I received a forwarded email with these headers today. Don't know which
spam filter product generated them, but they look like some neat tests:
* 0.3 NO_REAL_NAME From: does not include a real name
* 0.9 FROM_ENDS_IN_NUMS From: ends in numbers
* 0.6 US_DOLLARS_3 BODY: Mentions
I can't say that I am overwhelmed with the effectiveness of the MTLDB test
thus far. Every single email I have seen come through my server with the
MTLDB test triggered on it has been a false positive - in fact, it seems
that user not found automated messages originating from the mail servers
Does anyone know how to expedite getting removed from
AOL/Netscape/Compuserve's IP spam list? I have no idea how we got there,
but they have been blocking mail from every domain on my server for
almost two weeks now. I can guarantee we've never sent any spam their
way, or any way, for that
.
Matt
Scott MacLean wrote:
Does anyone know how to expedite
getting removed from AOL/Netscape/Compuserve's IP spam list? I have no
idea how we got there, but they have been blocking mail from every domain
on my server for almost two weeks now. I can guarantee we've never sent
any spam their way, or any
This may be a crutch solution, but it is what we have
implemented, and our customers seem to like it.
I wrote a small port redirection program that runs on the mail server. It
listens on a specific port number, and when it receives a connection,
opens a connection on the mail server on port 25,
that you can still secure things
by way of SMTP AUTH without needing to accept every message coming into
that port? And more importantly, would you be willing to
share your fine work :)
Matt
Scott MacLean wrote:
This may be a crutch solution, but
it is what we have implemented, and our customers
I've had BIND 4, 8 and 9 running on my IMail 6, 7 and
8, both master and slave, for years, with no problems ever. Well...no
problems relating to the interaction of IMail and DNS. :)
At 11:33 AM 12/12/2003, Burzin Sumariwalla wrote:
I thought it was a no-no to have
DNS running on your Imail
Some interesting results based on the poll TuCows sent to
its resellers:
http://icann.org/correspondence/noss-to-twomey-03oct03.htm
It wouldn't make sense to repeatedly download what was
essentially the same list with small changes. It would make much more
sense to have one large file to download once, followed by a distribution
of small diff files to apply to the main file, containing any
additions/deletions since the
I am getting TONS of this crap on my server. All kinds of
different messages, all with the little MPCM blurb at the
top. I set up two filters in my Wordfilter test to catch it:
BODY 10 CONTAINS mpcmffa.com
BODY 10 CONTAINS MPCM
However, it is not catching it - in fact, the only wordfilter entry I
At 04:03 PM 9/25/2003, R. Scott Perry wrote:
Are there any spaces/tabs after
MPCM on that line? Does the line end properly (if it is
the last line in the file, and you use Notepad, can the cursor go to the
line below it)?
The lines are fine - no spaces/tabs, and they are in the middle of the
At 05:10 PM 09/25/2003, Matthew Bramble wrote:
Scott MacLean wrote:
*sigh* you're right again, Scott.
Still doesn't explain why it's not catching my previous wordfilter lines.
I'm going to watch this one some more.
Keep checking your math for the other message :)
NOLEGITCONTENT nolegitcontent x
of Declude JunkMail before 1.75 that
whitelisting would not work properly on longer return addresses such as
this. We haven't had any such reports with 1.75, so if you aren't
on 1.75, I would recommend upgrading to it.
I'm definitely running 1.75.
___
Scott MacLean
[EMAIL PROTECTED
in your log file, are there any errors being
reported?
Bill
- Original Message -
From: Scott MacLean [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Sunday, July 27, 2003 9:45 PM
Subject: [Declude.JunkMail] Massive flood of uncaught spam
Starting Friday night, most of the users
: Scott MacLean [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Sunday, July 27, 2003 9:45 PM
Subject: [Declude.JunkMail] Massive flood of uncaught spam
Starting Friday night, most of the users of the various domains on
my
server have been complaining of a massive flood of spam. I would say
nova.sparklist.com ([216.91.57.182]).
X-Failed-Spam-Test: BLACKLIST, WORDFILTER, NOLEGITCONTENT, WEIGHT15
X-RCPT-TO: [EMAIL PROTECTED]
X-UIDL: 338337210
Status: U
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus
done is sidestepping my Declude setup.
Is anyone else seeing this?
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
to the wrong place.
What address were
you sending email to?
On your main webpage it shows [EMAIL PROTECTED] but it is really
linked to [EMAIL PROTECTED] ... and that bounces user
unknown.
Thanks, got that fixed now.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
user [EMAIL PROTECTED]
Any ideas what I can do about this? Is there anything I can do?
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from
], and
type unsubscribe Declude.JunkMail. The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
Now that we have the Comments tag, I now find spam with tons of these
peppered throughout:
font color=#5D5AC3
Not really comments, as they are functional, but they're put randomly
throughout the email. Functional, but pointless. Any ideas?
___
Scott MacLean
[EMAIL
came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
Declude.JunkMail. The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
This allows using other lists in addition to Tom's.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
/whatever.txt
This allows using other lists in addition to Tom's.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
unsubscribe Declude.JunkMail. The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
Scott, is it possible that the wordfilter, when looking at HTML source
messages, can be made to disregard HTML comments, as above?
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
I just saw an email that *should* have been caught several times over with
various BODY CONTAINS filters, but wasn't - instead, it caught BASE64.
Does Declude decode the BASE64 body and then apply the wordfilter? Because
it seems like it might not.
___
Scott MacLean
[EMAIL
to be spam.
_M
]-Original Message-
]From: [EMAIL PROTECTED]
][mailto:[EMAIL PROTECTED]]On
Behalf Of Scott MacLean
]Sent: Wednesday, September 25, 2002 8:10 AM
]To: [EMAIL PROTECTED]
]Subject: [Declude.JunkMail] Wordfilter in BASE64?
]
]
]I just saw an email that *should* have been caught several
.
To unsubscribe
from our broadcast, please click here REMOVE.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http
don't
mind if I download it and post it
on our web site.
http://www.imagefxonline.net/apps/delog
That is as soon as I get a chance. Perhaps Scott
will
do the same.
Of course, go right ahead.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
unsubscribe Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http
, misconfiguration in 10; expecting action
Any clue what I should be looking for?
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from
.
Unsubscribe
X-RBL-Warning: OSSRC: [1] netpalace, see http://spews.org/ask.cgi?S919 X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?65.172.10.207 X-RBL-Warning: WEIGHT10: Weight of 20 reaches or exceeds the limit of 10.
___
Scott MacLean
[EMAIL PROTECTED
to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned
], and
type unsubscribe Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http
Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
even
if their port 25 is blocked by their ISP.
What was the program, and will it do the same for port 80? ie: web
messaging
-- Timm Jasper
-- Systems Administrator
-- TQCi Internet
-- 301-863-6121
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
unsubscribe Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at
http://www.declude.com
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at
http://www.declude.com
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
], and
type unsubscribe Declude.JunkMail. You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at
http://www.declude.com
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
://www.declude.com
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
50 matches
Mail list logo
