[Declude.JunkMail] Listing in Blacklist
Title: Message Hi; It seems like Junkmail treats these two listings differently. .SAVINGSENGINE.COM @MAIL1.SAVINGSENGINE.COM I have always been under the impression that the first listing will include the 2nd listing. But it seems like the postings from this domain is getting through. Header from Declude: X-Declude-Sender: NOLIST-34636357-5666-ALI*ERFANI**XPERTMINDS*[EMAIL PROTECTED] [] The reason I think this is we have the first one listed in our blacklist and it is not getting caught but the 2nd one is listed in Tom's list (we use his list as a weighted list) and that is getting caught. Confusing! Thoughts? Regards, Kami
Re: [Declude.JunkMail] Listing in Blacklist
It seems like Junkmail treats these two listings differently. .SAVINGSENGINE.COM @MAIL1.SAVINGSENGINE.COM I have always been under the impression that the first listing will include the 2nd listing. But it seems like the postings from this domain is getting through. Header from Declude: X-Declude-Sender: mailto:NOLIST-34636357-5666-ALI*ERFANI**XPERTMINDS*COM;MAIL1.SAVINGSENGINE.COMNOLIST-34636357-5666-ALI*ERFANI**XPERTMINDS*[EMAIL PROTECTED] [] The reason I think this is we have the first one listed in our blacklist and it is not getting caught but the 2nd one is listed in Tom's list (we use his list as a weighted list) and that is getting caught. Confusing! Which version of Declude JunkMail are you using? I think the problem is due to the long address, but I believe that was fixed back around v1.32. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude gone whacky?
I resent an email and declude has now gone somewhat wacky. The imail server was acting loaded, so I checked the task man and there are 6 or 8 instances of declude running - taking up all of the cpu cycles. Ther are also about 15-20 .~md and .smd files in the spool dir and three or 4 .vir directories. It is busy doing something! Any ideas what happened? It looks like there was a problem with the code that could have potentially caused this, if there were large numbers of recipients for the E-mail. This will be fixed in the next release. However, with the 4 .vir directories as well (which are from Declude Virus), it may just be that you had a large amount of incoming traffic, that was being scanned normally. Does declude normally run multiple instances? Yes -- the IMail architecture will have either one Declude.exe process or one SMTP32.exe process for each E-mail that is being processed (after it is received by the SMTPD32.exe process). So it obviously doesn't like something with the filter. I did not create those accounts; muji and ddd. I was hoping the filters would work without a valid account as that was my inital goal. I have now deactivated the filter test line and all is running well. Tomorrow I'll try it with valid accounts, althought that doesn't do me much good, even if it works. I'll see if we can get the ALLRECIPS filter option to work with aliases as well. Although the aliases in IMail are very useful, they do come with their drawbacks. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] slightly OT spamcop message.
These are not legit -- you can check the IP address that they come from (doing a reverse DNS lookup or IPWHOIS) -- if the reverse DNS or IPWHOIS do not clearly indicate that it is from Spamcop, it isn't. -Scott At 09:42 AM 11/12/2002, you wrote: I got 3 mails this morning from spamcop about spam abuse from our network, I recall months back there was a bogus letter being sent, could this be happening again? Or is it legit? If it's legit, I obviously want some evidence of spamming from our users as we have a no tolerance policy on spam, and I'll drop whoever it is in a heartbeat, but I don't want to waste my time/energy if it's bogus. Thanks. Paul Received: from SMTP32-FWD by mail.2khiway.net (SMTP32) id A0B34; Mon, 11 Nov 2002 19:20:00 -0500 Received: from reports.spamcop.net [66.153.33.86] by mail.2khiway.net (SMTPD32-7.13) id A37E86E00DA; Mon, 11 Nov 2002 18:55:42 -0500 To: [EMAIL PROTECTED] X-Mailer: X-MSMail-Priority: Normal Subject: Your network is being compromised Date: Mon, 11 Nov 2002 18:52:55 -0500 From: [EMAIL PROTECTED] MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary==_NextPart_63785302331564251 Message-Id: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [66.153.33.86] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None Status: U X-UIDL: 322689227 -- Received: from SMTP32-FWD by mail.2khiway.net (SMTP32) id A13BC; Mon, 11 Nov 2002 19:18:38 -0500 Received: from reports.spamcop.net [66.153.33.86] by mail.2khiway.net (SMTPD32-7.13) id A35D86E00DA; Mon, 11 Nov 2002 18:55:09 -0500 From: [EMAIL PROTECTED] MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary==_NextPart_63785302331564251 X-Mailer: X-Mailer: Mozilla 4.61 [en]C-CCK-MCD (Win98; U) To: [EMAIL PROTECTED] Subject: Your site will be shut down Message-Id: [EMAIL PROTECTED] Date: Mon, 11 Nov 2002 18:52:22 -0500 X-Declude-Sender: [EMAIL PROTECTED] [66.153.33.86] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None Status: U X-UIDL: 322689226 --- Received: from SMTP32-FWD by mail.2khiway.net (SMTP32) id A0BCC; Mon, 11 Nov 2002 18:56:59 -0500 Received: from reports.spamcop.net [66.153.33.86] by mail.2khiway.net (SMTPD32-7.13) id A34D86E00DA; Mon, 11 Nov 2002 18:54:53 -0500 From: [EMAIL PROTECTED] Subject: Spamcop will block your network MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary==_NextPart_63785302331564251 Date: Mon, 11 Nov 2002 18:52:09 -0500 Message-Id: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Mailer: X-Mailer: QUALCOMM Windows Eudora Version 5.0 X-Declude-Sender: [EMAIL PROTECTED] [66.153.33.86] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None Status: U X-UIDL: 322689225 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] slightly OT spamcop message.
Thanks Scott, ok, dope slap me please. I should've thought of that. And I've spent alot of time on that dnsstuff.com page too... LOL Paul These are not legit -- you can check the IP address that they come from (doing a reverse DNS lookup or IPWHOIS) -- if the reverse DNS or IPWHOIS do not clearly indicate that it is from Spamcop, it isn't. -Scott --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Original Config File - Simple question
The original install of Declude includes a line in global.cfg that states WHITELIST HABEAS. I assume I can remark this out since we are receiving warnings in the log files called Invalid Whitelist test Habeas. Thanks for the input. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Original Config File - Simple question
The original install of Declude includes a line in global.cfg that states WHITELIST HABEAS. I assume I can remark this out since we are receiving warnings in the log files called Invalid Whitelist test Habeas. Thanks for the input. Yes, you can comment out the WHITELIST HABEAS line (by adding a # before it), since that feature is only available in the latest beta. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Original Config File - Simple question
Scott, Thanks for the reply. Speaking of the beta version - is it best to run the beta vs the 1.60. I guess we shy on the conservative side so at first glance the 1.60 was a good fit, however, if the 1.62 version is better (i.e. more features, bug fixes), and has proven stable, we may give it a road test. Just wanted to gain your thoughts, thanks again. Keith J -Original Message- From: R. Scott Perry [mailto:horizons;declude.com] Sent: Tuesday, November 12, 2002 10:18 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Original Config File - Simple question The original install of Declude includes a line in global.cfg that states WHITELIST HABEAS. I assume I can remark this out since we are receiving warnings in the log files called Invalid Whitelist test Habeas. Thanks for the input. Yes, you can comment out the WHITELIST HABEAS line (by adding a # before it), since that feature is only available in the latest beta. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Original Config File - Simple question
Thanks for the reply. Speaking of the beta version - is it best to run the beta vs the 1.60. I guess we shy on the conservative side so at first glance the 1.60 was a good fit, however, if the 1.62 version is better (i.e. more features, bug fixes), and has proven stable, we may give it a road test. Just wanted to gain your thoughts, thanks again. Our betas do tend to be very stable, usually the issues that come up are issues with the new features. We do have a v1.63 in the works, though, that includes a number of minor fixes over 1.62, so it may be best to wait for that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude gone whacky?
I resent an email and declude has now gone somewhat wacky. The imail server was acting loaded, so I checked the task man and there are 6 or 8 instances of declude running - taking up all of the cpu cycles. Ther are also about 15-20 .~md and .smd files in the spool dir and three or 4 .vir directories. It is busy doing something! Any ideas what happened? It looks like there was a problem with the code that could have potentially caused this, if there were large numbers of recipients for the E-mail. This will be fixed in the next release. However, with the 4 .vir directories as well (which are from Declude Virus), it may just be that you had a large amount of incoming traffic, that was being scanned normally. The test email that I sent only had one recipient. The problem started when I sent the test message to [EMAIL PROTECTED] to test the filter setup. There was not a valid imail account or alias for muji. I waited a minute for it to process and then checked the declude logs to see what had occurred. That is when I noticed that the server was acting loaded. I checked the mailboxes where the muji message would have gone and it wasn't there yet, so it was still processing. At this point I don't think there was any .vir directories. I waited 2-3 minutes and started to see multiple instances of declude.exe in taskman/processes. These were no doubt additional messages that were coming in while the test message was still processing. I waited another few minutes but none of the declude processes would ever finish and nothing was getting written to the logs. So that is when I killed it with a rename of global.cfg and a reboot. I believe it somehow chocked on the test message and the filter, possibly because there wasn't a valid imail account. I tried this two times with basically the same results. I will try it again but with a valid user account. Does declude normally run multiple instances? Yes -- the IMail architecture will have either one Declude.exe process or one SMTP32.exe process for each E-mail that is being processed (after it is received by the SMTPD32.exe process). So it obviously doesn't like something with the filter. I did not create those accounts; muji and ddd. I was hoping the filters would work without a valid account as that was my inital goal. I have now deactivated the filter test line and all is running well. Tomorrow I'll try it with valid accounts, althought that doesn't do me much good, even if it works. I'll see if we can get the ALLRECIPS filter option to work with aliases as well. Although the aliases in IMail are very useful, they do come with their drawbacks. How do you mean to work with aliases as well? Are you referring to the imail aliases? I guess it would be OK to still have an alias for old users, but where would it point to? I would like it just be able to delete a user when they are gone, aliases and all and then put their name in another file to have all their future mail dumped. It just makes imail more confusing to manage when there are many old unused users that should have been just deleted. I appreciate your help in figuring out a way to do this. Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude gone whacky?
The test email that I sent only had one recipient. The problem started when I sent the test message to [EMAIL PROTECTED] to test the filter setup. There was not a valid imail account or alias for muji. I waited a minute for it to process and then checked the declude logs to see what had occurred. That is when I noticed that the server was acting loaded. I checked the mailboxes where the muji message would have gone and it wasn't there yet, so it was still processing. At this point I don't think there was any .vir directories. I waited 2-3 minutes and started to see multiple instances of declude.exe in taskman/processes. These were no doubt additional messages that were coming in while the test message was still processing. I waited another few minutes but none of the declude processes would ever finish and nothing was getting written to the logs. Since there will only be one Declude.exe process for each E-mail, if there was a problem with the E-mail to [EMAIL PROTECTED], it couldn't have affected the other Declude.exe processes. My guess in this case is that there was a mail loop of some sort, which is the only way that extra Declude.exe processes could have been created (although the new ones would only appear after Declude processed the E-mail, so that doesn't make a lot of sense either). So that is when I killed it with a rename of global.cfg and a reboot. I believe it somehow chocked on the test message and the filter, possibly because there wasn't a valid imail account. I tried this two times with basically the same results. I will try it again but with a valid user account. Without the valid IMail account, the E-mail would be processed with the nobody alias as the recipient, rather than the actual account (so per-user settings would be based on the nobody alias, and the ALLRECIPS filter option would be based on the nobody alias). I'll see if we can get the ALLRECIPS filter option to work with aliases as well. Although the aliases in IMail are very useful, they do come with their drawbacks. How do you mean to work with aliases as well? The ALLRECIPS filter option (which was added to the v1.62 beta) only looks at the actual recipients, not the intended recipients (the address that the sender tried to send to). So in the case of the nobody alias, the ALLRECIPS filter option doesn't look at the intended recipient (which is what we are going to see if we can change). Are you referring to the imail aliases? I guess it would be OK to still have an alias for old users, but where would it point to? No -- the idea is just that you could still use the old nobody alias, and still have Declude JunkMail filter based on the intended recipient (muji), even though the mail is going to the nobody alias. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] slightly OT spamcop message.
We recieved a few of these messages as well. There is some info on Spamcop's site about it. http://spamcop.net/fom-serve/cache/124.html Dustin -Original Message- From: R. Scott Perry [mailto:horizons;declude.com] Sent: Tuesday, November 12, 2002 9:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] slightly OT spamcop message. These are not legit -- you can check the IP address that they come from (doing a reverse DNS lookup or IPWHOIS) -- if the reverse DNS or IPWHOIS do not clearly indicate that it is from Spamcop, it isn't. -Scott At 09:42 AM 11/12/2002, you wrote: I got 3 mails this morning from spamcop about spam abuse from our network, I recall months back there was a bogus letter being sent, could this be happening again? Or is it legit? If it's legit, I obviously want some evidence of spamming from our users as we have a no tolerance policy on spam, and I'll drop whoever it is in a heartbeat, but I don't want to waste my time/energy if it's bogus. Thanks. Paul Received: from SMTP32-FWD by mail.2khiway.net (SMTP32) id A0B34; Mon, 11 Nov 2002 19:20:00 -0500 Received: from reports.spamcop.net [66.153.33.86] by mail.2khiway.net (SMTPD32-7.13) id A37E86E00DA; Mon, 11 Nov 2002 18:55:42 -0500 To: [EMAIL PROTECTED] X-Mailer: X-MSMail-Priority: Normal Subject: Your network is being compromised Date: Mon, 11 Nov 2002 18:52:55 -0500 From: [EMAIL PROTECTED] MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary==_NextPart_63785302331564251 Message-Id: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [66.153.33.86] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None Status: U X-UIDL: 322689227 -- Received: from SMTP32-FWD by mail.2khiway.net (SMTP32) id A13BC; Mon, 11 Nov 2002 19:18:38 -0500 Received: from reports.spamcop.net [66.153.33.86] by mail.2khiway.net (SMTPD32-7.13) id A35D86E00DA; Mon, 11 Nov 2002 18:55:09 -0500 From: [EMAIL PROTECTED] MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary==_NextPart_63785302331564251 X-Mailer: X-Mailer: Mozilla 4.61 [en]C-CCK-MCD (Win98; U) To: [EMAIL PROTECTED] Subject: Your site will be shut down Message-Id: [EMAIL PROTECTED] Date: Mon, 11 Nov 2002 18:52:22 -0500 X-Declude-Sender: [EMAIL PROTECTED] [66.153.33.86] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None Status: U X-UIDL: 322689226 --- Received: from SMTP32-FWD by mail.2khiway.net (SMTP32) id A0BCC; Mon, 11 Nov 2002 18:56:59 -0500 Received: from reports.spamcop.net [66.153.33.86] by mail.2khiway.net (SMTPD32-7.13) id A34D86E00DA; Mon, 11 Nov 2002 18:54:53 -0500 From: [EMAIL PROTECTED] Subject: Spamcop will block your network MIME-Version: 1.0 X-Encoding: MIME Content-Type: multipart/alternative; boundary==_NextPart_63785302331564251 Date: Mon, 11 Nov 2002 18:52:09 -0500 Message-Id: [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Mailer: X-Mailer: QUALCOMM Windows Eudora Version 5.0 X-Declude-Sender: [EMAIL PROTECTED] [66.153.33.86] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None Status: U X-UIDL: 322689225 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:Re: [Declude.JunkMail] Adultery
Hi John, We do not have the docs finished yet, but the program is available if you would care to test it. There is a 'Declude style' configuration file and it is completely commented so it is easy to use without the docs. At this point we are still open to suggestions and comments. We hope to begin the Linux translation by Dec 1, so the feature set and program defaults are not locked down as yet. Let me know and I will send you the files and a license key. Brian On 11/08/02 1:45pm you wrote... Great. Please keep us posted on the progress. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamCop, OSSRC, and OSSOFT Tests
I currently give a weight of 16 to SpamCop, forcing the message to either fail 2 minor tests or one other major test. (Subject modification 15-19, hold at 20.) Here is what Declude has to say about OSSRC: Osirusoft's Confirmed Spam Source list. These are sites that continually spam and have been manually added, after multiple nominations. Apparently the same as Spews. Warning: Lists a number of legitimate mail servers that happen to have the same Class C address space as spammers. Has TXT records. Therefore, I do not use it, as it is guilty by association. Here is what Declude has to say about OSSOFT: Osirusoft's list of Spamware Software Developers. It is believed that these are IP ranges of companies that are known to produce spam software. Similar to or the same as SPAMHAUS/SBL test. Has TXT records. I have given this test a weight of 2. My thinking is that although they are known to produce SPAM, they have not been shown very in-effective in Scott's monthly log. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamCop, OSSRC, and OSSOFT Tests
Ron, Tuesday, November 12, 2002 you wrote: RH I currently Hold a lot of e-mail failing a lot of the open relay tests. The only two tests I hold directly are ORDB and SNIFFER. ORDB is about 99% for me and SNIFFER is less but still very high. Mainly SNIFFER fails on lists and personal messages from people who have spam domain addresses. ORDB only catches about 3.6% of our failed messages so it is not a big deal one way or the other. RH I am considering holding SpamCop and OSSRC also. I have not RH noticed any legitimate e-mail failing these two tests. Can you RH reply with some opinions please? SPAMCOP is my number 3 test in terms of number of failed messages. It ranks at 60.22% of failed messages compared to SNIFFER's 75.5%. But it fails too many legitimate messages for my users. OSSRC ranks 12th at 14.3% of failed messages but it also fails too many messages for me to hold on it alone. However, I weight both SPAMCOP and OSSRC so that any other test failed with them will trigger a HOLD. Keep in mind that we monitor HOLD and on average have to unhold about 2% of filtered messages. RH Also, I currently hold e-mail failing the OSSOFT, which will hold RH Yahoo mail. How does everyone else handle this issue? I weight OSSOFT the same as SPAMCOP and OSSRC. It fails about 4% of our failed messages. But I think that every user community is probably different and ours certainly changes over time so I do monitor and tweak these settings frequently. HTH Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Adultery
Brian, I would like to test it as well! Patrick Childers Network Administrator Hussey, Gay, Bell DeYoung Inc. 329 Commercial Drive Savannah, GA 31406 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Brian Milburn Sent: Tuesday, November 12, 2002 12:31 PM To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.JunkMail] Adultery Hi John, We do not have the docs finished yet, but the program is available if you would care to test it. There is a 'Declude style' configuration file and it is completely commented so it is easy to use without the docs. At this point we are still open to suggestions and comments. We hope to begin the Linux translation by Dec 1, so the feature set and program defaults are not locked down as yet. Let me know and I will send you the files and a license key. Brian On 11/08/02 1:45pm you wrote... Great. Please keep us posted on the progress. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:RE: Re: [Declude.JunkMail] Adultery
Ok, it is being sent to your email address. On 11/12/02 12:44pm you wrote... Brian, I would like to test it as well! Patrick Childers Network Administrator Hussey, Gay, Bell DeYoung Inc. 329 Commercial Drive Savannah, GA 31406 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Brian Milburn Sent: Tuesday, November 12, 2002 12:31 PM To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.JunkMail] Adultery Hi John, We do not have the docs finished yet, but the program is available if you would care to test it. There is a 'Declude style' configuration file and it is completely commented so it is easy to use without the docs. At this point we are still open to suggestions and comments. We hope to begin the Linux translation by Dec 1, so the feature set and program defaults are not locked down as yet. Let me know and I will send you the files and a license key. Brian On 11/08/02 1:45pm you wrote... Great. Please keep us posted on the progress. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Adultery
Yes, I would be willing to try it. Although we are a small company, and therefore our traffic is less and may not make as good of a test bed. On the other hand, if something goes wrong, it will not effect as much. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com] On Behalf Of Brian Milburn Sent: Tuesday, November 12, 2002 9:31 AM To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.JunkMail] Adultery Hi John, We do not have the docs finished yet, but the program is available if you would care to test it. There is a 'Declude style' configuration file and it is completely commented so it is easy to use without the docs. At this point we are still open to suggestions and comments. We hope to begin the Linux translation by Dec 1, so the feature set and program defaults are not locked down as yet. Let me know and I will send you the files and a license key. Brian On 11/08/02 1:45pm you wrote... Great. Please keep us posted on the progress. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamCop, OSSRC, and OSSOFT Tests
I have given this test a weight of 2. My thinking is that although they are known to produce SPAM, they have not been shown very in-effective in Scott's monthly log. Darn keyboard virus. Let me try that again. ...they have not been shown to be very effective in... John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Adultery
Brian, Us too please!! We catch a lot now but it still seems like the particularly nasty ones still get through. Seems like nobody complained before we started filtering Fritz Frederick P. Squib, Jr. Network Administrator Citizens Internet Services http://www.wpa.net -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com] On Behalf Of Brian Milburn Sent: Tuesday, November 12, 2002 12:31 PM To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.JunkMail] Adultery Hi John, We do not have the docs finished yet, but the program is available if you would care to test it. There is a 'Declude style' configuration file and it is completely commented so it is easy to use without the docs. At this point we are still open to suggestions and comments. We hope to begin the Linux translation by Dec 1, so the feature set and program defaults are not locked down as yet. Let me know and I will send you the files and a license key. Brian On 11/08/02 1:45pm you wrote... Great. Please keep us posted on the progress. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Citizens Internet Services with Declude Virus v 1.62] --- [This E-mail scanned for viruses by Citizens Internet Services with Declude Virus v 1.62] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 3rd Party Hold Readers
I've seen several emails come thru referencing 3rd party hold readers/reviewers. Does anyone have a pref on one. Also, I have gotten some feedback from Scott (much apprec.) on what he sees as a initial setup for guarding against spam. I would like to see what options others have unlocked or tweeked in the field (i.e. which tests you hold/bounce/delete, which work for you). Thanks for the aid (Realizing this is a loaded question) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Adultery
I'd love to give your program a try. Written between the lines of the post I first started this thread with: I have a nagging problem with porn and I have been charged with cleaning it up. My challenge is that the stuff I'm seeing is stuff that my local users are sharing among themselves, so I'm going to need to develop something a little more stern than standard spam filtering. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Brian Milburn Sent: Tuesday, 12 November 2002 12:31 PM To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.JunkMail] Adultery Hi John, We do not have the docs finished yet, but the program is available if you would care to test it. There is a 'Declude style' configuration file and it is completely commented so it is easy to use without the docs. At this point we are still open to suggestions and comments. We hope to begin the Linux translation by Dec 1, so the feature set and program defaults are not locked down as yet. Let me know and I will send you the files and a license key. Brian On 11/08/02 1:45pm you wrote... Great. Please keep us posted on the progress. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 3rd Party Hold Readers
I like Spam Review, and I use it every single day. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Keith Johnson Sent: Tuesday, 12 November 2002 1:40 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] 3rd Party Hold Readers I've seen several emails come thru referencing 3rd party hold readers/reviewers. Does anyone have a pref on one. Also, I have gotten some feedback from Scott (much apprec.) on what he sees as a initial setup for guarding against spam. I would like to see what options others have unlocked or tweeked in the field (i.e. which tests you hold/bounce/delete, which work for you). Thanks for the aid (Realizing this is a loaded question) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Adultery
My challenge is that the stuff I'm seeing is stuff that my local users are sharing among themselves, so I'm going to need to develop something a little more stern than standard spam filtering. If you're a private company, which it appears that you are, how about starting with an Acceptable Use Policy? Then if that doesn't work get the backing from HR/upper management and let the abusers know that you're watching their e-mail and if they don't cease and desist they will be dismissed (hey look, I'm Johnny Cochran). Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 3rd Party Hold Readers
Thanks for the aid(Realizing this is a loaded question) Glad Len is not on here. He would pull the trigger. :)) Basically, I give a heavy weight to the big tests like SpamCop and the junkmail domain list. I give a medium weight to Badheaders/Spamheaders, routing, and such. I hold on my custom adult domains list. The big tests are weighted so they trigger subject by them selves. If they fail one medium test or to light tests, they are held. I can share my file if you would like. (Although it is not neat.) John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re: [Declude.JunkMail] Adultery
I am a private company, we have an Acceptable Use Policy, I have the backing of Upper Management, I've sent hate mail to our users warning them of dire consequences, I understand the issue and the steps required to deal with it. What I'm working on now is enforcement. This isn't Johnny Cochran, this is the other half of Law and Order. Upper Management has charged me with detection and enforcement. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Bill Beach Sent: Tuesday, 12 November 2002 2:04 PM To: [EMAIL PROTECTED] Subject: RE: Re: [Declude.JunkMail] Adultery My challenge is that the stuff I'm seeing is stuff that my local users are sharing among themselves, so I'm going to need to develop something a little more stern than standard spam filtering. If you're a private company, which it appears that you are, how about starting with an Acceptable Use Policy? Then if that doesn't work get the backing from HR/upper management and let the abusers know that you're watching their e-mail and if they don't cease and desist they will be dismissed (hey look, I'm Johnny Cochran). Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Something better than Declude..transferred from Imail forum
I'm moving this discussion into the Declude forum, where it belongs... Markus Gufler stated: I'm not sure if this is per-user-.self-config-frontend is really needed for declude. Our users are very happy when we try to find a good and reliable configuration and keep them up to date. (spammers don't sleep) None of our clients know what are DNS-Tests, Open-Relay-Databases and so on. Wich normal internet user should be able to configure his own weight system or actions for different tests? If you download all files from the declude homepage and read the manual page it works fine in 20 minutes. However an admin can spend hours of work to test different settings, analyzing logfiles and adapt the config file for his special needs. Hours that at least our customers don't have. They want all the same: recieve a minimum of spam. We was able to increase the mail_send/spam_detected ratio from the default config-file to over 50% and I'm absolutely sure that no normal user can configure his settings better. If yes I will ask him to work for us. I mean that centralized systems like declude should be administered from admins that know what a powerfull tool they have in hands. Markus Unfortunately, we'd like to all work in an environment where there are real policies in place, and IT actually can properly protect end users against things like SPAM, Porno, etc., but we don't, and they won't. It's a sore subject that we won't get into right now. If we filter what we know is junk, somebody in upper management will get upset because they missed their latest 'junk' mail. That is why we wanted a per-user type of interface...so that those people can manage their own junk. It might actually be better that we give those select few software such as IHateSpam and let them completely manage their own, while we do, in fact, control all of the rest of us...I get over 200 emails a day, and mostly of junkby myself. What a major waste of time it is! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] EzMTS
I have a customer that uses EzMTS, a Windows freeware mailserver. When ever a message goes through that server and Declude all the Xheaders added by Declude show up in the body of the mail. Can I assure him that it's his problem (EzMTS). David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] EzMTS
I have a customer that uses EzMTS, a Windows freeware mailserver. When ever a message goes through that server and Declude all the Xheaders added by Declude show up in the body of the mail. Can I assure him that it's his problem (EzMTS). That's actually not a problem with EzMTS -- EzMTS does that by design. The X- headers that Declude adds to E-mails are just standard headers. Most mail clients will not display them by default, but it seems that EzMTS does. Most likely, EzMTS has an option to disable that, so the headers won't be visible. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Message Sniffer Confidence
That is exactly what we do... But we don't delete weight20, we route it to a mail box, that way if a customer calls, we can retrieve the email, look at all the test it failed, if it needs whitelisted, we can do that, and then forward the message on... We've had 0 problems with it!! -Russ What about forwarding to a second mailbox for the client and allowing them to look it up or delete it? Jeff --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Something better than Declude..transferred from Imail forum
If we filter what we know is junk, somebody in upper management will get upset because they missed their latest 'junk' mail. That is why we wanted a per-user type of interface...so that those people can manage their own junk. Actually, what you may want to try is the attach function, which attaches the Spam message to a clean message so the user can review if they want, or filter in their mail client on that subject line. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Something better than Declude..transferred from Imail forum
Thanks, that is actually the avenue that they were taking. They got the messages to appear with the changed headers and subject fields, but they apparently were having issues where those filters were affecting either people's email accounts that weren't on the list yet, they were getting each others messages for point values...i.e., a rule set for person 'A' would affect person 'B'. You're going to force me into looking into this situation closer, aren't you? I've been tempted...just trying to finish up a couple of other things before I do that. Dennis T. Kemp II (Tom) Program Manager MCSE/CNA/A+ Control Concepts, Inc. [EMAIL PROTECTED] 703-876-6418 Fax#: 703-876-6416 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of John Tolmachoff Sent: Tuesday, November 12, 2002 4:07 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Something better than Declude..transferred from Imail forum If we filter what we know is junk, somebody in upper management will get upset because they missed their latest 'junk' mail. That is why we wanted a per-user type of interface...so that those people can manage their own junk. Actually, what you may want to try is the attach function, which attaches the Spam message to a clean message so the user can review if they want, or filter in their mail client on that subject line. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Something better thanDeclude..transferred from Imail forum
... they apparently were having issues where those filters were affecting either people's email accounts that weren't on the list yet, they were getting each others messages for point values...i.e., a rule set for person 'A' would affect person 'B'. What is really happening here isn't that one person's rules are being used on someone else's E-mail (which would certainly be a serious problem). The problem here is that one copy of an E-mail is being sent to two separate users. In this case, both E-mails are expected to be treated identically (IMail can only handle one copy of the E-mail if only one is sent). So if one E-mail is sent to person 'A' and to person 'B' (not one copy to each, but the same identical E-mail is sent to both, so IMail has only one copy), then if the ATTACH action is used by either person 'A' or person 'B', the ATTACH action will be used on the E-mail. Since the ATTACH action is used on the E-mail, both recipients will see the E-mail as an attachment. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Something better than Declude..transferred from Imail forum
You're going to force me into looking into this situation closer, aren't you? I've been tempted...just trying to finish up a couple of other things before I do that. Yes. :)) Help is here. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Something better than Declude..transferred from Imail forum
As I recall, if a message is addressed to multiple recipients, JunkMail uses the most restrictive settings it finds. If one of the recipients is set up for JunkMail and the others aren't, then that user's filtering applies to ALL of them. - Original Message - From: Tom Kemp To: [EMAIL PROTECTED] Sent: Tuesday, November 12, 2002 3:14 PM Subject: RE: [Declude.JunkMail] Something better than Declude..transferred from Imail forum Thanks, that is actually the avenue that they were taking. They got themessages to appear with the changed headers and subject fields, but theyapparently were having issues where those filters were affecting eitherpeople's email accounts that weren't on the list yet, they were getting eachothers messages for point values...i.e., a rule set for person 'A' wouldaffect person 'B'.You're going to force me into looking into this situation closer, aren'tyou? I've been tempted...just trying to finish up a couple of other thingsbefore I do that.Dennis T. Kemp II (Tom)Program Manager MCSE/CNA/A+Control Concepts, Inc.[EMAIL PROTECTED]703-876-6418Fax#: 703-876-6416-Original Message-From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED]]On Behalf Of John TolmachoffSent: Tuesday, November 12, 2002 4:07 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Something better thanDeclude..transferred from Imail forumIf we filter what we know is junk, somebody in upper management will getupset because they missed their latest 'junk' mail. That is why we wanted aper-user type of interface...so that those people can manage their own junk.Actually, what you may want to try is the attach function, which attachesthe Spam message to a clean message so the user can review if they want, orfilter in their mail client on that subject line.John Tolmachoff MCSE, CSSAIT Manager, Network EngineerRelianceSoft, Inc.Fullerton, CA 92835www.reliancesoft.com---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] Something better than Declude..transferred from Imail forum
From what I overheard 'A' telling 'B' this morning, he sent the message from his account, so it went fro 'A' to 'B'. He purposely added text to the email body that he knew would have been caught by his rules, but not those of person 'B'. Do messages sent also go through the filter? Of course, I got this info heresayI heard 'A' say to 'B' that this happened. What I don't know is whether or not 'A' had sent the message to 'B' only, or if he had CC'd or BCC'd it to himself as well. Based on what you say here, if he did CC or BCC'd it to himself, then the rule would happen. I'll check into it... Dennis T. Kemp II (Tom) Program Manager MCSE/CNA/A+ Control Concepts, Inc. [EMAIL PROTECTED] 703-876-6418 Fax#: 703-876-6416 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of R. Scott Perry Sent: Tuesday, November 12, 2002 4:18 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Something better than Declude..transferred from Imail forum ... they apparently were having issues where those filters were affecting either people's email accounts that weren't on the list yet, they were getting each others messages for point values...i.e., a rule set for person 'A' would affect person 'B'. What is really happening here isn't that one person's rules are being used on someone else's E-mail (which would certainly be a serious problem). The problem here is that one copy of an E-mail is being sent to two separate users. In this case, both E-mails are expected to be treated identically (IMail can only handle one copy of the E-mail if only one is sent). So if one E-mail is sent to person 'A' and to person 'B' (not one copy to each, but the same identical E-mail is sent to both, so IMail has only one copy), then if the ATTACH action is used by either person 'A' or person 'B', the ATTACH action will be used on the E-mail. Since the ATTACH action is used on the E-mail, both recipients will see the E-mail as an attachment. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Something better thanDeclude..transferred from Imail forum
From what I overheard 'A' telling 'B' this morning, he sent the message from his account, so it went fro 'A' to 'B'. He purposely added text to the email body that he knew would have been caught by his rules, but not those of person 'B'. Note that Declude JunkMail doesn't have any per-user rules. So if there is a test defined that the E-mail would trigger, the E-mail would fail that test. Do messages sent also go through the filter? Yes. And the actions assigned to person 'B' would be used. For example, if they have the action for that test set to IGNORE, no action will be taken even though the E-mail failed the test. However, if you have the X-Spam-Tests-Failed: header added to your E-mails, it would show that the E-mail failed the test (since it did). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DSN:Message for Scott
Scott, If you will recall, I contacted you a while back when I was working on CYBERsitter NoXMail and I was having problems with Declude locking the spool file while processing it. You sent me a version that had this fixed. MUCH to my embarrassment, I sent out some beta copies of NoXMail to about 10-15 of your users this morning completely forgetting about the declude.exe problem. Is the fixed version of Declude available to all users? If so, maybe you could post the address here so it won't look like we send out software that doesn't work;-) Thanks, I appreciate it. Brian Milburn Solid Oak Software --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] DSN:Message for Scott
If you will recall, I contacted you a while back when I was working on CYBERsitter NoXMail and I was having problems with Declude locking the spool file while processing it. You sent me a version that had this fixed. MUCH to my embarrassment, I sent out some beta copies of NoXMail to about 10-15 of your users this morning completely forgetting about the declude.exe problem. Is the fixed version of Declude available to all users? If so, maybe you could post the address here so it won't look like we send out software that doesn't work;-) The interim releases (versions between betas) are given out as needed. In this case, anyone who needs it can download the latest interim release (1.62i4) from http://www.declude.com/release/162i/declude.exe . This includes the fix that allows external programs to access the spool file. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Something better than Declude
I've had two engineers here spending alot of time with this product. They are both considerably intelligent and experienced, yet they have had nothing but trouble. We've played with a per-user package called IHateSpam before we tried the declude solution. It wass very User friendly and worked right out of the box. The down side was that it only worked with Outlook (not even Outlook Express), and was configured for each individual on their systems...no centralized database. We would prefer something that was more centralized... giving more control to the engineers. Declude gave me the features that Imail never had. - Tom, Image`fx Spam is a never ending battle and there is no program and/or person that can guarantee a spam free system without compromising legitimate mail. With that said, if you or any one else on this list is in need of some filters and/or other cfg files for declude let me know off of this list and I will send them to you. Don't forget you are always welcome to use my updated blacklist and daily list of spammers. The download links are: http://www.imagefxonline.net/apps/delog/fromfile.txt http://www.imagefxonline.net/apps/delog/daily.txt Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Per User/Domain help
I'm not asking for help, just offering an opinion... Using Declude with one CFG file and multiple Domains one could set up a default JNK/Action file with weight tests as follows: CFG: WEIGHT1 weightrange x x 10 19 WEIGHT2 weightrange x x 20 29 WEIGHT3 weightrange x x 30 39 WEIGHT4 weight x x 40 0 JNK: WEIGHT1 WARN WEIGHT2 WARN WEIGHT3 WARN WEIGHT4 WARN These weights are based on the tests that you have defined in your cfg file. When a message fails a test and triggers a weight value Declude will write a warning message in the header. Imail is capable of reading headers using the Rules. Anyone using Imail can send the message wherever they want to based on the Rule. Each Weight (1-4) would represent the level of Spam they wish to trigger on. You may just want to use a Weight setting instead of a Weight range in the CFG file. A simple web interface or Imail web page setting can easily manipulate a text file that contains the rules for that domain and/or user. The person can either select option you added on or create rules for these weights. Use your imagination. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Yahoo gets caught with some tests
In an earlier thread there was a mention about Yahoo and OSSOFT. I have found OSSOFT to be unreliable and now I only use the following companies to help stop spam. OSSRC ip4rrelays.osirusoft.com127.0.0.4 16 0 SPAMCOP ip4rbl.spamcop.net 127.0.0.2 16 0 JAPAN ip4rjapan.blackholes.us 127.0.0.2 18 0 MONKEYFORMMAIL ip4rformmail.relays.monkeys.com * 16 0 MONKEYPROXIES ip4rproxies.relays.monkeys.com * 16 0 A message must fail more than one test before it is held for review. If you set the hold weight value to 19 then a message would have to fail one major and one or two minor tests before it is held. For example: message fails: OSSRC = 16 REVDNS = 4 Weight = less than 20 Message ok (may even mark the header if suspect) Hold Weight = 20 Message is held for review. Delete Weight = 100 Message is Deleted (use with caution) Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Bounce and Reply
A while ago there was a mention about bouncing mail back to spammers, don't bother unless you know where the mail is truly coming from. Using weight with Bounce is a bad idea, you are better off bouncing mail back to those who send the mass mailing and/or do exist and have sent you unsolicited mail. We have done this, however, it does not seem like it is successful in removing anyone from their mailings, although there have been very few bounce back messages sitting in the spool. So it appears the message is going someplace, perhaps to oblivion. I was able to send the following message: http://www.imagefxonline.net/apps/delog/bounce.txt to the addresses listed in the spam list without much trouble. So I don't know if it is worth it, but I figured why not give it a try. This way the message is not deleted and maybe, just maybe the address will be removed off of their list. Who knows... PS: And yes you can use the generic message as you see fit. I'm sure it needs to be re-written anyway. Best of Luck, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude gone whacky?
The test email that I sent only had one recipient. The problem started when I sent the test message to [EMAIL PROTECTED] to test the filter setup. There was not a valid imail account or alias for muji. I waited a minute for it to process and then checked the declude logs to see what had occurred. That is when I noticed that the server was acting loaded. I checked the mailboxes where the muji message would have gone and it wasn't there yet, so it was still processing. We've found the cause for this; there is a bug in the handling of the new ALLRECIP filter option that is causing this. It will be fixed in the next release. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Fromfile Status 11/12/02- Image`fx
50% effective List of spammers caught by the Fromfile: --- found: 2 ID-20021112-001525 @yite.com.ar found: 4 ID-20021112-000225 .gsjs.com found: 7 ID-20021112-000324 .ms83.com found: 26 ID-20021112-000700 @boing.azoogle.com found: 26 ID-20021112-000561 .YOURMAILSOURCE.COM found: 15 ID-20021112-001351 @senderlist5682.com found: 18 ID-20021112-000709 @bounce.rapid-e.net found: 22 ID-20021112-000707 @bounce.etracks.com found: 7 ID-20021112-001004 @hi-speed-mail.net found: 21 ID-20021112-59 .bluerockdove.com found: 34 ID-20021112-000705 @bounce.azoogle.com found: 1 ID-20021112-000736 @casinooptin.com found: 21 ID-20021112-000825 @direct4optin.com found: 4 ID-20021112-000706 @bounce.colonize.com found: 14 ID-20021112-001397 @stderr.handpickeddeals.com found: 10 ID-20021112-001242 @OptedForSavings.com found: 14 ID-20021112-001306 @redopti.com found: 1 ID-20021112-000781 @crucialoffers.com found: 1 ID-20021112-001581 [EMAIL PROTECTED] found: 6 ID-20021112-000169 .emazing.com found: 4 ID-20021112-000785 @CuraLife.com found: 61 ID-20021112-000373 .opmnet.net found: 4 ID-20021112-000232 .heresadeal.com found: 40 ID-20021112-000310 .mb00.net found: 1 ID-20021112-000947 @funpageland.com found: 1 ID-20021112-001192 @mountainwings2.com found: 25 ID-20021112-73 .c0olmail.com found: 21 ID-20021112-000791 @dailypromo.net found: 11 ID-20021112-000790 @dailypromo.com found: 14 ID-20021112-000135 .dont-miss-this-deal.com found: 1 ID-20021112-000987 @greatofferstoyou.net found: 1 ID-20021112-001273 @playtowinnow.net found: 4 ID-20021112-001482 @virginpussies.net found: 1 ID-20021112-000197 .freebietoday.com found: 17 ID-20021112-000159 .emailcourrier.com found: 5 ID-20021112-001602 @free2sample.com found: 2 ID-20021112-000833 @discountcertificates.com found: 16 ID-20021112-000508 .transcentives.net found: 10 ID-20021112-000332 .myfunsleuth.com found: 2 ID-20021112-001354 @server-777.com found: 4 ID-20021112-001476 @valuegazette.com found: 5 ID-20021112-000391 .panoramicnet.com found: 9 ID-20021112-000199 .freeforum.com found: 1 ID-20021112-000593 @42promotions.com found: 1 ID-20021112-001487 @wagerdirect.com found: 38 ID-20021112-000153 .edirectbroadcast.com found: 35 ID-20021112-000704 @bounce.azogle.com found: 21 ID-20021112-000701 @boing.topica.com found: 48 ID-20021112-001485 @vmadmin.com found: 16 ID-20021112-000854 @e54.org found: 34 ID-20021112-000930 @free-gift-offers.com found: 1 ID-20021112-000282 .krazykash.com found: 2 ID-20021112-000560 .youriphost.com found: 5 ID-20021112-31 .astrology.com found: 1 ID-20021112-000271 .jserve21.com found: 19 ID-20021112-001026 @hsmedia-offer.com found: 2 ID-20021112-001067 @joefuzz.com found: 5 ID-20021112-000822 @digitalknowhow.net found: 5 ID-20021112-001428 @thecasinobeat.com found: 1 ID-20021112-000683 @bigfatbaby.com found: 1 ID-20021112-000337 .mynetoffers.com found: 30 ID-20021112-000121 .dealdelivery.com found: 11 ID-20021112-000529 .verticalresponse.com found: 5 ID-20021112-000489 .theoffers.com found: 7 ID-20021112-001145 @mail1.phcoutbound1.com found: 12 ID-20021112-000524 .VALOFFERS.COM found: 19 ID-20021112-000164 .EMAILOFFERS.INFO found: 16 ID-20021112-000140 .e-clk.com found: 6 ID-20021112-000535 .virtual3.net found: 2 ID-20021112-000152 .EDIETS.COM found: 1 ID-20021112-001422 @teleseeker.com found: 3 ID-20021112-001513 @xidserv.com found: 1 ID-20021112-001392 @stderr.clickformail.com found: 13 ID-20021112-001146 @MAIL1.SAVINGSENGINE.COM found: 1 ID-20021112-000838 @dlbdirect.com found: 1 ID-20021112-86 .clickaction.net found: 10 ID-20021112-83 .chtah.com found: 5 ID-20021112-00 @list.euniverse.com found: 4 ID-20021112-000253 .infogeneratorpro.com found: 12 ID-20021112-000273 .justforyou-mail.com found: 3 ID-20021112-001166 @mb001.com found: 4 ID-20021112-000145 .e-valuemail.com found: 6 ID-20021112-23 .adversend.com found: 10 ID-20021112-000376 .optamail.com found: 16 ID-20021112-000329 .mycreativeoffers.com found
