Title: AW: [Declude.JunkMail] Updates to the confic file
hi,
i just (13:00 CET) get me the global.cfg and found:
MONKEYFORMMAIL ip4r formmail.relays.monkeys.com * 7 0
MONKEYPROXIES ip4r proxies.relays.monkeys.com * 7 0
in it.
are they back? i thought they went down 8 months ago?
i just (13:00 CET) get me the global.cfg and found:
MONKEYFORMMAIL ip4rformmail.relays.monkeys.com * 7
0
MONKEYPROXIES ip4rproxies.relays.monkeys.com * 7
0
in it.
are they back? i thought they went down 8 months ago?
They are
I've seen some spam with forged Mailfrom addresses NOT comming from icq.com.
So maybe it'S agood idea to add this single domain to the spamdomains file.
Markus
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
DOH! That's what I get for hurrying to get something out before quitting
time.
Dan Horne, CCNA
Web Services Administrator
TAIS Web
Wilcox World Travel Tours
[EMAIL PROTECTED]
CONFIDENTIALITY NOTICE:
This email message, including any
I am testing a small external test program. A message fails the test
if there is an discernable IP address in the HELO entry of the
message. These fail the test:
Received: from host-68-212-107-146.msy.bellsouth.net
[68.212.107.146] by mrpcap.com
Received: from ip-62-129-160-91.evhr.net
interested
thanks, andy
- Original Message -
From:
Bud
Durland
To: Declude List
Sent: Wednesday, April 14, 2004 8:58
AM
Subject: [Declude.JunkMail] New
test
I am testing a small external test program. A message
fails the test if there is an discernable IP
interested
At 09:17 AM 4/14/2004 -0400, you wrote:
interested
thanks, andy
- Original Message -
From: Bud Durland
To: Declude List
Sent: Wednesday, April 14, 2004 8:58 AM
Subject: [Declude.JunkMail] New test
I am testing a small external test program. A message fails the test
I have been using the SPAM filters from MailPure and I have notices that
the Anti-Gibberish Test has been triggered a lot more than the Gibberish
test (5:1 ratio) The Anti-Gibberish Test has been causing a lot of SPAM
to go through by applying negative weight to the message. I was
wondering if
Hello, All,
The Declude JunkMail Manual, http://www.declude.com/Articles.asp?ID=116,
appears to be ponting to an old version of GLOBAL.CFG, http://www.declude.com/version/release/GLOBAL.CFG.
I haven't looked very deep but the thing that immediately jumped out was that
the MONKEYS.COM and
The Declude JunkMail Manual,
http://www.declude.com/Articles.asp?ID=116http://www.declude.com/Articles.asp?ID=116,
appears to be ponting to an old version of GLOBAL.CFG,
http://www.declude.com/version/release/GLOBAL.CFGhttp://www.declude.com/version/release/GLOBAL.CFG.
I haven't looked very
Hello, All,
Occasionally I'll see a line like this in the
headers of some e-mail...
X-Country-Chain: 'EU' [corrupt RIPE
data]-UNITED STATES-destination
I realize that EU is not a valid country code
according to this page, http://www.iana.org/cctld/cctld-whois.htm,
but if I add a line to
on 4/14/04 10:57 AM, TC Online Support wrote:
I was
wondering if there was a way to skip the Anti-Gibberish Test if the
Gibberish is not triggered. (This goes to all the test that contain an
Anti- test)
If/when we get a NOTCONTAINS filter command a lot of things like this could
be done very
I just received this this from a mail admin of another ISP, Anyone care to
comment...
Your outgoing mail server adds the header:
X-RBL-Warning: SPAM-NONE: Total weight between 0 and 4.
Our filter software scans incomming mesages for a line that starts
X-RBL-Warning:
This is used as an
Occasionally I'll see a line like this in the headers of some e-mail...
X-Country-Chain: 'EU' [corrupt RIPE data]-UNITED STATES-destination
I realize that EU is not a valid country code according to this page,
http://www.iana.org/cctld/cctld-whois.htmhttp://www.iana.org/cctld/cctld-whois.htm,
I just received this this from a mail admin of another ISP, Anyone care to
comment...
Our filter software scans incomming mesages for a line that starts
X-RBL-Warning:
This is used as an indicator of spam. In your case it is saying that
this message is not spam, but our software only picks up
Yes, it will add 2 points.
But:
I've received 188 e-mails with the country of EU (I use country not countries) since I
added my country test.
Approximately 1/3 were not spam.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 10:34AM
Hello, All,
Occasionally I'll
I know [EMAIL PROTECTED] has new filters out in his Beta area that don't utilize the
anti-gibberish test.
There is just a gibberish and a gibberish-sub tests.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 09:57AM
I have been using the SPAM filters from
X-Country-Chain: 'EU' [corrupt RIPE data]-UNITED STATES-destination
COUNTRIES 2 CONTAINS eu
will it add 2 points to the total weight for finding eu?
My guess is No but I just though I would ask.
Actually, that will work. :)
So this will add 2 points for every message containing 'EU'
COUNTRIES 2 CONTAINS eu
will it add 2 points to the total weight for finding eu?
My guess is No but I just though I would ask.
Actually, that will work. :)
So this will add 2 points for every message containing 'EU' [corrupt RIPE
data] in the country chain and not for every message comming
The Declude JunkMail Manual,
http://www.declude.com/Articles.asp?ID=116http://www.declude.com/Articles.asp?ID=116,
appears to be ponting to an old version of GLOBAL.CFG,
http://www.declude.com/version/release/GLOBAL.CFGhttp://www.declude.com/version/release/GLOBAL.CFG.
I haven't looked very
Scott,
First, congratulations on the changes.
I would certainly be interested in a gateway product from your company
as a few changes are occurring here as well. We are likely going to be
moving from Imail for our student email server to an Exchange 2003
server (as a mate to the staff faculty
That is because end users apply programs how they WANT, now how the writer
intended hehe...
Nice program, thank you for your time investing to help us as well.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bill
Sent: Wednesday, April 14, 2004 12:43 PM
I know [EMAIL PROTECTED] has new filters out in his Beta area that
don't utilize the anti-gibberish test. There is just a gibberish and
a gibberish-sub tests.
I was beginning to wonder as nothing new has been posted at
http://www.mailpure.com/software/decludefilters/ since last year.
Sheldon
They are posted in the beta section. See this link for the link:
http://www.mail-archive.com/[EMAIL PROTECTED]/msg17542.html
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 12:02PM
I know [EMAIL PROTECTED] has new filters out in his Beta area that
don't utilize
Hi Bill,
Haven't tried this new version, but recently tried the old one and it is
very useful. Thanks.
Question for you: It looks like it counts whitelisted email in the total
percentages. Is this so? Might be useful to add a line showing what
percentage is whitelisted, or just exclude
First, congratulations on the changes.
Thank you. :)
I would certainly be interested in a gateway product from your company
as a few changes are occurring here as well. We are likely going to be
moving from Imail for our student email server to an Exchange 2003
server (as a mate to the staff
Do any of you run SmarterMail? What are your opinions?
As part of a hosting package SmarterMail is being given to us
for free and I'd like to know what other people's experiences
have been with it before we use it in a production environment.
Thanks,
Jose
---
Outgoing mail is certified Virus
Smokin' Bill!
That's very fast. I certainly found a few surprises at 0 hits for a normal
day.
Some low priority suggestions:
- Change fail wording in the header to trigger or hit or something.
- Ignore Declude directives, e.g. LOOSENSPAMHEADERS, HOPHIGH, CONSOLE,
PREWHITELIST ...
Thanks for
Hi,
The command script that downloads the SURBL rbldns zone file,
converts it to a body filter, and updates the existing filter file is
available for download at
http://www.botany.gu.se/download/decludescript/SURBL_filter.zip. I
have included a short readme file and added comments to the
I'm curious what caused this message to fail CMDSPACE?
Received: from PARTSMANAGER [64.72.97.82] by wcnet.net with ESMTP
(SMTPD32-7.15) id AF16D700130; Wed, 14 Apr 2004 12:04:22 -0500
Message-ID: [EMAIL PROTECTED]
From: First Last [EMAIL PROTECTED]
To: First Last [EMAIL PROTECTED]
Subject:
I'm curious what caused this message to fail CMDSPACE?
It failed because the mailserver sending the E-mail doesn't follow the RFCs
exactly (specifically, it had a space in one of the SMTP commands where it
should not have).
-Scott
---
Declude
So the problem is with the sending mail server at 64.72.97.82, not the
sending client (OE 6)? Just trying to understand.
Glenn Z.
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, April 14, 2004 12:46 PM
Subject: Re: [Declude.JunkMail]
So the problem is with the sending mail server at 64.72.97.82, not the
sending client (OE 6)? Just trying to understand.
The E-mail came from 64.72.97.82, so the SMTP software running on there is
at fault (it could be a mail client or a mail server -- SMTP does not
distinguish between the
Is there a working interim link yet?
Yes, the new link to interim releases is
http://www.declude.com/version/interim/ .
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra
Scott,Is there a working interim link yet?Neal M.[EMAIL PROTECTED] wrote: -To: [EMAIL PROTECTED]From: "R. Scott Perry" <[EMAIL PROTECTED]>Sent by: [EMAIL PROTECTED]Date: 04/14/2004 12:46PMSubject: Re: [Declude.JunkMail] Default GLOBAL.CFG Out of Date?The Declude JunkMail Manual,
My experience with SmarterMail is as an end user. The hosting company for my
hobby site made it available as a way to handle email via Web pages. It's
pretty good. What else do you want to know? On or off list?
Keith Purtell, Web/Network Administrator
VantageMed Corporation (Kansas City office)
My experience with SmarterMail is as an end user. The hosting company for
my
hobby site made it available as a way to handle email via Web pages. It's
pretty good. What else do you want to know? On or off list?
What, an IT person with time for a hobby? How dare you. ;-)
John Tolmachoff
Much obliged! :)Neal M.[EMAIL PROTECTED] wrote: -To: [EMAIL PROTECTED]From: "R. Scott Perry" <[EMAIL PROTECTED]>Sent by: [EMAIL PROTECTED]Date: 04/14/2004 02:26PMSubject: Re: [Declude.JunkMail] Default GLOBAL.CFG Out of Date?Is there a working interim link yet?Yes, the new link to interim
This paypal phish got through without being detected by the spamdomains. Can anyone
explain it?
Spamdomains line:
@paypal.com .paypal.
Headers:
Received: from imail.Farmprogress.com
by farmprogress.com; Tue, 13 Apr 2004 18:45:39 -0500
Received: from web.numberoneserver.com
Because the sender was not listed as @paypal.com. Look at this line:
X-Declude-Sender: [EMAIL PROTECTED] [66.36.241.111]
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of
Hi again,
This version of the SURBL filter script only works under Windows 2000
and later. I will try to adjust the script so that it also can be
used on Windows NT 4.
/Roger
Hi,
The command script that downloads the SURBL rbldns zone file,
converts it to a body filter, and updates the
Using Imail 6.05, and Declude 1.79 beta on NT4.0
I've had a spate of crud flowing in the last week or so from
@variousaddresses addressed to
[EMAIL PROTECTED], which of course get turned
away as the addressee is unknown to my mail server. Unfortunately there
seems to be such a flood of the
I see, I missed that.
I just like to lay down extra points on the phish schemes.
Thanks
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 02:33PM
Because the sender was not listed as @paypal.com. Look at this line:
X-Declude-Sender: [EMAIL PROTECTED]
The command script that downloads the SURBL rbldns zone file,
converts it to a body filter, and updates the existing filter
file is available for download at
http://www.botany.gu.se/download/decludescript/SURBL_filter.zi
p. I have included a short readme file and added comments to
the
Scott is of course correct. If you are using Declude 1.78+ (beta and
interim releases), there are single file versions of these filters that
will only show a hit when they actually score, and they are also a lot
more efficient. They can be found in the following location:
Sheldon,
I did decide last year not to try to keep two different sets of files
updated at the same time. Those using 1.78+ should definitely be using
the versions in the beta directory because they have additional
counterbalances and other improvements.
Matt
Sheldon Koehler wrote:
I agree. It took 10 minutes to get this test working.
And many of the domains listed were in my e-mails that are (hopefully were) falling
into that gray area.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 04:48PM
The command script that downloads the SURBL
Will the release notes be updated now that 1.79 is a beta?
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to
Will the release notes be updated now that 1.79 is a beta?
They were, but the new web site needs the new information. We're in the
process of going through the changes to the old web site that haven't made
it to the new web site, but somehow tech support seems to be taking
priority. :)
OT, A little, any body got it going? I got it to display just the page
with the word GRAPH on it. Using Windows 2003.
Hi Royce-
How are you rejecting the messages? Do you use a nobody alias with an
autoresponse, or do you just let Imail return the standard error message?
Any idea how many you're getting?
It seems odd that this would effect iwebmsg. Look for another problem
somewhere. How many files do you have
I'd like to test it also.
-Dave
- Original Message -
From:
Bud
Durland
To: Declude List
Sent: Wednesday, April 14, 2004 8:58
AM
Subject: [Declude.JunkMail] New
test
I am testing a small external test program. A message
fails the test if there is an
Terry,
I orginally looked at the argolink spam graph, but as the doc's mentioned it
goes through the full log file from beginning to end. Our log files are
big, but it would tie up the cpu for a bit ~10-15 minutes.
We just finished a seperate program that can be used with MRTG to graph
We are likely going to be moving from Imail for our student email
server to an Exchange 2003 server (as a mate to the staff faculty
server).
You might then be interested in MilterSink (announced earlier), which
will incorporate limited support for Declude (all tests, but not all
I subscribed to that other list - but have yet to see any emails? Is that
to be expected? (I'm in Digest mode).
Best Regards
Andy Schmidt
Phone: +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
I subscribed to that other list - but have yet to see any emails? Is
that to be expected? (I'm in Digest mode).
That list's Digest mode is both size-based and time-based, but you
wouldn't have received messages yet in either case, as I just sent the
first official message to the list about
I have been using this program for months with no problem but you guys
managed to break it in a matter of hours. :)
I guess that I should have called it a BETA release! Anyway, that's
what I call it now (v1.4B). I have fixed the problems that you have
pointed out to me and have added the
Some low priority suggestions:
- Change fail wording in the header to trigger or hit
or something.
- Ignore Declude directives, e.g. LOOSENSPAMHEADERS, HOPHIGH,
CONSOLE, PREWHITELIST ...
Thanks for the suggestions.
I did try to ignore Declude directives but I went by the manual.
58 matches
Mail list logo