we just use
subject [W10]
subject [W20]
and let endusers set their own filters/rules in imail web messaging
- Original Message -
From: Erik Hjelholt [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, June 17, 2003 4:09 AM
Subject: [Declude.JunkMail] JunkMail configurable front
John,
Thanks so much for the information. Very helpful stuff!
Dan
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, June 17, 2003 9:35 PM
Subject: RE: [Declude.JunkMail] SPAMCOP:OT: Can't Get To SpamCop's Web Site
Your listed on
Hello, All,
We are using Declude JunkMail Pro. For the time being I am using per
domain filtering. A piece of e-mail was blocked by DJM that isn't set up
for per domain filtering and I don't understand why. Here are the
headers...
-
Received: from michael [68.75.18.161] by wings-women.com
We are using Declude JunkMail Pro. For the time being I am using per
domain filtering. A piece of e-mail was blocked by DJM that isn't set up
for per domain filtering and I don't understand why. Here are the
headers...
What makes this tricky is that the headers do not include the list of
Today as I was going through the spam on hold after making some changes in
Declude's spam configuration yesterday I noticed a new X header in several
of the messages as follows:
X-Spam-Prob: 0.29
Has anyone seen this? Is it a new Declude header (I had also updated to the
current beta
This is an experimental header added by Declude JunkMail that will hopefully
be added soon as a new spam catching feature.
Bill
- Original Message -
From: Richard Edge [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, June 18, 2003 9:52 AM
Subject: [Declude.JunkMail] X-Spam-Prob:
I'm intrigued by this idea. During a given minute of time I may get 1000 messages.
1/4 of them are slown down (occupying more SMTP/Declude sessions), but the burdon is
spread out.
Can this be applied to increase server capacity? If I throttle, at the firewall, the
IPs of spammers, will the
I'm intrigued by this idea. During a given minute of time I may get 1000
messages. 1/4 of them are slown down (occupying more SMTP/Declude
sessions), but the burdon is spread out.
Actually, with true tarpitting, there would be slightly fewer SMTP32.exe
and Declude.exe processes (they would
Alligate does it :) (The gateway version anyway)
On 06/18/03 3:25pm you wrote...
It would be less, assuming that IMail can handle it (and that your firewall
can do the tarpitting). I'm not aware of any firewalls that can do true
SMTP tarpitting (which requires sending short bits of data
I find the idea intriguing as well but if you start to slow down connections
wouldnt that just hold TCP connections open longer possibly making fewer
connections available on the server?
One of the methods of thwarting file sharing sites is to trickle download
many files so that others cannot
Interesting Scott,
I'm not sure I want to do true tarpitting, I want the spam to get through eventually
(just in case its not), just way after the legitimate stuff. I use Netscreen
firewalls and their technical info says throttling to less than 10kbps risks dropping
the connection. The idea
I had one customer that told me that he had over 5000 simultaneous open
connections with no problems and a large number of these were being tarpitted.
I have seen postings in newsgroups that claim to have had 7000 open
connections on Win2k Pro. I have not yet been able to determine a hard number
Rick,
Makes me wonder if spammers cause traffic surges/spikes that slow our servers down and
if this would also smooth those spikes down. Suppose a given sending server had 100
copies of a particular message, running only 5 sessions (speculation) at a time, could
the sessions be dragged into
I'm not sure I want to do true tarpitting, I want the spam to get
through eventually (just in case its not), just way after the legitimate stuff.
True tarpitting will allow the E-mail through. The idea is that it will
have to wait a long, long time -- something that a legitimate mailserver
Hi, Scott,
I apologize in advance if the questions I'm about to pose to your are
simple.
We are using Declude JunkMail Pro. For the time being I am using per
domain filtering. A piece of e-mail was blocked by DJM that isn't set
up
for per domain filtering and I don't understand why. Here
and send mail only at the speed that IMail can handle
I'm curious, what rate did you find Imail capable of handling before it stopped
responding?
Bill
-Original Message-
From: [EMAIL PROTECTED]
Sent: Wed, 18 Jun 2003 13:36:44 -0700
Subject: Re: [Declude.JunkMail] Tar Pitting
I apologize in advance if the questions I'm about to pose to your are
simple.
No need to apologize -- simple questions are easier for me to answer. :)
What makes this tricky is that the headers do not include the list of
recipients. For that, you would need to check the IMail SMTP log file
Hi Bill,
We were testing Alligate at a sustained rate of 8 message per second, relaying
to 4 servers, all with different email server software. We ran this test for 4
hours. One was running IMail with Declude, SpamManager, and Declude Virus.
Each server was receiving 2 messages per second, or
Hello, All,
I'm curious to know how readers of this list take care of incorporating
changes from the new default GLOBAL.CFG into your existing and typically
personalized in use GLOBAL.CFG. Also, when new default tests are added
into GLOBAL.CFG is there some way for us to be notified that a new
My .biz seach continues (more later), but I'm now interested in subject tests for
words with numbers substituting for letters. A prime example:
ST0P Paying T00 MUCH for 1NSURANCE
Easy to stop, but its silly to make tests for every word in the dictionary. Anyone
have some already assembled?
Hi Dan,
I can confirm this. At the moment we have to follow the discussions on
the JM list to remain up-to-date.
Keep in mind that JM is very very flexible and there are out so much
different configurations that (I think) it's practically not possible to
offer such an auto-update function for
ST0P Paying T00 MUCH for 1NSURANCE
Easy to stop, but its silly to make tests for every word in
the dictionary. Anyone have some already assembled?
Our latest Alpha-Version of SpamChk has a new test called DigitsInWord.
At the moment it's not very reliable because we have to finish the
Has there been any more thought to allow Declude to have an option to either
use more than one DNS server, or have failover support to a secondary DNS
server?
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
---
[This E-mail was scanned for viruses by
Has there been any more thought to allow Declude to have an option to
either
use more than one DNS server, or have failover support to a secondary DNS
server?
It's something that we are considering. The catch, though, is that it
would only really be useful in conjunction with the Declude
We tried some generalized patterns in Message Sniffer at first, but always
found too many false positives in the analysis. Now we just wait for an
instance to come by and it's coded in the next update (usually within a
couple hours). No false positives for these codings so far... but of course
Title: Message
When
using the MAILBOX feature on Declude, will Imail
still
apply rules.ima to that incoming email?
Ex
We
have 2 actions on an email. Add SPAM to the subject line
and
send to SPAM folder. Based on weight we also include
a
"Spam Level" such as:
SPAM-1 or SPAM-2 that gets
Title: Message
I believe rules.ima gets run last.
John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Earl Baumgardner
Sent: Wednesday, June
It has been my experienct that the rules.ima is only effictive on mail
placed into the main folder.
I am 7.15
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Earl Baumgardner
Sent: Wednesday, June 18, 2003 6:13 PM
To: [EMAIL PROTECTED]
Weight20 Subject SPAM-2[%weight%]
#Weight20a MAILBOX SPAM
Weight30 Subject SPAM-3[%weight%]
#Weight30a MAILBOX SPAM
Do not use the mailbox action, rather copy a rules.ima into each users
folder that does not already have one. The contents of the 'default'
rules.ima should be like
S~SPAM:SPAM
Thats basically how we've been doing it. I was just looking for
a 1 step way to setup the user withour having to add the rule to
their folder. Sometimes users tend to play with their rules too
much :-)
I was just verifiying if this was the actual processing order.
thanks
Earl B
--
Watch out for this one, the underlying code looks like:
href=http://www.your-instant-credit-reporter.org/fraud.html;FONT face=Arial
size=2BestBuy.com/fraud_department.html/FONT/A/DIV/BODY/HTML
The subject reads:
BestBuy Order #1095619. Fraud Alert.
The message reads:
Dear customer,
Yep... I got one this PM. What do you think is the best way to block it??
~Joe
- Original Message -
From: Dan Patnode [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, June 18, 2003 11:50 PM
Subject: [Declude.JunkMail] OT: Fraud Alert
Watch out for this one, the underlying code
Hey that one looks familiar.. I got 4 copies of that one today on
different e-mail accounts that I NEVER used (however posted on
webpages). Funny thing is that each and everyone of these are the same
purchased item with same address..
I called BestBuy about it earlier today tried to get them to
33 matches
Mail list logo
