I was wondering if Declude would consider adding a test that looks for long
or strange from names before the @ in the from address of a message. It
would be used as a weighted test. It might help push some e-mails into the
delete weight range.
Here are some examples of strange from addresses -
If anyone is using the Habeas headers whitelist option you should be aware
that topica.com is sending their messages with habeas headers. We have them
blacklisted but since the whitelisting overrides everything, their messages
were getting through.
Greg
---
[This E-mail was scanned for viruses
on 3/25/03 10:14 AM, John Tolmachoff wrote:
What is the originating IP address?
66.180.244.23
66.180.244.25
66.180.244.28
and I assume others.
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing
on 3/25/03 2:41 PM, Darrell LaRock wrote:
I am sure many people have noticed a lot of spam that is like this.
Consider a users email address like this [EMAIL PROTECTED]
Then the subject of the email is
bsmith, have you seen this blah blah
Any thoughts on how to check to see if the
on 3/17/03 9:28 AM, Mark Smith wrote:
Has the addition of the TMDA test been discussed with Junkmail/Imail?
http://tmda.net
I don't know but I wanted to mention that we just started using the Bonded
Sender service at http://www.bondedsender.com/ and it is significantly
reducing false
Would it be possible to put the X-RBL warning and failed spam tests lines in
the header records of messages that are personally whitelisted via the
address book?
We've had a few requests from people who didn't get mail from x, add x
to their address book (to be whitelisted) and now would like to
Is there a way to setup the Heur10 test so that if the result of the level
10 test was 1.00 the test would have a weight of 5 but if the result was
.00 or less it would have a weight of 2?
I believe I'd have to setup two versions of the Heur10 test but I don't know
how to set it up for
on 2/19/03 2:54 PM, R. Scott Perry wrote:
After checking the logs I do see the SMTPD and SMTP entries as stated. So
that portion is workingÂ…now to find out why I am losing attachments.
Is it the whole E-mail being lost, or just the attachment? Neither Declude
nor IMail will remove
on 2/13/03 2:36 PM, paul wrote:
Ok guys, what do you see in ratio of junk vs good mail per day?
Spam messages account for over 75% of our incoming messages (we're an ISP).
Later,
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came
on 2/4/03 1:23 PM, R. Scott Perry wrote:
Would it be possible to change the format to this?
COMMENTS comments 5 x 10 0
COMMENTS comments 5 weight 10 0
Where the number is the minimum needed to fail the test.
The second value indicates whether or not the admin wants a cumulative
on 2/3/03 7:05 PM, R. Scott Perry wrote:
The test is defined in the global.cfg file as follows:
COMMENTS comments 5 x 10 0
where the 5 means that 5 such comments have to be encountered (the 10 is
the weight that will be added for E-mail that fails the
test). Alternatively,
on 1/16/03 6:57 PM, R. Scott Perry wrote:
I think I mentioned this to you
earlier, Scott; If you could have the user edit their addressbook in
Imail web mail as a whitelist, and Declude used this, then the user
could manage their own whitelist.
This is something that we are also
on 12/18/02 8:43 AM, R. Scott Perry wrote:
Both methods may be a possibility. However, the web interface would take
priority, unless it seemed that the E-mail option would be useful to a lot
of people.
How are subscribers going to log into a web interface? Won't they need a
password of some
on 12/17/02 1:12 PM, R. Scott Perry wrote:
I picture something along the lines of sending a change request to
[EMAIL PROTECTED] I get back a form where I can change the
settings and reply.
It's not nearly as slick as a web interface, but it would work for everyone
(except maybe Imail
on 11/5/02 12:23 PM, Bill B wrote:
WEIGHT20 ROUTETO junkmail@%LOCALHOST%
Does the US government still want spam sent to them at that one e-mail
address (that I can't remember)?
If there was a route to with headers option that included the headers in
with the original e-mail message, we could
I've noticed some spam messages getting through our system lately and some
of them have a definite pattern in the subject.
The subject will typically be something like -
my engine blewHNMTTWG
where there is a phrase and then at least 6 spaces and then some kind of
code. I can't
on 10/7/02 2:45 PM, R. Scott Perry wrote:
The SPAMHEADERS test should detect this.
It did, but I can't weight SPAMHEADERS so that it automatically deletes
those types of messages because SPAMHEADERS would catch/delete a lot of
legitimate e-mail messages.
Since, SPAMHEADERS is already spotting
on 9/25/02 9:31 AM, Scott MacLean wrote:
That's what I suspected. Has anyone seen HTML Base64 segments that *weren't*
spam?
Yes. A few at first but more are appearing now.
Are there any email clients that actually put out such a thing?
Every message my brother's in-laws send to their
on 9/5/02 9:23 PM, Madscientist wrote:
All this is good I guess. Until we come up with some good examples of
legitimate messages with text/html base64 then we won't completely
settle the issue. It does seem that the evidence so far is strongly in
favor of a spam/no-spam test for base64
I know there is an undocumented adult test in Declude, but I was wondering
if there could be an adult language test added to the program? Or maybe
that test does that.
I would like to add the subject Adult: to any message that would pass the
other Declude tests and contained words like XXX,
Some spammer is sending mail to our domains and addressing the to and the
from like the example below.
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Make Money in Real Estate
Date: Fri, Jun 7, 2002, 4:00 AM
The Declude logs show messages like this having a spam weight of 25+ (we
on 6/7/02 12:10 PM, Greg Foulks wrote:
Maybe blacklist [EMAIL PROTECTED]
My bad, I didn't explain that the from (aa in my example) keeps changing
to other legit @acsworld.net addresses.
Thanks,
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
on 6/7/02 12:17 PM, Jim Matuska wrote:
I would try whitelisting only the ip address of the acsworld.net
mailserver(s) That way the spam would get blocked unless the ip address was
also forged to match the mailserver.
If I do that won't all messages that are being forwarded from the .net
on 6/7/02 12:48 PM, R. Scott Perry wrote:
Is this with v1.54?
No, with 1.53.
After installing 1.54 I looked in the logs for bogus and found multiple
entries like this:
06/07/2002 00:21:38 Q34d158be013ce05f Bogus IP:
06/07/2002 00:21:39 Q34d158be013ce05f SPAMHEADERS:6 . Total weight = 6
on 6/7/02 12:47 PM, Smart Business Lists wrote:
Seems to be working fine for us.
in messages
X-RBL-Warning: HELOBOGUS: Domain company.mail has no MX/A records
in log
failed HELOBOGUS (Domain company.mail has no MX/A records.)
Weight is adding in - we're at 2 -
You are correct it is
Scott,
Could you explain HELOBOGUS?
I see the following entries in my log file -
Msg failed HELOBOGUS (Domain engrmail1.engr.psu.edu has no MX/A records.).
Msg failed HELOBOGUS (Domain bur05.standardsteel.com has no MX/A records.).
Msg failed HELOBOGUS (Domain mail12.w-advertising.com has no
on 6/7/02 3:55 PM, R. Scott Perry wrote:
I see the following entries in my log file -
Msg failed HELOBOGUS (Domain engrmail1.engr.psu.edu has no MX/A records.).
Msg failed HELOBOGUS (Domain bur05.standardsteel.com has no MX/A records.).
Msg failed HELOBOGUS (Domain mail12.w-advertising.com
Scott,
Could you give a quick explanation of what the following file extensions
mean/indicate in the IMail spool directory?
.SMP
.SMD
.~MD
.GSE
.GSC
.VAP
Thanks,
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the
Scott,
I was wondering if you could add a new test to Declude JunkMail? This test
could be called similar addresses.
If someone sends a message to multiple addresses and the to, cc or bcc
of all the addresses contain helpdesk@ then I'd think it's a pretty good
bet that it's a spam message
on 4/25/02 11:40 AM, R. Scott Perry wrote:
Looking at our spamtraps, it looks like only a small
portion (perhaps 5% to 10%) of the spam is sent with the multiple addresses
in the To:/Cc: headers. Making it less useful is that often they are
similar-but-not-exact names -- such as john123@,
Orbz is back as dsbl. Visit http://orbz.org/ or http://dsbl.org/ for more
information.
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
Since my logs show that ORBZ hasn't responded to my server since 2:19pm on
3/19, I was wondering what alternate services that are commented out of the
global.cfg file are highly recommended or used? I would prefer to hear about
ones that work well while my boss would prefer to hear about free or
on 3/21/02 9:28 AM, R. Scott Perry wrote:
Since my logs show that ORBZ hasn't responded to my server since 2:19pm on
3/19, I was wondering what alternate services that are commented out of the
global.cfg file are highly recommended or used? I would prefer to hear about
ones that work well
on 3/21/02 12:45 PM, Matt Robertson wrote:
The NJABL tests look promising. Anyone tried them yet?
Matt,
I just started testing them about 90 minutes ago and so far they look very
good.
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
Scott,
When I was testing some things for you, you had me set the log level in
global.cfg file to debug. In the debug logs I saw message deleted lines.
I really liked that line as I could search for it to see how many messages
were deleted in a day. Unfortunately, the high log level doesn't seem
on 2/28/02 12:52 PM, R. Scott Perry wrote:
Is there a setting that I can add to the global.cfg file so the line gets
added to the high or mid log levels? If not, could I request that in a
future version of Junkmail the high log level add the message deleted
line?
It was taken out because
36 matches
Mail list logo
