now. Looks like the burst started about 30 hours ago and is tailing off now. Attached image - new arrival rates last 2 days. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] False positive processing
Right. 15 from today. Let me know what you find out. The ones from the 10th were replies to FP processing to investigate further and apply white rules. The others were normal FP reports. Thanks, Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" Sent: Tuesday, March 21, 2006 11:52 AM Subject: Re[2]: [sniffer] False positive processing On Tuesday, March 21, 2006, 11:37:30 AM, Darin wrote: DC> Nope. None of them. DC> I haven't heard back from the replies to a couple of false positives on the DC> 10th, and we haven't heard anything from our submissions on the 16th (6) and DC> 17th (2). I don't remember if we've heard anything from those on the 15th DC> (4). Right now I'm preparing to process FPs. I have a total of 24. 15 from you. I don't show any others pending. When I'm done I'll go back and look at the 10th, 16th, and 17th to see if I received and responded. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] New Web Site!
Pete, while I fully understand all of what you said, allowing any one registered to edit any page is leaving things wide open for abuse. Isn't there a way to set permissions on a section basis? Example, I should not have the ability to edit the recent events page and not that I would, but I am human and humans make mistakes and do dumb things from time to time. John T eServices For You "Seek, and ye shall find!" > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Friday, March 17, 2006 9:30 AM > To: John T (Lists) > Subject: Re[2]: [sniffer] New Web Site! > > On Friday, March 17, 2006, 11:53:58 AM, John wrote: > > JTL> What is the purpose of using a WIKI site? > > A few things really - > > * It's fast and easy to create, update, and correct the content. > Things happen quickly here and in the messaging security business in > general. It makes sense to use tools that can adapt just as quickly > and with as little friction as possible. > > * Some of our user community contribute software and technical > knowledge on a regular basis. A wiki makes that process easier. This > is particularly useful where SNF overlaps with other software - The > folks who use, develop, or maintain that software can now participate > openly in developing documentation for that work. > > * We've always maintained a collaborative relationship with our > customers and this helps to enforce that point. > > * One of the things we've always encouraged is the sharing of > information related to, but not necessarily about SNF. For example, it > is not uncommon for a discussion about integrating SMF with a mail > server to branch off into a wide range of loosely related topics from > DNS, to server and network performance, to handy tools and tricks. > > We have a lot of experts in our community. Quite Often, difficult to > find solutions lurk in the context of the discussions on and off our > list. Now those solutions can be captured here in the natural context > in which they came up so that they will be easy to find. > > -- > > Consider this approach part of fostering a strong user community and > providing a resource that goes beyond our own products and services. > > At the end of the day we are working shoulder to shoulder with the > developers, managers, administrators, and users of all kinds of > systems. We want this wiki to be a valuable resource for anybody who > uses SNF, and lots of folks who don't (yet). > > _M > > > > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] New RuleBot F002 Online
Hi Pete, Don't worry about customizing our local rulebase for this. Just take this as a simple suggestion for future segregation to make it easy for new rulesets to be addressed differently in weighting schemes. Thanks for all of your efforts! Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" Sent: Monday, March 13, 2006 10:23 AM Subject: Re[2]: [sniffer] New RuleBot F002 Online On Friday, March 10, 2006, 3:41:00 PM, Darin wrote: DC> Totally agree. I'd like to see some separation between rules created by DC> newer rulebots and preexisting rules. That way if there becomes an issue DC> with a bot, we can turn off one group quickly and easily. There is no way to do this without completely reorganizing the result codes or defeating the competitive ranking mechanisms. If you feel strongly about it I can move these rule groups to lower numbers on your local rulebase or make some other numbering scheme - but I don't recommend it. Moving these rule groups to lower numbers would cause them to win competitions with other rules where they would normally not win. At some point in the future we might renumber the rule groups again, but I like to avoid this since there are so many folks that just don't get the message (no matter what we do to publish it) when we make changes like this and so any large scale changes tend to cause confusion for very long periods. For example: I still, on occasion, have questions about the gray-hosting group which has not existed for quite a long time. So far there has not been one FP reported on bot F002 and extremely few on F001 - the vast majority of those associated with the very first group of listings prior to the last two upgrades for the bot. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] F001 Rule Bot Change
I'd say I get least FPs on: warez (50), av push (49), advertising (56), insurance (48), and gambling (59) Most FPs on general (60), experimental (61) and travel (47) - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Nick Hayer" Sent: Thursday, March 09, 2006 9:54 AM Subject: Re[2]: [sniffer] F001 Rule Bot Change On Thursday, March 9, 2006, 10:04:17 AM, Nick wrote: NH> Hi Pete, It's a bit too early to know about the reliability of F001. NH> Understood - sorry I was not clear on this :) NH> I was referring to all your tests eg: printers, snake oil, what NH> have you. which one do you have the most confidence in maybe get NH> the least false positive reports on? I don't have hard data on that right now. My impression is that we get the fewest FP reports on Porn/Adult and also on Malware. My impression is that we get the most on group 63 - I think mostly because of IP rules from old bots. I don't have any other strong impressions at this time. I have it on the list to upgrade the FP processing bot - I will be providing it with behaviors to keep running statistics on rule locations at the time of report and other contextual data. This is not a high priority task - so it will be a while. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] New Rulebot F001
I also have got a lot of false positives with code 063 which are HOLD now. Ik know it's not very nice to set email on HOLD when failing sniffer but I've got a major problem with spam and until a few days ago this was going well, at least a few false positives in a week. 03/07/2006 20:12:44.628 qdb2402d03b56.smd Msg failed SNIFFER (Message failed SNIFFER: 63.). Action=HOLD. l6l0ow6m20060307191244 Ddb2402d03b56.smd 31 31 Match 672578 63 142 176 65 l6l0ow6m20060307191244 Ddb2402d03b56.smd 31 31 Final 672578 63 0 281965 Could this please stop, sniffer was pretty reliable for us, but not at the moment. Regards, Marcel Sangers Traction IT -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: dinsdag 7 maart 2006 0:18 To: Darin Cox Subject: Re[2]: [sniffer] New Rulebot F001 On Monday, March 6, 2006, 3:42:50 PM, Darin wrote: DC> We just reviewed this morning's logs and had a few false positives. DC> Not sure if these are due to the new rulebot, but it's more than DC> we've had for the entire day for the past month. DC> Rules DC> -- DC> 873261 DC> 866398 DC> 856734 DC> 284831 DC> 865663 Three of these are from F001 and have been removed. 865663 - http://www.dnsstuff.com/tools/ip4r.ch?ip=64.233.166.182 http://www.dnsstuff.com/tools/ptr.ch?ip=64.233.166.182 856734 - http://www.dnsstuff.com/tools/ip4r.ch?ip=64.249.82.200 http://www.dnsstuff.com/tools/ptr.ch?ip=64.249.82.200 873261 - http://www.dnsstuff.com/tools/ip4r.ch?ip=207.217.120.227 http://www.dnsstuff.com/tools/ptr.ch?ip=207.217.120.227 I haven't yet processed the fps, only looked up the rules. There are currently 32820 rules authored by the F001 bot. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] declude tests
Thanks so much Pete I got it all sorted out Phew It's humming along just fine with each individual test. I look forward to the day that there are more gui's in products like this. That way I can choose what I want done but the software does the configuring for me and thus eliminates syntax errors and other misunderstandings. Both declude and sniffer would benefit greatly from that. I future wish Thanks again Harry Vanderzand inTown Internet & Computer Services 519-741-1222 > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Tuesday, March 07, 2006 6:28 PM > To: Harry Vanderzand > Subject: Re[2]: [sniffer] declude tests > > On Tuesday, March 7, 2006, 6:20:04 PM, Harry wrote: > > HV> I guess I am not understanding something here after all this time > > HV> So as I understand I leave the persistent word out of the declude > HV> config and just run the service? > > YES. :-) > > The instances launched by Declude will recognize that the > service is running and will elect to be peer-client instances > automatically. > > Also, if the service fails for any reason then they will > automatically adopt peer-server mode. > > (In Peer-Server mode, instances take turns acting as a > service for short periods to improve performance.) > > Hope this helps, > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] New Rulebot F001
Thanks, Pete. Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" Sent: Monday, March 06, 2006 6:17 PM Subject: Re[2]: [sniffer] New Rulebot F001 On Monday, March 6, 2006, 3:42:50 PM, Darin wrote: DC> We just reviewed this morning's logs and had a few false positives. Not DC> sure if these are due to the new rulebot, but it's more than we've had for DC> the entire day for the past month. DC> Rules DC> -- DC> 873261 DC> 866398 DC> 856734 DC> 284831 DC> 865663 Three of these are from F001 and have been removed. 865663 - http://www.dnsstuff.com/tools/ip4r.ch?ip=64.233.166.182 http://www.dnsstuff.com/tools/ptr.ch?ip=64.233.166.182 856734 - http://www.dnsstuff.com/tools/ip4r.ch?ip=64.249.82.200 http://www.dnsstuff.com/tools/ptr.ch?ip=64.249.82.200 873261 - http://www.dnsstuff.com/tools/ip4r.ch?ip=207.217.120.227 http://www.dnsstuff.com/tools/ptr.ch?ip=207.217.120.227 I haven't yet processed the fps, only looked up the rules. There are currently 32820 rules authored by the F001 bot. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] New Rulebot F001
Pete, One of these was EarthLink [207.217.120.227], and one of these was Google Mail [64.233.166.182]. SpamBag lists the EarthLink address as a source of bogus bounces, and I posit that this would be the source of the mail to the spamtraps that would trigger the F001 bot. I would like to state that I don't need Message Sniffer to identify servers that send bogus postmaster notifications. This would be entirely due to false positives such as the three examples above. Given that spammers clearly recycle their email database as a fake-mailfrom database, any spamtrap address will get bogus bounces and therefore, the spamtraps will flag legitimate senders' IP addresses in Rule 63. I don't expect nor want you to discuss the details of the spamtraps as the point of one class of your spamtraps is that their methods are secret. However, Matt has described a subset of the filters various Decluders have used to filter out postmaster bounces and other reflected noise, and I can certainly chip in on that conversation offline. Andrew. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Monday, March 06, 2006 3:18 PM > To: Darin Cox > Subject: Re[2]: [sniffer] New Rulebot F001 > > On Monday, March 6, 2006, 3:42:50 PM, Darin wrote: > > DC> We just reviewed this morning's logs and had a few false > positives. > DC> Not sure if these are due to the new rulebot, but it's more than > DC> we've had for the entire day for the past month. > > DC> Rules > DC> -- > DC> 873261 > DC> 866398 > DC> 856734 > DC> 284831 > DC> 865663 > > Three of these are from F001 and have been removed. > > 865663 - http://www.dnsstuff.com/tools/ip4r.ch?ip=64.233.166.182 > http://www.dnsstuff.com/tools/ptr.ch?ip=64.233.166.182 > > 856734 - http://www.dnsstuff.com/tools/ip4r.ch?ip=64.249.82.200 > http://www.dnsstuff.com/tools/ptr.ch?ip=64.249.82.200 > > 873261 - http://www.dnsstuff.com/tools/ip4r.ch?ip=207.217.120.227 > http://www.dnsstuff.com/tools/ptr.ch?ip=207.217.120.227 > > > I haven't yet processed the fps, only looked up the rules. > > There are currently 32820 rules authored by the F001 bot. > > Hope this helps, > > _M > > > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] When to go persistent
Running as a service is the way to go. The steps I followed were taken directly from Matt's post in the archives and updated slightly for Windows 2003. I'm mostly just reposting his info here, but I like having instructions all together. 1) Download & install the Windows 2003 Resource Kit. http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7- 96ee-b18c4790cffd&displaylang=en 2) Open a command prompt (Click on the Start Button, select Run, and type CMD) 3)Enter the following commands (customize for the paths of the executables) C:\> cd Program Files\Windows Resource Kits\Tools C:\> Instsrv Sniffer "C:\Program Files\Windows Resource Kits\Tools\SRVANY.exe" 4) Open up the Registry Editor (Click on the Start Button, select Run, and type REGEDIT) 5) Locate the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sniffer 6) From the Edit menu, select New, select Key, and name the new key "Parameters" 7) Highlight the Parameters key 8) From the Edit menu, select New, select String Value, and name the new value "Application" 9) From the Edit menu, select Modify, and type in the full path name and application name, including the drive letter and file extension (don't use quotes). You must customize the path, executable name and authentication code. Example: C:\IMail\Declude\Sniffer\[yourlicx].exe [authenticationxx] persistent [yourlicx] = your license ID [authenticationxx] = your authentication string 10) Open the Services MMC 11) Start the Sniffer service 12) Set the Sniffer service to Automatic Matt's original post: http://www.mail-archive.com/sniffer@sortmonster.com/msg00169.html > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Rick Robeson > Sent: Thursday, February 23, 2006 12:23 PM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] When to go persistent > > I thought you had to run this as a service? > > Rick Robeson > getlocalnews.com > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic > Sent: Thursday, February 23, 2006 9:59 AM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] When to go persistent > > > Pete, > > > To run in persistent mode, simply launch an instance of SNF from the > > command line with the word "persistent" in place of the file to scan. > > > > .exe persistent > > > > I am calling Sniffer from Declude. Could I just later my statement in my > config file to include persistent? That way the first time it is called > that instance will go persistent and all the rest will end up talking to > it? > > Regardless of how the persistent instance is started should I have the > persistent keyword on the line that is called from Declude? > > Goran Jovanovic This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] When to go persistent
I thought you had to run this as a service? Rick Robeson getlocalnews.com [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic Sent: Thursday, February 23, 2006 9:59 AM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] When to go persistent Pete, > To run in persistent mode, simply launch an instance of SNF from the > command line with the word "persistent" in place of the file to scan. > > .exe persistent > I am calling Sniffer from Declude. Could I just later my statement in my config file to include persistent? That way the first time it is called that instance will go persistent and all the rest will end up talking to it? Regardless of how the persistent instance is started should I have the persistent keyword on the line that is called from Declude? Goran Jovanovic This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] When to go persistent
Pete, > To run in persistent mode, simply launch an instance of SNF from the > command line with the word "persistent" in place of the file to scan. > > .exe persistent > I am calling Sniffer from Declude. Could I just later my statement in my config file to include persistent? That way the first time it is called that instance will go persistent and all the rest will end up talking to it? Regardless of how the persistent instance is started should I have the persistent keyword on the line that is called from Declude? Goran Jovanovic This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] False Positive - no reaction?
That queue concept would be wonderful! Hopefully it would have some simple info extracted to show recipient, sender, subject, header info, and info on the rule(s) it failed. One of my ongoing challenges is matching responses to reports and following up to see what additional actions are required. Darin. - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: Sent: Tuesday, February 21, 2006 11:16 AM Subject: RE: Re[2]: [sniffer] False Positive - no reaction? Hi Pete, I agree that the email notification is tricky - because you might respond to spam - and, you may NOT respond to someone who did not use an authorized address. On the other hand, if I KNEW there was an auto-response and I did NOT get a response, it would be an indication to me, the user, that I must have done something wrong. So - in a sense - "no" response is also a "message" I can act on. The only other suggestion I have is to create a 24 hour 'queue' display on the web site. All you need to show is a column of the sender domain names of the email (not the entire sender email address). If I submit a false positive I can confirm that it made it into your queue by checking the web page. This way, you don't need to send automated emails. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Tuesday, February 21, 2006 11:04 AM To: Andy Schmidt Subject: Re[2]: [sniffer] False Positive - no reaction? On Tuesday, February 21, 2006, 10:16:11 AM, Andy wrote: AS> Sorry - didn't mean to be "pushy". I just thought that false AS> positives are worse than missed spam, so I had assumed that they AS> would always be at the top of the queue. It is a very tough balancing act. Don't feel bad at all - you're not being pushy. The current goal is to respond in less than 24 hours and if possible to review twice per day. Yesterday a number of urgent tasks toppled that schedule. The first review happened (at around 0600) but there were no FPs at that time. I'm working to increase the review cycle... there are just a lot of things going on right now. Just so everyone knows, we do hear - loud and clear - that responding to FPs is important, and we have been much better about it over the recent past. I expect that service aspect to improve moving forward along with other things. AS> I can wait (PS - would have calmed my nerves, if there had been some AS> automatic "ticket number" response that reassured me that my email AS> was received. The web site makes it sound as if there's a million AS> reasons why a false positive might not be accepted - so an automatic AS> confirmation might be a good "self-service" tool. That's a good point. I'll look at that possibility when I rewrite the false processing bot. We're getting a lot of spam lately at our false@ address and I would want to make sure that there was no outscatter. I can tell the bot to only respond to validated senders, but then there is the issue of email reliability in the response... what if you don't get the response I mean. ... There are still folks that occasionally (some frequently) send false reports from unauthorized addresses --- those would not get a response... I'm overthinking this now %^b When I get to the false processing bot I will add a response mechanism. Thanks! _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] False Positive - no reaction?
I like this idea more than the email notification. I really don't need more emails. - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: Sent: Tuesday, February 21, 2006 10:16 AM Subject: RE: Re[2]: [sniffer] False Positive - no reaction? Hi Pete, I agree that the email notification is tricky - because you might respond to spam - and, you may NOT respond to someone who did not use an authorized address. On the other hand, if I KNEW there was an auto-response and I did NOT get a response, it would be an indication to me, the user, that I must have done something wrong. So - in a sense - "no" response is also a "message" I can act on. The only other suggestion I have is to create a 24 hour 'queue' display on the web site. All you need to show is a column of the sender domain names of the email (not the entire sender email address). If I submit a false positive I can confirm that it made it into your queue by checking the web page. This way, you don't need to send automated emails. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Tuesday, February 21, 2006 11:04 AM To: Andy Schmidt Subject: Re[2]: [sniffer] False Positive - no reaction? On Tuesday, February 21, 2006, 10:16:11 AM, Andy wrote: AS> Sorry - didn't mean to be "pushy". I just thought that false AS> positives are worse than missed spam, so I had assumed that they AS> would always be at the top of the queue. It is a very tough balancing act. Don't feel bad at all - you're not being pushy. The current goal is to respond in less than 24 hours and if possible to review twice per day. Yesterday a number of urgent tasks toppled that schedule. The first review happened (at around 0600) but there were no FPs at that time. I'm working to increase the review cycle... there are just a lot of things going on right now. Just so everyone knows, we do hear - loud and clear - that responding to FPs is important, and we have been much better about it over the recent past. I expect that service aspect to improve moving forward along with other things. AS> I can wait (PS - would have calmed my nerves, if there had been some AS> automatic "ticket number" response that reassured me that my email AS> was received. The web site makes it sound as if there's a million AS> reasons why a false positive might not be accepted - so an automatic AS> confirmation might be a good "self-service" tool. That's a good point. I'll look at that possibility when I rewrite the false processing bot. We're getting a lot of spam lately at our false@ address and I would want to make sure that there was no outscatter. I can tell the bot to only respond to validated senders, but then there is the issue of email reliability in the response... what if you don't get the response I mean. ... There are still folks that occasionally (some frequently) send false reports from unauthorized addresses --- those would not get a response... I'm overthinking this now %^b When I get to the false processing bot I will add a response mechanism. Thanks! _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] False Positive - no reaction?
Hi Pete, I agree that the email notification is tricky - because you might respond to spam - and, you may NOT respond to someone who did not use an authorized address. On the other hand, if I KNEW there was an auto-response and I did NOT get a response, it would be an indication to me, the user, that I must have done something wrong. So - in a sense - "no" response is also a "message" I can act on. The only other suggestion I have is to create a 24 hour 'queue' display on the web site. All you need to show is a column of the sender domain names of the email (not the entire sender email address). If I submit a false positive I can confirm that it made it into your queue by checking the web page. This way, you don't need to send automated emails. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Tuesday, February 21, 2006 11:04 AM To: Andy Schmidt Subject: Re[2]: [sniffer] False Positive - no reaction? On Tuesday, February 21, 2006, 10:16:11 AM, Andy wrote: AS> Sorry - didn't mean to be "pushy". I just thought that false AS> positives are worse than missed spam, so I had assumed that they AS> would always be at the top of the queue. It is a very tough balancing act. Don't feel bad at all - you're not being pushy. The current goal is to respond in less than 24 hours and if possible to review twice per day. Yesterday a number of urgent tasks toppled that schedule. The first review happened (at around 0600) but there were no FPs at that time. I'm working to increase the review cycle... there are just a lot of things going on right now. Just so everyone knows, we do hear - loud and clear - that responding to FPs is important, and we have been much better about it over the recent past. I expect that service aspect to improve moving forward along with other things. AS> I can wait (PS - would have calmed my nerves, if there had been some AS> automatic "ticket number" response that reassured me that my email AS> was received. The web site makes it sound as if there's a million AS> reasons why a false positive might not be accepted - so an automatic AS> confirmation might be a good "self-service" tool. That's a good point. I'll look at that possibility when I rewrite the false processing bot. We're getting a lot of spam lately at our false@ address and I would want to make sure that there was no outscatter. I can tell the bot to only respond to validated senders, but then there is the issue of email reliability in the response... what if you don't get the response I mean. ... There are still folks that occasionally (some frequently) send false reports from unauthorized addresses --- those would not get a response... I'm overthinking this now %^b When I get to the false processing bot I will add a response mechanism. Thanks! _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] problems!!!!
What is the correct Sniffer string in Declude Global.cfg file. SNIFFER external nonzero "d:\imail\declude\sniffer\sniffer.exe code"12 0 of SNIFFER external nonzero "d:\imail\declude\sniffer\sniffer.exe code"10 0 Thanks Filippo
Re: Re[2]: [sniffer] problems!!!!
There was no error in my comment. I completely understand that some issues will not be foreseeable... I did say "mostly", not entirely. The switch to the automated bots caused a rash of false positives in our system. I'm not pointing fingers, but instead want to make sure I have the ability to decide what risks to take on my end. While mistakes are always possible... we are human after all... the more controls we have available to minimize possible impact, the better. What I would be looking for is an announcement of a specific date/time for a cutover so we could freeze just before that, and unfreeze once it was clear that no glut of false positives would result. Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" Sent: Wednesday, February 08, 2006 11:13 AM Subject: Re[2]: [sniffer] problems On Wednesday, February 8, 2006, 10:59:09 AM, Darin wrote: DC> I have an idea. These problems seem to stem mostly from changes DC> in the methods of handling rulebase updates. DC> Would it be feasible to announce in advance when such changes DC> are to be implemented? With advance notice of a date and time DC> for the switch we could choose to freeze our rulebases just before DC> that for a day to make sure the kinks were worked out before DC> updating. A few spam messages that slip through are better than DC> a slough of false positives that require review and are delayed in reaching the customer. That's a good idea, and we do, in fact, follow that procedure. Whenever we make any large scale changes we always announce them here on this list,... we usually also put them on our web site. There is an error in your comment however... the previous event (with the rule-bots) was completely unforeseeable. There was no way to announce that known good software would suddenly fail so spectacularly when no changes within our control were made. Thankfully, that kind of event is extremely unlikely also. It is unfortunate that these two events would happen so closely together. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] problems!!!!
Thank you Pete Harry Vanderzand inTown Internet & Computer Services 519-741-1222 > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Wednesday, February 08, 2006 11:09 AM > To: Markus Gufler > Subject: Re[2]: [sniffer] problems > > On Wednesday, February 8, 2006, 10:48:10 AM, Markus wrote: > > MG> > MG> > MG> Harry, > MG> > MG> > MG> > MG> (please don't post your entire license code to a public list.) > > Yes, Harry, please don't. I'll be resetting your > Authorization code and sending it to you off list. > > Other than changing your authentication code you should not > need to change anything else in your configuration, that is, > unless you are having some other problem than we have assumed. > > MG> regarding the reliability of sniffer we should know that errors > MG> sometimes can happen, even at sniffer-side after they've > worked for > MG> years now very relaible. I don't expect that such errors > will happen now more often. > > Thanks for that. It is true that we've had a few bad days > here lately, but these things are unlikely to recur. For > example, the robot problem is a one-off event. It is > inexplicable how software that ran reliably for years > suddenly "loses it's mind" like that... the event was unforeseeable. > > Bad rules will happen from time to time, but less and less frequently. > To begin with, our staff has only recently been expanded, so > as time goes on they will become much more adept, less likely > to create errors, and more likely to catch them if they happen. > > Also, with each new event we learn new things about the > process and where it can fail, and then we implement changes > to prevent those failures. > > There will always be a non-zero probability of error... the > blackhats are continually changing their tactics, evolving > new techniques, and even mounting new kinds of attacks. In > order for us to respond to that environment we must also > continue to evolve with increasing speed - that means > entering unknown territory on a continual basis, and, with as > little damage as possible, it means we must make some > mistakes from time to time. > > MG> What you can do is trying to configure your declude > spamfilter in > MG> order to hold only if multiple or at least more then one test > MG> failed. For doing this the first step is to set the > maximum weight > MG> of each test (at least slightly) below your hold weight. > > This is always a good idea. No matter how good any single > component may be, you should a avoid relying on that single > component in order to mitigate risk and reduce errors - > nothing is perfect even if it can seem that way for a time. > > > > MG> Thanks to Andrew and Goran for their info's and scripts. > Saved a lot of time here. > > I second that! > > MG> Pete: Any info if and if yes when you can adapt MDLP for the > MG> declude v3 logfile? I realy miss this data. Once > accustomized to the > MG> hourly results of MDLP e sometimes feel now like a blind chicken > MG> :-) > > I'm hopeful I can spend some time on that soon. I also miss the data. > > Thanks! > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Bad Rule - 828931
Final\t828931 and Final.*828931 both found 850 entries in my current log using Baregrep. John C -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Tuesday, February 07, 2006 6:12 PM To: sniffer@SortMonster.com Subject: Re[2]: [sniffer] Bad Rule - 828931 Hello Matt, Tuesday, February 7, 2006, 6:27:25 PM, you wrote: M> rule number, and I don't have the tools set up or the knowledge of M> grep yet to do a piped query of Sniffer's logs to extract the spool file names. http://www.baremetalsoft.com/ is a great grep'er for windows. In BSD I always used ".*" to represent any number of characters, white space or non, but that didn't seem to work with baregrep. That's why I was trying to confirm with anyone on the list my regex of "Final\t828931" was an accurate regex to find every message that 'finaled' on that rule. I'm praying that I screwed up the expression and I don't have 22,055 messages held by that rule. M> BTW, David, it is generally better not to hold or block on one single M> test, especially one that automates such listings (despite whatever M> safeguards there might be). I know, shame on me. I guess I'm used to the days that we used to be able to hold on sniffer alone. We have some safeguards in place now and are transitioning our rule methodologies but hadn't gotten to this one yet as this always seems to hit back-burner. This is also why I'd really like to see the content of the rule to see how it made it passed our safeguards. -- Best regards, Davidmailto:[EMAIL PROTECTED] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Bad Rule - 828931
Don't know about the proper syntax for baregrep, but for the standard UNIX grep for Win32, the following would give you an accurate count: grep -c "Final.*828931" c:\imail\declude\sniffer\logfile.log Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Tuesday, February 07, 2006 4:12 PM To: sniffer@SortMonster.com Subject: Re[2]: [sniffer] Bad Rule - 828931 Hello Matt, Tuesday, February 7, 2006, 6:27:25 PM, you wrote: M> rule number, and I don't have the tools set up or the knowledge of M> grep yet to do a piped query of Sniffer's logs to extract the spool file names. http://www.baremetalsoft.com/ is a great grep'er for windows. In BSD I always used ".*" to represent any number of characters, white space or non, but that didn't seem to work with baregrep. That's why I was trying to confirm with anyone on the list my regex of "Final\t828931" was an accurate regex to find every message that 'finaled' on that rule. I'm praying that I screwed up the expression and I don't have 22,055 messages held by that rule. M> BTW, David, it is generally better not to hold or block on one single M> test, especially one that automates such listings (despite whatever M> safeguards there might be). I know, shame on me. I guess I'm used to the days that we used to be able to hold on sniffer alone. We have some safeguards in place now and are transitioning our rule methodologies but hadn't gotten to this one yet as this always seems to hit back-burner. This is also why I'd really like to see the content of the rule to see how it made it passed our safeguards. -- Best regards, Davidmailto:[EMAIL PROTECTED] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html --- This message and any included attachments are from Siemens Medical Solutions USA, Inc. and are intended only for the addressee(s). The information contained herein may include trade secrets or privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you received this message in error, or have reason to believe you are not authorized to receive it, please promptly delete this message and notify the sender by e-mail with a copy to [EMAIL PROTECTED] Thank you This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Bad Rule - 828931
Pete, Just to reemphasize the need for speed. I had 578 hits on that rule before I disabled it. George > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Pete McNeil > Sent: Tuesday, February 07, 2006 4:24 PM > To: Computer House Support > Subject: Re[2]: [sniffer] Bad Rule - 828931 > > I do most humbly apologize, > > It was my intention to do it immediately, however I became embroiled > in related support issues and was delayed. > > I don't expect more of these, but I will make announcing their > discovery the next event after removing them from the system. > > Thanks, > > _M > > On Tuesday, February 7, 2006, 4:19:24 PM, Computer wrote: > > CHS> Dear Pete, > > CHS> In the future, please let us know immediately when you become aware > of this. > CHS> As it is, I will spend the next 3 hours picking out the fales > positives from > CHS> the mailbox and forwarding them to the clients. If I could have put > the > CHS> rulepanic in place an hour ago it would have saved me a lot of work > and > CHS> confused customers. > > > CHS> Thank you, > > CHS> Michael Stein > CHS> Computer House > > > CHS> - Original Message - > CHS> From: "Pete McNeil" <[EMAIL PROTECTED]> > CHS> To: > CHS> Sent: Tuesday, February 07, 2006 4:07 PM > CHS> Subject: [sniffer] Bad Rule - 828931 > > > CHS> Hello Sniffer folks, > > CHS> I'm sorry to report that another bad rule got past us today. The > CHS> rule has been removed (was in from about 1200-1500), but it may be > CHS> in some of your rulebases. > > CHS> To avoid a problem with this rule you can enter a rule-panic entry > CHS> in your .cfg file for rule id: 828931 > > CHS> If it is not already, the rule will be gone from your rulebase > after > CHS> your next update. > > CHS> Thanks, > CHS> _M > > CHS> Pete McNeil (Madscientist) > CHS> President, MicroNeil Research Corporation > CHS> Chief SortMonster (www.sortmonster.com) > CHS> Chief Scientist (www.armresearch.com) > > > CHS> This E-Mail came from the Message Sniffer mailing list. For > information and > CHS> (un)subscription instructions go to > CHS> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > CHS> This E-Mail came from the Message Sniffer mailing list. For > CHS> information and (un)subscription instructions go to > CHS> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For information > and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Bad Rule - 828931
Dear Pete, Please excuse my previous E-mail if it seemed a bit harsh. I guess I am so used to your great service, that on the rare occasion when this happens, I panic. Thanks for being there to walk me through the procedure. Sincerely, Michael Stein Computer House - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Computer House Support" Sent: Tuesday, February 07, 2006 4:24 PM Subject: Re[2]: [sniffer] Bad Rule - 828931 I do most humbly apologize, It was my intention to do it immediately, however I became embroiled in related support issues and was delayed. I don't expect more of these, but I will make announcing their discovery the next event after removing them from the system. Thanks, _M On Tuesday, February 7, 2006, 4:19:24 PM, Computer wrote: CHS> Dear Pete, CHS> In the future, please let us know immediately when you become aware of this. CHS> As it is, I will spend the next 3 hours picking out the fales positives from CHS> the mailbox and forwarding them to the clients. If I could have put the CHS> rulepanic in place an hour ago it would have saved me a lot of work and CHS> confused customers. CHS> Thank you, CHS> Michael Stein CHS> Computer House CHS> - Original Message - CHS> From: "Pete McNeil" <[EMAIL PROTECTED]> CHS> To: CHS> Sent: Tuesday, February 07, 2006 4:07 PM CHS> Subject: [sniffer] Bad Rule - 828931 CHS> Hello Sniffer folks, CHS> I'm sorry to report that another bad rule got past us today. The CHS> rule has been removed (was in from about 1200-1500), but it may be CHS> in some of your rulebases. CHS> To avoid a problem with this rule you can enter a rule-panic entry CHS> in your .cfg file for rule id: 828931 CHS> If it is not already, the rule will be gone from your rulebase after CHS> your next update. CHS> Thanks, CHS> _M CHS> Pete McNeil (Madscientist) CHS> President, MicroNeil Research Corporation CHS> Chief SortMonster (www.sortmonster.com) CHS> Chief Scientist (www.armresearch.com) CHS> This E-Mail came from the Message Sniffer mailing list. For information and CHS> (un)subscription instructions go to CHS> http://www.sortmonster.com/MessageSniffer/Help/Help.html CHS> This E-Mail came from the Message Sniffer mailing list. For CHS> information and (un)subscription instructions go to CHS> http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Stock SPAM now HTML
This is going to get harder and harder to identify and fight. Is it worthwhile to put something like this in a new category which we are very confident about and so if it fails on the new combined image/text thing we can delete it outright? Not sure if this is a good idea or not but I had to add extra static filters to pop the older text only stock spam above my delete weight. This combined image/text is going to make it tougher I think. Thoughts? Goran Jovanovic Omega Network Solutions > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Pete McNeil > Sent: Thursday, February 02, 2006 11:40 AM > To: Goran Jovanovic > Subject: Re[2]: [sniffer] Stock SPAM now HTML > > There are some new mutations of the latest campaigns out today. These > ones look like they were hand tweaked (not evolved by machine). They > are a lot tougher, but I think we've got some abstracts coming out > that will get them. > > This new trend - using embedded images, adding static to images to > avoid hashing systems, stuffing text, and avoiding links and email > addresses is going to increase. > > _M > > On Thursday, February 2, 2006, 11:12:59 AM, Goran wrote: > > GJ> Will it ever stop :( > > GJ> Probably not. Actually maybe I shouldn't be wishing that SPAM stops > GJ> because then I would lose a revenue streamhmm conundrum > > GJ> Goran Jovanovic > GJ> Omega Network Solutions > > GJ> > > >> -Original Message- > >> From: [EMAIL PROTECTED] > GJ> [mailto:[EMAIL PROTECTED] > >> On Behalf Of Pete McNeil > >> Sent: Thursday, February 02, 2006 7:20 AM > >> To: Goran Jovanovic > >> Subject: Re: [sniffer] Stock SPAM now HTML > >> > >> On Wednesday, February 1, 2006, 11:30:49 PM, Goran wrote: > >> > >> GJ> > >> GJ> > >> GJ> > >> GJ> Well the plain text stock spam has just taken a turn to more > >> GJ> interesting and SNF is not capturing it yet as of 10:55 EST. I > GJ> have > >> submitted a couple to spam@ > >> GJ> > >> GJ> Now they are including part of a picture to make up the text. > >> GJ> Here is what the source looks like > >> > >> Isn't it amazing. > >> > >> I've coded some abstracts for this. More to come. > >> > >> _M > >> > >> > >> > >> This E-Mail came from the Message Sniffer mailing list. For > GJ> information > >> and (un)subscription instructions go to > >> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > GJ> This E-Mail came from the Message Sniffer mailing list. For > GJ> information and (un)subscription instructions go to > GJ> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For information > and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Stock Market Spam Messages
They seem to be different ones sporadically over the last week or so. I'll keep an eye on any new ones and let you know if they change. Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Thursday, January 26, 2006 10:54 AM To: Jim Matuska Jr. Subject: Re[2]: [sniffer] Stock Market Spam Messages I see. I misunderstood. We generally get text based stock-push campaigns very quickly. We have seen an increase in these recently tough. If it's a plain text stock push then it's most likely that you saw it before we did. I'll make sure that the rest of the team are watching out for these just in case - (we have two new guys on the team,... if they "pushed it back" then we might have been delayed in coding for it). Those guys are on this list too so they'll see this note when the get a minute. If you see the same one repeatedly then please .zip it and send a copy to support as a "chronic" spam. The other night I saw a burst of more than 5 new stock push campaigns come out in the same 10 minute period across the spamtraps. I thought that was unusual. It's possible, perhaps even likely, that you got this burst before we saw it. Please let use know if you're getting the same one repeatedly or different ones. Thanks, _M On Thursday, January 26, 2006, 11:55:52 AM, Jim wrote: JMJ> The ones I seem to be getting have no images, and are only plain text. JMJ> Jim Matuska Jr. JMJ> Computer Tech2, CCNA JMJ> Nez Perce Tribe JMJ> Information Systems JMJ> [EMAIL PROTECTED] JMJ> JMJ> -Original Message- JMJ> From: [EMAIL PROTECTED] JMJ> [mailto:[EMAIL PROTECTED] JMJ> On Behalf Of Pete McNeil JMJ> Sent: Thursday, January 26, 2006 8:53 AM JMJ> To: Jim Matuska Jr. JMJ> Subject: Re: [sniffer] Stock Market Spam Messages JMJ> On Thursday, January 26, 2006, 11:22:40 AM, Jim wrote: JMJ>> I seem to be noticing a lot of spam messages recently that are stock JMJ> ads for JMJ>> offshore companies; I seem to be getting a lot of these that are not JMJ> being JMJ>> classified by sniffer. I have been forwarding these to the spam@ JMJ> address, JMJ>> but have yet to notice any real changes. Any thoughts on these? JMJ> There has been a recent shift to using randomized images for these JMJ> which makes them a bit harder to defeat. JMJ> I'll take a look. JMJ> _M JMJ> This E-Mail came from the Message Sniffer mailing list. For information and JMJ> (un)subscription instructions go to JMJ> http://www.sortmonster.com/MessageSniffer/Help/Help.html JMJ> This E-Mail came from the Message Sniffer mailing list. For JMJ> information and (un)subscription instructions go to JMJ> http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] False Positives
Are you just blanket responding to every message to the list with this? If so, you might be wasting your time. I've been following the list, so I know things are back to normal after yesterday's snafu. Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" <[EMAIL PROTECTED]> Cc: ; <[EMAIL PROTECTED]> Sent: Wednesday, January 18, 2006 1:40 PM Subject: Re[2]: [sniffer] False Positives On Wednesday, January 18, 2006, 8:54:49 AM, Darin wrote: DC> Agreed. We counted 100 false positives yesterday, compared to our normal DC> rate of less than 5. DC> No false positives since 6pm ET yesterday, though. Thank goodness. Please visit: http://www.mail-archive.com/sniffer@sortmonster.com/msg02346.html and http://www.mail-archive.com/sniffer@sortmonster.com/msg02348.html Thanks, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Yeah -- Ive been getting a lot of credit card offers in my postal mail lately .. can we adapt a procmail filter to check my mail and wash my dog? Jonathan At 04:03 PM 12/30/2005, you wrote: Can I also use this product on my snailmail? :p From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]] On Behalf Of Jonathan Hickman Sent: vrijdag 30 december 2005 16:58 To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! I believe a new topic is in order. Quick, someone ask a newbie question! - Original Message - From: John W. Enyart To: sniffer@SortMonster.com Sent: Thursday, December 29, 2005 11:27 AM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Amen. Keep this professional, or take me off the list. My mailbox is filling up with this garbage. - John W. Enyart EAI, Inc. 3259 Blackberry Lane Malvern, PA 19355-9670 610/935/3085 FAX 610.935.3086 [EMAIL PROTECTED] From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]] On Behalf Of Wolf Tombe Sent: Thursday, December 29, 2005 11:23 AM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! What the heck is going on with people posting to this list lately? People seem to be jumping all over each other, jumping to a lot of conclusions and getting all riled up. Its the Holiday Season for goodness sake! Its supposed to be a time of good will to others. We can agree or disagree about the amount of the price hike; but is all the other escalating banter really necessary? Wolf From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]] On Behalf Of John T (Lists) Sent: Wednesday, December 28, 2005 9:33 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Joe, you are correct. I searched for and got out my agreement and it states Minimum Advertised Price. Memory does not always work so well. It is no ECC you know. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]] On Behalf Of Joe Wolf Sent: Wednesday, December 28, 2005 5:43 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! FYI, a reseller agreement may include a MAP (Minimum Advertised Price) but it is illegal in the United States for the agreement to determine a minimum selling price. Any such stipulation in an agreement would put both of you in violation of federal price-fixing laws. -Joe - Original Message - From: John T (Lists) To: sniffer@SortMonster.com Sent: Wednesday, December 28, 2005 7:29 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! According to the Reseller agreement I signed when I became a reseller of Message Sniffer, I can not charge that low of a price. As such, Pete or some one at Sniffer would need to notify me that I had permission to sell at such a low price. What I mean is, be careful. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 5:00 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Can I also use this product on my snailmail? :p From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jonathan Hickman Sent: vrijdag 30 december 2005 16:58 To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! I believe a new topic is in order. Quick, someone ask a newbie question! - Original Message - From: John W. Enyart To: sniffer@SortMonster.com Sent: Thursday, December 29, 2005 11:27 AM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Amen. Keep this professional, or take me off the list. My mailbox is filling up with this garbage. - John W. Enyart EAI, Inc. 3259 Blackberry Lane Malvern, PA 19355-9670 610/935/3085 FAX 610.935.3086 [EMAIL PROTECTED] From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Wolf Tombe Sent: Thursday, December 29, 2005 11:23 AM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! What the heck is going on with people posting to this list lately? People seem to be jumping all over each other, jumping to a lot of conclusions and getting all riled up. It’s the Holiday Season for goodness sake! It’s supposed to be a time of good will to others. We can agree or disagree about the amount of the price hike; but is all the other escalating banter really necessary? Wolf From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Wednesday, December 28, 2005 9:33 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Joe, you are correct. I searched for and got out my agreement and it states Minimum Advertised Price. Memory does not always work so well. It is no ECC you know. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Wolf Sent: Wednesday, December 28, 2005 5:43 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! FYI, a reseller agreement may include a MAP (Minimum Advertised Price) but it is illegal in the United States for the agreement to determine a minimum selling price. Any such stipulation in an agreement would put both of you in violation of federal price-fixing laws. -Joe - Original Message - From: John T (Lists) To: sniffer@SortMonster.com Sent: Wednesday, December 28, 2005 7:29 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! According to the Reseller agreement I signed when I became a reseller of Message Sniffer, I can not charge that low of a price. As such, Pete or some one at Sniffer would need to notify me that I had permission to sell at such a low price. What I mean is, be careful. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 5:00 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Wow, you supply all your staff members with StarBucks coffee everyday? Must be a nice place to work. No wonder the price hike doesn't effect you much! Happy New Year and lots of StarBucks coffee to you and yours! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of george Sent: Friday, December 30, 2005 12:05 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! After much debate, we decided that one staff member would switch one cup of coffee a day from Starbucks to 7-11 in order to fund the additional cost. We're also allowing them to play the soundtrack from 'Spamalot' while they drink it. Happy New Year to all. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > On Behalf Of Jonathan Hickman > Sent: Friday, December 30, 2005 10:58 AM > To: sniffer@SortMonster.com > Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! > > I believe a new topic is in order. Quick, someone ask a newbie question! > > - Original Message - > From: John W. Enyart <mailto:[EMAIL PROTECTED]> > To: sniffer@SortMonster.com > Sent: Thursday, December 29, 2005 11:27 AM > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > Amen. Keep this professional, or take me off the list. My mailbox is > filling up with this garbage. > > > - > John W. Enyart > EAI, Inc. > 3259 Blackberry Lane > Malvern, PA 19355-9670 > 610/935/3085 FAX 610.935.3086 > [EMAIL PROTECTED] > > > > From: [EMAIL PROTECTED] [mailto:sniffer- > [EMAIL PROTECTED] On Behalf Of Wolf Tombe > Sent: Thursday, December 29, 2005 11:23 AM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > > > What the heck is going on with people posting to this list lately? > People seem to be jumping all over each other, jumping to a lot of > conclusions and getting all riled up. It's the Holiday Season for > goodness sake! It's supposed to be a time of good will to others. We > can agree or disagree about the amount of the price hike; but is all > the other escalating banter really necessary? > > > > Wolf > > > > > > > > From: [EMAIL PROTECTED] [mailto:sniffer- > [EMAIL PROTECTED] On Behalf Of John T (Lists) > Sent: Wednesday, December 28, 2005 9:33 PM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > > > Joe, you are correct. I searched for and got out my agreement and it > states Minimum Advertised Price. > > > > Memory does not always work so well. > > > > It is no ECC you know. > > > > John T > > eServices For You > > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:sniffer- > [EMAIL PROTECTED] On Behalf Of Joe Wolf > Sent: Wednesday, December 28, 2005 5:43 PM > To: sniffer@SortMonster.com > Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! > > > > FYI, a reseller agreement may include a MAP (Minimum Advertised > Price) but it is illegal in the United States for the agreement to > determine a minimum selling price. Any such stipulation in an > agreement would put both of you in violation of federal price-fixing laws. > > > > -Joe > > - Original Message - > > From: John T (Lists) <mailto:[EMAIL PROTECTED]> > > To: sniffer@SortMonster.com > > Sent: Wednesday, December 28, 2005 7:29 PM > > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old > price! > > > > According to the Reseller agreement I signed when I became a > reseller of Message Sniffer, I can not charge that low of a price. > > > > As such, Pete or some one at Sniffer would need to notify me that I > had permission to sell at such a low price. > > > > What I mean is, be careful. > > > > John T > > eServices For You > > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:sniffer- > [EMAIL PROTECTED] On Behalf Of Kevin > Sent: Wednesday, December 28, 2005 5:00 PM > To: sniffer@SortMonster.com >
RE: Re[2]: [sniffer] Last chance to renew at the old price!
After much debate, we decided that one staff member would switch one cup of coffee a day from Starbucks to 7-11 in order to fund the additional cost. We're also allowing them to play the soundtrack from 'Spamalot' while they drink it. Happy New Year to all. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > On Behalf Of Jonathan Hickman > Sent: Friday, December 30, 2005 10:58 AM > To: sniffer@SortMonster.com > Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! > > I believe a new topic is in order. Quick, someone ask a newbie question! > > - Original Message - > From: John W. Enyart <mailto:[EMAIL PROTECTED]> > To: sniffer@SortMonster.com > Sent: Thursday, December 29, 2005 11:27 AM > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > Amen. Keep this professional, or take me off the list. My mailbox > is filling up with this garbage. > > > - > John W. Enyart > EAI, Inc. > 3259 Blackberry Lane > Malvern, PA 19355-9670 > 610/935/3085 FAX 610.935.3086 > [EMAIL PROTECTED] > > > > From: [EMAIL PROTECTED] [mailto:sniffer- > [EMAIL PROTECTED] On Behalf Of Wolf Tombe > Sent: Thursday, December 29, 2005 11:23 AM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > > > What the heck is going on with people posting to this list lately? > People seem to be jumping all over each other, jumping to a lot of > conclusions and getting all riled up. It's the Holiday Season for > goodness sake! It's supposed to be a time of good will to others. We can > agree or disagree about the amount of the price hike; but is all the other > escalating banter really necessary? > > > > Wolf > > > > > > > > From: [EMAIL PROTECTED] [mailto:sniffer- > [EMAIL PROTECTED] On Behalf Of John T (Lists) > Sent: Wednesday, December 28, 2005 9:33 PM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > > > Joe, you are correct. I searched for and got out my agreement and it > states Minimum Advertised Price. > > > > Memory does not always work so well. > > > > It is no ECC you know. > > > > John T > > eServices For You > > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:sniffer- > [EMAIL PROTECTED] On Behalf Of Joe Wolf > Sent: Wednesday, December 28, 2005 5:43 PM > To: sniffer@SortMonster.com > Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! > > > > FYI, a reseller agreement may include a MAP (Minimum Advertised > Price) but it is illegal in the United States for the agreement to > determine a minimum selling price. Any such stipulation in an agreement > would put both of you in violation of federal price-fixing laws. > > > > -Joe > > - Original Message - > > From: John T (Lists) <mailto:[EMAIL PROTECTED]> > > To: sniffer@SortMonster.com > > Sent: Wednesday, December 28, 2005 7:29 PM > > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old > price! > > > > According to the Reseller agreement I signed when I became a > reseller of Message Sniffer, I can not charge that low of a price. > > > > As such, Pete or some one at Sniffer would need to notify me > that I had permission to sell at such a low price. > > > > What I mean is, be careful. > > > > John T > > eServices For You > > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:sniffer- > [EMAIL PROTECTED] On Behalf Of Kevin > Sent: Wednesday, December 28, 2005 5:00 PM > To: sniffer@SortMonster.com > Subject: Re: Re[2]: [sniffer] Last chance to renew at the old > price! > > > > After posting this, another reseller pm me their renewal rate > of $269. I didn't know Sniffer had another reseller besides Declude. > > Anyways, for those who are interested and want to save money, > it's https://www.computerhouse.com/ccsecure.html > > > At 01:21 PM 12/28/2005, you wrote: &g
Re: Re[2]: [sniffer] Last chance to renew at the old price!
I believe a new topic is in order. Quick, someone ask a newbie question! - Original Message - From: John W. Enyart To: sniffer@SortMonster.com Sent: Thursday, December 29, 2005 11:27 AM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Amen. Keep this professional, or take me off the list. My mailbox is filling up with this garbage. - John W. Enyart EAI, Inc. 3259 Blackberry Lane Malvern, PA 19355-9670 610/935/3085 FAX 610.935.3086 [EMAIL PROTECTED] From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Wolf TombeSent: Thursday, December 29, 2005 11:23 AMTo: sniffer@SortMonster.comSubject: RE: Re[2]: [sniffer] Last chance to renew at the old price! What the heck is going on with people posting to this list lately? People seem to be jumping all over each other, jumping to a lot of conclusions and getting all riled up. Its the Holiday Season for goodness sake! Its supposed to be a time of good will to others. We can agree or disagree about the amount of the price hike; but is all the other escalating banter really necessary? Wolf From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Wednesday, December 28, 2005 9:33 PMTo: sniffer@SortMonster.comSubject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Joe, you are correct. I searched for and got out my agreement and it states Minimum Advertised Price. Memory does not always work so well. It is no ECC you know. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe WolfSent: Wednesday, December 28, 2005 5:43 PMTo: sniffer@SortMonster.comSubject: Re: Re[2]: [sniffer] Last chance to renew at the old price! FYI, a reseller agreement may include a MAP (Minimum Advertised Price) but it is illegal in the United States for the agreement to determine a minimum selling price. Any such stipulation in an agreement would put both of you in violation of federal price-fixing laws. -Joe - Original Message - From: John T (Lists) To: sniffer@SortMonster.com Sent: Wednesday, December 28, 2005 7:29 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! According to the Reseller agreement I signed when I became a reseller of Message Sniffer, I can not charge that low of a price. As such, Pete or some one at Sniffer would need to notify me that I had permission to sell at such a low price. What I mean is, be careful. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of KevinSent: Wednesday, December 28, 2005 5:00 PMTo: sniffer@SortMonster.comSubject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude.Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too.This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Amen. Keep this professional, or take me off the list. My mailbox is filling up with this garbage. - John W. Enyart EAI, Inc. 3259 Blackberry Lane Malvern, PA 19355-9670 610/935/3085 FAX 610.935.3086 [EMAIL PROTECTED] From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Wolf TombeSent: Thursday, December 29, 2005 11:23 AMTo: sniffer@SortMonster.comSubject: RE: Re[2]: [sniffer] Last chance to renew at the old price! What the heck is going on with people posting to this list lately? People seem to be jumping all over each other, jumping to a lot of conclusions and getting all riled up. It’s the Holiday Season for goodness sake! It’s supposed to be a time of good will to others. We can agree or disagree about the amount of the price hike; but is all the other escalating banter really necessary? Wolf From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists)Sent: Wednesday, December 28, 2005 9:33 PMTo: sniffer@SortMonster.comSubject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Joe, you are correct. I searched for and got out my agreement and it states Minimum Advertised Price. Memory does not always work so well. It is no ECC you know. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe WolfSent: Wednesday, December 28, 2005 5:43 PMTo: sniffer@SortMonster.comSubject: Re: Re[2]: [sniffer] Last chance to renew at the old price! FYI, a reseller agreement may include a MAP (Minimum Advertised Price) but it is illegal in the United States for the agreement to determine a minimum selling price. Any such stipulation in an agreement would put both of you in violation of federal price-fixing laws. -Joe - Original Message - From: John T (Lists) To: sniffer@SortMonster.com Sent: Wednesday, December 28, 2005 7:29 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! According to the Reseller agreement I signed when I became a reseller of Message Sniffer, I can not charge that low of a price. As such, Pete or some one at Sniffer would need to notify me that I had permission to sell at such a low price. What I mean is, be careful. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of KevinSent: Wednesday, December 28, 2005 5:00 PMTo: sniffer@SortMonster.comSubject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude.Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too.This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
What the heck is going on with people posting to this list lately? People seem to be jumping all over each other, jumping to a lot of conclusions and getting all riled up. It’s the Holiday Season for goodness sake! It’s supposed to be a time of good will to others. We can agree or disagree about the amount of the price hike; but is all the other escalating banter really necessary? Wolf From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Wednesday, December 28, 2005 9:33 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Joe, you are correct. I searched for and got out my agreement and it states Minimum Advertised Price. Memory does not always work so well. It is no ECC you know. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Wolf Sent: Wednesday, December 28, 2005 5:43 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! FYI, a reseller agreement may include a MAP (Minimum Advertised Price) but it is illegal in the United States for the agreement to determine a minimum selling price. Any such stipulation in an agreement would put both of you in violation of federal price-fixing laws. -Joe - Original Message - From: John T (Lists) To: sniffer@SortMonster.com Sent: Wednesday, December 28, 2005 7:29 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! According to the Reseller agreement I signed when I became a reseller of Message Sniffer, I can not charge that low of a price. As such, Pete or some one at Sniffer would need to notify me that I had permission to sell at such a low price. What I mean is, be careful. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 5:00 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
We should probably slow down here a bit .. I don't think it was John T that solicited the guy off-list. John T was simply saying, "if anyone wants options, let me know.. oh, and this other guy could be shady since the price is too low". Sure it was a sales tactic, but I don't think he was the first guy ... Jonathan At 08:00 PM 12/28/2005, you wrote: You certainly crossed a line of ethical integrity at the very least. Pete: If you don't already have a 'non-compete' agreement in your reseller agreement its time. I would never have believed someone would actually try to sell your reseller rates to your customer base. It's simply appalling. And should be grounds for termination. -Original Message- From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]]On Behalf Of John T (Lists) Sent: Wednesday, December 28, 2005 8:46 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Absolutely not. In fact, if you read my post after this, I am questioning whether or not it can be sold for a lower price. I am not here to undermine any one, as after all where do you think the license that I sell comes from? After all, we are all here to help one another. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]] On Behalf Of Peer-to-Peer (Support) Sent: Wednesday, December 28, 2005 5:41 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! John T: Did you just solicit the ENTIRE sniffer community with pricing that will undermine Pete? Never bit the hand that feeds you my friend. -Original Message- From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]]On Behalf Of John T (Lists) Sent: Wednesday, December 28, 2005 8:17 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Although I am a registered reseller, I normally only sell hardware and software to clients as part of my services. However, if any one is interested in a price, contact me off list. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [ mailto:[EMAIL PROTECTED]] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 5:00 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Joe, you are correct. I searched for and got out my agreement and it states Minimum Advertised Price. Memory does not always work so well. It is no ECC you know. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Wolf Sent: Wednesday, December 28, 2005 5:43 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! FYI, a reseller agreement may include a MAP (Minimum Advertised Price) but it is illegal in the United States for the agreement to determine a minimum selling price. Any such stipulation in an agreement would put both of you in violation of federal price-fixing laws. -Joe - Original Message - From: John T (Lists) To: sniffer@SortMonster.com Sent: Wednesday, December 28, 2005 7:29 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! According to the Reseller agreement I signed when I became a reseller of Message Sniffer, I can not charge that low of a price. As such, Pete or some one at Sniffer would need to notify me that I had permission to sell at such a low price. What I mean is, be careful. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 5:00 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
1. What is YOUR motive for taking such a tone? 2. I never made an out right solicitation. It was done in for the benefit of others. I am a small business and to my bottom line, every dollar or 5 dollars or 10 dollars count. I clearly said I am not in the business of selling software or hardware. I have turned away requests before from people that have contacted me off list about software. It is extremely rare that I will sell to other than my clients. 3. How do you respond to the posting on this very list by Pete just a bit ago that the seller selling at such a low rate is a valid reseller? 4. How do you respond to the posting on this very list by Michael Murdock that yes you can renew with Declude at a lower cost? Your responses are injecting that I am taking advantage of something or trying to take away something from SortMonster. That is not true at all. Your comment about competing is very unusual, in that in essence many of us are natural competitors to one anther, yet day after day we help each other, in essence helping our competitor. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Peer-to-Peer (Support) Sent: Wednesday, December 28, 2005 6:01 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! You certainly crossed a line of ethical integrity at the very least. Pete: If you don't already have a 'non-compete' agreement in your reseller agreement its time. I would never have believed someone would actually try to sell your reseller rates to your customer base. It's simply appalling. And should be grounds for termination. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of John T (Lists) Sent: Wednesday, December 28, 2005 8:46 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Absolutely not. In fact, if you read my post after this, I am questioning whether or not it can be sold for a lower price. I am not here to undermine any one, as after all where do you think the license that I sell comes from? After all, we are all here to help one another. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Peer-to-Peer (Support) Sent: Wednesday, December 28, 2005 5:41 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! John T: Did you just solicit the ENTIRE sniffer community with pricing that will undermine Pete? Never bit the hand that feeds you my friend. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of John T (Lists) Sent: Wednesday, December 28, 2005 8:17 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Although I am a registered reseller, I normally only sell hardware and software to clients as part of my services. However, if any one is interested in a price, contact me off list. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 5:00 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
You certainly crossed a line of ethical integrity at the very least. Pete: If you don't already have a 'non-compete' agreement in your reseller agreement its time. I would never have believed someone would actually try to sell your reseller rates to your customer base. It's simply appalling. And should be grounds for termination. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of John T (Lists)Sent: Wednesday, December 28, 2005 8:46 PMTo: sniffer@SortMonster.comSubject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Absolutely not. In fact, if you read my post after this, I am questioning whether or not it can be sold for a lower price. I am not here to undermine any one, as after all where do you think the license that I sell comes from? After all, we are all here to help one another. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Peer-to-Peer (Support)Sent: Wednesday, December 28, 2005 5:41 PMTo: sniffer@SortMonster.comSubject: RE: Re[2]: [sniffer] Last chance to renew at the old price! John T: Did you just solicit the ENTIRE sniffer community with pricing that will undermine Pete? Never bit the hand that feeds you my friend. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of John T (Lists)Sent: Wednesday, December 28, 2005 8:17 PMTo: sniffer@SortMonster.comSubject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Although I am a registered reseller, I normally only sell hardware and software to clients as part of my services. However, if any one is interested in a price, contact me off list. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of KevinSent: Wednesday, December 28, 2005 5:00 PMTo: sniffer@SortMonster.comSubject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude.Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too.This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Absolutely not. In fact, if you read my post after this, I am questioning whether or not it can be sold for a lower price. I am not here to undermine any one, as after all where do you think the license that I sell comes from? After all, we are all here to help one another. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Peer-to-Peer (Support) Sent: Wednesday, December 28, 2005 5:41 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! John T: Did you just solicit the ENTIRE sniffer community with pricing that will undermine Pete? Never bit the hand that feeds you my friend. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of John T (Lists) Sent: Wednesday, December 28, 2005 8:17 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Although I am a registered reseller, I normally only sell hardware and software to clients as part of my services. However, if any one is interested in a price, contact me off list. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 5:00 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Last chance to renew at the old price!
FYI, a reseller agreement may include a MAP (Minimum Advertised Price) but it is illegal in the United States for the agreement to determine a minimum selling price. Any such stipulation in an agreement would put both of you in violation of federal price-fixing laws. -Joe - Original Message - From: John T (Lists) To: sniffer@SortMonster.com Sent: Wednesday, December 28, 2005 7:29 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! According to the Reseller agreement I signed when I became a reseller of Message Sniffer, I can not charge that low of a price. As such, Pete or some one at Sniffer would need to notify me that I had permission to sell at such a low price. What I mean is, be careful. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of KevinSent: Wednesday, December 28, 2005 5:00 PMTo: sniffer@SortMonster.comSubject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude.Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too.This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
John T: Did you just solicit the ENTIRE sniffer community with pricing that will undermine Pete? Never bit the hand that feeds you my friend. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of John T (Lists)Sent: Wednesday, December 28, 2005 8:17 PMTo: sniffer@SortMonster.comSubject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Although I am a registered reseller, I normally only sell hardware and software to clients as part of my services. However, if any one is interested in a price, contact me off list. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of KevinSent: Wednesday, December 28, 2005 5:00 PMTo: sniffer@SortMonster.comSubject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude.Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too.This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
According to the Reseller agreement I signed when I became a reseller of Message Sniffer, I can not charge that low of a price. As such, Pete or some one at Sniffer would need to notify me that I had permission to sell at such a low price. What I mean is, be careful. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 5:00 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Although I am a registered reseller, I normally only sell hardware and software to clients as part of my services. However, if any one is interested in a price, contact me off list. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 5:00 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Last chance to renew at the old price!
rats .. I didn't even see that I could do that. I just renewed direct and paid the extra .. At 03:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Are they a valid reseller, sniffer-folks?? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of KevinSent: Wednesday, December 28, 2005 8:00 PMTo: sniffer@SortMonster.comSubject: Re: Re[2]: [sniffer] Last chance to renew at the old price! After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude.Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too.This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Last chance to renew at the old price!
After posting this, another reseller pm me their renewal rate of $269. I didn't know Sniffer had another reseller besides Declude. Anyways, for those who are interested and want to save money, it's https://www.computerhouse.com/ccsecure.html At 01:21 PM 12/28/2005, you wrote: Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Yes, you can renew with Declude. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Wednesday, December 28, 2005 3:22 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Last chance to renew at the old price!
Can we renew at declude.com since their pricing is $292.50? I assume their prices will increase on Jan 1, 2006 too. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Last chance to renew at the old price!
I agree that it's worth it. I just wish I had had more notice to plan for the expense. I didn't receive the announcement you mentioned. Darin. - Original Message - From: "Chuck Schick" <[EMAIL PROTECTED]> To: Sent: Wednesday, December 28, 2005 11:58 AM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! I received an announcement from Karen Perry of MicroNeil on Novemeber 20th there was going to be a price increase. Since the salutation said "Dear Sniffer Customer" I thought everyone received the notice (maybe I am special - doubt it). While I don't like any price increase - I understand that it is necessary. I also thought it was generous of Microneil to allow me to lock in the existing price for a year - actually by paying the annual fee instead of the month to month I will be paying $35 less for sniffer next year. I guess it is all on how you look at it. Is sniffer worth $30 a month to me - obviously because I have been paying it. Is it worth $45 a month to me, probably but I don't have to decide until the end of 2006. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, December 27, 2005 7:11 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! I think I remember hearing there might be a rate change in the near future, but nothing definite. Telling people on a list it was on the website seems a bit silly. It should have been posted to the list when it was posted to the website. I know I wouldn't check the website unless there was something I needed from it. Darin. - Original Message - From: "John T (Lists)" <[EMAIL PROTECTED]> To: Sent: Tuesday, December 27, 2005 8:44 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Pete, I am both a Sniffer reseller and user, and I was blind sided by this announcement. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Tuesday, December 27, 2005 2:11 PM > To: Darin Cox > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > I'm sorry that it wasn't more visible. We have been talking about this > for several months and have made a few announcements. It has also been > on the web site for several months. > > My announcement today was just to make sure that anyone who had not > heard didn't get blind-sided. Sorry it didn't turn out that way. We > will be working on some better out-reach problems to help avoid this > in the future. > > _M > > On Tuesday, December 27, 2005, 4:02:15 PM, Darin wrote: > > DC> Wow... last minute notice. It's difficult to budgets for these > DC> things with > DC> so little notice. Please consider a couple month's notice the > DC> next time. > > DC> Darin. > > > DC> - Original Message - > DC> From: "Pete McNeil" <[EMAIL PROTECTED]> > DC> To: > DC> Sent: Tuesday, December 27, 2005 12:42 PM > DC> Subject: [sniffer] Last chance to renew at the old price! > > > DC> Hello Sniffer folks, > > DC> This is just a friendly reminder that prices will be going up > DC> January 1. > > DC> You can add a year to your SNF subscription at the current price if > DC> you renew before January 1. > > DC> Details are here: > DC> https://www.armresearch.com/message-sniffer/forms/form-renewal.asp > > DC> Thanks, > DC> _M > > DC> Pete McNeil (Madscientist) > DC> President, MicroNeil Research Corporation > DC> Chief SortMonster (www.sortmonster.com) > DC> Chief Scientist (www.armresearch.com) > > > DC> This E-Mail came from the Message Sniffer mailing list. For information and > DC> (un)subscription instructions go to > DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > DC> This E-Mail came from the Message Sniffer mailing list. For > DC> information and (un)subscription instructions go to > DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For > information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
I received an announcement from Karen Perry of MicroNeil on Novemeber 20th there was going to be a price increase. Since the salutation said "Dear Sniffer Customer" I thought everyone received the notice (maybe I am special - doubt it). While I don't like any price increase - I understand that it is necessary. I also thought it was generous of Microneil to allow me to lock in the existing price for a year - actually by paying the annual fee instead of the month to month I will be paying $35 less for sniffer next year. I guess it is all on how you look at it. Is sniffer worth $30 a month to me - obviously because I have been paying it. Is it worth $45 a month to me, probably but I don't have to decide until the end of 2006. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, December 27, 2005 7:11 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! I think I remember hearing there might be a rate change in the near future, but nothing definite. Telling people on a list it was on the website seems a bit silly. It should have been posted to the list when it was posted to the website. I know I wouldn't check the website unless there was something I needed from it. Darin. - Original Message - From: "John T (Lists)" <[EMAIL PROTECTED]> To: Sent: Tuesday, December 27, 2005 8:44 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Pete, I am both a Sniffer reseller and user, and I was blind sided by this announcement. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Tuesday, December 27, 2005 2:11 PM > To: Darin Cox > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > I'm sorry that it wasn't more visible. We have been talking about this > for several months and have made a few announcements. It has also been > on the web site for several months. > > My announcement today was just to make sure that anyone who had not > heard didn't get blind-sided. Sorry it didn't turn out that way. We > will be working on some better out-reach problems to help avoid this > in the future. > > _M > > On Tuesday, December 27, 2005, 4:02:15 PM, Darin wrote: > > DC> Wow... last minute notice. It's difficult to budgets for these > DC> things with > DC> so little notice. Please consider a couple month's notice the > DC> next time. > > DC> Darin. > > > DC> - Original Message - > DC> From: "Pete McNeil" <[EMAIL PROTECTED]> > DC> To: > DC> Sent: Tuesday, December 27, 2005 12:42 PM > DC> Subject: [sniffer] Last chance to renew at the old price! > > > DC> Hello Sniffer folks, > > DC> This is just a friendly reminder that prices will be going up > DC> January 1. > > DC> You can add a year to your SNF subscription at the current price if > DC> you renew before January 1. > > DC> Details are here: > DC> https://www.armresearch.com/message-sniffer/forms/form-renewal.asp > > DC> Thanks, > DC> _M > > DC> Pete McNeil (Madscientist) > DC> President, MicroNeil Research Corporation > DC> Chief SortMonster (www.sortmonster.com) > DC> Chief Scientist (www.armresearch.com) > > > DC> This E-Mail came from the Message Sniffer mailing list. For information and > DC> (un)subscription instructions go to > DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > DC> This E-Mail came from the Message Sniffer mailing list. For > DC> information and (un)subscription instructions go to > DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For > information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
William -- the "gripping (sic)" has to do with the percentage increase, year over year, being exorbitant. I've already stated here, publicly, that we'll probably continue to use the software. What this amounts to, basically, is either past poor business planning (not raising prices for several years) or poor current cash flow forecasting (needing to raise prices an unreasonable amount immediately). And let's not forget, in order to take advantage of the special offer for existing customers, you *must* renew *now* -- not when your current subscription expires. Classic way to raise immediate cash. If your current subscription doesn't end until, say, September, 2006 -- the Sniffer folks will have the use of your cash for nine months before you receive any benefit of the expenditure. CLASSIC emergency cash raise. Like I said, we'll more than likely continue, but I'll pick month to month (which we do now) -- just in case. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Landry, > William (MED US) > Sent: Tuesday, December 27, 2005 5:57 PM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > > Thomas, if your company cannot afford the rather small > monetary increase, > and you are running that close to the edge, then maybe you > should not be in > business. I for one am glad to hear the SNF is adding > resources and has > mapped out a list of future feature enhancements. Please > quit your gripping > or take it off list. > > Bill > > -Original Message- > From: Fox, Thomas [mailto:[EMAIL PROTECTED] > Sent: Tuesday, December 27, 2005 2:40 PM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > Your interpretation of "a bit" as being 50+% is disingenuous > at best, and > thievery at the worst. > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > > Sent: Tuesday, December 27, 2005 5:34 PM > > To: Fox, Thomas > > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > > > On Tuesday, December 27, 2005, 5:14:13 PM, Thomas wrote: > > > > >> -Original Message- > > >> From: [EMAIL PROTECTED] > > >> [mailto:[EMAIL PROTECTED] On Behalf Of > Michael Murdoch > > >> > > >> If you don't feel that's the case, then you > > >> are free to decide if you think otherwise. Thanks and > take care! > > > > FT> EASY FOX TRANSLATION: > > > > FT> "Like it, or lump it." > > > > Translated another way... > > > > We could keep things as they are, stand still while spam generation > > technology advances rapidly, whither away, and die. > > > > OR > > > > We could charge a bit more, accelerate development and make > sure that > > SNF stays out in front and even expands the gap. > > > > I, for one, am not willing to make the first choice, and I > doubt that > > it would be in anyone's best interests - except, perhaps, the > > blackhats. > > > > _M > > > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > information and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > > > > --- > [This E-mail scanned for viruses by Declude Virus] > > > > This E-Mail came from the Message Sniffer mailing list. For > information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > -- > - > This message and any included attachments are from Siemens > Medical Solutions > USA, Inc. and are intended only for the addressee(s). > The information contained herein may include trade secrets or > privileged or > otherwise confidential information. Unauthorized review, > forwarding, printing, > copying, distributing, or using such information is strictly > prohibited and may > be unlawful. If you received this message in error, or have > reason to believe > you are not authorized to receive it, please promptly delete > this message and > notify the sender by e-mail with a copy to > [EMAIL PROTECTED] > > Thank you > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Pete, I am both a Sniffer reseller and user, and I was blind sided by this announcement. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Tuesday, December 27, 2005 2:11 PM > To: Darin Cox > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > I'm sorry that it wasn't more visible. We have been talking about this > for several months and have made a few announcements. It has also been > on the web site for several months. > > My announcement today was just to make sure that anyone who had not > heard didn't get blind-sided. Sorry it didn't turn out that way. We > will be working on some better out-reach problems to help avoid this > in the future. > > _M > > On Tuesday, December 27, 2005, 4:02:15 PM, Darin wrote: > > DC> Wow... last minute notice. It's difficult to budgets for these things with > DC> so little notice. Please consider a couple month's notice the next time. > > DC> Darin. > > > DC> - Original Message - > DC> From: "Pete McNeil" <[EMAIL PROTECTED]> > DC> To: > DC> Sent: Tuesday, December 27, 2005 12:42 PM > DC> Subject: [sniffer] Last chance to renew at the old price! > > > DC> Hello Sniffer folks, > > DC> This is just a friendly reminder that prices will be going up > DC> January 1. > > DC> You can add a year to your SNF subscription at the current price if > DC> you renew before January 1. > > DC> Details are here: > DC> https://www.armresearch.com/message-sniffer/forms/form-renewal.asp > > DC> Thanks, > DC> _M > > DC> Pete McNeil (Madscientist) > DC> President, MicroNeil Research Corporation > DC> Chief SortMonster (www.sortmonster.com) > DC> Chief Scientist (www.armresearch.com) > > > DC> This E-Mail came from the Message Sniffer mailing list. For information and > DC> (un)subscription instructions go to > DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > DC> This E-Mail came from the Message Sniffer mailing list. For > DC> information and (un)subscription instructions go to > DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Last chance to renew at the old price!
I think I remember hearing there might be a rate change in the near future, but nothing definite. Telling people on a list it was on the website seems a bit silly. It should have been posted to the list when it was posted to the website. I know I wouldn't check the website unless there was something I needed from it. Darin. - Original Message - From: "John T (Lists)" <[EMAIL PROTECTED]> To: Sent: Tuesday, December 27, 2005 8:44 PM Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Pete, I am both a Sniffer reseller and user, and I was blind sided by this announcement. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Tuesday, December 27, 2005 2:11 PM > To: Darin Cox > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > I'm sorry that it wasn't more visible. We have been talking about this > for several months and have made a few announcements. It has also been > on the web site for several months. > > My announcement today was just to make sure that anyone who had not > heard didn't get blind-sided. Sorry it didn't turn out that way. We > will be working on some better out-reach problems to help avoid this > in the future. > > _M > > On Tuesday, December 27, 2005, 4:02:15 PM, Darin wrote: > > DC> Wow... last minute notice. It's difficult to budgets for these things with > DC> so little notice. Please consider a couple month's notice the next time. > > DC> Darin. > > > DC> - Original Message - > DC> From: "Pete McNeil" <[EMAIL PROTECTED]> > DC> To: > DC> Sent: Tuesday, December 27, 2005 12:42 PM > DC> Subject: [sniffer] Last chance to renew at the old price! > > > DC> Hello Sniffer folks, > > DC> This is just a friendly reminder that prices will be going up > DC> January 1. > > DC> You can add a year to your SNF subscription at the current price if > DC> you renew before January 1. > > DC> Details are here: > DC> https://www.armresearch.com/message-sniffer/forms/form-renewal.asp > > DC> Thanks, > DC> _M > > DC> Pete McNeil (Madscientist) > DC> President, MicroNeil Research Corporation > DC> Chief SortMonster (www.sortmonster.com) > DC> Chief Scientist (www.armresearch.com) > > > DC> This E-Mail came from the Message Sniffer mailing list. For information and > DC> (un)subscription instructions go to > DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > DC> This E-Mail came from the Message Sniffer mailing list. For > DC> information and (un)subscription instructions go to > DC> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
The only problem with that, and one which I do not know how large of a problem it is, is if you have always provided a single product, and suddenly divide it into 2 levels, you end up with twice the amount of critics: Those that pay less but expect more, those that pay more and then expect even more. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Rick Robeson > Sent: Tuesday, December 27, 2005 2:54 PM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > The thought does occur to me of how other companies have dealt with similar > issues. > That issue being how to address a market requiring internal expansion (i.e. > expanded reinvestment) while not alienating an existing satisifed customer > base. Many companies simply split their product line into 'basic' and > 'premium' services. If the need is as great as Michael says, and the new > revisions will result in vastly improved service, than most of their > existing customers should want to move forward. However, giving people the > option to 'stand still' is viable, good marketing, and good strategy. At > this point, you have a certain catch 22. Everyone that pays now (for next > year) is still paying you at the same rate (meaning no expanded funds), but > is now wondering if they're doing the right thing. Almost seems like the > only way to make the current strategy pay off would have been to demand the > increased fees from all clients and not given the grace period for renewing > at the old rate. At least that way, you'd have gotten something in return > for any perceived customer dissatisfaction. > > Consider expanding to a two-tier service option. It really can work well, > especially when in the future you might want to charge even more, but not > alienate 'new' customers who need a lower buy-in. > > > Rick Robeson > getlocalnews.com > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > > > > -Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Fox, Thomas > Sent: Tuesday, December 27, 2005 2:40 PM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! > > > Your interpretation of "a bit" as being 50+% > is disingenuous at best, and thievery at the > worst. > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > > Sent: Tuesday, December 27, 2005 5:34 PM > > To: Fox, Thomas > > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > > > On Tuesday, December 27, 2005, 5:14:13 PM, Thomas wrote: > > > > >> -Original Message- > > >> From: [EMAIL PROTECTED] > > >> [mailto:[EMAIL PROTECTED] On Behalf Of Michael Murdoch > > >> > > >> If you don't feel that's the case, then you > > >> are free to decide if you think otherwise. Thanks and take care! > > > > FT> EASY FOX TRANSLATION: > > > > FT> "Like it, or lump it." > > > > Translated another way... > > > > We could keep things as they are, stand still while spam generation > > technology advances rapidly, whither away, and die. > > > > OR > > > > We could charge a bit more, accelerate development and make sure that > > SNF stays out in front and even expands the gap. > > > > I, for one, am not willing to make the first choice, and I doubt that > > it would be in anyone's best interests - except, perhaps, the > > blackhats. > > > > _M > > > > > > > > This E-Mail came from the Message Sniffer mailing list. For > > information and (un)subscription instructions go to > > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > > > > --- > [This E-mail scanned for viruses by Declude Virus] > > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Hi Rick, That is an interesting proposal. For the sake of simplicity and efficiency, we decided that we would invest the resources and money needed to take SNF to the next level. New customers would come on at the new price level. Then out of consideration and appreciation to our existing customers, we would offer the opportunity to renew at the existing price for another year. As far as new/more revenue to drive these enhancements, we have already invested a great deal as stated before and are investing more everyday. Some more good news is that our new business, products and services are expanding at a rate that helps us get this done. So again, we wanted to say thank you to all of you guys and extend the grandfathered offer for a year. We believe that this was the reasonable thing to do. As far as running two levels/versions of our service, that is also very interesting, but again in our case it would mean a more complex system to support as we make these changes and implement the enhancements. For the future though, that's an idea that I'm sure we'll consider. Thanks and have a good night! Michael -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Robeson Sent: Tuesday, December 27, 2005 4:54 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! The thought does occur to me of how other companies have dealt with similar issues. That issue being how to address a market requiring internal expansion (i.e. expanded reinvestment) while not alienating an existing satisifed customer base. Many companies simply split their product line into 'basic' and 'premium' services. If the need is as great as Michael says, and the new revisions will result in vastly improved service, than most of their existing customers should want to move forward. However, giving people the option to 'stand still' is viable, good marketing, and good strategy. At this point, you have a certain catch 22. Everyone that pays now (for next year) is still paying you at the same rate (meaning no expanded funds), but is now wondering if they're doing the right thing. Almost seems like the only way to make the current strategy pay off would have been to demand the increased fees from all clients and not given the grace period for renewing at the old rate. At least that way, you'd have gotten something in return for any perceived customer dissatisfaction. Consider expanding to a two-tier service option. It really can work well, especially when in the future you might want to charge even more, but not alienate 'new' customers who need a lower buy-in. Rick Robeson getlocalnews.com [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Fox, Thomas Sent: Tuesday, December 27, 2005 2:40 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Your interpretation of "a bit" as being 50+% is disingenuous at best, and thievery at the worst. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Tuesday, December 27, 2005 5:34 PM > To: Fox, Thomas > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > On Tuesday, December 27, 2005, 5:14:13 PM, Thomas wrote: > > >> -Original Message- > >> From: [EMAIL PROTECTED] > >> [mailto:[EMAIL PROTECTED] On Behalf Of Michael Murdoch > >> > >> If you don't feel that's the case, then you > >> are free to decide if you think otherwise. Thanks and take care! > > FT> EASY FOX TRANSLATION: > > FT> "Like it, or lump it." > > Translated another way... > > We could keep things as they are, stand still while spam generation > technology advances rapidly, whither away, and die. > > OR > > We could charge a bit more, accelerate development and make sure that > SNF stays out in front and even expands the gap. > > I, for one, am not willing to make the first choice, and I doubt that > it would be in anyone's best interests - except, perhaps, the > blackhats. > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Thomas, if your company cannot afford the rather small monetary increase, and you are running that close to the edge, then maybe you should not be in business. I for one am glad to hear the SNF is adding resources and has mapped out a list of future feature enhancements. Please quit your gripping or take it off list. Bill -Original Message- From: Fox, Thomas [mailto:[EMAIL PROTECTED] Sent: Tuesday, December 27, 2005 2:40 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Your interpretation of "a bit" as being 50+% is disingenuous at best, and thievery at the worst. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Tuesday, December 27, 2005 5:34 PM > To: Fox, Thomas > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > On Tuesday, December 27, 2005, 5:14:13 PM, Thomas wrote: > > >> -Original Message- > >> From: [EMAIL PROTECTED] > >> [mailto:[EMAIL PROTECTED] On Behalf Of Michael Murdoch > >> > >> If you don't feel that's the case, then you > >> are free to decide if you think otherwise. Thanks and take care! > > FT> EASY FOX TRANSLATION: > > FT> "Like it, or lump it." > > Translated another way... > > We could keep things as they are, stand still while spam generation > technology advances rapidly, whither away, and die. > > OR > > We could charge a bit more, accelerate development and make sure that > SNF stays out in front and even expands the gap. > > I, for one, am not willing to make the first choice, and I doubt that > it would be in anyone's best interests - except, perhaps, the > blackhats. > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html --- This message and any included attachments are from Siemens Medical Solutions USA, Inc. and are intended only for the addressee(s). The information contained herein may include trade secrets or privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you received this message in error, or have reason to believe you are not authorized to receive it, please promptly delete this message and notify the sender by e-mail with a copy to [EMAIL PROTECTED] Thank you This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Agree wholeheartedly! Bill From: Dean Lawrence [mailto:[EMAIL PROTECTED] Sent: Tuesday, December 27, 2005 2:18 PMTo: sniffer@SortMonster.comSubject: Re: Re[2]: [sniffer] Last chance to renew at the old price! You know, I just don't get where all of the doom and gloom comes from. Yes, it is a large percentage increase, but it's still only 2 bucks a day to run the best piece of software on my server. I'm sure that they have taken these comments into consideration and will try to give more advanced notice in the future. But, to start with the "Time to start looking for another solutions" talk is rediculous. Reading Michael's description of what is going on over there suggests that their business is exploding, not imploding. And to keep on top of it, they need to increase their cash flow, not to buy nicer cars. I think everyone needs to look at how much Sniffer saves you everyday instead of griping about how much it costs you. Just my 2 cents. Dean On 12/27/05, Pete McNeil <[EMAIL PROTECTED]> wrote: Part of the purpose for additional staff is to reach a goal of FPprocessing measured in minutes to hours, never days as it is sometimes now. We also have some automated tools on the drawing board that willhelp to mitigate many FP cases on a self-serve basis. These will becoming in this next year._MOn Tuesday, December 27, 2005, 4:00:59 PM, Darin wrote: DC> Hi Michael,DC> How about false positive processing? That's our biggest headache, but itDC> would be drastically reduced by faster processing than the 3-5 days weDC> currently see.DC> Darin.DC> - Original Message -DC> From: "Michael Murdoch" <[EMAIL PROTECTED]>DC> To: < sniffer@SortMonster.com>DC> Cc: "Pete McNeil" <[EMAIL PROTECTED]>DC> Sent: Tuesday, December 27, 2005 2:13 PMDC> Subject: RE: [sniffer] Last chance to renew at the old price! DC> Hi Folks,DC> Actually, here is some more detail as to the reasons for the priceDC> increase. In addition, please bear in mind that that prices haven'tDC> been raised in approximately 2 years and even with this increase we are DC> priced very competitively.DC> The new feature/benefits and more to come are as follows:DC> * In the past 6 months we have more than doubled the number of updatesDC> per day and we will continue to increase our bandwidth and the speed of DC> our updates.DC> * We have more than tripled our staff to improve our monitoring,DC> support, and rule generation capabilities. Come January, we are againDC> doubling this staff as the black-hats have gotten much more DC> sophisticated and this has become a 24x7 battle. Even Pete needs toDC> sleep sometimes. :-)DC> * We are adding new R&D programs for AFF/419 spam and Malware mitigationDC> (many of the results from these projects have already been implemented). DC> * During this next year as part of our continuous improvement policy weDC> will continue to roll out new features and enhancements such as fullyDC> automated reporting, in-band real-time updates, an optimized message DC> processing pipeline, image and file attachment tagging, advanced headerDC> structure analysis, enhanced adaptive heuristics, improved machineDC> learning systems, real-time wave-front threat detection, and many DC> more...DC> It's important to recognize that many of our improvements don't requireDC> new software to be installed on the client side since they are deliveredDC> through rulebase enhancements. Though this often causes our work to go DC> unnoticed, it is actually a design feature since it means that yourDC> installation requires very little maintenance. This translates toDC> lowered administration costs and higher reliability.DC> As a result of this "reliability-first" design strategy, it may notDC> always be obvious that our service is constantly being improved andDC> enhanced - we never stand still ;-)DC> We'd hate to see any of you go, but please do compare us with other DC> services.DC> I'm sure that you'll find we're well worth the money, but it's alwaysDC> good to keep your options open. In fact, best practice these days forDC> spam filtering is to use a blended approach that leverages many DC> services. We personally encourage that for best results.DC> Please let me know if you have any questions. Thank you for yourDC> feedback and business!DC> SincerelyDC> Michael Murdoch DC> The Sniffer TeamDC> ARM Research Labs, LLCDC> Tel. 850-932-5338 x303DC> -Original Message-DC> From: [EMAIL PROTECTED] DC> [mailto:[EMAIL PROTECTED]] On Behalf Of Fox,
RE: Re[2]: [sniffer] Last chance to renew at the old price!
The thought does occur to me of how other companies have dealt with similar issues. That issue being how to address a market requiring internal expansion (i.e. expanded reinvestment) while not alienating an existing satisifed customer base. Many companies simply split their product line into 'basic' and 'premium' services. If the need is as great as Michael says, and the new revisions will result in vastly improved service, than most of their existing customers should want to move forward. However, giving people the option to 'stand still' is viable, good marketing, and good strategy. At this point, you have a certain catch 22. Everyone that pays now (for next year) is still paying you at the same rate (meaning no expanded funds), but is now wondering if they're doing the right thing. Almost seems like the only way to make the current strategy pay off would have been to demand the increased fees from all clients and not given the grace period for renewing at the old rate. At least that way, you'd have gotten something in return for any perceived customer dissatisfaction. Consider expanding to a two-tier service option. It really can work well, especially when in the future you might want to charge even more, but not alienate 'new' customers who need a lower buy-in. Rick Robeson getlocalnews.com [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Fox, Thomas Sent: Tuesday, December 27, 2005 2:40 PM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Last chance to renew at the old price! Your interpretation of "a bit" as being 50+% is disingenuous at best, and thievery at the worst. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Tuesday, December 27, 2005 5:34 PM > To: Fox, Thomas > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > On Tuesday, December 27, 2005, 5:14:13 PM, Thomas wrote: > > >> -Original Message- > >> From: [EMAIL PROTECTED] > >> [mailto:[EMAIL PROTECTED] On Behalf Of Michael Murdoch > >> > >> If you don't feel that's the case, then you > >> are free to decide if you think otherwise. Thanks and take care! > > FT> EASY FOX TRANSLATION: > > FT> "Like it, or lump it." > > Translated another way... > > We could keep things as they are, stand still while spam generation > technology advances rapidly, whither away, and die. > > OR > > We could charge a bit more, accelerate development and make sure that > SNF stays out in front and even expands the gap. > > I, for one, am not willing to make the first choice, and I doubt that > it would be in anyone's best interests - except, perhaps, the > blackhats. > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Your interpretation of "a bit" as being 50+% is disingenuous at best, and thievery at the worst. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Tuesday, December 27, 2005 5:34 PM > To: Fox, Thomas > Subject: Re[2]: [sniffer] Last chance to renew at the old price! > > On Tuesday, December 27, 2005, 5:14:13 PM, Thomas wrote: > > >> -Original Message- > >> From: [EMAIL PROTECTED] > >> [mailto:[EMAIL PROTECTED] On Behalf Of Michael Murdoch > >> > >> If you don't feel that's the case, then you > >> are free to decide if you think otherwise. Thanks and take care! > > FT> EASY FOX TRANSLATION: > > FT> "Like it, or lump it." > > Translated another way... > > We could keep things as they are, stand still while spam generation > technology advances rapidly, whither away, and die. > > OR > > We could charge a bit more, accelerate development and make sure that > SNF stays out in front and even expands the gap. > > I, for one, am not willing to make the first choice, and I doubt that > it would be in anyone's best interests - except, perhaps, the > blackhats. > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > --- > [This E-mail scanned for viruses by Declude Virus] > > --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Last chance to renew at the old price!
Thanks Dean - And thanks to all of you who have been very supportive and understanding of what we are doing here! From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dean Lawrence Sent: Tuesday, December 27, 2005 4:18 PM To: sniffer@sortmonster.com Subject: Re: Re[2]: [sniffer] Last chance to renew at the old price! You know, I just don't get where all of the doom and gloom comes from. Yes, it is a large percentage increase, but it's still only 2 bucks a day to run the best piece of software on my server. I'm sure that they have taken these comments into consideration and will try to give more advanced notice in the future. But, to start with the "Time to start looking for another solutions" talk is rediculous. Reading Michael's description of what is going on over there suggests that their business is exploding, not imploding. And to keep on top of it, they need to increase their cash flow, not to buy nicer cars. I think everyone needs to look at how much Sniffer saves you everyday instead of griping about how much it costs you. Just my 2 cents. Dean On 12/27/05, Pete McNeil <[EMAIL PROTECTED]> wrote: Part of the purpose for additional staff is to reach a goal of FP processing measured in minutes to hours, never days as it is sometimes now. We also have some automated tools on the drawing board that will help to mitigate many FP cases on a self-serve basis. These will be coming in this next year. _M On Tuesday, December 27, 2005, 4:00:59 PM, Darin wrote: DC> Hi Michael, DC> How about false positive processing? That's our biggest headache, but it DC> would be drastically reduced by faster processing than the 3-5 days we DC> currently see. DC> Darin. DC> - Original Message - DC> From: "Michael Murdoch" <[EMAIL PROTECTED]> DC> To: < sniffer@SortMonster.com> DC> Cc: "Pete McNeil" <[EMAIL PROTECTED]> DC> Sent: Tuesday, December 27, 2005 2:13 PM DC> Subject: RE: [sniffer] Last chance to renew at the old price! DC> Hi Folks, DC> Actually, here is some more detail as to the reasons for the price DC> increase. In addition, please bear in mind that that prices haven't DC> been raised in approximately 2 years and even with this increase we are DC> priced very competitively. DC> The new feature/benefits and more to come are as follows: DC> * In the past 6 months we have more than doubled the number of updates DC> per day and we will continue to increase our bandwidth and the speed of DC> our updates. DC> * We have more than tripled our staff to improve our monitoring, DC> support, and rule generation capabilities. Come January, we are again DC> doubling this staff as the black-hats have gotten much more DC> sophisticated and this has become a 24x7 battle. Even Pete needs to DC> sleep sometimes. :-) DC> * We are adding new R&D programs for AFF/419 spam and Malware mitigation DC> (many of the results from these projects have already been implemented). DC> * During this next year as part of our continuous improvement policy we DC> will continue to roll out new features and enhancements such as fully DC> automated reporting, in-band real-time updates, an optimized message DC> processing pipeline, image and file attachment tagging, advanced header DC> structure analysis, enhanced adaptive heuristics, improved machine DC> learning systems, real-time wave-front threat detection, and many DC> more... DC> It's important to recognize that many of our improvements don't require DC> new software to be installed on the client side since they are delivered DC> through rulebase enhancements. Though this often causes our work to go DC> unnoticed, it is actually a design feature since it means that your DC> installation requires very little maintenance. This translates to DC> lowered administration costs and higher reliability. DC> As a result of this "reliability-first" design strategy, it may not DC> always be obvious that our service is constantly being improved and DC> enhanced - we never stand still ;-) DC> We'd hate to see any of you go, but please do compare us with other DC> services. DC> I'm sure that you'll find we're well worth the money, but it's always DC> good to keep your options open. In fact, best practice these days for DC> spam filtering is to use a blended approach that leverages many DC> services. We personally encourage that for best results. DC> Please let me know if you have any questions. Thank you for your DC> feedback and business! DC> Sincerely DC> Michael Murdoch DC> The Sniffer Team DC> ARM Research Labs, LLC DC> Tel. 850-932-5338 x303 DC> -Original Message- DC> From: [EMAIL PR
Re: Re[2]: [sniffer] Last chance to renew at the old price!
You know, I just don't get where all of the doom and gloom comes from. Yes, it is a large percentage increase, but it's still only 2 bucks a day to run the best piece of software on my server. I'm sure that they have taken these comments into consideration and will try to give more advanced notice in the future. But, to start with the "Time to start looking for another solutions" talk is rediculous. Reading Michael's description of what is going on over there suggests that their business is exploding, not imploding. And to keep on top of it, they need to increase their cash flow, not to buy nicer cars. I think everyone needs to look at how much Sniffer saves you everyday instead of griping about how much it costs you. Just my 2 cents. Dean On 12/27/05, Pete McNeil <[EMAIL PROTECTED]> wrote: Part of the purpose for additional staff is to reach a goal of FPprocessing measured in minutes to hours, never days as it is sometimes now. We also have some automated tools on the drawing board that willhelp to mitigate many FP cases on a self-serve basis. These will becoming in this next year._MOn Tuesday, December 27, 2005, 4:00:59 PM, Darin wrote: DC> Hi Michael,DC> How about false positive processing? That's our biggest headache, but itDC> would be drastically reduced by faster processing than the 3-5 days weDC> currently see. DC> Darin.DC> - Original Message -DC> From: "Michael Murdoch" <[EMAIL PROTECTED]>DC> To: < sniffer@SortMonster.com>DC> Cc: "Pete McNeil" <[EMAIL PROTECTED]>DC> Sent: Tuesday, December 27, 2005 2:13 PMDC> Subject: RE: [sniffer] Last chance to renew at the old price! DC> Hi Folks,DC> Actually, here is some more detail as to the reasons for the priceDC> increase. In addition, please bear in mind that that prices haven'tDC> been raised in approximately 2 years and even with this increase we are DC> priced very competitively.DC> The new feature/benefits and more to come are as follows:DC> * In the past 6 months we have more than doubled the number of updatesDC> per day and we will continue to increase our bandwidth and the speed of DC> our updates.DC> * We have more than tripled our staff to improve our monitoring,DC> support, and rule generation capabilities. Come January, we are againDC> doubling this staff as the black-hats have gotten much more DC> sophisticated and this has become a 24x7 battle. Even Pete needs toDC> sleep sometimes. :-)DC> * We are adding new R&D programs for AFF/419 spam and Malware mitigationDC> (many of the results from these projects have already been implemented). DC> * During this next year as part of our continuous improvement policy weDC> will continue to roll out new features and enhancements such as fullyDC> automated reporting, in-band real-time updates, an optimized message DC> processing pipeline, image and file attachment tagging, advanced headerDC> structure analysis, enhanced adaptive heuristics, improved machineDC> learning systems, real-time wave-front threat detection, and many DC> more...DC> It's important to recognize that many of our improvements don't requireDC> new software to be installed on the client side since they are deliveredDC> through rulebase enhancements. Though this often causes our work to go DC> unnoticed, it is actually a design feature since it means that yourDC> installation requires very little maintenance. This translates toDC> lowered administration costs and higher reliability. DC> As a result of this "reliability-first" design strategy, it may notDC> always be obvious that our service is constantly being improved andDC> enhanced - we never stand still ;-)DC> We'd hate to see any of you go, but please do compare us with other DC> services.DC> I'm sure that you'll find we're well worth the money, but it's alwaysDC> good to keep your options open. In fact, best practice these days forDC> spam filtering is to use a blended approach that leverages many DC> services. We personally encourage that for best results.DC> Please let me know if you have any questions. Thank you for yourDC> feedback and business!DC> SincerelyDC> Michael Murdoch DC> The Sniffer TeamDC> ARM Research Labs, LLCDC> Tel. 850-932-5338 x303DC> -Original Message-DC> From: [EMAIL PROTECTED] DC> [mailto:[EMAIL PROTECTED]] On Behalf Of Fox, ThomasDC> Sent: Tuesday, December 27, 2005 1:03 PMDC> To: sniffer@SortMonster.comDC> Subject: RE: [sniffer] Last chance to renew at the old price!DC> I said the same thing, and the response was, basically,DC> "We haven't raised the price in a long time, we need DC> the money, like it or lump it.">> -Original Message->> From: [EMAIL PROTECTED]>> [mailto: [EMAIL PROTECTED]] On Behalf Of Dave Koontz>> Sent: Tuesday, December 27, 2005 1:57 PM>> To: sniffer@SortMonster.com>> Subject: RE: [sniffer] Last chance to renew at the old price! Pete, why over a 50% increase? That seems rather drastic>> -Original Message->> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED]]>> On Behalf Of
Re: Re[2]: [sniffer] Last chance to renew at the old price!
Great. I've tracked ours and it is almost always 3 days, and sometimes up to 5 days when it goes over a weekend. This usually results in multiple reports for false positives for a given rule. Appreciate anything you can do to speed that up. Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" Sent: Tuesday, December 27, 2005 5:08 PM Subject: Re[2]: [sniffer] Last chance to renew at the old price! Part of the purpose for additional staff is to reach a goal of FP processing measured in minutes to hours, never days as it is sometimes now. We also have some automated tools on the drawing board that will help to mitigate many FP cases on a self-serve basis. These will be coming in this next year. _M On Tuesday, December 27, 2005, 4:00:59 PM, Darin wrote: DC> Hi Michael, DC> How about false positive processing? That's our biggest headache, but it DC> would be drastically reduced by faster processing than the 3-5 days we DC> currently see. DC> Darin. DC> - Original Message - DC> From: "Michael Murdoch" <[EMAIL PROTECTED]> DC> To: DC> Cc: "Pete McNeil" <[EMAIL PROTECTED]> DC> Sent: Tuesday, December 27, 2005 2:13 PM DC> Subject: RE: [sniffer] Last chance to renew at the old price! DC> Hi Folks, DC> Actually, here is some more detail as to the reasons for the price DC> increase. In addition, please bear in mind that that prices haven't DC> been raised in approximately 2 years and even with this increase we are DC> priced very competitively. DC> The new feature/benefits and more to come are as follows: DC> * In the past 6 months we have more than doubled the number of updates DC> per day and we will continue to increase our bandwidth and the speed of DC> our updates. DC> * We have more than tripled our staff to improve our monitoring, DC> support, and rule generation capabilities. Come January, we are again DC> doubling this staff as the black-hats have gotten much more DC> sophisticated and this has become a 24x7 battle. Even Pete needs to DC> sleep sometimes. :-) DC> * We are adding new R&D programs for AFF/419 spam and Malware mitigation DC> (many of the results from these projects have already been implemented). DC> * During this next year as part of our continuous improvement policy we DC> will continue to roll out new features and enhancements such as fully DC> automated reporting, in-band real-time updates, an optimized message DC> processing pipeline, image and file attachment tagging, advanced header DC> structure analysis, enhanced adaptive heuristics, improved machine DC> learning systems, real-time wave-front threat detection, and many DC> more... DC> It's important to recognize that many of our improvements don't require DC> new software to be installed on the client side since they are delivered DC> through rulebase enhancements. Though this often causes our work to go DC> unnoticed, it is actually a design feature since it means that your DC> installation requires very little maintenance. This translates to DC> lowered administration costs and higher reliability. DC> As a result of this "reliability-first" design strategy, it may not DC> always be obvious that our service is constantly being improved and DC> enhanced - we never stand still ;-) DC> We'd hate to see any of you go, but please do compare us with other DC> services. DC> I'm sure that you'll find we're well worth the money, but it's always DC> good to keep your options open. In fact, best practice these days for DC> spam filtering is to use a blended approach that leverages many DC> services. We personally encourage that for best results. DC> Please let me know if you have any questions. Thank you for your DC> feedback and business! DC> Sincerely DC> Michael Murdoch DC> The Sniffer Team DC> ARM Research Labs, LLC DC> Tel. 850-932-5338 x303 DC> -Original Message- DC> From: [EMAIL PROTECTED] DC> [mailto:[EMAIL PROTECTED] On Behalf Of Fox, Thomas DC> Sent: Tuesday, December 27, 2005 1:03 PM DC> To: sniffer@SortMonster.com DC> Subject: RE: [sniffer] Last chance to renew at the old price! DC> I said the same thing, and the response was, basically, DC> "We haven't raised the price in a long time, we need DC> the money, like it or lump it." >> -Original Message- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] On Behalf Of Dave Koontz >> Sent: Tuesday, December 27, 2005 1:57 PM >> To: sniffer@SortMonster.com >> Subject: RE: [sniffer] Last chance to renew at the old price! >> >> Pete, why over a 50% increase? That seems rather drastic >> >> >> -Original Message- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] >> On Behalf Of Pete McNeil >> Sent: Tuesday, December 27, 2005 12:42 PM >> To: sniffer@sortmonster.com >> Subject: [sniffer] Last chance to renew at the old price! >> >> Hello Sniffer folks, >> >> This is just a friendly reminder that prices will be going up >> January 1. >> >> You can add a year to your S
RE: Re[2]: [sniffer] POP3 Account Question
Thanks, Pete. That answers my question and makes good sense. I've been testing my own trap reporting and Scott's timing couldn't have been better. Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeilSent: Monday, December 05, 2005 2:21 PMTo: Colbeck, AndrewSubject: Re[2]: [sniffer] POP3 Account Question On Monday, December 5, 2005, 3:38:14 PM, Andrew wrote: > (nuts, to fast on the "Send" button). ... plus, future hits on spam that is already detected can accumulate hits on, say, SNIFFEREXPIP that weren't already hitting. Therefore, trying to save bandwidth and processing power over at sortmonster.com by submitting less spam is not helpful. Pete, how'd I do? . We're ok for bandwidth - but no need to spend yours on bandwidth that's not necessary. Outbound bandwidth is more frequently billable than inbound bandwidth (IME). We always want this to be as painless as possible for you ;-) As for waking up dormant rules (I think that's what you were getting at), the way it would work is: If the rule is dormant in your rulebase, then it would not match SNF... so, in theory the message would get through to your trap and would get picked up by the Trap-Bot. The Trap-Bots use fullbase to scan inbound spam. That contains ALL of the rules (at present > 62!), dormant or not, so the message getting through would cause a hit - and that would raise the strength and reactivate the rule. Additional activity from reported logs (or additional instances in traps) would push a rule's strength over the standard threshold (1.0) very quickly --- say after only 30 messages or so. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] POP3 Account Question
What is the best way to get a spam trap going. I have an old "abandoned" email account that I just use for testing. It gets some spam now, but a low volume. However, 100% of the mail is spam. It would be very easy to filter and keep the non-Sniff'd mail and delete the remainder. Should I use it to sign up at some junkmail sites, kind of "seeding" the account to encourage spam to it? John C From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeilSent: Monday, December 05, 2005 4:11 PMTo: Colbeck, AndrewSubject: Re[2]: [sniffer] POP3 Account Question On Monday, December 5, 2005, 3:33:33 PM, Andrew wrote: > I had the same question, but more specifically: Is is helpful for sniffer trap (spam and user trap) submissions to skip, or to include messages on which sniffer already hits. It's best for those messages to be removed. The trap-bot will remove anything that matches SNF on it's way in. > I imagine that all trap hits are useful, and that duplicate submissions reinforce the rule strength for a given hit when we submit spam that is already detected... It is true that if the Trap-Bot filters a message the rules get extra hits, however the best way to get at that data is from your reported logs. This way the Trap-Bots spend all of their time on new things. Thanks, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer]
_M, <<_M said>> will create a "default" installation that emits headers and puts a .cf file in place for SA to interpret them. Not sure if this is relevant to your thought process, but we feel that SA (SpamAssassin) does more harm than good. Under moderate loads it bogs-down MDaemon so we always have SA disabled. Sniffer is by far superior in every category, (accuracy, speed, dependability etc...) so there's no need to use SpamAssassin. My point: Keep in mind that some of us use sniffer independently (not tied to SA). We're using sniffers .cfg plug-in for MD ver 8. I assume you will, and I probably misunderstood your post, but just wanted to mention this out-loud. Thanks, Paul R -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Pete McNeil Sent: Thursday, November 10, 2005 10:43 AM To: Daniel Bayerdorffer Subject: Re[2]: [sniffer] On Thursday, November 10, 2005, 9:40:42 AM, Daniel wrote: DB> Hi Pete, DB> Thanks for the info. I actually already have the current version running. DB> I'm very happy with it's performance. I just did not have a clear DB> understanding on those issues. DB> On another note, when you have the new version install, will it overwrite my DB> current settings? And will it also install scripts for updating the rule DB> base, and sending logs? Because I already have that setup now. In theory the installer will know if there is a previous version and will not adjust any of the config data. It's a bit of a complicated problem because there are so many way to configure the software.. so the installation process can be complex. I'd like to know how you have your updates set up - perhaps I can use that as a model for the installer. The basic idea is that the installer will create a "default" installation that emits headers and puts a .cf file in place for SA to interpret them. After that, the technically minded can manually adjust the installation. If the installer finds an installation in place then it will likely update the .DLL and leave everything else alone. Comments about these concepts are welcome, of course. The goal is to make a plug-and-play installation possible while leaving the more sophisticated options open to the technically minded. Thanks, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Rash of false positives
Hi Pete, There was a consistent stream of false positives over the mentioned time period, not just a blast at a particular time. They suddenly started at 5pm (shortly after a 4:30pm rulesbase update), and were fairly evenly spread from 5pm - 11pm and 6am - 10am today (not many legitimate emails came in between 11pm and 6am)...spanning 4 other rulebase updates at 8:40pm, 12am, 3am, and 6:20am. There were a number of different rules involved, and over 45 false positives in that time period. Since the problem was evidently corrected with the 10am rulebase, you will probably need to look back at what happened starting with the 4:30pm rulebase. I doubt looking at the current rulebase will help since the problem has now been corrected, but I'm sure you archive them and can look back to see what process breakdown allowed this to happen. I'm familiar with the panic procedure, but since there was such a broad base of false positives across a number of rules, adding panic rules for all of them just didn't make sense. Disabling Sniffer entirely would have been the action we would have taken. Let me know what you find out. I completely understand the learning curve with new staff, but the quality of the rules is imperative. Anything you can do to keep that quality high is much appreciated. Thanks, Darin. - Original Message - From: Pete McNeil To: Darin Cox Sent: Tuesday, November 08, 2005 2:49 PM Subject: Re[2]: [sniffer] Rash of false positives On Tuesday, November 8, 2005, 11:02:09 AM, Darin wrote: > Hi Pete, The rash of false positives seems to have stopped with the last sniffer rulebase update at 10am ET. It had started with a rulebase update at 4:30pm ET yesterday, and continued through the updates at 8:40pm, 12am, 3am, and 6:20am today. I'd still like to know what happened, and how we can avoid it in the future. I've been bound up in some performance tuning today so I've not had a chance to follow this thread until now. When I first looked in on it I scanned the false positive submissions and almost none of them matched any active rules. I know that a couple of rules were pulled out after review last night late .. they had been picked up by some FPs in SURBL & others that matched up with spamtrap submissions. It's possible that these are what you experienced. I won't know unless you can give me some log entries to go with those messages since those entries will tell me the rule IDs. As for having it happen again - that's very unlikely since ever time we pull a rule out due to FPs or potential FPs (the rules that were pulled had not caused any FPs yet but were expected to... one was rr.com IIRC, it was pulled only a couple hours after it's creation). A lot of things have to go wrong to cause an FP problem like you are reporting. Please look up our rule-panic procedure which is designed to mitigate these problems immediately for you if they happen: http://www.sortmonster.com/MessageSniffer/Help/FalsePositivesHelp.html#RulePanic We can't guarantee that rule-panics won't happen, but we can make them exceedingly rare and non-repeatable. I will be processing your FP submissions shortly. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Large amounts of spam still getting through
I just assumed it was a defective spamming software. - Original Message - From: "John T (Lists)" <[EMAIL PROTECTED]> To: Sent: Saturday, October 15, 2005 2:10 PM Subject: RE: Re[2]: [sniffer] Large amounts of spam still getting through I wonder is that is some kind Outlook vulnerability. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Grosshandler Sent: Saturday, October 15, 2005 10:43 AM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] Large amounts of spam still getting through We're seeing the header info in the body problem. It seems to be always spam. Another way it manifests itself is that Declude can't alter the Subject line properly. The folks at Declude tell us that they're aware of it, and that they are just waiting for more "pre altered by Declude" examples to code for it. Rob M. Stein wrote: >By the way, has anyone seen the spam that gets through that has the header info in >the body of the mail message instead of where it's supposed to be? How is that possible? --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Large amounts of spam still getting through
I wonder is that is some kind Outlook vulnerability. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Robert Grosshandler > Sent: Saturday, October 15, 2005 10:43 AM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Large amounts of spam still getting through > > We're seeing the header info in the body problem. It seems to be always > spam. Another way it manifests itself is that Declude can't alter the > Subject line properly. > > The folks at Declude tell us that they're aware of it, and that they are > just waiting for more "pre altered by Declude" examples to code for it. > > Rob > > > M. Stein wrote: > > >By the way, has anyone seen the spam that gets through that has the header > info in >the body of the mail message instead of where it's supposed to be? > How is that possible? > > --- > [This E-mail scanned for viruses by Declude Virus] > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Large amounts of spam still getting through
We're seeing the header info in the body problem. It seems to be always spam. Another way it manifests itself is that Declude can't alter the Subject line properly. The folks at Declude tell us that they're aware of it, and that they are just waiting for more "pre altered by Declude" examples to code for it. Rob M. Stein wrote: >By the way, has anyone seen the spam that gets through that has the header info in >the body of the mail message instead of where it's supposed to be? How is that possible? --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Large amounts of spam still getting through
For what it's worth, we have not see a major increase in spam this week either. Things seem pretty normal. We did recently upgrade to the Pro version of Declude Junkmail, and now it is much easier to block mail from certain countries (like .cz .ru etc.) as well as header and subject content, etc. By the way, has anyone seen the spam that gets through that has the header info in the body of the mail message instead of where it's supposed to be? How is that possible? Michael Stein Computer House www.computerhouse.com - Original Message - From: "Rick Hogue" <[EMAIL PROTECTED]> To: Sent: Saturday, October 15, 2005 12:33 PM Subject: RE: Re[2]: [sniffer] Large amounts of spam still getting through My only concern is that all of this was being caught by Sniffer before and all of a sudden very little of it is being caught. We are told that they are working on it to get it fixed but we are getting slammed by customers telling us we are not catching any spam. Any help in a solution other than greylisting would be really appreciated. Or is this a declude problem? Rick Hogue Intent.Net - Web Hosting 3802 Handley Avenue Louisville, KY 40218 1-502-459-3100 1-800-866-2983 Toll Free --- [This E-mail scanned for viruses by Declude on http://www.intent.net hosted Email] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Large amounts of spam still getting through
Rick, I, for one, have not seen any increase in spam getting through recently. It may be because I have so many other filters in front of Sniffer that my capture/reject rates are so high, but I have not had a single spam make it through to my own inbox this entire week. That's on the verge of a record for me. I'm sure that I am personally targeted with a minimum of 300+ spams each day. I have not heard any complaints from my users as of late, either. Sniffer is just a single tool, and it takes an entire arsenal if you want to get anywhere near (or above) a 99% spam kill rate. You may very well want to check on the declude list concerning the latest tweaks to that software for the best performance. I use MxGuard, so I couldn't really give you much advice on Declude. The bottom line is, the more spam you stop BEFORE it gets to Sniffer, the better off you will be. Sniffer is pulling its own weight here very nicely, so I'm sure that mileage may vary. If anything, I am seeing less spam get through this week than I did the week before. William Van Hefner Network Administrator Vantek Communications, Inc. 555 H Street, Ste. C Eureka, CA 95501 > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Rick Hogue > Sent: Saturday, October 15, 2005 9:34 AM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Large amounts of spam still > getting through > > > My only concern is that all of this was being caught by > Sniffer before and all of a sudden very little of it is being > caught. We are told that they are working on it to get it > fixed but we are getting slammed by customers telling us we > are not catching any spam. > > Any help in a solution other than greylisting would be really > appreciated. > > Or is this a declude problem? > > Rick Hogue > > Intent.Net - Web Hosting > > 3802 Handley Avenue > > Louisville, KY 40218 > > 1-502-459-3100 > > 1-800-866-2983 Toll Free > > --- > [This E-mail scanned for viruses by Declude on > http://www.intent.net hosted Email] > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Large amounts of spam still getting through
My only concern is that all of this was being caught by Sniffer before and all of a sudden very little of it is being caught. We are told that they are working on it to get it fixed but we are getting slammed by customers telling us we are not catching any spam. Any help in a solution other than greylisting would be really appreciated. Or is this a declude problem? Rick Hogue Intent.Net - Web Hosting 3802 Handley Avenue Louisville, KY 40218 1-502-459-3100 1-800-866-2983 Toll Free --- [This E-mail scanned for viruses by Declude on http://www.intent.net hosted Email] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] POP Approach
Hello Pete, Are you going to implement something similar for false positives? Thanks, Daniel > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Friday, October 14, 2005 12:32 AM > To: William Van Hefner > Subject: Re[2]: [sniffer] POP Approach > > On Wednesday, October 12, 2005, 6:30:45 PM, William wrote: > > WVH> Pete, > > WVH> Was just wondering, I have all of my e-mail pass through > an IMGate/Postfix > WVH> machine prior to hitting my main mail server. Sometimes, > e-mail (especially > WVH> spam) gets forwarded from the secondary MX as well. If > we use the POP method > WVH> of redirecting spam to an appropriate mailbox are you > just going to be > WVH> scanning the messages for content, or inspecting the > headers for IP > WVH> information as well? > > We will inspect all parts of the messages manually and with automated > tools. This is true of all spam that arrives at our system no matter > how it gets there. > > WVH> Reason I'm asking is, I just want to make sure that one > of my own servers > WVH> doesn't end up included in some type of blacklist rule. > It seems like it > WVH> would take an awful lot of work on your part to ensure > that any filters > WVH> don't contain IPs of one of your customer's machines, if > you are scanning > WVH> header information. When you throw-in the fact that the > redirect may come > WVH> from the client of an entirely different network with no > link whatsoever to > WVH> our DNS records, that would seem to make taking any > header information > WVH> (except maybe the Subject or From lines) into account a > very risky > WVH> proposition. Thanks!!! > > Actually, we can often be very precise about the routing of messages > pulled from pop accounts. > > That said, there is always a non-zero risk that an IP which is listed > in certain black lists and also arrives at one of our traps may be > added to our rulebase. This is almost always an automated process > since we have determined that manually entered IPs are prone to > errors. > > If an IP on one of your servers does get tagged, then you would be > able to use to rule-panic procedure for immediate relief and once the > problem was solved it could not be recreated. > > Part of our system is that it remembers every mistake we ever made and > prevents us making that same mistake again --- unless we're really, > really determined ;-) > > Understand, I'm not making light of this possibility... we take all > false positive cases (real or imagined) very seriously. I do want to > point out that these cases are rare, easily solved, and nearly > impossible to repeat. I should also point out that this "risk" is not > increased by using the pop3 method. > > Hope this helps, > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] POP Approach
What is going on with the sniffer not catching any of the spam that is now coming through? We are getting slammed with medication, mortgage and other junk email? Rick Hogue Intent.Net - Web Hosting 3802 Handley Avenue Louisville, KY 40218 1-502-459-3100 1-800-866-2983 Toll Free New Books Available "Prosperity Or Better Times Ten" "Hot Slot Secrets" "The Incredible Inman's Louisville Trivia Challenge" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jonathan Sent: Friday, October 14, 2005 12:40 AM To: sniffer@SortMonster.com Subject: Re[2]: [sniffer] POP Approach Just a little "me too" here .. you're very right to be concerned about this kind of thing. This happened to us twice (once with an inbound gateway server, and once with a primary POP box). It was nothing short of devastating until we realized what was going on, and we spent a lot of time recovering the damage. Once we let them know what was happening, Pete was quick to add a whitelist entry into their system, and it didn't happen again (until the second time). All in all, I'm not overly concerned about it happening again, but if we ever changed the IPs of those two boxes, I'd certainly have him update the whitelist. Just my 2 cents, Jonathan At 11:31 PM 10/13/2005, you wrote: >On Wednesday, October 12, 2005, 6:30:45 PM, William wrote: > >WVH> Pete, > >WVH> Was just wondering, I have all of my e-mail pass through an >IMGate/Postfix >WVH> machine prior to hitting my main mail server. Sometimes, e-mail >(especially >WVH> spam) gets forwarded from the secondary MX as well. If we use >the POP method >WVH> of redirecting spam to an appropriate mailbox are you just going to be >WVH> scanning the messages for content, or inspecting the headers for IP >WVH> information as well? > >We will inspect all parts of the messages manually and with automated >tools. This is true of all spam that arrives at our system no matter >how it gets there. > >WVH> Reason I'm asking is, I just want to make sure that one of my own servers >WVH> doesn't end up included in some type of blacklist rule. It seems like it >WVH> would take an awful lot of work on your part to ensure that any filters >WVH> don't contain IPs of one of your customer's machines, if you are scanning >WVH> header information. When you throw-in the fact that the redirect may come >WVH> from the client of an entirely different network with no link >whatsoever to >WVH> our DNS records, that would seem to make taking any header information >WVH> (except maybe the Subject or From lines) into account a very risky >WVH> proposition. Thanks!!! > >Actually, we can often be very precise about the routing of messages >pulled from pop accounts. > >That said, there is always a non-zero risk that an IP which is listed >in certain black lists and also arrives at one of our traps may be >added to our rulebase. This is almost always an automated process >since we have determined that manually entered IPs are prone to >errors. > >If an IP on one of your servers does get tagged, then you would be >able to use to rule-panic procedure for immediate relief and once the >problem was solved it could not be recreated. > >Part of our system is that it remembers every mistake we ever made and >prevents us making that same mistake again --- unless we're really, >really determined ;-) > >Understand, I'm not making light of this possibility... we take all >false positive cases (real or imagined) very seriously. I do want to >point out that these cases are rare, easily solved, and nearly >impossible to repeat. I should also point out that this "risk" is not >increased by using the pop3 method. > >Hope this helps, > >_M > > > >This E-Mail came from the Message Sniffer mailing list. For >information and (un)subscription instructions go to >http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html --- [This E-mail scanned for viruses by Declude on http://www.intent.net hosted Email] --- [This E-mail scanned for viruses by Declude on http://www.intent.net hosted Email] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Sniffer working now
Is there a way to stop sniffer from processing if declude is at a certain weight already? Harry Vanderzand inTown Internet & Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: Re[2]: [sniffer] auto update tmp files
Bonno Bloksma <> wrote on Friday, September 23, 2005 2:44 AM: > C:\IMail\spool\tmp6C40.tmp > > As you can see the %1 is a complete path. So just Del %1 should do > the trick. Wow, thanks. I never thought of actually checking to see what the value of %1 was. I just assumed (I know...) that it was just the file name. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] auto update tmp files
Hi, I had trouble for a while with the "del %1" functionality, but I had a problem with the script running in the wrong directory. I [] Yeah, my script does explicitly enter the sniffer directory, and the line to delete the file is explicit as well: Del s:\imail\spool\%1 ...but that never worked. Maybe if I cd into the spool first it might It would not work because.. I have the %1 parameter in the email sent to me as part of the reporting. Using IMail 8.21 Here is what's in the email: Rulefile OK, updated C:\IMail\spool\tmp6C40.tmp As you can see the %1 is a complete path. So just Del %1 should do the trick. Groetjes, Bonno Bloksma --- [E-mail scanned at tio.nl for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] auto update tmp files
Pete McNeil <> wrote on Thursday, September 22, 2005 11:24 AM: > On Thursday, September 22, 2005, 9:51:31 AM, John wrote: > >> Sorry I'm late. >> >> I had trouble for a while with the "del %1" functionality, but I >> had a problem with the script running in the wrong directory. I >> believe I added a "cd \sniffer2" type line and it worked thereafter >> like a charm. > > This is a common problem with program aliases in IMail. It is always > best to set the working directory at the top of any scripts that run > as a "program alias" so that there is no question where they are > running. I've learned that one the hard way a couple of times ;-) > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html Yeah, my script does explicitly enter the sniffer directory, and the line to delete the file is explicit as well: Del s:\imail\spool\%1 ...but that never worked. Maybe if I cd into the spool first it might work, but it is working with current directive, which is: Del s:\imail\spool\*.tmp ...so I really don't have a compelling reason to test it. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] YAhoo mails failing sniffer?
When we report these to false what kind of time frame should we get notifications back from AFF? I sent one of these from yahoo yesterday morning and haven't received anything. I can read it on the list before I receive anything from AFF. Thanks, Mike -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Thursday, September 22, 2005 3:10 AM To: Matt Subject: Re[2]: [sniffer] YAhoo mails failing sniffer? That is the one. That rule is already gone. Again, I apologize. It is all fixed now. Thanks, _M On Thursday, September 22, 2005, 12:29:27 AM, Matt wrote: M> Quick follow-up. The bad rule appears to be 497585. M> Matt M> Marc Catuogno wrote: >>I'm seeing a few legit e-mails from Yahoo failing sniffer. Anyone else? >> >>--- >>[This E-mail scanned for viruses by Declude Virus] >> >> >>This E-Mail came from the Message Sniffer mailing list. For >>information and (un)subscription instructions go to >>http://www.sortmonster.com/MessageSniffer/Help/Help.html >> >> >> >> M> This E-Mail came from the Message Sniffer mailing list. For M> information and (un)subscription instructions go to M> http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] False positive
Pete, other than database update e-mails, I see know e-mails from "@microneil.com" or [EMAIL PROTECTED] in the last 2 days received by my server. John T eServices For You > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Tuesday, September 13, 2005 4:45 AM > To: John Tolmachoff (Lists) > Subject: Re[2]: [sniffer] False positive > > I have your response in my sent folder. > > I will send it again.. > > _M > > On Monday, September 12, 2005, 8:37:52 PM, John wrote: > > JTL> I also have sent some false positives in the last 2 weeks with no response, > JTL> the lastest being at 09/10/05 at 9:49 AM PDT. > > JTL> John T > JTL> eServices For You > > > >> -Original Message- > >> From: [EMAIL PROTECTED] > >> [mailto:[EMAIL PROTECTED] > JTL> On > >> Behalf Of Pete McNeil > >> Sent: Friday, September 09, 2005 5:08 AM > >> To: Ali Resting > >> Subject: Re: [sniffer] False positive > >> > >> On Friday, September 9, 2005, 2:17:31 AM, Ali wrote: > >> > >> AR> Hi Peter, > >> > >> AR> I have submited 3 email to [EMAIL PROTECTED] with all the required > >> AR> fields as per you instaructions on the website, I have not received > JTL> any > >> AR> feedback whether this request has been effected. > >> > >> I cleared the false positives queue last night. I don't see any > >> messages in there from you today. You should have received a response > >> for each submission. I will review my responses and get back to you > >> off list. > >> > >> Thanks, > >> > >> _M > >> > >> > >> > >> This E-Mail came from the Message Sniffer mailing list. For information > JTL> and > >> (un)subscription instructions go to > >> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > JTL> This E-Mail came from the Message Sniffer mailing list. For > JTL> information and (un)subscription instructions go to > JTL> http://www.sortmonster.com/MessageSniffer/Help/Help.html > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] can auto-forward be disabled when spam is detected?
I'm afraid I'm not that up on my email standards. What exactly does forwarding by main.fwd do and how does one implement that type of solution? I know how forwarding by IMA (simple text file) works. Rick Robeson getlocalnews.com [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Craig Deal Sent: Friday, September 02, 2005 7:34 AM To: sniffer@SortMonster.com Subject: RE: Re[2]: [sniffer] can auto-forward be disabled when spam is detected? Thanks for pointing out that option. I didn't know you could forward based on *.mbx. I'm not sure how this solution is any less complex, but I do like the idea of having individual spam mailbox's instead of a central quarantine. Craig > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman > Sent: Friday, September 02, 2005 12:44 AM > To: Craig Deal > Subject: Re[2]: [sniffer] can auto-forward be disabled when > spam is detected? > > > You can change your rules to forward spam to > separate user > > quarantine mailbox (not a subfolder or sub-mailbox) that > does not > > have forwarding setup. You just cannot make the rules > forward (or > > move)the spam to a sub-mailbox like > [EMAIL PROTECTED] on an > > account that is forwarded. > > That's an overly complex solution. Just put a forward on the > main.mbx by using a main.fwd -- do not use forward.ima. > Unless you have users regularly using direct mailbox > subaddressing (which is not common), you won't need to deploy > any other .fwd. > > --Sandy > > > > Sanford Whiteman, Chief Technologist > Broadleaf Systems, a division of > Cypress Integrated Systems, Inc. > e-mail: [EMAIL PROTECTED] > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] can auto-forward be disabled when spam is detected?
Thanks for pointing out that option. I didn't know you could forward based on *.mbx. I'm not sure how this solution is any less complex, but I do like the idea of having individual spam mailbox's instead of a central quarantine. Craig > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman > Sent: Friday, September 02, 2005 12:44 AM > To: Craig Deal > Subject: Re[2]: [sniffer] can auto-forward be disabled when > spam is detected? > > > You can change your rules to forward spam to > separate user > > quarantine mailbox (not a subfolder or sub-mailbox) that > does not > > have forwarding setup. You just cannot make the rules > forward (or > > move)the spam to a sub-mailbox like > [EMAIL PROTECTED] on an > > account that is forwarded. > > That's an overly complex solution. Just put a forward on the > main.mbx by using a main.fwd -- do not use forward.ima. > Unless you have users regularly using direct mailbox > subaddressing (which is not common), you won't need to deploy > any other .fwd. > > --Sandy > > > > Sanford Whiteman, Chief Technologist > Broadleaf Systems, a division of > Cypress Integrated Systems, Inc. > e-mail: [EMAIL PROTECTED] > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Headers showing up in message body after switching to Mdaemon
Yes, something is going on weird in Mdaemon. The strange thing is I got both copies of your message, the one to me direct and the one to the sniffer list. The strange thing is the one Pete sent to the list I had to pull out of the bad message directory as it did not make it to me. I'm not sure what the difference is. I also found I get the following errors in the Mdaemon log for these messages: Fri 2005-08-19 11:10:33: Error parsing Fri 2005-08-19 11:10:33: Message moved to Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] - Original Message - From: "Alberto Santoni" <[EMAIL PROTECTED]> To: Cc: <[EMAIL PROTECTED]> Sent: Friday, August 19, 2005 11:15 AM Subject: RE: Re[2]: [sniffer] Headers showing up in message body after switching to Mdaemon Hello I received messages of this kind me too. Then I must understand that the cause is MDaemon and not iMail? Alberto -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: venerdì 19 agosto 2005 20.03 To: Jim Matuska Cc: [EMAIL PROTECTED] Subject: Re[2]: [sniffer] Headers showing up in message body after switching to Mdaemon On Friday, August 19, 2005, 12:53:39 PM, Jim wrote: JM> Pete, JM> The switch in question was from Imail to Mdaemon, so far so I was almost hoping this was a switch to a new version of MDaemon since this seems to be a new phenomena. Thanks for the data! JM> good other than a few misc bugs, I like the Mdaemon Sniffer JM> integration much better than the declude integration. We're hoping to go this route with other systems too-- but change is slow. The MDaemon folks are very aggressive in seeking new improvements :-) JM> Also Pete for some reason your message to the list got stuck JM> in the bad message queue but I recieved my original post to the JM> list. Any thoughts? Please cc: me direct [EMAIL PROTECTED] if JM> you can so I don't have to read the response from my bad message JM> queue when it comes from the list. Can you check the headers for the SNF results and any other tests which might have cause the message to get captured? There's something there that needs to be fixed. Thanks, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Headers showing up in message body after switching to Mdaemon
Hello I received messages of this kind me too. Then I must understand that the cause is MDaemon and not iMail? Alberto -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: venerdì 19 agosto 2005 20.03 To: Jim Matuska Cc: [EMAIL PROTECTED] Subject: Re[2]: [sniffer] Headers showing up in message body after switching to Mdaemon On Friday, August 19, 2005, 12:53:39 PM, Jim wrote: JM> Pete, JM> The switch in question was from Imail to Mdaemon, so far so I was almost hoping this was a switch to a new version of MDaemon since this seems to be a new phenomena. Thanks for the data! JM> good other than a few misc bugs, I like the Mdaemon Sniffer JM> integration much better than the declude integration. We're hoping to go this route with other systems too-- but change is slow. The MDaemon folks are very aggressive in seeking new improvements :-) JM> Also Pete for some reason your message to the list got stuck JM> in the bad message queue but I recieved my original post to the JM> list. Any thoughts? Please cc: me direct [EMAIL PROTECTED] if JM> you can so I don't have to read the response from my bad message JM> queue when it comes from the list. Can you check the headers for the SNF results and any other tests which might have cause the message to get captured? There's something there that needs to be fixed. Thanks, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Sniffer taking a long time?
Thanks, I will do that. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew > Sent: Wednesday, August 03, 2005 3:17 AM > To: sniffer@SortMonster.com > Subject: RE: Re[2]: [sniffer] Sniffer taking a long time? > > > So basically, what you are saying is that my volume is > really too low > > to take advantage of the persistent sniffer (and such may actually > > decrease my performance), and I should stick with the non-service > > version. Is that right? That is about what I thought (without the > > details of how sniffer works, I just wanted to be sure). > > Well, Dan, for the inevitable rush of traffic, I'd stick with > the persistent sniffer implementation now that you have it working. > > If the 2 second wait time galls you, then use your **.cfg > file and specify the > > MaxPollTime: 500 > > value at 500 ms or whatever you'd like your maximum wait time > to be instead of 2 seconds (2000 ms). > > Andrew 8) > > > > > This E-Mail came from the Message Sniffer mailing list. For > information and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Sniffer taking a long time?
> So basically, what you are saying is that my volume is really > too low to take advantage of the persistent sniffer (and such > may actually decrease my performance), and I should stick > with the non-service version. Is that right? That is about > what I thought (without the details of how sniffer works, I > just wanted to be sure). Well, Dan, for the inevitable rush of traffic, I'd stick with the persistent sniffer implementation now that you have it working. If the 2 second wait time galls you, then use your **.cfg file and specify the MaxPollTime: 500 value at 500 ms or whatever you'd like your maximum wait time to be instead of 2 seconds (2000 ms). Andrew 8) This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Sniffer taking a long time?
So basically, what you are saying is that my volume is really too low to take advantage of the persistent sniffer (and such may actually decrease my performance), and I should stick with the non-service version. Is that right? That is about what I thought (without the details of how sniffer works, I just wanted to be sure). Thanks, Pete. Dan Horne > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Tuesday, August 02, 2005 4:09 PM > To: Dan Horne > Subject: Re[2]: [sniffer] Sniffer taking a long time? > > After following through all of this and looking at the .stat > file, I think I see what's going on. > > Now that it is running and producing a .stat file, the flow > rate is very low. According to the stat data, about 6 msgs / minute. > > Note the poll and loop times are in the 450 - 550 ms range. > > SNF with the persistent engine is built for high throughput, > but it's also built to play nice. > > The maximum poll time gets up to 2 seconds or so (sound familiar?) > > If there are no messages for a while, then everything slows > down until the first message goes through. For that first > message, the SNF client will probably wait about 2 seconds > before looking for it's result because that's what the stat > file will tell it to do. > > Since the next message probably won't come around for a few > seconds, that next message will probably wait about 2 seconds also. > > If you were doing 6 messages a second then all of the times > would be much lower and so would the individual delays. > > When you turn off the persistent instance, each new message > causes a client to look and see if there are any other peers > acting a servers... Since the messages are far and few > between, the client will elect to be a server (momentarily), > will find no work but it's own, will process it's own message > and leave. -- This is the automatic peer-server mode. It will > always work like this unless more than one message is being > processed at the same moment. > > In peer-server mode, since there is nothing else going on and > no persistent instance to coordinate the operations, each > message will get processed as fast as the rulebase can be > loaded and then the program will drop. > > When the persistent instance is introduced, it sets the pace > - and sicne there are no other messages, each client will > wait about 2 seconds (or half a second or so with the .stat > file contents you show) before it begins looking for it's results. > > The server instance will also wait a bit before looking for > new jobs so that the file system isn't constantly being scanned. > > Of course, if a burst of messages come through then the > pacing will speed up as much as necessary to keep up with the volume. > > Hope this helps, > > _M > > On Tuesday, August 2, 2005, 3:38:52 PM, Dan wrote: > > DH> No, I followed your instructions exactly (and not for the first > DH> time). I didn't add those extra values until today. Prior to > DH> adding the AppDirectory value, the service was taking a minute to > DH> scan emails; after adding it the scan time went to around 2 > DH> seconds. I can't get it any lower than that. Initially > mine was > DH> set up exactly as you said, with only "Application" > containing the > DH> path, authcode and persistent. Today after hearing no > suggestions > DH> from the list, and based on recent list messages > mentioning the home > DH> directory for the service, I looked at the srvany.exe > doco to find > DH> out how to give it a home directory. > DH> That's when I added AppDirectory. I also saw and added > DH> AppParameters at the same time and added those as well, > though they > DH> seem not to be needed. > DH> > DH> Prior to adding the AppDirectory value, I never got any > .stat file > DH> or any .SVR file in my sniffer dir. After adding that value and > DH> starting the service those files appeared. > DH> > DH> > > > DH> From: [EMAIL PROTECTED] > DH> [mailto:[EMAIL PROTECTED] On Behalf Of Matt > DH> Sent: Tuesday, August 02, 2005 3:24 PM > DH> To: sniffer@SortMonster.com > DH> Subject: Re: [sniffer] Sniffer taking a long time? > > > > > DH> Dan, > > DH> There is no AppDirectory value on my servereither. The > DH> Parameters key has only one value under it besides Default > DH> which is "Application", and it contains exactly what I provided > DH> below. Could it be that you tried to hard to get everything > DH> right by tweaking theseadditional keys? > > DH> Something else. Did you make sure that theSniffer > DH> service that you created was started? No doubt it will work if > DH> you follow those directions to a T, and there aren't any issues > DH> with yourserver apart from this. > > DH> Matt > > > > DH> Dan Horne wrote: > > > > DH> I removed the AppParameters value and put the authcode > DH> an
RE: Re[2]: [sniffer] Sniffer taking a long time?
I replied to an off-list message from Pete, but for completeness, I will repost it to the list. We can keep it on the list, Pete, if that does ya'. It looks like Pete is probably right in that the service is probably not loading correctly for some reason. There is no .stat file in my sniffer directory. Here are my responses to Pete's questions: > Can you please tell me the content of your .stat file. There is no .stat file in my sniffer directory. No file ending with .stat, either. > > Can you estimate the number of messages per minute that you are > processing? Fairly low volume, I guess, around 10 messages per minute. > Do you have a lot of extra files in your sniffer directory? Yes, there are tons of old *.FIN files, *.WRK files, *.XXX files, *.ERR files, and a few *.ABT files. However they are mostly old files. Sorting by date, I can see several *.FIN files, but they don't hang around long. There are several still there from each day though (I assume due to daily scheduled reboots according to the timestamp). The last occurrences of the other files by extension are: *.XXX - 7/24/2005 *.ERR - 4/27/2005 *.ABT - 2/4/2005 *.WRK - 12/14/2004 I assume it is ok to delete all these? > Does you have a lot of fragmentation in your file system? How do you > mitigate the fragmentation you do have? No, we defrag daily after hours using Diskeeper's smart scheduling. > This information will help. > > Thanks, > > _M > NP. I'm sure you saw my other posts to the list, but I'll recap. When I stop the service, processing time goes down to milliseconds. Reenabling the sniffer service (installed per the archived instructions using srvany.exe) causes the processing time to go back up into the minute per message range. I have the service disabled for now. We moved our Imail/Declude install off to a weaker machine a couple weeks ago in prep for replacing it with Suse Linux ES running postfix (and sniffer, of course) on the more powerful hardware. Because the current computer is not as powerful and has become backed up a few times, I was looking at ways to lower the CPU cost per message when I found this. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Declude and Sniffer
Hi Pete, Ok. First I'd heard of it. Do you want us to change the process? If so let me know how to proceed. Darin. - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" Sent: Thursday, July 21, 2005 1:44 PM Subject: Re[2]: [sniffer] Declude and Sniffer On Thursday, July 21, 2005, 12:01:32 PM, Darin wrote: DC> I thought we were supposed to just forward these as attachments to the spam@ DC> address? We're trying to move away from that :-) poping the messages is more scalable. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Declude and Sniffer
My bad. Trying to multi-task isn't working today. :-) John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Wednesday, July 20, 2005 11:13 AM To: John Carter Subject: Re[2]: [sniffer] Declude and Sniffer On Wednesday, July 20, 2005, 12:05:29 PM, John wrote: JC> Thanks, that helps a lot. Didn't understand the replace "nonzero" JC> with the weight number in the Global file. Minor correction... Actually -- you replace "nonzero" with the result code. You adjust the weights at the end of the line as usual. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Spam blocks loading me up with spam
Today I saw hits from this campaign on another IP block as well, and plugging that into SenderBase.org gives me: http://www.senderbase.org/search?searchString=200.49.37.130 Note in the top right that they list: 200.49.36.0/22 belonging to "Network Access Point S.R.L.", and following that link shows 19 domains, many of which follow Scott's spam campaign sample domains. Weirdly, plugging in that CIDR format back into SenderBase reveals little joy. I've submitted to "spam@" multiple samples from today of spam that I caught with and without Sniffer so that Pete can see what is common. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Thursday, June 16, 2005 3:58 PM To: Chuck Schick Subject: Re[2]: [sniffer] Spam blocks loading me up with spam Additional info (justifying the IP block rules just added): http://www.senderbase.org/search?searchString=200.49.48.0%2F20 I wonder why nobody else is listing these IPs yet. Could we just be the first? (This exercise has given me some ideas for new research tasks-- :-) ) Interesting. _M On Thursday, June 16, 2005, 6:46:13 PM, Chuck wrote: CS> We have been seeing these. CS> Chuck Schick CS> Warp 8, Inc. CS> (303)-421-5140 CS> www.warp8.com CS> -Original Message- CS> From: [EMAIL PROTECTED] CS> [mailto:[EMAIL PROTECTED] CS> On Behalf Of Scott Fisher CS> Sent: Thursday, June 16, 2005 4:04 PM CS> To: sniffer@SortMonster.com CS> Subject: [sniffer] Spam blocks loading me up with spam CS> Am I the only one getting blasted by these spam from these IP CS> blocks? Sniffer seems a little behind on catching these. CS> 200.49.48.0/24 200.49.48.0/24 CS> 200.49.49.0/24 200.49.49.0/24 mowz2.com CS> 200.49.50.0/24 200.49.50.0/24 qckcstmr.com CS> 200.49.51.0/24 200.49.51.0/24 srvdupfrsh.com CS> 200.49.52.0/24 200.49.52.0/24 aahtv.com CS> 200.49.53.0/24 200.49.53.0/24 aakai.com CS> 200.49.54.0/24 200.49.54.0/24 aakib.com CS> 200.49.55.0/24 200.49.55.0/24 aakli.com CS> 200.49.56.0/24 200.49.56.0/24 aafix.com CS> 200.49.57.0/24 200.49.57.0/24 e.com CS> 200.49.58.0/24 200.49.58.0/24 CS> 200.49.59.0/24 200.49.59.0/24 CS> Domain names and links seem to be five chars beginning with aa. They CS> also seem to be progressing through the IP blocks. CS> i think they started in on the June 15th and have been spamming CS> pretty consistantly. CS> This E-Mail came from the Message Sniffer mailing list. For CS> information and (un)subscription instructions go to CS> http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] New Spam/Virus?
New target ip: 205.138.199.146 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim Matuska Sent: Monday, June 06, 2005 3:01 PM To: sniffer@SortMonster.com Subject: Re: Re[2]: [sniffer] New Spam/Virus? Thanks Pete, What Return code will this be under? Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Dave Koontz" Sent: Monday, June 06, 2005 3:00 PM Subject: Re[2]: [sniffer] New Spam/Virus? > On Monday, June 6, 2005, 5:50:38 PM, Dave wrote: > > DK> Same exact IP here! > > We've got a couple of rules for this now -- making the rounds as new > compiles go out. > > _M > > > > This E-Mail came from the Message Sniffer mailing list. For > information > and (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html > This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] New Spam/Virus?
Thanks Pete, What Return code will this be under? Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Dave Koontz" Sent: Monday, June 06, 2005 3:00 PM Subject: Re[2]: [sniffer] New Spam/Virus? On Monday, June 6, 2005, 5:50:38 PM, Dave wrote: DK> Same exact IP here! We've got a couple of rules for this now -- making the rounds as new compiles go out. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Sniffer and SmarterMail?
If you have a current SA with Declude, you can move from iMail Declude to SmarterMail Declude for free. I suggest that you contact Declude about this - that is, assuming you are completely shutting down your iMail server. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, June 01, 2005 8:31 PM To: Joe Wolf Subject: Re[2]: [sniffer] Sniffer and SmarterMail? Hi Joe, Yeah, we had talked about buying the low cost Declude Virus/JM versions and then letting Sniffer hook into those as well as then hooking with SmarterMail... That's an option for you too. -jason - - - - - - - - - - - - - - - - - - > Wednesday, June 1, 2005, 7:02:30 PM, you wrote: JW> Mdaemon may be great, but it's out of my budget. I can't afford $2500 for JW> the mail server and then another $1600 for the anti-virus. Especially when JW> I compare it to SmarterMail at $600. JW> I would love to continue to use Sniffer... I respect it more than Imail and JW> Declude combined! But the fact is that it's time to move on. Ipswitch has JW> completely lost their mind and just doesn't give a damn about their JW> customers, failed to fix major problems, and raised their prices thru the JW> roof. JW> It may be very simple to plug in Sniffer to SmarterMail, but I'm not a JW> developer. I don't really want to run a non-supported implementation. JW> If there's a better option than SmarterMail I'd love to hear it, but I can't JW> compare a $4000+ server to a $600 one. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Sniffer and SmarterMail?
I currently own and use Declude, but want NOTHING to do with Declude from here on out. Since Scott left I nothing good to say about them. -Joe - Original Message - From: <[EMAIL PROTECTED]> To: "Joe Wolf" Sent: Wednesday, June 01, 2005 7:31 PM Subject: Re[2]: [sniffer] Sniffer and SmarterMail? Hi Joe, Yeah, we had talked about buying the low cost Declude Virus/JM versions and then letting Sniffer hook into those as well as then hooking with SmarterMail... That's an option for you too. -jason - - - - - - - - - - - - - - - - - - > Wednesday, June 1, 2005, 7:02:30 PM, you wrote: JW> Mdaemon may be great, but it's out of my budget. I can't afford $2500 for JW> the mail server and then another $1600 for the anti-virus. Especially when JW> I compare it to SmarterMail at $600. JW> I would love to continue to use Sniffer... I respect it more than Imail and JW> Declude combined! But the fact is that it's time to move on. Ipswitch has JW> completely lost their mind and just doesn't give a damn about their JW> customers, failed to fix major problems, and raised their prices thru the JW> roof. JW> It may be very simple to plug in Sniffer to SmarterMail, but I'm not a JW> developer. I don't really want to run a non-supported implementation. JW> If there's a better option than SmarterMail I'd love to hear it, but I can't JW> compare a $4000+ server to a $600 one. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] New Spam Storm
Thanks Pete, would you be able to provide the current false positive rates for the return codes? Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Jim Matuska" Sent: Tuesday, May 17, 2005 11:54 AM Subject: Re[2]: [sniffer] New Spam Storm On Tuesday, May 17, 2005, 1:44:30 PM, Jim wrote: JM> Pete, JM> Is there a possibility of setting up another return code for JM> situations such as this such as a blacklist rulecode that only has JM> rules for messages such as these that should be blacklisted JM> immediately. I wouldn't mind setting certain high priority rules JM> to block immediately. A couple of things --- When we first saw this we didn't know it was a virus, so we were blocking the messages as normal spam. Once we did know it was malware we coded it to the malware group. No filters are perfect (even ours ;-) but I believe the code you are looking for is our malware result code: 55 That's as close as I can come to this requests without doing something new and therefore less reliable. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Message Sniffer Plugin for MDaemon Wide Beta & Promo
Do you configure rules similar to in the previous versions, or by using this as a plug in is there a GUI for configuration. Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] - Original Message - From: "Dave Koontz" <[EMAIL PROTECTED]> To: Sent: Wednesday, April 20, 2005 12:36 PM Subject: RE: Re[2]: [sniffer] Message Sniffer Plugin for MDaemon Wide Beta & Promo Pete, I've been using this plugin for the last couple of months and can say it's been rock solid. Nice work! One little feature request though would be to add an option to auto prune the sniffer log file to so many days, or "X" killobytes. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Wednesday, April 20, 2005 1:45 PM To: Jim Matuska Subject: Re[2]: [sniffer] Message Sniffer Plugin for MDaemon Wide Beta & Promo On Wednesday, April 20, 2005, 1:15:37 PM, Jim wrote: JM> Pete, JM> Should we change the license info in the plugin.cfg file to match JM> our license info or should we wait to do so until the release version comes out? Please go ahead and make the change. The current code is considered to be production ready. Any changes prior to release will be minor additions, and it is likely there will be no changes... that is, unless someone reports a bug ;-) The new plugin is clearly the preferable Message Sniffer implementation for MDaemon. Best, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Message Sniffer Plugin for MDaemon Wide Beta & Promo
Pete, I've been using this plugin for the last couple of months and can say it's been rock solid. Nice work! One little feature request though would be to add an option to auto prune the sniffer log file to so many days, or "X" killobytes. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Wednesday, April 20, 2005 1:45 PM To: Jim Matuska Subject: Re[2]: [sniffer] Message Sniffer Plugin for MDaemon Wide Beta & Promo On Wednesday, April 20, 2005, 1:15:37 PM, Jim wrote: JM> Pete, JM> Should we change the license info in the plugin.cfg file to match JM> our license info or should we wait to do so until the release version comes out? Please go ahead and make the change. The current code is considered to be production ready. Any changes prior to release will be minor additions, and it is likely there will be no changes... that is, unless someone reports a bug ;-) The new plugin is clearly the preferable Message Sniffer implementation for MDaemon. Best, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re: Re[2]: [sniffer] Message Sniffer Plugin for MDaemon Wide Beta & Promo
Pete, Is there a difference between the normal .snf files I have been downloading and the one for the plugin? I have setup my script to download the .snf file and noticed it is a couple mb's smaller than the included demo .snf file. Jim Matuska Jr. Computer Tech2, CCNA Nez Perce Tribe Information Systems [EMAIL PROTECTED] - Original Message - From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Jim Matuska" Sent: Wednesday, April 20, 2005 10:45 AM Subject: Re[2]: [sniffer] Message Sniffer Plugin for MDaemon Wide Beta & Promo On Wednesday, April 20, 2005, 1:15:37 PM, Jim wrote: JM> Pete, JM> Should we change the license info in the plugin.cfg file to match our JM> license info or should we wait to do so until the release version comes out? Please go ahead and make the change. The current code is considered to be production ready. Any changes prior to release will be minor additions, and it is likely there will be no changes... that is, unless someone reports a bug ;-) The new plugin is clearly the preferable Message Sniffer implementation for MDaemon. Best, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] Notice: Potential outages tonight...
Yes but that really seems strange when I was getting 4 to 10 messages every day. Now I did not get any since the 3rd of March right after you announced that there would be the outage? You may want to check into this closer. Rick Hogue Intent.Net - Web Hosting 3802 Handley Avenue Louisville, KY 40218 1-502-459-3100 1-800-866-2983 Toll Free New Books Available "Prosperity Or Better Times Ten" "Hot Slot Secrets" "The Incredible Inman's Louisville Trivia Challenge" -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Saturday, April 09, 2005 1:34 PM To: Rick Hogue Cc: sniffer@SortMonster.com Subject: Re[2]: [sniffer] Notice: Potential outages tonight... On Saturday, April 9, 2005, 1:27:51 PM, Rick wrote: RH> I have not had any messages from the list since the 3rd of March. What is RH> happening on the list? The list has been very quiet. I got your message twice - once from you directly and once from the list. This seems correct based on your headers ;-) _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
