RE: [Declude.JunkMail] headers indicate both failed and not failed????
Can anyone tell me what is happening with the following headers? It indicates that tests failed yet at the end it says that test failed is NOINE thanks Received: from SMTP32-FWD by intown.net (SMTP32) id A062012F3; Fri, 30 May 2003 03:12:59 -0400 Received: from mail.escapees.com [207.70.132.66] by intown.net with ESMTP (SMTPD32-8.00) id A46EE000D0; Fri, 30 May 2003 03:12:46 -0400 Received: from SMTP32-FWD by mail.escapees.com (SMTP32) id A03D42CC5; Fri, 30 May 2003 02:06:10 -0500 Received: from compuserve.com [68.58.200.135] by mail.escapees.com (SMTPD32-8.00) id A2DF4E30272; Fri, 30 May 2003 02:06:07 -0500 Date: Fri, 30 May 2003 06:17:29 + From: Hailey [EMAIL PROTECTED] Subject: [SPAM WARNING]Lrosenberg, This XXX area is like no other, real explicit sex as NEVER been seen like this before!!! To: Lrosenberg [EMAIL PROTECTED] References: [EMAIL PROTECTED] In-Reply-To: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_L4GFK710_L0GFLCB7_6AD17CB X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?68.58.200.135 X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the limit of 10. X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.58.200.135 X-Declude-Sender: [EMAIL PROTECTED] [68.58.200.135] X-Note: This E-mail was scanned by Declude. X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, WEIGHTWARN, DSBL X-Note: This E-mail was sent from pcp02799235pcs.goosck01.sc.comcast.net ([68.58.200.135]). X-Declude-Sender: [EMAIL PROTECTED] [207.70.132.66] X-Declude-Spoolname: D046e00e000d0aec7.SMD X-Note: Tests Failed: None Status: U X-UIDL: 354131753 Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] headers indicate both failed and notfailed????
Can anyone tell me what is happening with the following headers? It indicates that tests failed yet at the end it says that test failed is NOINE Received: from mail.escapees.com [207.70.132.66] by intown.net with ESMTP (SMTPD32-8.00) id A46EE000D0; Fri, 30 May 2003 03:12:46 -0400 Received: from compuserve.com [68.58.200.135] by mail.escapees.com (SMTPD32-8.00) id A2DF4E30272; Fri, 30 May 2003 02:06:07 -0500 It looks like the E-mail passed through 2 IMail servers, yours and mail.escapees.com. X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?68.58.200.135 X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the limit of 10. X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.58.200.135 X-Declude-Sender: [EMAIL PROTECTED] [68.58.200.135] X-Note: This E-mail was scanned by Declude. X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, WEIGHTWARN, DSBL These are the headers that their Declude JunkMail added, and: X-Note: This E-mail was sent from pcp02799235pcs.goosck01.sc.comcast.net ([68.58.200.135]). X-Declude-Sender: [EMAIL PROTECTED] [207.70.132.66] X-Declude-Spoolname: D046e00e000d0aec7.SMD X-Note: Tests Failed: None These are the ones that your Declude JunkMail added. Since the server that sent you the E-mail (207.70.132.66) is not listed in any spam databases, it didn't fail any tests on your server. This is a problem inherent in E-mail forwarded from one server to another. One option in this case would be to add a line IPBYPASS 207.70.132.66 to your \IMail\Declude\global.cfg file, which will let Declude JunkMail see the IP address that actually sent the E-mail (so it will fail the SPAMCOP and DSBL tests on your server). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist
I want to whitelist from a file in both the config.cfg and $default$.junkmail I know this is the command for $default$.junkmail WHITELISTFILE C:\IMail\Declude\WhiteList.txt What is the command for the config.cfg. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] headers indicate both failed and not failed????
That makes sense thanks Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W. Kitchener, ON N2M 1L2 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, May 30, 2003 9:10 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] headers indicate both failed and not failed Can anyone tell me what is happening with the following headers? It indicates that tests failed yet at the end it says that test failed is NOINE Received: from mail.escapees.com [207.70.132.66] by intown.net with ESMTP (SMTPD32-8.00) id A46EE000D0; Fri, 30 May 2003 03:12:46 -0400 Received: from compuserve.com [68.58.200.135] by mail.escapees.com (SMTPD32-8.00) id A2DF4E30272; Fri, 30 May 2003 02:06:07 -0500 It looks like the E-mail passed through 2 IMail servers, yours and mail.escapees.com. X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?68.58.200.135 X-RBL-Warning: WEIGHT10: Weight of 13 reaches or exceeds the limit of 10. X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.58.200.135 X-Declude-Sender: [EMAIL PROTECTED] [68.58.200.135] X-Note: This E-mail was scanned by Declude. X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, WEIGHTWARN, DSBL These are the headers that their Declude JunkMail added, and: X-Note: This E-mail was sent from pcp02799235pcs.goosck01.sc.comcast.net ([68.58.200.135]). X-Declude-Sender: [EMAIL PROTECTED] [207.70.132.66] X-Declude-Spoolname: D046e00e000d0aec7.SMD X-Note: Tests Failed: None These are the ones that your Declude JunkMail added. Since the server that sent you the E-mail (207.70.132.66) is not listed in any spam databases, it didn't fail any tests on your server. This is a problem inherent in E-mail forwarded from one server to another. One option in this case would be to add a line IPBYPASS 207.70.132.66 to your \IMail\Declude\global.cfg file, which will let Declude JunkMail see the IP address that actually sent the E-mail (so it will fail the SPAMCOP and DSBL tests on your server). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: imail (NOT) spam....
This is waht Spamcop have to say about how their system works: http://mailsc.spamcop.net/fom-serve/cache/297.html look at number 7 especially: 7. If a host has only 1 SUBE report against it, it will not be listed. (SUBE is Supposed Unsolicited Bulk Mail) We are quite aggressive in blocking spam and use ROUTETO a specific account for Spamcop blocked email, I find that 99% of the time it is accurate with very few false positives. Jools On Fri, 30 May 2003 05:53:10 -0500, you wrote: Jools, Friday, May 30, 2003 you wrote: JC But, to block a server at Spamcop it must be reported several times, JC this is obviously to stop people from being nasty and getting servers JC blocked that they don't like. That's not true. Spamcop blocks on ONE incident. Sometimes it is only for an hour or two but it is very disruptive. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] base64 false-positive
Scott, Emails with a message body that just contains blank lines and that contains an attachment, are still failing the BASE64 test. Attached is a sample. Bill base64fail.zip Description: Zip archive
Re: [Declude.JunkMail] Whitelist
I want to whitelist from a file in both the config.cfg and $default$.junkmail I know this is the command for $default$.junkmail WHITELISTFILE C:\IMail\Declude\WhiteList.txt What is the command for the config.cfg. The WHITELISTFILE command does not work in the global.cfg file. It only applies to incoming E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: imail (NOT) spam....
Jools, Friday, May 30, 2003 you wrote: JC This is waht Spamcop have to say about how their system works: JC http://mailsc.spamcop.net/fom-serve/cache/297.html JC look at number 7 especially: JC 7. If a host has only 1 SUBE report against it, it will not be listed. JC (SUBE is Supposed Unsolicited Bulk Mail) JC We are quite aggressive in blocking spam and use ROUTETO a specific JC account for Spamcop blocked email, I find that 99% of the time it is JC accurate with very few false positives. What they say and what they do are two different things. We have been listed only once by SpamCop but have had to investigate numerous SpamCop incidents. In these incidents there has never been more than one report - always one single message filed by a complaining recipient. In none of these cases was the message sent from our server but the message contained a URL pointing to a web site on our servers. At least in one case I am pretty certain the complaint was filed as a harassment technique. The one time we were listed resulted from a single incident also. It was the result of a complaint filed by one of our own clients who submitted one of HIS OWN messages to SpamCop. It was a mistake on his part obviously but we were listed for about 2 or 3 hours and mail was disrupted during that time. Obviously you can do what you want regarding SapmCop but I and many others can attest that they do make mistakes and they do list innocent bystanders. Now in their defense I will say they are pretty good about responding to my messages and they have always done the right thing. But it is still time consuming and disruptive to have to investigate each incident. Their system is much too easily used for malicious purposes. Terry Fritts --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: imail (NOT) spam....
Now in their defense I will say they are pretty good about responding to my messages and they have always done the right thing. But it is still time consuming and disruptive to have to investigate each incident. Their system is much too easily used for malicious purposes. What Spamcop really needs to do is have the TXT record include the % of spam-to-legit E-mail, and their modified % (based on how recent the spam was, etc.). From that, programs like Declude JunkMail could let you choose exactly when to block the E-mail. I'm guessing that with better settings, you might reduce the amount of spam that is caught by a couple percent, but would virtually eliminate the false positives. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] base64 false-positive
Emails with a message body that just contains blank lines and that contains an attachment, are still failing the BASE64 test. This is something that we are working on. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelist
What command can I use to White list from a file in the config.cfg Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 30, 2003 10:18 AM Subject: Re: [Declude.JunkMail] Whitelist I want to whitelist from a file in both the config.cfg and $default$.junkmail I know this is the command for $default$.junkmail WHITELISTFILE C:\IMail\Declude\WhiteList.txt What is the command for the config.cfg. The WHITELISTFILE command does not work in the global.cfg file. It only applies to incoming E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] iMail 8.0
Are there any issues with Junkmail/Virus and iMail version 8.0? We're planning on the upgrade next week and didn't want to break anything. :) Thanks! --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Reply to: Bill B. Re: [Declude.JunkMail] spamdomains list on Friday 9:20:04 AM Wait a second? When I requested this, was this format put in Declude? earthlink.com earthlink.net earthlink.net earthlink.com email.itwebmessenger.it excite.com excitenetwork.com If so, I did not see this indicated in any messages I have read. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - B Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? B Bill -- ActivatorMail(tm) ver.0518031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Enhancement Request: XUNIQUEINHEADER
Hi, Would be nice if Declude could be told not insert a header if one already exists, e.g.: XUNIQUEINHEADER Return-Path: %MAILFROM% Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: imail (NOT) spam....
It's a wonder that more people don't submit mail maliciously if the system works as it appears. Some do. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
email provided by netscape.net is at least partly based from AOL instant messenger accounts, which partly correspond to some peoples' real aol.com email addresses. when you do a full install of Netscape 6 and above, it links w/ your AIM account for messaging, and provides you a *free*, spammed, email account in the netscape.net domain, under your username as defined in AIM. That may be the connection. At 08:02 05.30.2003, you wrote: Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? Please forgive my ignorance here, I have nearly every message from this list for the past 6 months on my machine, so I have looked, but missed it I guess. Anyway, what's the deal with this in the spamdomains list?? earthlink.com earthlink.net earthlink.net earthlink.com Does this mean if the address comes in as [EMAIL PROTECTED] - it's rev DNS can be either earthlink.net or earthlink.com ??? and the other way around if it's [EMAIL PROTECTED] - ? What confuses me are these: aol.com netscape.net netscape.net aol.com My feeling here is why would a netscape user be sending with an AOL address and vice-versa. So am I off here? Thanks for any help Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Joseph C. Acac CNPRC University of California at Davis [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Wait a second? When I requested this, was this format put in Declude? earthlink.com earthlink.net earthlink.net earthlink.com email.itwebmessenger.it excite.com excitenetwork.com If so, I did not see this indicated in any messages I have read. This was added to v1.70 -- you can either have one entry on a line (where the reverse DNS must contain that entry, if the return address contains it), or you can have two (in which case the reverse DNS entry must contain *either* of the two entries, if the *first* entry appears in the return address). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
One comment. Instead of having: yahoo.com yahoo.ca yahoo.com yahoo.de yahoo.com yahoo.dk yahoo.com yahoo.es yahoo.com yahoo.fr yahoo.com yahoo.it yahoo.com yahoo.no yahoo.com yahoo.se yahoo.com yahoo.co.jp yahoo.com yahoo.co.uk yahoo.com yahoo.com.ar yahoo.com yahoo.com.au yahoo.com yahoo.com.br yahoo.com yahoo.com.cn yahoo.com yahoo.com.hk yahoo.com yahoo.co.kr yahoo.com yahoo.com.mx yahoo.com yahoo.com.tw yahoo.com Why not just consolidate this down to: yahoo.yahoo.com Bill - Original Message - From: Bill B. [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 30, 2003 7:20 AM Subject: [Declude.JunkMail] spamdomains list Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] New Variable Question ?
Scott, Would it be possible to have a variable like the %weight% variable say %weight*% that would convert the weight into a series of stars based on a set division number with the division number possibly held in the global.cfg file. This way only one x-header can be used rather than a series of x-headers showing up if with different x-headers for each weight level. Using the weight alone is difficult because of all the combinations that can develop (3 30 33) all look the same it trying to filter on x-header contains xx 3. Using a division number of say 5 this could be represented as xxand xx ** or xx *** (depending on rounding factor) and be represented with 1 x-header instead of several depending on the weight levels defined. Stu - CSOnline Technical Support Normal hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Summer hours - Monday thru Saturday 8am - 12pm (June - July - August) CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Cochranton 814-425-1696 Parker724-399-1158 GremLan 814-337-7060 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com http://www.gremlan.org - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: imail (NOT) spam....
The difference with us is that we are mainly handling our own companys mail with a few small clients, our traffic is quite low so we can afford to look at our routeto mailbox fairly often. False positives (if there are any) are forwarded to the original recipient, otherwise they are binned. We also routeto anything between 15-30 weights and bounce anything over 30. It works for us. At some point I intend to write a pop mailbox viewer that I can press a button to forward to original recipient (with addition of a whitelisted header), reply, delete, bounce or report to spamcop. Jools On Fri, 30 May 2003 08:16:22 -0700, you wrote: We are quite aggressive in blocking spam and use ROUTETO a specific account for SpamCop blocked email, I find that 99% of the time it is accurate with very few false positives. If you would kindly search the archives (when they are back up) you will find past discussions that have proven differently at times. Like Terry said, others have already been down that road. Try looking up Dunn Bradstreet. Last year, they were listed about 8 times. One of those was for only 20 minutes. Yes, 20 minutes. Just because some Yo Yo did not like receiving the notices that they sent to him, (as in collection notices,) he reported them. SpamCop seems to go in cycles. They will be great for a while then all of a sudden start listing anything with one report. So, the next time SpamCop lists Dunn Bradstreet and you Route the bosses latest Credit report on the companies new big client, and the boss doesn't get it, how are you going to explain that to him? (I speak from experience here, when a client of mine called and said he was not getting his reports.) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
Darrell / Scott: We do not whitelist the postmaster account, instead you setup a filter test that contains an allrecips for the postmasters email address and assign this test a really high negative value to prevent the message from being bounced. Then you set the action up for the test as a routeto back to the postmasters account. Hm - I assume your method only works, if I don't use a DELETE and/or BOUNCE action directly on individual tests - or will routeto supercede delete and/or bounce? Let's assume... Bounce on: Any OSDUL/OSSOFT Weight = 10 Hold on: Any MailFrom/Percent I delete on: Weight = 20 If someone needs assistance who gets caught by the MailFrom/Percent or OSDUL/OSSOFT and all your test does is reduce weights - I assume the people's emails would still not get through? So I do need to whitelist the PostMaster? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist and mult rcpt
We do not whitelist the postmaster account, instead you setup a filter test that contains an allrecips for the postmasters email address and assign this test a really high negative value to prevent the message from being bounced. Then you set the action up for the test as a routeto back to the postmasters account. Hm - I assume your method only works, if I don't use a DELETE and/or BOUNCE action directly on individual tests - or will routeto supercede delete and/or bounce? DELETE takes priority over all other actions. So if you have SPAMCOP DELETE, any E-mail failing the SPAMCOP test will be deleted (unless the E-mail is whitelisted). In that case, the weighting system won't help. The idea above assumes that you are using the weighting system exclusively. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Variable Question ?
I use weightrange to define 6 distinct levels of spam (the last one actually is just weight so anything over is caught). Then all I do is add a header X-SPAM-Level: TESTNAME. End result is what you are asking for, just use stars instead of TESTNAME. Global.cfg SPAM-NONE weightrange x x 0 4 SPAM-VLOW weightrange x x 5 9 SPAM-LOWweightrange x x 10 14 SPAM-MIDweightrange x x 15 19 SPAM-HIGH weightrange x x 20 29 SPAM-VHIGH weight x x 30 0 $default$.junkmail SPAM-NONE WARN X-SPAM-Level: %TESTNAME% SPAM-VLOW WARN X-SPAM-Level: %TESTNAME% SPAM-LOWWARN X-SPAM-Level: %TESTNAME% SPAM-MIDWARN X-SPAM-Level: %TESTNAME% SPAM-HIGH WARN X-SPAM-Level: %TESTNAME% SPAM-VHIGH WARN X-SPAM-Level: %TESTNAME% Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, May 30, 2003 11:05 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] New Variable Question ? Scott, Would it be possible to have a variable like the %weight% variable say %weight*% that would convert the weight into a series of stars based on a set division number with the division number possibly held in the global.cfg file. This way only one x-header can be used rather than a series of x-headers showing up if with different x-headers for each weight level. Using the weight alone is difficult because of all the combinations that can develop (3 30 33) all look the same it trying to filter on x-header contains xx 3. Using a division number of say 5 this could be represented as xxand xx ** or xx *** (depending on rounding factor) and be represented with 1 x-header instead of several depending on the weight levels defined. Stu - CSOnline Technical Support Normal hours - Monday thru Saturday 7am - 1am CSOnline Technical Support Summer hours - Monday thru Saturday 8am - 12pm (June - July - August) CSOnline Technical Support Numbers Seneca814-677-2447 Clarion 814-227-3638 Cochranton 814-425-1696 Parker724-399-1158 GremLan 814-337-7060 http://www.csonline.net http://www.cshowcase.com http://www.learncenter.com http://www.gremlan.org - --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
OK I am having trouble with the spam domains test. I just can not get my brain to wrap it. Could someone try to give a concise detailed explanation??? Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill B. Sent: Friday, May 30, 2003 7:20 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] spamdomains list Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
At 01:36 PM 5/30/2003, John Tolmachoff \(Lists\) wrote: If someone has a comprehensive spamdomains listing they are happy with,could they post it for others to analyze/use? Uh, see the orginal post that started this thread. I would, except the list archives are still down. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
John, In your list you your have: microsoft.com msn.com Urgh, I can't win. It is not my list. Please people, read the entire post. (Yes, I myself am guilty at times, so first admonishment is to me.) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Sorry John. I am questioning the validity of the test more then I am questioning you. Fred - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 30, 2003 4:16 PM Subject: RE: [Declude.JunkMail] spamdomains list John, In your list you your have: microsoft.com msn.com Urgh, I can't win. It is not my list. Please people, read the entire post. (Yes, I myself am guilty at times, so first admonishment is to me.) John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] spamdomains list
Bill, MX records only tell you where email is SENT to. It doesn't tell you anything about OUTBOUND mail. I have in fact received emails where signed @excite.com but where sent through the excitenetwork's server. The only way how you can determine, which other RDNS are used, is by checking your Declude log files, use FILESTR to find the SPAMDOMAINS failures and then filter for excite... Best Regards Andy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Friday, May 30, 2003 03:04 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] spamdomains list From what I see, they look to be mutually exclusive: == dig mx excite.com ; DiG 9.2.1 mx excite.com ;; global options: printcmd ;; Got answer: ;; -HEADER- opcode: QUERY, status: NOERROR, id: 15919 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 ;; QUESTION SECTION: ;excite.com.IN MX ;; ANSWER SECTION: excite.com. 900 IN MX 10 xmxpita.excite.com. ;; AUTHORITY SECTION: excite.com. 900 IN NS dns5.imgfarm.com. excite.com. 900 IN NS dns4.imgfarm.com. ;; ADDITIONAL SECTION: xmxpita.excite.com. 900 IN A 208.45.133.107 ;; Query time: 81 msec ;; SERVER: 204.189.38.2#53(204.189.38.2) ;; WHEN: Fri May 30 11:50:28 2003 ;; MSG SIZE rcvd: 114 == dig mx excitenetwork.com ; DiG 9.2.1 mx excitenetwork.com ;; global options: printcmd ;; Got answer: ;; -HEADER- opcode: QUERY, status: NOERROR, id: 2577 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 ;; QUESTION SECTION: ;excitenetwork.com. IN MX ;; ANSWER SECTION: excitenetwork.com. 300 IN MX 25 mx.excitenetwork.com. ;; AUTHORITY SECTION: excitenetwork.com. 300 IN NS dns5.imgfarm.com. excitenetwork.com. 300 IN NS dns4.imgfarm.com. ;; ADDITIONAL SECTION: mx.excitenetwork.com. 300 IN A 63.108.110.20 ;; Query time: 121 msec ;; SERVER: 204.189.38.2#53(204.189.38.2) ;; WHEN: Fri May 30 11:51:56 2003 ;; MSG SIZE rcvd: 116 == Bill - Original Message - From: Andy Schmidt [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 30, 2003 11:45 AM Subject: RE: [Declude.JunkMail] spamdomains list Bill, You need to update: excite.com excitenetwork.com Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Friday, May 30, 2003 01:16 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] spamdomains list Here is my list thus far: amazon.com aol.com apple.com att. attbi.com bellsouth.net charter.net comcast. compuserve.com cox. earthlink. excite.com gte. hotmail.com juno.com .untd.com lycos.com microsoft.com mindspring. msn.com .hotmail.com netscape. psi. qwest. .rr.com verio. verizon. .bellatlantic. yahoo.com Bill - Original Message - From: Scott MacLean [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 30, 2003 9:49 AM Subject: Re: [Declude.JunkMail] spamdomains list If someone has a comprehensive spamdomains listing they are happy with,could they post it for others to analyze/use? At 10:36 AM 5/30/2003, Bill Landry wrote: One comment. Instead of having: yahoo.com yahoo.ca yahoo.com yahoo.de yahoo.com yahoo.dk yahoo.com yahoo.es yahoo.com yahoo.fr yahoo.com yahoo.it yahoo.com yahoo.no yahoo.com yahoo.se yahoo.com yahoo.co.jp yahoo.com yahoo.co.uk yahoo.com yahoo.com.ar yahoo.com yahoo.com.au yahoo.com yahoo.com.br yahoo.com yahoo.com.cn yahoo.com yahoo.com.hk yahoo.com yahoo.co.kr yahoo.com yahoo.com.mx yahoo.com yahoo.com.tw yahoo.com Why not just consolidate this down to: yahoo.yahoo.com Bill - Original Message - From: Bill B. [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, May 30, 2003 7:20 AM Subject: [Declude.JunkMail] spamdomains list Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com --- [This E-mail was scanned for viruses by Declude Virus
Re[2]: [Declude.JunkMail] New Variable Question ?
This works and we have set this up now however, this setup adds a number of extra x-headers... Further to Chuck's comment on this, can you post the WEIGHTRANGE lines from your .CFG? By definition, you can't fail mutually exclusive WEIGHTRANGE tests. -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] updated spamdomains list
Here is my updated list that we're using based on todays's discussions and further review of our log data. Let me know if anybody sees any errors or omissions. Would anybody like to expand on the Lycos domains? I know they offer free email accounts at several of their international domain names, however the RevDNS doesn't always include .lycos. Bill sd.zip Description: Zip archive
RE: [Declude.JunkMail] updated spamdomains list
Hi Bill, I think for GMX-mails (german freemailer) we can use the same solution as you have proposed for yahoo @gmx. .gmx. I've seen that there are a lot of country specific domains (gmx.it, .at, .de ...) resolving to the PTR-Records: 213.165.64.100 PTR record: mx0.gmx.net. [TTL 50222s] [A=213.165.64.100] 213.165.64.100 PTR record: mx0.gmx.de. [TTL 50222s] [A=213.165.64.100] Other gmx-domains (gmx.net, ...) have the PTR records: 213.165.64.20 PTR record: mail.gmx.net. [TTL 86400s] [A=213.165.64.20] 213.165.64.20 PTR record: mail.gmx.de. [TTL 86400s] [A=213.165.64.20] 213.165.64.20 PTR record: pop.gmx.net. [TTL 86400s] [A=213.165.64.20] 213.165.64.20 PTR record: pop.gmx.de. [TTL 86400s] [A=213.165.64.20] 213.165.64.20 PTR record: imap.gmx.net. [TTL 86400s] [A=213.165.64.20] Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill B. Sent: Saturday, May 31, 2003 12:16 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] updated spamdomains list Here is my updated list that we're using based on todays's discussions and further review of our log data. Let me know if anybody sees any errors or omissions. Would anybody like to expand on the Lycos domains? I know they offer free email accounts at several of their international domain names, however the RevDNS doesn't always include .lycos. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
What if you had two lines: msn.com hotmail.com msn.com microsoft.com It would NOT fail if it reversed to either hotmail or ms, correct? Actually, it would fail in this case, since each line is processed separately from the rest. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] updated spamdomains list
What about the following? Bigfoot.com Geocities.com Rocketmail.com Wanadoo.fr Another question: Normaly if one of our new customers has a old ISP-specific email-Adress (for example [EMAIL PROTECTED]) we try to let configure an email-forwarding to the clients mailbox on our server. For this messages it's already difficult to make DNS-based tests, specialy if the old ISP forwards the message over 3-4 hops. (Require declude's hophigh set to 4-5) But if I understand right all this forwarded messages will fail also the SPAMDOMAINS test because the sending ISP usually hasn't the allowed string in his PTR record. Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill B. Sent: Saturday, May 31, 2003 12:16 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] updated spamdomains list Here is my updated list that we're using based on todays's discussions and further review of our log data. Let me know if anybody sees any errors or omissions. Would anybody like to expand on the Lycos domains? I know they offer free email accounts at several of their international domain names, however the RevDNS doesn't always include .lycos. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] updated spamdomains list
Rocketmail.com resolves to yahoo.com So: Rocketmail.com yahoo.com Would be a valid entry What about the following? Bigfoot.com Geocities.com Rocketmail.com Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] MAILFROM - correct?
Hi Scott: Granted, based on http://www.dnsreport.com/tools/dnsreport.ch?domain=skanskausa.com this domain is a mess - but, it DOES have a MX record and the lowest priority MX record (5) has an A record and IS even answered. Most of the cc:'s in this email when to @skanskausa.com and WERE indeed delivered - proving that MAILFROM is valid. So, why did this fail MAILFROM: Received: from mlx-sku-par-1.skubi.com [12.3.242.12] by mail.webhost.hm-software.com with ESMTP (SMTPD32-7.07) id AC05147F0162; Fri, 30 May 2003 11:43:01 -0400 Received: from mlx-sku-par-1.skubi.com ([127.0.0.1]) by mlx-sku-par-1.skubi.com with Microsoft SMTPSVC(5.0.2195.5329); Fri, 30 May 2003 11:38:19 -0400 Received: by mlb-sku-par-1.skanskausa.com with Internet Mail Service (5.5.2653.19) id L9132BXP; Fri, 30 May 2003 11:41:00 -0400 Message-ID: [EMAIL PROTECTED] From: ...removed... To: ...removed... Cc: ...removed..., ...removed... ...removed..., ...removed... ...removed..., ...removed... ...removed... Subject: MDY Date: Fri, 30 May 2003 11:42:01 -0400 Importance: high X-Priority: 1 Return-Receipt-To: [EMAIL PROTECTED] MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/html; charset=iso-8859-1 Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 30 May 2003 15:38:19.0640 (UTC) FILETIME=[7EEB4F80:01C326C1] X-Declude-Note: Domain mlx-sku-par-1.skubi.com has no MX or A records. X-Declude: Version 1.70i1; D7c05147f0162cb7b.SMD from gateway1.skubi.com [12.3.242.12] X-Declude: Triggered MAILFROM, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT [3] X-Countries: UNITED STATES-destination Return-Path: [EMAIL PROTECTED] X-Spam-Prob: 0.768622 Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] PREWHITELIST Question
Scott, I have PREWHITELIST ON and WHITELIST IP 10.0.0.0/8 in my Global.cfg, but I am still seeing: == 05/30/2003 21:27:10 Q2f1b167300aa673e nNOLEGITCONTENT:-5 BODY-FILTER:20 SPAMCHECK:2 . Total weight = 17 05/30/2003 21:27:10 Q2f1b167300aa673e E-mail whitelisted - automatically passing all spam tests [10.0.0.0/8] 05/30/2003 21:27:10 Q2f1b167300aa673e R1 Message OK 05/30/2003 21:27:10 Q2f1b167300aa673e Subject: Re: Friday 05/30/2003 21:27:10 Q2f1b167300aa673e From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 10.2.68.1 ID: == I thought that whitelisted IP addresses would not be scanned with PREWHITELIST ON. I am currently running: Diagnostics ON (Declude v1.70i1). Declude JunkMail Status: PRO version registered. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
