RE: [Declude.JunkMail] Log Analyzer - Comments Needed
Keith, I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. Please let me know if you are interested. Darrell LaRock -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Thursday, February 06, 2003 4:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Darrell, That is awesome. I get those same requests from our clients weekly. I appreciate your time in writing it. Keith -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Thursday, February 06, 2003 11:35 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Log Analyzer - Comments Needed *Sorry if this is outside the realm in which the forum should be used. Several of my customers have started asking me for reports on what Declude is blocking for their domain or a certain user. Obtaining this information was challenging manually sifting through the logs - to say the least. I then decided to write an analyzer that could accomplish what I needed. It's a good portion of the way wrote, and I am thinking about making it public at some point when it is completely finished. However, I was looking for features that people would like that I may not have thought of at this point. Currently right now it can do the following 1.) Report on Number of messages that fails each test. 2.) Comprehensive reporting on each individual tests. Reports can be generated based on (to, from, domain, subjects, date, time). 3.) Report on individual domains and which messages failed which tests 4.) Report on individual users and which messages failed which tests. 5.) It is a console application written in C# (.net). It is self contained and does not need any external databases like SQL Server or MSDE. Things Still to be added 1.) Ability to email the reports Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
Darrell, Totally interested. You can hit me with the beta off list if you'd like. Email is [EMAIL PROTECTED] Thanks again for writing it and providing out to this forum. Keith -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Friday, February 28, 2003 9:15 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Keith, I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. Please let me know if you are interested. Darrell LaRock -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Thursday, February 06, 2003 4:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Darrell, That is awesome. I get those same requests from our clients weekly. I appreciate your time in writing it. Keith -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Thursday, February 06, 2003 11:35 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Log Analyzer - Comments Needed *Sorry if this is outside the realm in which the forum should be used. Several of my customers have started asking me for reports on what Declude is blocking for their domain or a certain user. Obtaining this information was challenging manually sifting through the logs - to say the least. I then decided to write an analyzer that could accomplish what I needed. It's a good portion of the way wrote, and I am thinking about making it public at some point when it is completely finished. However, I was looking for features that people would like that I may not have thought of at this point. Currently right now it can do the following 1.) Report on Number of messages that fails each test. 2.) Comprehensive reporting on each individual tests. Reports can be generated based on (to, from, domain, subjects, date, time). 3.) Report on individual domains and which messages failed which tests 4.) Report on individual users and which messages failed which tests. 5.) It is a console application written in C# (.net). It is self contained and does not need any external databases like SQL Server or MSDE. Things Still to be added 1.) Ability to email the reports Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. I would be interested. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
Yes, me too please. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff Sent: Friday, 28 February 2003 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. I would be interested. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
I would love it too. [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell L. Sent: Friday, February 28, 2003 9:15 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Keith, I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. Please let me know if you are interested. Darrell LaRock -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Thursday, February 06, 2003 4:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Darrell, That is awesome. I get those same requests from our clients weekly. I appreciate your time in writing it. Keith -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Thursday, February 06, 2003 11:35 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Log Analyzer - Comments Needed *Sorry if this is outside the realm in which the forum should be used. Several of my customers have started asking me for reports on what Declude is blocking for their domain or a certain user. Obtaining this information was challenging manually sifting through the logs - to say the least. I then decided to write an analyzer that could accomplish what I needed. It's a good portion of the way wrote, and I am thinking about making it public at some point when it is completely finished. However, I was looking for features that people would like that I may not have thought of at this point. Currently right now it can do the following 1.) Report on Number of messages that fails each test. 2.) Comprehensive reporting on each individual tests. Reports can be generated based on (to, from, domain, subjects, date, time). 3.) Report on individual domains and which messages failed which tests 4.) Report on individual users and which messages failed which tests. 5.) It is a console application written in C# (.net). It is self contained and does not need any external databases like SQL Server or MSDE. Things Still to be added 1.) Ability to email the reports Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hijack
Is it possible to tell Hijack to not store messages from certain IPs Yes. You can use the ALLOWIP option to do that. For example, if you add the following line to the \IMail\Declude\hijack.cfg file: ALLOWIP 192.0.2.25 then Declude Hijack will allow unlimited E-mail from 192.0.2.25. also once the messages are stored in the hold directory is it possible to have hijack send all messages from that IP as if it would have done so the first time? No, but we are working on something to send them automatically. In the meantime, there is a tool listed at http://www.declude.com/tools that we have been told will allow you to rename the files automatically (when you remove the initial part of the filenames, so they begin with a Q or D, they can be moved back to the spool). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude REVDNS test
Scott, What information / location in the e-mail headers does Declude use for the REVDNS test. Does Declude use the DNS server in the global.cfg file to make the query ? Thanks Stu - CSOnline Technical Support hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Meadville 814-425-1696 Parker724-399-1158 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
Count me in : [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Shacklett Sent: Friday, February 28, 2003 9:44 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Yes, me too please. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff Sent: Friday, 28 February 2003 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. I would be interested. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
Me too!!! [EMAIL PROTECTED] At 10:28 AM 2/28/2003, you wrote: Count me in : [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Shacklett Sent: Friday, February 28, 2003 9:44 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Yes, me too please. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff Sent: Friday, 28 February 2003 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. I would be interested. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. * If you are not the intended addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. Please advise immediately if you or your employer do not consent to Internet email for messages of this kind. === Neal R. Mathews Network Systems Engineer Email: [EMAIL PROTECTED] Phone: 1-716-673-1000 ext 8321 Direct: 1-716-673-8321 The Carriage House Companies, Inc. 196 Newton Street Fredonia, NY 14063
Re: [Declude.JunkMail] Declude REVDNS test
What information / location in the e-mail headers does Declude use for the REVDNS test. It uses the appropriate Received: header (based on your settings in the \IMail\Declude\global.cfg file). By default, it will use the IP from the first Received: header. However, by using the IPBYPASS/HOP settings, it could use a different Received: header. For example, if your backup mailserver is at 192.0.2.25, and you have a line IPBYPASS 192.0.2.25 in the global.cfg file, then if an E-mail came from your backup mailserver, the second Received: header would be used. Does Declude use the DNS server in the global.cfg file to make the query ? By default, Declude JunkMail will use the first DNS server listed in the IMail SMTP settings. However, if there is a DNS line in the global.cfg file, Declude JunkMail will use the DNS server listed in that line. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Where I'm At Now and Where Should I Be Going?
Hello, All, I am pushing hard to learn as much about Declude.JunkMail as my time allows during the trial period. I think I installed on February 11th so I'm about 17 days into the trial. I was hoping to get some feedback from the list as far as things I might have looked over and might want to consider looking into next. Just to bring things up to speed... I am currently testing Declude.JunkMail Beta v1.67. I have isolated 2 in-house hosts (out of the 90 we have on our IMail server) for testing purposes. For each host I did some pre-analysis to find out what an ideal hold weight would be for each. For the first host, with the domain name NEXUSTECHGROUP.COM, I came up with WEIGHT13 as my hold weight. For the second host, with the domain name PAGEROVER.COM, I came up with WEIGHT12 as my hold weight. NEXUSTECHGROUP.COM probably gets about 90% legitimate e-mail and PAGEROVER.COM probably gets about 95% (or higher) spam e-mail. Once I set up the hold weight most spam immediately started being caught by Declude. Those who receive e-mail at those domains were very impressed. But there are still the occasional spam e-mail which make it under the threshold of the hold weight. To further fine tune Declude.JunkMail I have done 2 things, one which was my idea (and I'm comfortable with) and another which was done to please my boss, which I don't necessarily agree with: Fine Tuning #1: This is the one I am comfortable with... In addition to the hold weight I also hold e-mail for a test that I created called SENDERBLOCK. SENDERBLOCK is defined in GLOBAL.CFG as SENDERBLOCK fromfile D:\iMail\declude\senderblock.txt x 0 0. This is based upon the test described in the Your own sender blacklists section of the Declude.JunkMail. Whenever a spam e-mail slips under my hold weight I add the sender's domain (provided it's an obvious spamming domain) to this list. That test has helped to filter a few more spam e-mails out of my user's inboxes. Fine Tuning #2: This one I'm less comfortable with... My boss noticed that a number of the spam e-mails that were still slipping in underneath the hold weight were failing the test SPAMCOP. He wanted to know how come I wasn't filtering out all e-mails that failed that test as, from his estimation, the SPAMCOP test was using a list of known spammers. I explained in detail the information I gleamed from the Declude.JunkMail web site and the SPAMCOP web site about the accuracy of the SPAMCOP test. I know that the SPAMCOP test finds mail server which have a high incidence of spam to legitimate e-mail but that real e-mail can pass through those servers. I told him I'd rather continue to filter on spam domains (via SENDERBLOCK) and that I was trying to avoid catching any legitimate e-mail altogether. I'm trying to set the bar low enough so that a) most spam is caught, b) no legitimate e-mail is caught and then c) filtering further for actual identified spam e-mails. He thinks it's too much overhead to add each domain name whereas I think over time as I add more and more domains to the list the number of domains I have to add will go down considerably. Needless to say I gave in and just started holding for the SPAMCOP test because I really didn't feel like taking the time to turn him over to my spam blocking philosophy. So that's basically where I'm at right now and from this I've come up with a number of questions and/or comments I am looking for feedback on. Mostly I'm looking for best practices sorts of answers from the community as a whole... #1) Are there are any other tests, which I am missing, like the SENDERBLOCK test which I might want to consider adding to my bag of tricks to continue to filter out spam e-mail which slide in under my hold weight and also fall in line with my philosophy, i.e. catching legit e-mail is a bad thing? #2) Am I correct in my assumption that holding for SPAMCOP is a bad idea or is there so little legitimate e-mail passing through a server on the SPAMCOP list that if I am holding on that test the chance of actually catching legit e-mail is pretty low? #3) In addition to what I've learned about about Declude.JunkMail itself, I've also started using two of the 3rd-party freeware tools that have been released by Declude devotees, SpamReview and Delog. SpamReview is great and I use it every day to take a quick look at all of the e-mail that is being held by Declude.JunkMail. I haven't gotten to work with Delog as much but it seems pretty cool. Are there any other 3rd-party tools which I also might want to look closer at? #4) Since I established my hold weights I think Declude has only held 2 pieces of legitimate e-mail. I looked at them briefly in SpamReview before requeuing but I couldn't figure a good way to make sure that those would have passed through. I hesitate to up my hold weight (for 2 pieces of e-mail) and I'd rather just have a test that I could use to make certain domains (or users) exempt from Declude.JunkMail.
Re: [Declude.JunkMail] Declude REVDNS test
Could someone pleaase :) help me out, my declude mail and virus config setup is soo old, ( been so busy you know...). it needs updating real bad, could someone help me update my config files and settings to the latest configurations too much stuff getting thru especially adult stuff etc... Thanks in advance ! Sheldon Steele - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, February 28, 2003 7:44 AM Subject: Re: [Declude.JunkMail] Declude REVDNS test What information / location in the e-mail headers does Declude use for the REVDNS test. It uses the appropriate Received: header (based on your settings in the \IMail\Declude\global.cfg file). By default, it will use the IP from the first Received: header. However, by using the IPBYPASS/HOP settings, it could use a different Received: header. For example, if your backup mailserver is at 192.0.2.25, and you have a line IPBYPASS 192.0.2.25 in the global.cfg file, then if an E-mail came from your backup mailserver, the second Received: header would be used. Does Declude use the DNS server in the global.cfg file to make the query ? By default, Declude JunkMail will use the first DNS server listed in the IMail SMTP settings. However, if there is a DNS line in the global.cfg file, Declude JunkMail will use the DNS server listed in that line. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [Stealth Anti-Virus scanning] courtesy http://www.oilfielddirectory.com --- [Stealth Anti-Virus scanning] courtesy http://www.oilfielddirectory.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going?
In my experience SPAMCOP has been very good at weeding out SPAM and we hold/block using this test alone. We do occasionally get a false positive or two, but no more or less than any of RBL's that list known open relays. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, February 28, 2003 11:36 AM To: Declude JunkMail Subject: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? Hello, All, I am pushing hard to learn as much about Declude.JunkMail as my time allows during the trial period. I think I installed on February 11th so I'm about 17 days into the trial. I was hoping to get some feedback from the list as far as things I might have looked over and might want to consider looking into next. Just to bring things up to speed... I am currently testing Declude.JunkMail Beta v1.67. I have isolated 2 in-house hosts (out of the 90 we have on our IMail server) for testing purposes. For each host I did some pre-analysis to find out what an ideal hold weight would be for each. For the first host, with the domain name NEXUSTECHGROUP.COM, I came up with WEIGHT13 as my hold weight. For the second host, with the domain name PAGEROVER.COM, I came up with WEIGHT12 as my hold weight. NEXUSTECHGROUP.COM probably gets about 90% legitimate e-mail and PAGEROVER.COM probably gets about 95% (or higher) spam e-mail. Once I set up the hold weight most spam immediately started being caught by Declude. Those who receive e-mail at those domains were very impressed. But there are still the occasional spam e-mail which make it under the threshold of the hold weight. To further fine tune Declude.JunkMail I have done 2 things, one which was my idea (and I'm comfortable with) and another which was done to please my boss, which I don't necessarily agree with: Fine Tuning #1: This is the one I am comfortable with... In addition to the hold weight I also hold e-mail for a test that I created called SENDERBLOCK. SENDERBLOCK is defined in GLOBAL.CFG as SENDERBLOCK fromfile D:\iMail\declude\senderblock.txt x 0 0. This is based upon the test described in the Your own sender blacklists section of the Declude.JunkMail. Whenever a spam e-mail slips under my hold weight I add the sender's domain (provided it's an obvious spamming domain) to this list. That test has helped to filter a few more spam e-mails out of my user's inboxes. Fine Tuning #2: This one I'm less comfortable with... My boss noticed that a number of the spam e-mails that were still slipping in underneath the hold weight were failing the test SPAMCOP. He wanted to know how come I wasn't filtering out all e-mails that failed that test as, from his estimation, the SPAMCOP test was using a list of known spammers. I explained in detail the information I gleamed from the Declude.JunkMail web site and the SPAMCOP web site about the accuracy of the SPAMCOP test. I know that the SPAMCOP test finds mail server which have a high incidence of spam to legitimate e-mail but that real e-mail can pass through those servers. I told him I'd rather continue to filter on spam domains (via SENDERBLOCK) and that I was trying to avoid catching any legitimate e-mail altogether. I'm trying to set the bar low enough so that a) most spam is caught, b) no legitimate e-mail is caught and then c) filtering further for actual identified spam e-mails. He thinks it's too much overhead to add each domain name whereas I think over time as I add more and more domains to the list the number of domains I have to add will go down considerably. Needless to say I gave in and just started holding for the SPAMCOP test because I really didn't feel like taking the time to turn him over to my spam blocking philosophy. So that's basically where I'm at right now and from this I've come up with a number of questions and/or comments I am looking for feedback on. Mostly I'm looking for best practices sorts of answers from the community as a whole... #1) Are there are any other tests, which I am missing, like the SENDERBLOCK test which I might want to consider adding to my bag of tricks to continue to filter out spam e-mail which slide in under my hold weight and also fall in line with my philosophy, i.e. catching legit e-mail is a bad thing? #2) Am I correct in my assumption that holding for SPAMCOP is a bad idea or is there so little legitimate e-mail passing through a server on the SPAMCOP list that if I am holding on that test the chance of actually catching legit e-mail is pretty low? #3) In addition to what I've learned about about Declude.JunkMail itself, I've also started using two of the 3rd-party freeware tools that have been released by Declude devotees, SpamReview and Delog. SpamReview is great and I use it every day to take a quick look at all of the e-mail that is being held by Declude.JunkMail. I haven't gotten to work with Delog as much but it seems pretty cool. Are there any other 3rd-party
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going?
In our experience as an ISP, this was our INITIAL reaction (based on my personal mailbox), However SPAMCOP turned into about 50% accuracy system wide, and we had to move to at least 2 RBL tests failed to hold, or SNIFFER. It would be a good idea to run the sniffer (http://www.sortmonster.com/sniffer/) trial as well. What declude is currently passing through sniffer should catch most of. -Tom -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Friday, February 28, 2003 10:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? In my experience SPAMCOP has been very good at weeding out SPAM and we hold/block using this test alone. We do occasionally get a false positive or two, but no more or less than any of RBL's that list known open relays. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, February 28, 2003 11:36 AM To: Declude JunkMail Subject: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? Hello, All, I am pushing hard to learn as much about Declude.JunkMail as my time allows during the trial period. I think I installed on February 11th so I'm about 17 days into the trial. I was hoping to get some feedback from the list as far as things I might have looked over and might want to consider looking into next. Just to bring things up to speed... I am currently testing Declude.JunkMail Beta v1.67. I have isolated 2 in-house hosts (out of the 90 we have on our IMail server) for testing purposes. For each host I did some pre-analysis to find out what an ideal hold weight would be for each. For the first host, with the domain name NEXUSTECHGROUP.COM, I came up with WEIGHT13 as my hold weight. For the second host, with the domain name PAGEROVER.COM, I came up with WEIGHT12 as my hold weight. NEXUSTECHGROUP.COM probably gets about 90% legitimate e-mail and PAGEROVER.COM probably gets about 95% (or higher) spam e-mail. Once I set up the hold weight most spam immediately started being caught by Declude. Those who receive e-mail at those domains were very impressed. But there are still the occasional spam e-mail which make it under the threshold of the hold weight. To further fine tune Declude.JunkMail I have done 2 things, one which was my idea (and I'm comfortable with) and another which was done to please my boss, which I don't necessarily agree with: Fine Tuning #1: This is the one I am comfortable with... In addition to the hold weight I also hold e-mail for a test that I created called SENDERBLOCK. SENDERBLOCK is defined in GLOBAL.CFG as SENDERBLOCK fromfile D:\iMail\declude\senderblock.txt x 0 0. This is based upon the test described in the Your own sender blacklists section of the Declude.JunkMail. Whenever a spam e-mail slips under my hold weight I add the sender's domain (provided it's an obvious spamming domain) to this list. That test has helped to filter a few more spam e-mails out of my user's inboxes. Fine Tuning #2: This one I'm less comfortable with... My boss noticed that a number of the spam e-mails that were still slipping in underneath the hold weight were failing the test SPAMCOP. He wanted to know how come I wasn't filtering out all e-mails that failed that test as, from his estimation, the SPAMCOP test was using a list of known spammers. I explained in detail the information I gleamed from the Declude.JunkMail web site and the SPAMCOP web site about the accuracy of the SPAMCOP test. I know that the SPAMCOP test finds mail server which have a high incidence of spam to legitimate e-mail but that real e-mail can pass through those servers. I told him I'd rather continue to filter on spam domains (via SENDERBLOCK) and that I was trying to avoid catching any legitimate e-mail altogether. I'm trying to set the bar low enough so that a) most spam is caught, b) no legitimate e-mail is caught and then c) filtering further for actual identified spam e-mails. He thinks it's too much overhead to add each domain name whereas I think over time as I add more and more domains to the list the number of domains I have to add will go down considerably. Needless to say I gave in and just started holding for the SPAMCOP test because I really didn't feel like taking the time to turn him over to my spam blocking philosophy. So that's basically where I'm at right now and from this I've come up with a number of questions and/or comments I am looking for feedback on. Mostly I'm looking for best practices sorts of answers from the community as a whole... #1) Are there are any other tests, which I am missing, like the SENDERBLOCK test which I might want to consider adding to my bag of tricks to continue to filter out spam e-mail which slide in under my hold weight and also fall in line with my philosophy, i.e. catching legit e-mail is a bad thing? #2) Am I correct in my assumption that holding for SPAMCOP is a bad
[Declude.JunkMail] Need A Recommendation
Hello, All, I have a question concerning the best way to go about filtering out a specific e-mail message. For an overview of the current state of our spam filtering setup please see an e-mail I just sent to the list with the subject Where I'm At Now and Where Should I Be Going?. OK, below I have included the headers for an e-mail that one of my users forwarded to me. I have removed the username... == From [EMAIL PROTECTED] Fri Feb 28 00:58:23 2003 Received: from SMTP32-FWD by pagerover.com (SMTP32) id A116C; Fri, 28 Feb 2003 00:58:23 -0500 Received: from mdkpower.dkpower.com [211.241.219.3] by pagerover.com with ESMTP (SMTPD32-6.06) id AA7C27540134; Fri, 28 Feb 2003 00:58:20 -0500 Received: from smtp0210.mail.yahoo.com ([206.169.238.250]) by mdkpower.dkpower.com with Microsoft SMTPSVC(5.0.2195.4453); Fri, 28 Feb 2003 15:01:02 +0900 Date: Fri, 28 Feb 2003 05:59:32 GMT From: mcgough [EMAIL PROTECTED] X-Priority: 3 To: user@pagerover.com Subject: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Return-Path: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 28 Feb 2003 06:01:03.0063 (UTC) FILETIME=[C651D670:01C2DEEE] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-RBL-Warning: IPNOTINMX: X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [6000110f]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [6000110f]. X-Declude-Sender: [EMAIL PROTECTED] [211.241.219.3] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOPOSTMASTER, IPNOTINMX, ROUTING, SPAMHEADERS [8] X-UIDL: 8513 Status: R == The current hold weight for PAGEROVER.COM is WEIGHT12. Obviously the weight of this message is substantially lower than that. I could use my SENDERBLOCK list to block this individual sender ([EMAIL PROTECTED]) but that seems to specific a solution, i.e. a waste of a perfectly good entry which could so so much more. And I can't go too general and use the domain (comcast.net) because I'm sure there's much legitimate e-mail emanating from the domain name. I know there has to be a test built into Declude for situations like this but I'm not quite sure where to look. Does anyone have a suggestion as to how they would handle this situation? All feedback is appreciated. Thanks, Much! Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going?
Speaking of SPAMCOP, one option would be to increase the weight that that test applies. Then you will block mail that fails that test and another, but pass mail that fails only that test. YMMV __ David Fletcher InfoTech International, LLC. (904)338-9234 (904)721-1253 fax http://www.ITI-InfoTech.com __ -Original Message- From: Dan Geiser [mailto:[EMAIL PROTECTED] Sent: Friday, February 28, 2003 11:36 AM To: Declude JunkMail Subject: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? Hello, All, I am pushing hard to learn as much about Declude.JunkMail as my time allows during the trial period. I think I installed on February 11th so I'm about 17 days into the trial. I was hoping to get some feedback from the list as far as things I might have looked over and might want to consider looking into next. Just to bring things up to speed... I am currently testing Declude.JunkMail Beta v1.67. I have isolated 2 in-house hosts (out of the 90 we have on our IMail server) for testing purposes. For each host I did some pre-analysis to find out what an ideal hold weight would be for each. For the first host, with the domain name NEXUSTECHGROUP.COM, I came up with WEIGHT13 as my hold weight. For the second host, with the domain name PAGEROVER.COM, I came up with WEIGHT12 as my hold weight. NEXUSTECHGROUP.COM probably gets about 90% legitimate e-mail and PAGEROVER.COM probably gets about 95% (or higher) spam e-mail. Once I set up the hold weight most spam immediately started being caught by Declude. Those who receive e-mail at those domains were very impressed. But there are still the occasional spam e-mail which make it under the threshold of the hold weight. To further fine tune Declude.JunkMail I have done 2 things, one which was my idea (and I'm comfortable with) and another which was done to please my boss, which I don't necessarily agree with: Fine Tuning #1: This is the one I am comfortable with... In addition to the hold weight I also hold e-mail for a test that I created called SENDERBLOCK. SENDERBLOCK is defined in GLOBAL.CFG as SENDERBLOCK fromfile D:\iMail\declude\senderblock.txt x 0 0. This is based upon the test described in the Your own sender blacklists section of the Declude.JunkMail. Whenever a spam e-mail slips under my hold weight I add the sender's domain (provided it's an obvious spamming domain) to this list. That test has helped to filter a few more spam e-mails out of my user's inboxes. Fine Tuning #2: This one I'm less comfortable with... My boss noticed that a number of the spam e-mails that were still slipping in underneath the hold weight were failing the test SPAMCOP. He wanted to know how come I wasn't filtering out all e-mails that failed that test as, from his estimation, the SPAMCOP test was using a list of known spammers. I explained in detail the information I gleamed from the Declude.JunkMail web site and the SPAMCOP web site about the accuracy of the SPAMCOP test. I know that the SPAMCOP test finds mail server which have a high incidence of spam to legitimate e-mail but that real e-mail can pass through those servers. I told him I'd rather continue to filter on spam domains (via SENDERBLOCK) and that I was trying to avoid catching any legitimate e-mail altogether. I'm trying to set the bar low enough so that a) most spam is caught, b) no legitimate e-mail is caught and then c) filtering further for actual identified spam e-mails. He thinks it's too much overhead to add each domain name whereas I think over time as I add more and more domains to the list the number of domains I have to add will go down considerably. Needless to say I gave in and just started holding for the SPAMCOP test because I really didn't feel like taking the time to turn him over to my spam blocking philosophy. So that's basically where I'm at right now and from this I've come up with a number of questions and/or comments I am looking for feedback on. Mostly I'm looking for best practices sorts of answers from the community as a whole... #1) Are there are any other tests, which I am missing, like the SENDERBLOCK test which I might want to consider adding to my bag of tricks to continue to filter out spam e-mail which slide in under my hold weight and also fall in line with my philosophy, i.e. catching legit e-mail is a bad thing? #2) Am I correct in my assumption that holding for SPAMCOP is a bad idea or is there so little legitimate e-mail passing through a server on the SPAMCOP list that if I am holding on that test the chance of actually catching legit e-mail is pretty low? #3) In addition to what I've learned about about Declude.JunkMail itself, I've also started using two of the 3rd-party freeware tools that have been released by Declude devotees, SpamReview and Delog. SpamReview is great and I use it every day to take a quick look at all of the e-mail that is
Re: [Declude.JunkMail] Fromfile or Filter file limits
Title: Message Hello, All, Just trying to expand my own internal KnowledgeBase. In the below message, what exactly is a "filter file"? Is it a feature of Declude or a different 3rd-party add-on? If it's part of Declude is there somewhere in the documentation where I can read more about it? Is "filter" a type of test like "fromfile"? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] - Original Message - From: Kami Razvan To: JunkMail List Sent: Saturday, February 08, 2003 10:51 AM Subject: [Declude.JunkMail] Fromfile or Filter file limits Hi; Is there anyway possible to set a flag if a filter file reaches a certain limit in weight? We have setup several filter files and each for specific actions. It would be nice to be able to assign a limit weight (upper allowable) for each test. If that limit for that file exceeds then to take a certain action. Right now it is not possible to know how much of the total weight is from which test. For example: We have tests for: Test 1: URL's found in the body Test 2: Language found in Subject Test 3: Phone numbers found in body Test 4: Words found in body I think some of the false positives are based on individual weights exceeding a certain limit. But if we could have individual tests trigger a certain weight if a certain limit is reached then we can play with the weights a lot more effectively. So: Word 1 - weight 1 Word 2 - weight 1 Word 3 - weight 1 Word 4- weight 1 Then: If Weight = 4 Then Weight = 500 If the limit for this filter file reaches 4 then total weight is 500 This way we can have a little more freedom in fine tuning our tests. Thoughts? or can we do this already and I don't know it? Regards, Kami
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
I would love to use this as well. Darryl Koster~~Status Technologies Inc. President/Owner"Let Us Help You Get The Status You Deserve!"http://www.statustechnologies.comP: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Neal MathewsSent: Friday, February 28, 2003 10:37 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Log Analyzer - Comments NeededMe too!!! [EMAIL PROTECTED]At 10:28 AM 2/28/2003, you wrote: Count me in : [EMAIL PROTECTED] -Original Message-From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED]] On Behalf Of John ShacklettSent: Friday, February 28, 2003 9:44 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Log Analyzer - Comments NeededYes, me too please.-Original Message-From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED] Behalf Of John TolmachoffSent: Friday, 28 February 2003 9:25 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed I have a beta available and I am looking for individuals to test itout. If you are interested the beta will be made available as early as Monday.I would be interested.John Tolmachoff MCSE, CSSAIT Manager, Network EngineerRelianceSoft, Inc.Fullerton, CA 92835www.reliancesoft.com---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.---[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.* If you are not the intended addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. Please advise immediately if you or your employer do not consent to Internet email for messages of this kind.===Neal R. MathewsNetwork Systems EngineerEmail: [EMAIL PROTECTED]Phone: 1-716-673-1000 ext 8321Direct: 1-716-673-8321The Carriage House Companies, Inc. 196 Newton StreetFredonia, NY 14063
Re: DSN:Re: [Declude.JunkMail] Whitlist Compiler
Hello, Brian, Is there a link on the web somewhere to CYBERsitter SpamManager? I can't seem to find it. Also,would you consider this product a competing product to Declude.JunkMail? Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: Brian Milburn [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, February 08, 2003 12:45 PM Subject: DSN:Re: [Declude.JunkMail] Whitlist Compiler Hmmm... somebody stole my thunder! We added Smart Whitelisting to CYBERsitter SpamManager for the final release. It automatically (optionally) adds the recipients address to the users personal whitelist. $27,000 ?? Jeepers! Somebody's got a lot of VC guys to pay off! On 02/08/03 10:16am you wrote... IronMail compiles whitelists by looking at the recipient addresses of outgoing mail, on the assumption that frequently used addresses are those of people that an enterprise has a partnership with, and who should be allowed to send e-mail into the enterprise. Would be a nice feature in Declude... This is something that we have been thinking about for a long time. It would be a bit awkward to set up, and would use more resources, but could really help minimize false positives. -Scott This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need A Recommendation
OK, below I have included the headers for an e-mail that one of my users forwarded to me. I have removed the username... From [EMAIL PROTECTED] Fri Feb 28 00:58:23 2003 This is one option that you can filter on -- [EMAIL PROTECTED] is the return address of the E-mail. The advantage of filtering on this is that any E-mail from this address will then get caught. The disadvantages are that the spammer can send from another address (which wouldn't get caught), and that the return address could be a legitimate user's address that the spammer used without permission (but it is unlikely that the person whose address was used would be sending you E-mail). Received: from mdkpower.dkpower.com [211.241.219.3] by pagerover.com with ESMTP (SMTPD32-6.06) id AA7C27540134; Fri, 28 Feb 2003 00:58:20 -0500 The primary other option is to block the E-mail based on the IP address (211.241.219.3, from the top Received: header). The advantage of this is that you will block any E-mail that the spammer sends from that IP, regardless of the return address they use. However, the disadvantage is that spammers will often use open relays, and switch from one to another fairly often (and other spammers have 100s or 1,000s of compromised computers that they can send from, each with a different IP). You can also try setting up a filter based on other parts of the E-mail. For example, at least one of our customers has a filter file that contains the line SUBJECT 3 ISBLANK, which would add 3 to the weight of the E-mail if the subject was blank (as is the case here). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fromfile or Filter file limits
In the below message, what exactly is a filter file? Is it a feature of Declude or a different 3rd-party add-on? If it's part of Declude is there somewhere in the documentation where I can read more about it? Is filter a type of test like fromfile? A filter file is just the file that is used with a filter in Declude JunkMail Pro (from the Filtering section of the manual). A filter test is very similar to a fromfile test, in that it uses a separate file with a list of things to look for. In the case of the filter, it is a bit more flexible, as it lets you look at specific sections of the E-mail (such as just the headers, return address, or even the reverse DNS entry of the remote mailserver), and also lets you assign different weights for each line in the filter file (so you could assign an E-mail with a subject containing Read my spam! a different weight than an E-mail with a subject reading This is not spam, for example). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng?
I agree as an ISP that SPAMCOP alone does not work, but as a corporate email, it might be considerably different, positive or negative. Another test you might consider is SpamChk, I just started using it and it makes a huge difference in my mail box, I do need to tune it though, it trapps my Daily Dilbert and my rules delete at the level it's pushing it to. From what I see you can make it inch spam weight up or really push it. You can find it on the Tools page at www.declude.com. BTW, Scott, I know there are other add-ons out there that are not on your tools list, if it is not your intention to maintain a comprehensive list then maybe someone else might want to put one together. It would be nice to know all the options we have. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tom Baker | Netsmith Inc Sent: Friday, February 28, 2003 11:00 AM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng? In our experience as an ISP, this was our INITIAL reaction (based on my personal mailbox), However SPAMCOP turned into about 50% accuracy system wide, and we had to move to at least 2 RBL tests failed to hold, or SNIFFER. It would be a good idea to run the sniffer (http://www.sortmonster.com/sniffer/) trial as well. What declude is currently passing through sniffer should catch most of. -Tom -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Friday, February 28, 2003 10:55 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? In my experience SPAMCOP has been very good at weeding out SPAM and we hold/block using this test alone. We do occasionally get a false positive or two, but no more or less than any of RBL's that list known open relays. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, February 28, 2003 11:36 AM To: Declude JunkMail Subject: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going? Hello, All, I am pushing hard to learn as much about Declude.JunkMail as my time allows during the trial period. I think I installed on February 11th so I'm about 17 days into the trial. I was hoping to get some feedback from the list as far as things I might have looked over and might want to consider looking into next. Just to bring things up to speed... I am currently testing Declude.JunkMail Beta v1.67. I have isolated 2 in-house hosts (out of the 90 we have on our IMail server) for testing purposes. For each host I did some pre-analysis to find out what an ideal hold weight would be for each. For the first host, with the domain name NEXUSTECHGROUP.COM, I came up with WEIGHT13 as my hold weight. For the second host, with the domain name PAGEROVER.COM, I came up with WEIGHT12 as my hold weight. NEXUSTECHGROUP.COM probably gets about 90% legitimate e-mail and PAGEROVER.COM probably gets about 95% (or higher) spam e-mail. Once I set up the hold weight most spam immediately started being caught by Declude. Those who receive e-mail at those domains were very impressed. But there are still the occasional spam e-mail which make it under the threshold of the hold weight. To further fine tune Declude.JunkMail I have done 2 things, one which was my idea (and I'm comfortable with) and another which was done to please my boss, which I don't necessarily agree with: Fine Tuning #1: This is the one I am comfortable with... In addition to the hold weight I also hold e-mail for a test that I created called SENDERBLOCK. SENDERBLOCK is defined in GLOBAL.CFG as SENDERBLOCK fromfile D:\iMail\declude\senderblock.txt x 0 0. This is based upon the test described in the Your own sender blacklists section of the Declude.JunkMail. Whenever a spam e-mail slips under my hold weight I add the sender's domain (provided it's an obvious spamming domain) to this list. That test has helped to filter a few more spam e-mails out of my user's inboxes. Fine Tuning #2: This one I'm less comfortable with... My boss noticed that a number of the spam e-mails that were still slipping in underneath the hold weight were failing the test SPAMCOP. He wanted to know how come I wasn't filtering out all e-mails that failed that test as, from his estimation, the SPAMCOP test was using a list of known spammers. I explained in detail the information I gleamed from the Declude.JunkMail web site and the SPAMCOP web site about the accuracy of the SPAMCOP test. I know that the SPAMCOP test finds mail server which have a high incidence of spam to legitimate e-mail but that real e-mail can pass through those servers. I told him I'd rather continue to filter on spam domains (via SENDERBLOCK) and that I was trying to avoid catching any legitimate e-mail altogether. I'm trying to set the bar low enough so that a) most spam is caught, b) no legitimate e-mail
RE: [Declude.JunkMail] Where I'm At Now and Where Should I BeGoi ng?
You can find it on the Tools page at www.declude.com. BTW, Scott, I know there are other add-ons out there that are not on your tools list, if it is not your intention to maintain a comprehensive list then maybe someone else might want to put one together. It would be nice to know all the options we have. It definitely is intended to be a comprehensive list -- if you know of any other programs, scripts, tools, etc. that you think should be on the page at http://www.declude.com/tools , please let me know, and I'll add it. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam Kill.lst
Quick question, the list of spam address's at http://www.imagefxonline.net/apps/delog/fromfile.txt have an id number at the end of them. Will this affect the kill list by leaving them in? Darryl Koster ~~ Status Technologies Inc. President/Owner Let Us Help You Get The Status You Deserve! http://www.statustechnologies.com P: (905) 435-0145 TF (NA) 888-909-9004 F: (905) 435-0873 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Going?
It seems that SPAMCOP goes through cycles. Right now, I have not heard many complaints lately. But about 4 months ago, I had to lower its weight from hold to major test. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude REVDNS test
Could someone pleaase :) help me out, my declude mail and virus config setup is soo old, ( been so busy you know...). it needs updating real bad, could someone help me update my config files and settings to the latest configurations too much stuff getting thru especially adult stuff etc... If you go to http://www.declude.com/junkmail/manual.htm (and http://www.declude.com/virus/manual.htm for Declude Virus), you can download the latest configuration files. You would then have the choice of either [1] Using the new config files (and making any necessary changes from your old config files), or [2] Using the old config files, and adding changes from the new config files. Depending on how customized you are, one will likely be easier than the other. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] h:Releasing Netcomm LogTool for Declude JunkMail
We would like to announce the release of LogTool for Declude JunkMail. This application was designed from the ground up to allow the user to quickly and easily drill-down into JunkMail's logs to assist in the fine-tuning of the filters. In a near future release, we will expand LogTool's capabilities to include the processing of Virus' log format. More information is available at: http://www.netcomm.com/products/logtool Email us off-list at [EMAIL PROTECTED] if you have any questions, comments or interest. Thanks, Jason Wolfe Lead Developer Netcomm, Inc. http://www.netcomm.com (859) 224-4124 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Log Analyzer - Comments Needed
Darrell, I'll be glad to have a look at that too. [EMAIL PROTECTED] - Maybe it would be easier to post it to a site so we can download it from there and save you time. Paul Keith, I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. Please let me know if you are interested. Darrell LaRock --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler
www.spammanager.com There is a version that is intended to work closely with Declude that some of us including myself beta tested and helped worked out the bugs. There is also a standalone version to work directly with Imail. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need A Recommendation
Dan, In a perfect BOFH world, I would just block 211.0.0.0/8 :D But, I'd say the best way to filter out that subject line would be just by using the the Imail filters. It's very unlikely that a legit message would ever use that *exact* subject, so I think you'd be okay. Koree Dan Geiser wrote: Hello, All, I have a question concerning the best way to go about filtering out a specific e-mail message. For an overview of the current state of our spam filtering setup please see an e-mail I just sent to the list with the subject Where I'm At Now and Where Should I Be Going?. OK, below I have included the headers for an e-mail that one of my users forwarded to me. I have removed the username... == From [EMAIL PROTECTED] Fri Feb 28 00:58:23 2003 Received: from SMTP32-FWD by pagerover.com (SMTP32) id A116C; Fri, 28 Feb 2003 00:58:23 -0500 Received: from mdkpower.dkpower.com [211.241.219.3] by pagerover.com with ESMTP (SMTPD32-6.06) id AA7C27540134; Fri, 28 Feb 2003 00:58:20 -0500 Received: from smtp0210.mail.yahoo.com ([206.169.238.250]) by mdkpower.dkpower.com with Microsoft SMTPSVC(5.0.2195.4453); Fri, 28 Feb 2003 15:01:02 +0900 Date: Fri, 28 Feb 2003 05:59:32 GMT From: mcgough [EMAIL PROTECTED] X-Priority: 3 To: user@pagerover.com Subject: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Return-Path: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 28 Feb 2003 06:01:03.0063 (UTC) FILETIME=[C651D670:01C2DEEE] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-RBL-Warning: IPNOTINMX: X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [6000110f]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [6000110f]. X-Declude-Sender: [EMAIL PROTECTED] [211.241.219.3] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOPOSTMASTER, IPNOTINMX, ROUTING, SPAMHEADERS [8] X-UIDL: 8513 Status: R == The current hold weight for PAGEROVER.COM is WEIGHT12. Obviously the weight of this message is substantially lower than that. I could use my SENDERBLOCK list to block this individual sender ([EMAIL PROTECTED]) but that seems to specific a solution, i.e. a waste of a perfectly good entry which could so so much more. And I can't go too general and use the domain (comcast.net) because I'm sure there's much legitimate e-mail emanating from the domain name. I know there has to be a test built into Declude for situations like this but I'm not quite sure where to look. Does anyone have a suggestion as to how they would handle this situation? All feedback is appreciated. Thanks, Much! Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng?
I see you updated it recently, I was killing myself yesterday to remember the name of Spammanager, had to search the archives. Also, could you include a link to my add-ons site http://spamreview.argolink.net/software, I have several tools there, one is the zipfile for the Hijack notifier. As I make new utils or update old ones, I will update the page. As for others that should be on there, I can't think of any off hand. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, February 28, 2003 12:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng? You can find it on the Tools page at www.declude.com. BTW, Scott, I know there are other add-ons out there that are not on your tools list, if it is not your intention to maintain a comprehensive list then maybe someone else might want to put one together. It would be nice to know all the options we have. It definitely is intended to be a comprehensive list -- if you know of any other programs, scripts, tools, etc. that you think should be on the page at http://www.declude.com/tools , please let me know, and I'll add it. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need A Recommendation
Dan, I have several tests I made myself, which if I wanted to, could drop to 2 or 3, however, here is what I would do. FWIW - I'm by no means an expert here, trial and error gets you through it. X-Declude-Sender: [EMAIL PROTECTED] [211.241.219.3] This line is your best friend! well, I refer to it alot =) I have a fromfile list, which I would place the address in, I also have an IP list that I use to track repeat offenders. I'd put 211.241.219.3 in that list. If I see repeated mailings from that address, it eventually makes it to imails SMTP ACC list. Right or wrong, I don't know, but it's what I do and has worked well so far. Also, the email addy could be added to Imails kill list, but chances are they won't use that address again. Scott also mentioned the CONTAINS for body text etc. Also very useful for when they send mass mailings through compromised servers - different IPs but same messages. Comments gang? Too much? Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: DSN:Re: [Declude.JunkMail] Whitlist Compiler
The address is http://www.spammanager.com It might be a competing product for Declude, but it is not intended to be. It is a different approach however it also supports being used as a Declude test. Imail is not really our intended market, however since we use IMail ourselves, it was a natural place to start. (I hate #%$#%* SPAM!) We use it here in conjunction with Declude products however it will work alone. Our main push is going to be the gateway version which will work with any mail server and numerous mail servers at the same time, and is about 8-10x faster that using it in conjunction with IMail in our tests so far. We are also planning on adding support for Declude Junkmail and Spam in the gateway version as soon as we finish our initial alpha testing. There is a Declude specific version of SpamManager now available that does not have all the bells and whistles and simply returns result codes for Declude JunkMail. It is much less expensive. On 02/28/03 12:24pm you wrote... Hello, Brian, Is there a link on the web somewhere to CYBERsitter SpamManager? I can't seem to find it. Also,would you consider this product a competing product to Declude.JunkMail? Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: Brian Milburn [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, February 08, 2003 12:45 PM Subject: DSN:Re: [Declude.JunkMail] Whitlist Compiler Hmmm... somebody stole my thunder! We added Smart Whitelisting to CYBERsitter SpamManager for the final release. It automatically (optionally) adds the recipients address to the users personal whitelist. $27,000 ?? Jeepers! Somebody's got a lot of VC guys to pay off! On 02/08/03 10:16am you wrote... IronMail compiles whitelists by looking at the recipient addresses of outgoing mail, on the assumption that frequently used addresses are those of people that an enterprise has a partnership with, and who should be allowed to send e-mail into the enterprise. Would be a nice feature in Declude... This is something that we have been thinking about for a long time. It would be a bit awkward to set up, and would use more resources, but could really help minimize false positives. -Scott This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Solid Oak Software] ware] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I BeGoi ng?
I see you updated it recently :) Also, could you include a link to my add-ons site http://spamreview.argolink.net/software, I have several tools there, one is the zipfile for the Hijack notifier. It's set up now with one link to each tool, I hope that isn't a problem (it should be easier for people to find them that way). By the way, I really like the Junkmail Statistics Grapher. :) -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
Same here, I would be interested. Jeff Kratka * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Darrell L. Sent: Friday, February 28, 2003 6:15 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Keith, I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. Please let me know if you are interested. Darrell LaRock -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Thursday, February 06, 2003 4:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Darrell, That is awesome. I get those same requests from our clients weekly. I appreciate your time in writing it. Keith -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Thursday, February 06, 2003 11:35 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Log Analyzer - Comments Needed *Sorry if this is outside the realm in which the forum should be used. Several of my customers have started asking me for reports on what Declude is blocking for their domain or a certain user. Obtaining this information was challenging manually sifting through the logs - to say the least. I then decided to write an analyzer that could accomplish what I needed. It's a good portion of the way wrote, and I am thinking about making it public at some point when it is completely finished. However, I was looking for features that people would like that I may not have thought of at this point. Currently right now it can do the following 1.) Report on Number of messages that fails each test. 2.) Comprehensive reporting on each individual tests. Reports can be generated based on (to, from, domain, subjects, date, time). 3.) Report on individual domains and which messages failed which tests 4.) Report on individual users and which messages failed which tests. 5.) It is a console application written in C# (.net). It is self contained and does not need any external databases like SQL Server or MSDE. Things Still to be added 1.) Ability to email the reports Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need A Recommendation
Dear, Scott, et. al. Thank you very much for all of the recommendations. It is definitely my itent to learn how to do all of the possible techniques that people suggested when responding to my original e-mail, eventually. But for the time being I think I'll try the block the E-mail based on the IP address option that Scott suggested. It doesn't seem to be too far away in theory and execution from the SENDERBLOCK test that I am already running. Oh, how I wish I were more adventurous to try all of those other options right now that other suggested! The primary other option is to block the E-mail based on the IP address (211.241.219.3, from the top Received: header). The advantage of this is that you will block any E-mail that the spammer sends from that IP, regardless of the return address they use. However, the disadvantage is that spammers will often use open relays, and switch from one to another fairly often (and other spammers have 100s or 1,000s of compromised computers that they can send from, each with a different IP). Am I correct that the setup for this option is outlined in the section labeled Your own IP blacklists in the Declude JunkMail manual? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng?
Thank you, it is a nice way to see how the filters are doing, and it keeps the data set small, all 28 of my tests take up less than a meg to store (rrd's are created at their final size). Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, February 28, 2003 1:09 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Where I'm At Now and Where Should I Be Goi ng? I see you updated it recently :) Also, could you include a link to my add-ons site http://spamreview.argolink.net/software, I have several tools there, one is the zipfile for the Hijack notifier. It's set up now with one link to each tool, I hope that isn't a problem (it should be easier for people to find them that way). By the way, I really like the Junkmail Statistics Grapher. :) -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need A Recommendation
The primary other option is to block the E-mail based on the IP address (211.241.219.3, from the top Received: header) Am I correct that the setup for this option is outlined in the section labeled Your own IP blacklists in the Declude JunkMail manual? That is correct. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log Analyzer - Comments Needed
I would be interested. [EMAIL PROTECTED] Dan Horne, CCNA Systems Administrator TAIS Web Wilcox World Travel Tours [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell L. Sent: Friday, February 28, 2003 9:15 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Keith, I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. Please let me know if you are interested. Darrell LaRock -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Thursday, February 06, 2003 4:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Darrell, That is awesome. I get those same requests from our clients weekly. I appreciate your time in writing it. Keith -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Thursday, February 06, 2003 11:35 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Log Analyzer - Comments Needed *Sorry if this is outside the realm in which the forum should be used. Several of my customers have started asking me for reports on what Declude is blocking for their domain or a certain user. Obtaining this information was challenging manually sifting through the logs - to say the least. I then decided to write an analyzer that could accomplish what I needed. It's a good portion of the way wrote, and I am thinking about making it public at some point when it is completely finished. However, I was looking for features that people would like that I may not have thought of at this point. Currently right now it can do the following 1.) Report on Number of messages that fails each test. 2.) Comprehensive reporting on each individual tests. Reports can be generated based on (to, from, domain, subjects, date, time). 3.) Report on individual domains and which messages failed which tests 4.) Report on individual users and which messages failed which tests. 5.) It is a console application written in C# (.net). It is self contained and does not need any external databases like SQL Server or MSDE. Things Still to be added 1.) Ability to email the reports Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
NOABUSE:RE: [Declude.JunkMail] Log Analyzer - Comments Needed
I would love to try it out as well!! Sounds very usefull. [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell L. Sent: Friday, February 28, 2003 6:15 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Keith, I have a beta available and I am looking for individuals to test it out. If you are interested the beta will be made available as early as Monday. Please let me know if you are interested. Darrell LaRock -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Thursday, February 06, 2003 4:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Log Analyzer - Comments Needed Darrell, That is awesome. I get those same requests from our clients weekly. I appreciate your time in writing it. Keith -Original Message- From: Darrell L. [mailto:[EMAIL PROTECTED] Sent: Thursday, February 06, 2003 11:35 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Log Analyzer - Comments Needed *Sorry if this is outside the realm in which the forum should be used. Several of my customers have started asking me for reports on what Declude is blocking for their domain or a certain user. Obtaining this information was challenging manually sifting through the logs - to say the least. I then decided to write an analyzer that could accomplish what I needed. It's a good portion of the way wrote, and I am thinking about making it public at some point when it is completely finished. However, I was looking for features that people would like that I may not have thought of at this point. Currently right now it can do the following 1.) Report on Number of messages that fails each test. 2.) Comprehensive reporting on each individual tests. Reports can be generated based on (to, from, domain, subjects, date, time). 3.) Report on individual domains and which messages failed which tests 4.) Report on individual users and which messages failed which tests. 5.) It is a console application written in C# (.net). It is self contained and does not need any external databases like SQL Server or MSDE. Things Still to be added 1.) Ability to email the reports Thanks Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Not all headers for gateway domain appearing.
I am finding that not all the headers are being inserted when the message is from an Internet domain and going to a gateway domain. These are the headers that are being added: XINHEADER X-RBL-Warning: Total weight: %WEIGHT% XSENDER ON XSPOOLNAME ON XINHEADER X-Tests-Failed: %TESTSFAILED% XINHEADER X-Note: This E-mail was sent from %REVDNS% ([%REMOTEIP%]). XINHEADER X-Note: This e-mail was scanned by RelianceSoft, Inc for Viruses and SPAM. XINHEADER X-Note: To report any issues, please goto http://support.reliance.net/help.html Is it that I should also have those XINHEADER as XOUTHEADER? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Not all headers for gateway domainappearing.
I am finding that not all the headers are being inserted when the message is from an Internet domain and going to a gateway domain. That's normal. If the E-mail is not destined to an account on the IMail server, it is considered outgoing E-mail, so: XINHEADER X-RBL-Warning: Total weight: %WEIGHT% This header won't be added. Is it that I should also have those XINHEADER as XOUTHEADER? Correct. :) -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: runaway process MAPISP32
Pardon me going off topic, but we've exhausted our normal diagnostics on this Outlook problem. I have two users (software developers) who both run Windows/Office 2000 and started having email trouble today. It doesn't send or receive, acts very sluggish, and when they check the Task Manager an executable named MAPISP32 is hogging the CPU. I know there's a worm named W32.magistr.24876 that sometimes takes this file name, but we're running Symantec AntiVirus Corporate Edition and both users are up to date on virus definitions. Plus they are properly patched via Windows Update. Also ran a utility to remove spyware. (Part of my emphasis on possible worm is that these developers have been working with a client who is reporting similar problems.) Tried searching the MS site and the Web but didn't find anything. I checked the mail server for evidence of excessive outgoing traffic but didn't find anything there either. Tips? Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) Email: [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: runaway process MAPISP32
I know this sounds elementary but you yourself might want to make sure that Real-time File protection is enabled on their system and do a full manual scan. Googling for MAPISP32 and CPU turns up some interesting hits. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Keith Purtell Sent: Friday, February 28, 2003 12:32 PM To: Declude JunkMail (E-mail) Subject: [Declude.JunkMail] OT: runaway process MAPISP32 Pardon me going off topic, but we've exhausted our normal diagnostics on this Outlook problem. I have two users (software developers) who both run Windows/Office 2000 and started having email trouble today. It doesn't send or receive, acts very sluggish, and when they check the Task Manager an executable named MAPISP32 is hogging the CPU. I know there's a worm named W32.magistr.24876 that sometimes takes this file name, but we're running Symantec AntiVirus Corporate Edition and both users are up to date on virus definitions. Plus they are properly patched via Windows Update. Also ran a utility to remove spyware. (Part of my emphasis on possible worm is that these developers have been working with a client who is reporting similar problems.) Tried searching the MS site and the Web but didn't find anything. I checked the mail server for evidence of excessive outgoing traffic but didn't find anything there either. Tips? Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) Email: [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: runaway process MAPISP32
Keith, Did you check Google Groups? There looks to be tons of stuff discussing similar issues in there. Some sample subjects include... OL2000/MAPISP32 livelock state (NOT COVERED BY Q195922) mail problem mapisp32.exe using 99% CPU MAPISP32 uses 100% CPU etc... Just a thought. Take Care, Dan [EMAIL PROTECTED] - Original Message - From: Keith Purtell [EMAIL PROTECTED] To: Declude JunkMail (E-mail) [EMAIL PROTECTED] Sent: Friday, February 28, 2003 3:31 PM Subject: [Declude.JunkMail] OT: runaway process MAPISP32 Pardon me going off topic, but we've exhausted our normal diagnostics on this Outlook problem. I have two users (software developers) who both run Windows/Office 2000 and started having email trouble today. It doesn't send or receive, acts very sluggish, and when they check the Task Manager an executable named MAPISP32 is hogging the CPU. I know there's a worm named W32.magistr.24876 that sometimes takes this file name, but we're running Symantec AntiVirus Corporate Edition and both users are up to date on virus definitions. Plus they are properly patched via Windows Update. Also ran a utility to remove spyware. (Part of my emphasis on possible worm is that these developers have been working with a client who is reporting similar problems.) Tried searching the MS site and the Web but didn't find anything. I checked the mail server for evidence of excessive outgoing traffic but didn't find anything there either. Tips? Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) Email: [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. This E-mail is scanned and free from viruses. www.nexustechgroup.com This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: runaway process MAPISP32
Indeed, Google does have information. I've got expand my search engine horizons beyond Alta Vista! (P.S. We've got RealTime enabled and tried manual scan.) Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) Email: [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser Sent: Friday, February 28, 2003 2:42 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] OT: runaway process MAPISP32 Keith, Did you check Google Groups? There looks to be tons of stuff discussing similar issues in there. Some sample subjects include... OL2000/MAPISP32 livelock state (NOT COVERED BY Q195922) mail problem mapisp32.exe using 99% CPU MAPISP32 uses 100% CPU etc... Just a thought. Take Care, Dan [EMAIL PROTECTED] - Original Message - From: Keith Purtell [EMAIL PROTECTED] To: Declude JunkMail (E-mail) [EMAIL PROTECTED] Sent: Friday, February 28, 2003 3:31 PM Subject: [Declude.JunkMail] OT: runaway process MAPISP32 Pardon me going off topic, but we've exhausted our normal diagnostics on this Outlook problem. I have two users (software developers) who both run Windows/Office 2000 and started having email trouble today. It doesn't send or receive, acts very sluggish, and when they check the Task Manager an executable named MAPISP32 is hogging the CPU. I know there's a worm named W32.magistr.24876 that sometimes takes this file name, but we're running Symantec AntiVirus Corporate Edition and both users are up to date on virus definitions. Plus they are properly patched via Windows Update. Also ran a utility to remove spyware. (Part of my emphasis on possible worm is that these developers have been working with a client who is reporting similar problems.) Tried searching the MS site and the Web but didn't find anything. I checked the mail server for evidence of excessive outgoing traffic but didn't find anything there either. Tips? Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) Email: [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. --- --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude.JunkMail Statistics
Hello, All, We've been running Declude.JunkMail in filtering (HOLD action) mode for about a week now. I think the powers that be are interested in seeing some real, concrete numbers regarding what sort of benefit Declude.JunkMail has been brining to our mail server lo these last 7 days. I am not looking for anything fancy (no graphs or anything) just something simple that can take our JunkMail logs for the last week and run some totals on how many messages were scanned, how many were id'ed as spam, etc. I found the JunkMail Statistics Grapher off of the Tools page but I was interested in looking at something a little less graphical. Are there any simple, good tools out there for producing and/or analyzing the status which a new JunkMail installation might produce? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Bounce Action and IMail Server Relay
Hi, Again, I was asked me an interesting question today which I did not have an answer for so I thought I would find out. Currently we hold all suspected spam but somewhere down the road we might be interested in rejecting the spam for even being received by our mail server. One JunkMail action which could accomplish this might be the bouce action. My question is this... When the bounce action is flipped on, if a message fails a test with bounce associated with it does Declude.JunkMail tell IMail to reject the message during the incoming SMTP conversation (and not even accept it into the server) or does IMail actually accept the message and then queue the bounce message up in the spool to be sent back to the sender? If the latter, and the senders are spoofing their addresses, couldn't this potentially cause a lot of mail in limbo to build up in the spool folder? The reason that I ask is this... Currently we are planning on offering Spam Filtering (once we finish testing) to our current e-mail hosting customers, i.e. those hosted on our IMail server. We also have a few customers who don't host e-mail with us but would probably be interested in spam filtering if we had it available. For those who don't host with us we were thinking we could let them relay their e-mail through our system, filter out their spam, and then send it on the way. I know this question might be better posted to the IMail Server discussion list but I thought I would try here first. Can IMail Server be configured to act as a relay in this manner? I don't have tons of experience with IMail (only enough to be dangerous), so forgive me if that's a silly question. If IMail can be configured as a relay for Incoming Mail as I described, do you know where the IMail interface I might configure it, or perhaps a piece of documentation that would outline this setup? I appreciate the feedback. Thanks, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bounce Action and IMail Server Relay
When the bounce action is flipped on, if a message fails a test with bounce associated with it does Declude.JunkMail tell IMail to reject the message during the incoming SMTP conversation (and not even accept it into the server) or does IMail actually accept the message and then queue the bounce message up in the spool to be sent back to the sender? If the latter, and the senders are spoofing their addresses, couldn't this potentially cause a lot of mail in limbo to build up in the spool folder? The key here is the DO NOT USE THIS ACTION unless you understand FULLY that spammers will NEVER receive the bounce message. from the test description. IMail doesn't allow software to interfere with the SMTP transaction, so this is an actual bounce message, not a reject. The problem isn't that *you* have to deal with the E-mail in limbo, but that innocent victims will be getting bounce messages from you. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude.JunkMail Statistics
Delog is good, there is a thread about a beta log analyzer Log Analyzer - Comments Needed, sounds real promising. You might check those out. I seem to remember there being others, but can't think of them off hand. The only other one is Netcomm LogTool, but I don't think you want to spend $200 just to show quick stats for a tool you are evaluating. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, February 28, 2003 2:57 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude.JunkMail Statistics Hello, All, We've been running Declude.JunkMail in filtering (HOLD action) mode for about a week now. I think the powers that be are interested in seeing some real, concrete numbers regarding what sort of benefit Declude.JunkMail has been brining to our mail server lo these last 7 days. I am not looking for anything fancy (no graphs or anything) just something simple that can take our JunkMail logs for the last week and run some totals on how many messages were scanned, how many were id'ed as spam, etc. I found the JunkMail Statistics Grapher off of the Tools page but I was interested in looking at something a little less graphical. Are there any simple, good tools out there for producing and/or analyzing the status which a new JunkMail installation might produce? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam Kill.lst
Quick question, the list of spam address's at http://www.imagefxonline.net/apps/delog/fromfile.txt have an id number at the end of them. Will this affect the kill list by leaving them in? No these are allowed with Declude and are no more than a comment. The comments, however, have a special meaning to them allowing a log analyzer to review and update your fromfile. Take a look at http://www.imagefxonline.net/apps/readid it's free. Regards, Tom Image`fx --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: h:Re: [Declude.JunkMail] Declude.JunkMail Statistics
Hello, Greg,
Does Log Tool have a trial version that I can
try?
Thanks, Much!
Dan
- Original Message -
From:
Greg Bourland
To: [EMAIL PROTECTED]
Sent: Friday, February 28, 2003 5:27
PM
Subject: h:Re: [Declude.JunkMail]
Declude.JunkMail Statistics
Check out www.netcomm.com/products/logtool.
Dan Geiser[EMAIL PROTECTED]
02/28/03 03:56PM Hello, All,We've been running
Declude.JunkMail in "filtering" ("HOLD" action) mode forabout a week
now.I think the powers that be are interested in seeing some real,
concretenumbers regarding what sort of benefit Declude.JunkMail has been
brining toour mail server lo these last 7 days. I am not looking for
anything fancy(no graphs or anything) just something simple that can take
our JunkMaillogs for the last week and run some totals on how many
messages werescanned, how many were id'ed as spam, etc. I found the
JunkMail StatisticsGrapher off of the Tools page but I was interested in
looking at something alittle less graphical. Are there any simple,
good tools out there forproducing and/or analyzing the status which a new
JunkMail installationmight produce?Thanks In Advance,Dan
Geiser
[EMAIL PROTECTED]This
E-mail is scanned and free from viruses. www.nexustechgroup.com---[This
E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]---This
E-mail came from the Declude.JunkMail mailing list. Tounsubscribe,
just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe
Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler
Yes it will by setting it up per the Declude configuration in the documentation. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Patrick Childers Sent: Friday, February 28, 2003 4:41 PM To: [EMAIL PROTECTED] Subject: RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler There is a Declude specific version of SpamManager now available that does not have all the bells and whistles and simply returns result codes for Declude JunkMail. Hey Scott/Bryan, For the Declude specific version of SpamManager, will the result codes distinguish the difference between adult content and regular spam? I used SpamManager as an external test during it's beta testing and was quite impressed with it's performance! :-) Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler
Thanks John! ~Patrick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff Sent: Friday, February 28, 2003 7:47 PM To: [EMAIL PROTECTED] Subject: RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler Yes it will by setting it up per the Declude configuration in the documentation. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Patrick Childers Sent: Friday, February 28, 2003 4:41 PM To: [EMAIL PROTECTED] Subject: RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler There is a Declude specific version of SpamManager now available that does not have all the bells and whistles and simply returns result codes for Declude JunkMail. Hey Scott/Bryan, For the Declude specific version of SpamManager, will the result codes distinguish the difference between adult content and regular spam? I used SpamManager as an external test during it's beta testing and was quite impressed with it's performance! :-) Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler
If any one needs the exact Declude tests definitions let me know. (Although I may not be able to get it to you until Tuesday. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Patrick Childers Sent: Friday, February 28, 2003 4:52 PM To: [EMAIL PROTECTED] Subject: RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler Thanks John! ~Patrick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff Sent: Friday, February 28, 2003 7:47 PM To: [EMAIL PROTECTED] Subject: RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler Yes it will by setting it up per the Declude configuration in the documentation. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Patrick Childers Sent: Friday, February 28, 2003 4:41 PM To: [EMAIL PROTECTED] Subject: RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler There is a Declude specific version of SpamManager now available that does not have all the bells and whistles and simply returns result codes for Declude JunkMail. Hey Scott/Bryan, For the Declude specific version of SpamManager, will the result codes distinguish the difference between adult content and regular spam? I used SpamManager as an external test during it's beta testing and was quite impressed with it's performance! :-) Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler
SpamManager returns negative results for adult and positive results for spam. John has some good test definitions that I am sure he will share. On 02/28/03 7:41pm you wrote... There is a Declude specific version of SpamManager now available that does not have all the bells and whistles and simply returns result codes for Declude JunkMail. Hey Scott/Bryan, For the Declude specific version of SpamManager, will the result codes distinguish the difference between adult content and regular spam? I used SpamManager as an external test during it's beta testing and was quite impressed with it's performance! :-) Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Solid Oak Software] ware] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: DSN:Re: Re[2]: [Declude.JunkMail] A Question of Ethics
In a corporate setting a company may or may not have an Internet/email/conduct policy. If not, it may be very dificult to fire someone for conduct that they didn't agree to abide by and if it came to a lawsuit they would probably loose. In fact, in TN, a long-haul trucker won a worker's comp lawsuit against his employer for injuries suffered while having sex in his cab, driving down the road and he was hit by a train (the female passenger, having no seat belt and not being seated in a passenger seat anyway, was thrown from the truck and killed). The first court ruled against the trucker (holding the belief that such behavior was outside the bounds of reasonable on-the-job behavior and as such, not a compensible accident). Higher courts ruled for the trucker - there was no written policy prohibiting such behavior and this person was used to doing this on a routine basis while performing his job (doesn't this make you feel safe, driving the freeway when it is full of trucks?). So, yes, without a written policy prohibiting certain behavior, you will probably lose in a suit. However, in any case, using porn email as proof of violating a written policy would probably also result in losing such a suit -- all it would take is having one person on a jury that has an email account of their own -- eventually, everyone gets porn email, it seems, and once on the list, the amount seems to keep adding up (we even get it on email accounts that were set up as a mailing list for internal distribution, that have never sent any emails out to the world). And much porn email can look as though it was asked for, substituting first names (gathered using many techniques) into long messages, using subject lines that look as tho you asked for the information (lures to get the email opened), etc. A better use of Declude would be to offer porn filtering (delete on detection) and spam forwarding (for retrieval of misclassified messages when necessary). Better proof would be simply browsing someones workstation and web surfing history (few delete such things and one of the worst cases I ever worked on was an attorney several years back that had installed compression onto his drives in order to make room for all the pornographic games, pictures, movies that had been downloaded and stored all over his official company computer). K. Oland --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: DSN:Re: Re[2]: [Declude.JunkMail] A Question of Ethics
I can't believe you guys are agonizing over this ethical dilema. it redicuolus... have you been so jaded by popular opinion of what is right or wrong that you let $$$ signs dictate what is right and wrong? Poronography and all the sick things that go with it ( i don't think i have to elaborate do I?) are PLAIN WRONG! Anyone caught dealing with it within our system is removed and banned instantly! no chance of appealIf you don't like the terms conditions then leave! And you know what... our clients like that .. many signup with us for that very fact they feel safer that we enforce those rules.. Ty it you'll be surprised. - Original Message - From: Karen Oland [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, February 28, 2003 7:23 PM Subject: RE: Re[2]: DSN:Re: Re[2]: [Declude.JunkMail] A Question of Ethics In a corporate setting a company may or may not have an Internet/email/conduct policy. If not, it may be very dificult to fire someone for conduct that they didn't agree to abide by and if it came to a lawsuit they would probably loose. In fact, in TN, a long-haul trucker won a worker's comp lawsuit against his employer for injuries suffered while having sex in his cab, driving down the road and he was hit by a train (the female passenger, having no seat belt and not being seated in a passenger seat anyway, was thrown from the truck and killed). The first court ruled against the trucker (holding the belief that such behavior was outside the bounds of reasonable on-the-job behavior and as such, not a compensible accident). Higher courts ruled for the trucker - there was no written policy prohibiting such behavior and this person was used to doing this on a routine basis while performing his job (doesn't this make you feel safe, driving the freeway when it is full of trucks?). So, yes, without a written policy prohibiting certain behavior, you will probably lose in a suit. However, in any case, using porn email as proof of violating a written policy would probably also result in losing such a suit -- all it would take is having one person on a jury that has an email account of their own -- eventually, everyone gets porn email, it seems, and once on the list, the amount seems to keep adding up (we even get it on email accounts that were set up as a mailing list for internal distribution, that have never sent any emails out to the world). And much porn email can look as though it was asked for, substituting first names (gathered using many techniques) into long messages, using subject lines that look as tho you asked for the information (lures to get the email opened), etc. A better use of Declude would be to offer porn filtering (delete on detection) and spam forwarding (for retrieval of misclassified messages when necessary). Better proof would be simply browsing someones workstation and web surfing history (few delete such things and one of the worst cases I ever worked on was an attorney several years back that had installed compression onto his drives in order to make room for all the pornographic games, pictures, movies that had been downloaded and stored all over his official company computer). K. Oland --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [Stealth Anti-Virus scanning] courtesy http://www.oilfielddirectory.com --- [Stealth Anti-Virus scanning] courtesy http://www.oilfielddirectory.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
