RE: [Declude.JunkMail] Originating IP -I'm confused, please don't flame me...

2003-11-12 Thread Marc Catuogno
I guess I never really looked. I just assumed that when mail came from my server, even if it was to a local user, that it would have the IP of my server as the sending IP, as it would if my server was sending mail to another server. I wonder if I had them authenticate at a different SMTP or did

Re[2]: [Declude.JunkMail] Originating IP -I'm confused, please don't flame me...

2003-11-12 Thread Sanford Whiteman
I just assumed that when mail came from my server... From your server = originating IP is your server's IP. This is not the case when sending from any MUA other than an app running on the server itself! You've def'ly been confused about the connecting IP of mail from your local users,

Re: [Declude.JunkMail] Junkmail Tests and Configs

2003-11-12 Thread Jonathan
I'm sorry, when I said the help files .. I meant the online manual. Those are the files I used as a reference. Jonathan At 08:13 PM 11/11/2003, you wrote: In an effort to clean up our junkmail configs, and only use valid tests, we cleaned out our previous tests (old services that were dead

RE: [Declude.JunkMail] OT: Do you use ColdFusion? - Java?

2003-11-12 Thread Craig Gittens
The neat thing about Posini though is that my delivery load PrePostini was 220,000 emails AFTER Declude sorted. PostPostini it is now 35,000. Postini stops DHA and SPAM DOS as well. They use Postfix. It really is neat and I would prefer if I could have the staff and resources to build a redundant

[Declude.JunkMail] URL Redirectors

2003-11-12 Thread George Kulman
Hi all, I have an IMail client who doesn't have budget funds available for Declude where these are easily filterable. A fair amount of their spam contains a URL redirection such as: http://drs.yahoo.com/effloresce/*http://click.com-click.com.ph/click.php?id= leneyeiID=40gi=hallmark 1. Is

Re: [Declude.JunkMail] Non-English Emails.

2003-11-12 Thread R. Scott Perry
I have attached 2 emails that are not English in the subject line and still did not fail the Non-English test. I am seeing that the subject is encoded in the headers however. Actually: Subject: O?eoa Aiaeeeneee o Ian 995-8241 a Iineaa Subject: AECIAN ­ EO?N II YOOAEOEAIIE ?AAIOA IOENA Those

Re: [Declude.JunkMail] Junkmail Tests and Configs

2003-11-12 Thread Nick Hayer
Jonathan, Here is my setup - hopefully it will help. Anyone feel free to tell me what I have messed up... -Nick #GLOBAL.CFG edited # #SETTINGS CONSOLE ON HOP 0

RE: Re[2]: [Declude.JunkMail] Originating IP -I'm confused, please don't flame me...

2003-11-12 Thread Marc Catuogno
Of course I know that you're right. I will do an express install somewhere, but I doubt I'd be able to simulate the load and the processes. I am backing up my IMAIL reg and all the user mailboxes. Where my mail is hosted I am due for an upgrade of the server, I may install 7.15 on the new

RE: [Declude.JunkMail] Declude Updater

2003-11-12 Thread Burzin Sumariwalla
Hi Markus, Declude.ini reads... [system] url=http://www.declude.com/version.txt imailpath=c:\imail\ [EMAIL PROTECTED] userelease=-1 To test the functionality, I copied an version 165 of declude into the c:\imail directory, and deleted the release/175 folder. I then ran DU manually and received

Re: [Declude.JunkMail] Originating IP -I'm confused, please don't flame me... flame me...

2003-11-12 Thread Matthew Bramble
Marc Catuogno wrote: Please excuse my ignorance again, but since I have updated my Declude to include the EASYNET-DYNA test someone who is sending from an optimum online account is getting caught by this test. Are all of optonline's servers listed by this test? Or is something else going on

Re: [Declude.JunkMail] Junkmail Tests and Configs

2003-11-12 Thread Matthew Bramble
Nick, I noticed that you are using the blackholes and a country filter. FYI, this will be almost all caught by the FOREIGN test so keep in mind that you will be adding even more points by using the three together and that could result in some false positives (i.e. Russian originators will get

Re: [Declude.JunkMail] URL Redirectors

2003-11-12 Thread Matthew Bramble
George, Spammers will use a variety of Yahoo sub-domains, most of which are valid. I'm not familiar with that one in particular, but it might help to search Google for examples of that showing up (that's how I do some of my research).

[Declude.JunkMail] global.cfg outgoing

2003-11-12 Thread Danny Klopfer
How does declude know at what point in the global.cfg is for checking outgoing mail only? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED],

[Declude.JunkMail] Spammer wanting servers?

2003-11-12 Thread Jeff Kratka
I received this over the weekend and thought others may be interested. This guy wants to get servers so he can spam.. Below is the headers and the message. Jeff Kratka * TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417

Re: [Declude.JunkMail] global.cfg outgoing

2003-11-12 Thread R. Scott Perry
How does declude know at what point in the global.cfg is for checking outgoing mail only? When Declude JunkMail goes through the global.cfg file, it first looks for any commands (such as CODE or XINHEADER). If it sees a line that it does not recognize, it assumes that it is a test definition

RE: [Declude.JunkMail] URL Redirectors

2003-11-12 Thread George Kulman
Matt, Thanks for the info. It's still difficult for me to imagine a legitimate user having a redirected web site being pointed to as their web site in an email. More research I guess. George -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of

Re: [Declude.JunkMail] Junkmail Tests and Configs

2003-11-12 Thread Nick Hayer
Matt - Thank you much for your suggestions. I did not realize about the compounded scoring w/the blackholes country test - fixed! I wasn't using the FiveTen tests because I thought I read in this list they were not that reliable - I've added them will monitor. I was using the in.dnsbl.org

RE: [Declude.JunkMail] Spammer wanting servers?

2003-11-12 Thread Danny Klopfer
I received the same exact message too. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeff Kratka Sent: Wednesday, November 12, 2003 12:56 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spammer wanting servers? I received this over the weekend and

[Declude.JunkMail] ldeliver interpretation

2003-11-12 Thread Katie La Salle-Lowery
If, when I run find ldeliver sys.txt /c, I get 20,699 is that the number of messages that Imail is receiving before Declude Junkmail Pro scans our incoming mail or after? Thanks, Katie --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came

Re: [Declude.JunkMail] ldeliver interpretation

2003-11-12 Thread R. Scott Perry
If, when I run find ldeliver sys.txt /c, I get 20,699 is that the number of messages that Imail is receiving before Declude Junkmail Pro scans our incoming mail or after? After. So if Declude JunkMail deletes/quarantines any E-mail, it will not be included in the count.

RE: [Declude.JunkMail] Spammer wanting servers?

2003-11-12 Thread John Tolmachoff \(Lists\)
Number is a Sprint PCS cell phone in Boston. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Jeff Kratka Sent: Wednesday, November 12, 2003 12:56 PM To: [EMAIL PROTECTED]

Re: [Declude.JunkMail] URL Redirectors

2003-11-12 Thread Matthew Bramble
George, I did build a test for this exact thing and shared it on my site (called Y!DIRECTED), but I thought that you might have been more interested in that URL in particular and replied accordingly. My Y!DIRECTED filter will stop most of this stuff and it allows for places like Yahoo and

RE: [Declude.JunkMail] ldeliver interpretation

2003-11-12 Thread Katie La Salle-Lowery
Okay, so is there a way I can get a count before scanning by Declude? I want concrete data to take to a meeting where we will evaluate if a new machine or upgrade is necessary. CPU usage has been very high with smtp and Declude being the biggest users. The machine is 400mhz w/ 384mb ram. CPU

Re: [Declude.JunkMail] dns blacklist

2003-11-12 Thread Nick Hayer
Scott, I have over 5000 ip's that I have blocked with Imails ACL -now over time I am worried that some my need to be removed. Since I cannot think of a way to check them all at once I am considering a filter file with thousands of lines or is a dns blacklist the better choice? Or? Thanks

RE: [Declude.JunkMail] Spammer wanting servers?

2003-11-12 Thread R. Scott Perry
offer me such service please call me at: 1617-901-4129, Leave me a message Number is a Sprint PCS cell phone in Boston. ... or an ATT wireless phone in Boston, per http://www.dnsstuff.com/tools/dophone.ch?name=1617-901-4129 . -Scott ---

[Declude.JunkMail] OT: OE contacts to Outlook

2003-11-12 Thread Todd Holt
Does anyone have a process to move Outlook Express 6.0 contacts and messages to Outlook 2000? Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This

Re: [Declude.JunkMail] Junkmail Tests and Configs

2003-11-12 Thread Matthew Bramble
Resending because I think the first one got munged. Matt Original Message Subject: Re: [Declude.JunkMail] Junkmail Tests and Configs Date: Wed, 12 Nov 2003 17:10:05 -0500 From: Matthew Bramble [EMAIL

RE: [Declude.JunkMail] Spammer wanting servers?

2003-11-12 Thread Mark Brody
Hi Scott- Where on the tools page is this nifty test located? :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, November 12, 2003 2:47 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spammer wanting servers?

Re: [Declude.JunkMail] dns blacklist

2003-11-12 Thread R. Scott Perry
I have over 5000 ip's that I have blocked with Imails ACL -now over time I am worried that some my need to be removed. Since I cannot think of a way to check them all at once I am considering a filter file with thousands of lines or is a dns blacklist the better choice? Or? The IMail Control

RE: [Declude.JunkMail] Spammer wanting servers?

2003-11-12 Thread R. Scott Perry
... or an ATT wireless phone in Boston, per http://www.dnsstuff.com/tools/dophone.ch?name=1617-901-4129 . Where on the tools page is this nifty test located? You can find that one hidden at http://www.declude.com/pages/testbed.htm . :)

RE: [Declude.JunkMail] Spammer wanting servers?

2003-11-12 Thread Jonathan
He wants 2,000 IPs? Sure, no problem .. in fact, I'll give him a whole class B. 10.123.x.x :) Jonathan At 05:22 PM 11/12/2003, you wrote: Hi Scott- Where on the tools page is this nifty test located? :) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of

RE: [Declude.JunkMail] ldeliver interpretation

2003-11-12 Thread R. Scott Perry
Okay, so is there a way I can get a count before scanning by Declude? One option would be to count HELO and EHLO's, such as: find HELO sys.txt /c find EHLO sys.txt /c and add them. The drawback to this is that it will also include non-delivered E-mail (for example,

RE: [Declude.JunkMail] URL Redirectors

2003-11-12 Thread George Kulman
Title: Message Matt, I'm familiar with the Y!DIRECTED and other tests that you've so kindly made available. In this case I'm trying to find a way to identify these and block them with the basic IMail tests. If I can't, then I'll have to route all of their mail through my Declude Pro

RE: [Declude.JunkMail] ldeliver interpretation

2003-11-12 Thread George Kulman
Katie, If you want the fully loaded mail / recipient count on the incomings try find RCPT TO: sys.txt /C /I George -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, November 12, 2003 6:39 PM To:

Re[2]: [Declude.JunkMail] URL Redirectors

2003-11-12 Thread Sanford Whiteman
Not sure why Scott's server hates me :)  Maybe you should try non-HTML. ;) -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED]

Re: [Declude.JunkMail] OT: Processes

2003-11-12 Thread Serge
sandy, john look at the graph below for number of .smd files in spool. notice the difference in pattern between this week and last what should i investigate ? what are the possible causes ? bandwidth saturation ? incoming spam ? outgoing spam ? - Original Message - From: Sanford

RE: [Declude.JunkMail] OT: Processes

2003-11-12 Thread John Tolmachoff \(Lists\)
You would probably need to analyze the logs for those days to see for sure. What are the total number of messages for those days? John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On