Re: [Declude.JunkMail] Bounced mail

2004-01-06 Thread R. Scott Perry
You know what I would like to see is a means of sending back a message on confirmed Spam that carries the "550 User Unknown" designation and a "from" address appearing to be [EMAIL PROTECTED] (whatever it was) to make it appear believable. I realize that a goodly number of these would bounce b

[Declude.JunkMail] Bounced mail

2004-01-06 Thread Orin Wells
Scott, You know what I would like to see is a means of sending back a message on confirmed Spam that carries the "550 User Unknown" designation and a "from" address appearing to be [EMAIL PROTECTED] (whatever it was) to make it appear believable. I realize that a goodly number of these would b

Re: [Declude.JunkMail] New CMDSPACE test in latest interim release

2004-01-06 Thread R. Scott Perry
Also, remember if you are using the "bounce" action for anything it has been renamed to "bounceifyoumust". This is probably a good time to let people know that on several occasions the bounce messages that our customers have sent out have been reported as spam (with the assumption that they wer

Re: [Declude.JunkMail] New CMDSPACE test in latest interim release

2004-01-06 Thread DLAnalyzer Support
Also, remember if you are using the "bounce" action for anything it has been renamed to "bounceifyoumust". Darrell Jonathan writes: Can't imagine why you'd need to restart .. it hooks the EXE each time it spawns an smtp thread, so the next message after the EXE is in place, should use the

Re: [Declude.JunkMail] New CMDSPACE test in latest interim release

2004-01-06 Thread Jonathan
Can't imagine why you'd need to restart .. it hooks the EXE each time it spawns an smtp thread, so the next message after the EXE is in place, should use the new exe. Jonathan At 07:20 PM 1/6/2004, you wrote: It has been a while since I upgrade my versionare there any special step to upgra

Re: [Declude.JunkMail] New CMDSPACE test in latest interim release

2004-01-06 Thread Glenn Brooks
It has been a while since I upgrade my versionare there any special step to upgrading or can I simply replace the .exe file and restart Imail SMTP and POP services? thanks in advance gb At 07:42 PM 1/6/2004 -0500, you wrote: Woops on the Delude thing Sorry, it should be: http://www.d

Re: [Declude.JunkMail] New CMDSPACE test in latest interim release

2004-01-06 Thread R. Scott Perry
Woops on the Delude thing Sorry, it should be: http://www.declude.com/interim -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnera

Re: [Declude.JunkMail] New CMDSPACE test in latest interim release

2004-01-06 Thread Frederick Samarelli
Woops on the Delude thing - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, January 06, 2004 6:53 PM Subject: [Declude.JunkMail] New CMDSPACE test in latest interim release > We've just added a new test to the latest interim releas

[Declude.JunkMail] New CMDSPACE test in latest interim release

2004-01-06 Thread R. Scott Perry
We've just added a new test to the latest interim release, called CMDSPACE. This one looks for spaces in SMTP commands where there shouldn't be any. It is catching about 75% of the spam to the spamtraps here, and since we started using it, only 1 of the approximately 500 legitimate E-mails tha

Re[2]: [Declude.JunkMail] Any thoughts on blocking bounce messages from spam? spam?

2004-01-06 Thread Sanford Whiteman
> Maybe a problem can occur if a customer sends out a large number of > e-mails and there are several bounces. But if this happens I assume > that the addresses was not aquired "regulary" ;-) I wouldn't say that's an accurate assumption; site-specific factors will dictate what % of bounce tr

[Declude.JunkMail] Something for Exchange mailbox servers behind IMail/Declude

2004-01-06 Thread Sanford Whiteman
All, I came across a pre-built filter for Exchange that seems useful for submailbox redirection (akin to Declude's MAILBOX action) when forwarding mail to an Exchange back end. As far as I'm aware, Exchange does not have built-in - type addressing, and if it does, it's likely nothing l

Re: [Declude.JunkMail] Two small bugs

2004-01-06 Thread Matthew Bramble
Thanks Scott, the fix appears to be working. Regarding that cookie "bug," I understood that Declude tagged the file appropriately based on the COM extension, but Outlook Express screwed up attaching it in the way that it did. This was actually a gif used for tracking, and it named the file acc

Re: [Declude.JunkMail] Two small bugs

2004-01-06 Thread R. Scott Perry
Virus Bug == The first bug is more straightforward, however it is related to Declude Virus, so please forgive me for not joining that group. In an E-mail that was forwarded from monstor.com, it tripped on a banned extension of .com because a cookie reference was attached by Out

[Declude.JunkMail] Two small bugs

2004-01-06 Thread Matthew Bramble
Scott, Virus Bug == The first bug is more straightforward, however it is related to Declude Virus, so please forgive me for not joining that group. In an E-mail that was forwarded from monstor.com, it tripped on a banned extension of .com because a cookie reference was attached

RE: [Declude.JunkMail] Checking blacklists entire CIDR blocks

2004-01-06 Thread Charles Frolick
SenderBase is cool, just wish it had more RBL's, or if Scott had CIDR lookup in DNSStuff. The trick is it is a /20 block, way too many to check one by one in DNSStuff. Thanks, Chuck Frolick ArgoLink.net -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan

Re: [Declude.JunkMail] Checking blacklists entire CIDR blocks

2004-01-06 Thread Dan Geiser
Chuck, I would use the Spam Database Lookup here, http://www.dnsstuff.com/, and SenderBase, http://www.senderbase.org/. Dan [EMAIL PROTECTED] - Original Message - From: "Charles Frolick" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, January 06, 2004 12:26 PM Subject: [Declud

[Declude.JunkMail] Do legitimate mailers use iso 8859 character sets?

2004-01-06 Thread Chuck Schick
I have been blocking email that is using the iso-8859 character sets and it has been effective in reducing Spam. Today I came across MSNBC sending out a notification using iso-8859. Is anyone aware of others doing this? Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com --- [This E-mail was s

[Declude.JunkMail] Checking blacklists entire CIDR blocks

2004-01-06 Thread Charles Frolick
Does anyone know of an easy way to check an entire netblock for listings? We are suppsed to be getting some additional IP's but I want to make sure they are clean first. Thanks, Chuck Frolick ArgoLink.net --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- Th

Re: [Declude.JunkMail] Atriks - Pt.2

2004-01-06 Thread Matthew Bramble
SPEWS and SBL are two opposite extremes. The only time that SBL will false positive is when they list a hosting company that primarily engages in providing facilities to spammers. For the most part, these hosting companies are only fronts that they use to avoid being fully listed. SBL doesn'

RE: [Declude.JunkMail] Atriks - Pt.2

2004-01-06 Thread Darrell LaRock
How aggressive is SBL compared to SPEWS? I know with SPEWS they list a lot of adjacent net blocks of the spammers... Does SBL employ the same tactics? Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Tuesday, January 06, 200

[Declude.JunkMail] OBFUSCATION v2.0.1 for JunkMail Pro v1.77i7+

2004-01-06 Thread Matthew Bramble
I found that the OBFUSCATION filter can FP on UNICODE attachments (which are uncommon). The new version of this filter fixes this problem. Note that I'm only updating the version that uses functionality introduced and fully supported in JunkMail Pro v1.77i7 or higher. For users of the older v

Re: [Declude.JunkMail] IP4 Tests

2004-01-06 Thread Matthew Bramble
Just a quick follow up to this message. Today I removed DSBLMULTI after two days of testing. Seemingly they consider lots of ISP mail servers to be spam relays for inclusion in this list. I think I made the mistake in adding them before... DSBL is on the other hand very reliable IMO. Matt

Re: [Declude.JunkMail] Atriks - Pt.2

2004-01-06 Thread Matthew Bramble
Forgive me for repeating myself on this one, but I'm a proponent of blocking outright on SBL. There's a good reason for spammers to be in their list, and it's not some community project where anyone and everyone makes nominations, so it's practically flawless. Another trick for Green Horse is