AW: [Declude.JunkMail] Updates to the confic file
Title: AW: [Declude.JunkMail] Updates to the confic file hi, i just (13:00 CET) get me the global.cfg and found: MONKEYFORMMAIL ip4r formmail.relays.monkeys.com * 7 0 MONKEYPROXIES ip4r proxies.relays.monkeys.com * 7 0 in it. are they back? i thought they went down 8 months ago? mfg i.a. gez. markus guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: R. Scott Perry [mailto:[EMAIL PROTECTED]] Gesendet am: Dienstag, 13. April 2004 18:40 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] Updates to the confic file Where do I find and updated version of the rbl's used per default ? And there settings Or has they not been changed for the last 6 -8 months ? We constantly update the config files, as old spam databases are killed off and new ones are added. You can find the latest config files at http://www.declude.com/junkmail/manual.htm . -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: AW: [Declude.JunkMail] Updates to the confic file
i just (13:00 CET) get me the global.cfg and found: MONKEYFORMMAIL ip4rformmail.relays.monkeys.com * 7 0 MONKEYPROXIES ip4rproxies.relays.monkeys.com * 7 0 in it. are they back? i thought they went down 8 months ago? They are definitely not back. This is a glitch with the new web site, that should be fixed soon. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] icq.com for spamdomains
I've seen some spam with forged Mailfrom addresses NOT comming from icq.com. So maybe it'S agood idea to add this single domain to the spamdomains file. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
DOH! That's what I get for hurrying to get something out before quitting time. Dan Horne, CCNA Web Services Administrator TAIS Web Wilcox World Travel Tours [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. SPAM-FREE 1.0(2476) -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Tuesday, April 13, 2004 5:40 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report - Original Message - From: Dan Horne [EMAIL PROTECTED] I have attached my Global.cfg. The logfile that it was parsing was only 14 megs. Any ideas? Do I need to change something for it to work? I tried WAMLOG with the debug option, but it did the same thing. You should really consider doing some editing/masking of your config file settings before sending it to a public list. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] New test
I am testing a small external test program. A message fails the test if there is an discernable IP address in the HELO entry of the message. These fail the test: Received: from host-68-212-107-146.msy.bellsouth.net [68.212.107.146] by mrpcap.com Received: from ip-62-129-160-91.evhr.net [62.129.160.91] by mrpcap.com Received: from acs-24-154-41-142.zoominternet.net [24.154.41.142] by mrpcap.com Only the bolded part of the line (HELO name) is tested. Basically, dashes become 'dots', and anything other than numbers and dots are stripped out. If what remains looks like a valid 4-octet IP address, the test fails. These entries would NOT fail -- stray number make the location of the IP ambiguous Received: from wbar3.lax1-4-8-227-083.dsl-verizon.net [4.8.227.83] by mrpcap.com Received: from c-24-125-42-12.va.client2.attbi.com [24.125.42.12] by mrpcap.com For testing, I set it up with 0 weight and a HOLD action. So far, it has not flagged anything that was not spam. If anyone is interested in trying it out, let me know. I'll probably be putting it up for download from my web site later this week. -- --- illigitimi non carborundum --- Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com ---
Re: [Declude.JunkMail] New test
interested thanks, andy - Original Message - From: Bud Durland To: Declude List Sent: Wednesday, April 14, 2004 8:58 AM Subject: [Declude.JunkMail] New test I am testing a small external test program. A message fails the test if there is an discernable IP address in the HELO entry of the message. These fail the test: Received: from host-68-212-107-146.msy.bellsouth.net [68.212.107.146] by mrpcap.com Received: from ip-62-129-160-91.evhr.net [62.129.160.91] by mrpcap.com Received: from acs-24-154-41-142.zoominternet.net [24.154.41.142] by mrpcap.comOnly the bolded part of the line (HELO name) is tested. Basically, dashes become 'dots', and anything other than numbers and dots are stripped out. If what remains looks like a valid 4-octet IP address, the test fails.These entries would NOT fail -- stray number make the location of the IP ambiguous Received: from wbar3.lax1-4-8-227-083.dsl-verizon.net [4.8.227.83] by mrpcap.com Received: from c-24-125-42-12.va.client2.attbi.com [24.125.42.12] by mrpcap.com For testing, I set it up with 0 weight and a HOLD action. So far, it has not flagged anything that was not spam.If anyone is interested in trying it out, let me know. I'll probably be putting it up for download from my web site later this week.-- --- illigitimi non carborundum --- Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com ---
Re: [Declude.JunkMail] New test
interested At 09:17 AM 4/14/2004 -0400, you wrote: interested thanks, andy - Original Message - From: Bud Durland To: Declude List Sent: Wednesday, April 14, 2004 8:58 AM Subject: [Declude.JunkMail] New test I am testing a small external test program. A message fails the test if there is an discernable IP address in the HELO entry of the message. These fail the test: Received: from host-68-212-107-146.msy.bellsouth.net [68.212.107.146] by mrpcap.com Received: from ip-62-129-160-91.evhr.net [62.129.160.91] by mrpcap.com Received: from acs-24-154-41-142.zoominternet.net [24.154.41.142] by mrpcap.com Only the bolded part of the line (HELO name) is tested. Basically, dashes become 'dots', and anything other than numbers and dots are stripped out. If what remains looks like a valid 4-octet IP address, the test fails. These entries would NOT fail -- stray number make the location of the IP ambiguous Received: from wbar3.lax1-4-8-227-083.dsl-verizon.net [4.8.227.83] by mrpcap.com Received: from c-24-125-42-12.va.client2.attbi.com [24.125.42.12] by mrpcap.com For testing, I set it up with 0 weight and a HOLD action. So far, it has not flagged anything that was not spam. If anyone is interested in trying it out, let me know. I'll probably be putting it up for download from my web site later this week. -- --- illigitimi non carborundum --- Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com --- Glenn Brooks WebWize, Inc. 713-688-4382 http://www.webwize.com
[Declude.JunkMail] Gibberish and Anti-Gibberish Testing
I have been using the SPAM filters from MailPure and I have notices that the Anti-Gibberish Test has been triggered a lot more than the Gibberish test (5:1 ratio) The Anti-Gibberish Test has been causing a lot of SPAM to go through by applying negative weight to the message. I was wondering if there was a way to skip the Anti-Gibberish Test if the Gibberish is not triggered. (This goes to all the test that contain an Anti- test) Isaias Hernandez Internet Tech Support [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Default GLOBAL.CFG Out of Date?
Hello, All, The Declude JunkMail Manual, http://www.declude.com/Articles.asp?ID=116, appears to be ponting to an old version of GLOBAL.CFG, http://www.declude.com/version/release/GLOBAL.CFG. I haven't looked very deep but the thing that immediately jumped out was that the MONKEYS.COM and EASYNET.NL IP4R entries are enabled. Am I correct that this GLOBAL.CFG is way out of date and is unreliable? If so, does anyone know where I can get the latest and great version of GLOBAL.CFG? On a related note, have you ever considered entering a comment line in GLOBAL.CFG which has the date that the GLOBAL.CFG file was last updated? Thanks In Advance, Dan Geiser [EMAIL PROTECTED]
Re: [Declude.JunkMail] Default GLOBAL.CFG Out of Date?
The Declude JunkMail Manual, http://www.declude.com/Articles.asp?ID=116http://www.declude.com/Articles.asp?ID=116, appears to be ponting to an old version of GLOBAL.CFG, http://www.declude.com/version/release/GLOBAL.CFGhttp://www.declude.com/version/release/GLOBAL.CFG. I haven't looked very deep but the thing that immediately jumped out was that the MONKEYS.COM and EASYNET.NL IP4R entries are enabled. Am I correct that this GLOBAL.CFG is way out of date and is unreliable? If so, does anyone know where I can get the latest and great version of GLOBAL.CFG? The person who maintains the web site should have this fixed shortly. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] EU in Country Chain
Hello, All, Occasionally I'll see a line like this in the headers of some e-mail... X-Country-Chain: 'EU' [corrupt RIPE data]-UNITED STATES-destination I realize that EU is not a valid country code according to this page, http://www.iana.org/cctld/cctld-whois.htm, but if I add a line to my COUNTRY filter like COUNTRIES2CONTAINSeu will it add 2 points to the total weight for finding "eu"? My guess is "No" but I just though I would ask. Thanks In Advance, Dan Geiser [EMAIL PROTECTED]
Re: [Declude.JunkMail] Gibberish and Anti-Gibberish Testing
on 4/14/04 10:57 AM, TC Online Support wrote: I was wondering if there was a way to skip the Anti-Gibberish Test if the Gibberish is not triggered. (This goes to all the test that contain an Anti- test) If/when we get a NOTCONTAINS filter command a lot of things like this could be done very easily. IE, at the top of the Anti-Gibberish filter you could have some code like - SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINSGIBBERISH rest of the anti-gibberish code Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] X-RBL-Warning:
I just received this this from a mail admin of another ISP, Anyone care to comment... Your outgoing mail server adds the header: X-RBL-Warning: SPAM-NONE: Total weight between 0 and 4. Our filter software scans incomming mesages for a line that starts X-RBL-Warning: This is used as an indicator of spam. In your case it is saying that this message is not spam, but our software only picks up the first half of the tag. RBL stands for Real Time Blacklist. Normally that tag is used to indicate that the sender of the mail has an IP address that is listed at a RBL. It should not be used to tag mail as non spam, because people block on the X-RBL-Warning part. As you've found out. Contact your mail admin and ask him to either change the tag or even remove it all together. In theory it is a good idea to have a tag along the lines of : X-spam-scanned: ok But dont use the RBL tag unless your IP is on a RBL, or else you will be blocked as spam. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] EU in Country Chain
Occasionally I'll see a line like this in the headers of some e-mail... X-Country-Chain: 'EU' [corrupt RIPE data]-UNITED STATES-destination I realize that EU is not a valid country code according to this page, http://www.iana.org/cctld/cctld-whois.htmhttp://www.iana.org/cctld/cctld-whois.htm, but if I add a line to my COUNTRY filter like COUNTRIES 2 CONTAINS eu will it add 2 points to the total weight for finding eu? My guess is No but I just though I would ask. Actually, that will work. :) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] X-RBL-Warning:
I just received this this from a mail admin of another ISP, Anyone care to comment... Our filter software scans incomming mesages for a line that starts X-RBL-Warning: This is used as an indicator of spam. In your case it is saying that this message is not spam, but our software only picks up the first half of the tag. You're both right. While a mail client/server really shouldn't block on the X-RBL-Warning: header alone, it's probably best not to use it for tests that don't somehow indicate that the E-mail is likely to be spam. Instead of SPAM-NONE WARN, I would use SPAM-NONE WARN X-Note: This E-mail fell into the SPAM-NONE range (Total weight between 0 and 4). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] EU in Country Chain
Yes, it will add 2 points. But: I've received 188 e-mails with the country of EU (I use country not countries) since I added my country test. Approximately 1/3 were not spam. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/14/04 10:34AM Hello, All, Occasionally I'll see a line like this in the headers of some e-mail... X-Country-Chain: 'EU' [corrupt RIPE data]-UNITED STATES-destination I realize that EU is not a valid country code according to this page, http://www.iana.org/cctld/cctld-whois.htm, but if I add a line to my COUNTRY filter like COUNTRIES 2 CONTAINS eu will it add 2 points to the total weight for finding eu? My guess is No but I just though I would ask. Thanks In Advance, Dan Geiser [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Gibberish and Anti-Gibberish Testing
I know [EMAIL PROTECTED] has new filters out in his Beta area that don't utilize the anti-gibberish test. There is just a gibberish and a gibberish-sub tests. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/14/04 09:57AM I have been using the SPAM filters from MailPure and I have notices that the Anti-Gibberish Test has been triggered a lot more than the Gibberish test (5:1 ratio) The Anti-Gibberish Test has been causing a lot of SPAM to go through by applying negative weight to the message. I was wondering if there was a way to skip the Anti-Gibberish Test if the Gibberish is not triggered. (This goes to all the test that contain an Anti- test) Isaias Hernandez Internet Tech Support [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] EU in Country Chain
X-Country-Chain: 'EU' [corrupt RIPE data]-UNITED STATES-destination COUNTRIES 2 CONTAINS eu will it add 2 points to the total weight for finding eu? My guess is No but I just though I would ask. Actually, that will work. :) So this will add 2 points for every message containing 'EU' [corrupt RIPE data] in the country chain and not for every message comming from any european country? Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] EU in Country Chain
COUNTRIES 2 CONTAINS eu will it add 2 points to the total weight for finding eu? My guess is No but I just though I would ask. Actually, that will work. :) So this will add 2 points for every message containing 'EU' [corrupt RIPE data] in the country chain and not for every message comming from any european country? Correct. EU will only appear when RIPE has EU in their records as the country (which should normally not happen). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Default GLOBAL.CFG Out of Date?
The Declude JunkMail Manual, http://www.declude.com/Articles.asp?ID=116http://www.declude.com/Articles.asp?ID=116, appears to be ponting to an old version of GLOBAL.CFG, http://www.declude.com/version/release/GLOBAL.CFGhttp://www.declude.com/version/release/GLOBAL.CFG. I haven't looked very deep but the thing that immediately jumped out was that the MONKEYS.COM and EASYNET.NL IP4R entries are enabled. Am I correct that this GLOBAL.CFG is way out of date and is unreliable? If so, does anyone know where I can get the latest and great version of GLOBAL.CFG? The correct one is now online. :) If anyone else notices any other issues with the website, please be sure to let me know, and I'll make sure that they get taken care of. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Notification to customers of change of ownership
Scott, First, congratulations on the changes. I would certainly be interested in a gateway product from your company as a few changes are occurring here as well. We are likely going to be moving from Imail for our student email server to an Exchange 2003 server (as a mate to the staff faculty server). I have become somewhat disappointed with Imail and Ipswitch as we have had a couple of serious bugs with attachments of late that I feel have not been dealt with seriously enough by Ipswitch. This is what is prompting the change. Both bugs were problems dealing with Imail's handling of attachments. This was pretty critical for an academic institution that relies on email attachments for students to send in assignments and faculty that needs to send course materials to students. The first bug you are aware of and actually let me know that it was a known bug in Sept.. 2003 and wasn't fixed until December 2003 affecting the whole first semester. The second is a bug with multipart/mixed attachments that I reported as critical in January and now it is the end of the school year and still no news of a fix. I have only praise for your product and support and if I had to leave Imail, my regret would be losing Declude and therefore I was quite excited to see your message about a potential gateway product. Sorry for the rant, but after repeated inquires to Ipswitch with no response and now seeing an upgrade release (8.1) but still no fix for 8.05, I am just a little frustrated and *very pleased* that you weren't purchased by Ipswitch. Anyway congrats and I will continue to monitor for news of a gateway product so that I can continue to offer top quality anti-spam and virus protection for my users by a company that provides what I consider to be the best product and support in the entire industry. Richard Edge Senior Systems Administrator Technology Services Department TRINITY WESTERN UNIVERSITY Voice: 604-513-2089 E-mail: [EMAIL PROTECTED] WWW: http://www.ucs.twu.ca FAQ: http://www.ucs.twu.ca/resources/faq.htm -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, April 12, 2004 1:26 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Notification to customers of change of ownership Have you already started considering which other MTA's you will try to integrate with? No decisions have been made yet, but it looks like a gateway product (which would be compatible with all SMTP servers) may be the way that we go. I want to suggest Xmail Server (http://www.xmailserver.org). I have looked at making Declude work with it before, but never found the time to write the middleware needed. I like Xmail for it's speed and configurability, and the next release will add integrated IMAP finally. I also like the suggestion of MS SMTP service, but either dealing with sinks used in MS SMTP is very difficult or developers think admins are suckers, I have never seen a cheap addin for MS SMTP, even simple ones. Of course, feel free to correct me if they do exist. Thanks for the suggestions -- we will take a note of this. Another question, will there be any consideration in making Declude multi-platform? It is something that we are giving serious thought to. At this point, it isn't a high priority -- but something that is being considered as we do development work. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
That is because end users apply programs how they WANT, now how the writer intended hehe... Nice program, thank you for your time investing to help us as well. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Sent: Wednesday, April 14, 2004 12:43 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH90727 99325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL49544 65273 BLITZEDALL33502 59913 BASE6422521 29561 MAILFROM16841 28411 COMMENTS13281 20561 MYFILTERFAIL11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 50409230 SORBS-SMTP 4450 11320 OBFUSCATION 36004570 ORDB 31606540 SORBS-WEB 31605140 SORBS-ZOMBIE 28002800 SPFPASS 20802340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Gibberish and Anti-Gibberish Testing
I know [EMAIL PROTECTED] has new filters out in his Beta area that don't utilize the anti-gibberish test. There is just a gibberish and a gibberish-sub tests. I was beginning to wonder as nothing new has been posted at http://www.mailpure.com/software/decludefilters/ since last year. Sheldon Sheldon Koehler, Sr. SysAdminhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Gibberish and Anti-Gibberish Testing
They are posted in the beta section. See this link for the link: http://www.mail-archive.com/[EMAIL PROTECTED]/msg17542.html Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/14/04 12:02PM I know [EMAIL PROTECTED] has new filters out in his Beta area that don't utilize the anti-gibberish test. There is just a gibberish and a gibberish-sub tests. I was beginning to wonder as nothing new has been posted at http://www.mailpure.com/software/decludefilters/ since last year. Sheldon Sheldon Koehler, Sr. SysAdminhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Hi Bill, Haven't tried this new version, but recently tried the old one and it is very useful. Thanks. Question for you: It looks like it counts whitelisted email in the total percentages. Is this so? Might be useful to add a line showing what percentage is whitelisted, or just exclude whitelisted email, to more accurately portray usefulness of various tests. Darin. - Original Message - From: Bill [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 12:43 PM Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count % Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH9072799325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL4954465273 BLITZEDALL3350259913 BASE642252129561 MAILFROM1684128411 COMMENTS1328120561 MYFILTERFAIL1159017230 WAMO 5850 6090 MYFILTERPASS 512012390 SORBS-MISC 5040 9230 SORBS-SMTP 445011320 OBFUSCATION 3600 4570 ORDB 3160 6540 SORBS-WEB 3160 5140 SORBS-ZOMBIE 2800 2800 SPFPASS 2080 2340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Notification to customers of change of ownership
First, congratulations on the changes. Thank you. :) I would certainly be interested in a gateway product from your company as a few changes are occurring here as well. We are likely going to be moving from Imail for our student email server to an Exchange 2003 server (as a mate to the staff faculty server). Thank you for your input about a gateway version, and explaining your situation with IMail, and: I have only praise for your product and support and if I had to leave Imail, my regret would be losing Declude and therefore I was quite excited to see your message about a potential gateway product. Thanks for the kind words. :) Sorry for the rant, but after repeated inquires to Ipswitch with no response and now seeing an upgrade release (8.1) but still no fix for 8.05, I am just a little frustrated and *very pleased* that you weren't purchased by Ipswitch. I can certainly understand that. Non-disclosures can be a nuisance, but what I can say is that one of my top priorities was finding a new owner that would be able to meet the needs of my customers. There were potential new owners that I did not feel would be able to do that. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: SmarterMail any good?
Do any of you run SmarterMail? What are your opinions? As part of a hosting package SmarterMail is being given to us for free and I'd like to know what other people's experiences have been with it before we use it in a production environment. Thanks, Jose --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.656 / Virus Database: 421 - Release Date: 4/9/2004 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Smokin' Bill! That's very fast. I certainly found a few surprises at 0 hits for a normal day. Some low priority suggestions: - Change fail wording in the header to trigger or hit or something. - Ignore Declude directives, e.g. LOOSENSPAMHEADERS, HOPHIGH, CONSOLE, PREWHITELIST ... Thanks for the new tool. Andrew 8) -Original Message- From: Bill [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 9:43 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH90727 99325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL49544 65273 BLITZEDALL33502 59913 BASE6422521 29561 MAILFROM16841 28411 COMMENTS13281 20561 MYFILTERFAIL11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 50409230 SORBS-SMTP 4450 11320 OBFUSCATION 36004570 ORDB 31606540 SORBS-WEB 31605140 SORBS-ZOMBIE 28002800 SPFPASS 20802340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SURBL filter script
Hi, The command script that downloads the SURBL rbldns zone file, converts it to a body filter, and updates the existing filter file is available for download at http://www.botany.gu.se/download/decludescript/SURBL_filter.zip. I have included a short readme file and added comments to the script. It will take a day or two before the log analysis and test check scripts are available, since I must adjust them to handle all log levels. /Roger --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] CMDSPACE failure on OE auto-responder
I'm curious what caused this message to fail CMDSPACE? Received: from PARTSMANAGER [64.72.97.82] by wcnet.net with ESMTP (SMTPD32-7.15) id AF16D700130; Wed, 14 Apr 2004 12:04:22 -0500 Message-ID: [EMAIL PROTECTED] From: First Last [EMAIL PROTECTED] To: First Last [EMAIL PROTECTED] Subject: Spam (12) - Re: Undeliverable Mail Date: Wed, 14 Apr 2004 12:04:06 -0500 MIME-Version: 1.0 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Declude-Sender: [EMAIL PROTECTED] [64.72.97.82] X-Declude-Spoolname: D6f160d7001302fd4.SMD X-Note-In: This E-mail was scanned on MAIL1 by Declude JunkMail for evidence of spam. X-Spam-Tests-Failed: CMDSPACE, REVDNS, WEIGHT10 X-Note: Total spam weight of this E-mail is 12. X-Note: This E-mail was sent from [No Reverse DNS] ([64.72.97.82]) X-Note: SMTP Real From: [EMAIL PROTECTED] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 323735851 [AUTOMATED NOTE: Your mail server [68.89.56.16] is missing a reverse DNS entry. All Internet hosts are required to have a reverse DNS entry. The missing reverse DNS entry will cause your mail to be treated as spam on some servers, such as AOL.] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] CMDSPACE failure on OE auto-responder
I'm curious what caused this message to fail CMDSPACE? It failed because the mailserver sending the E-mail doesn't follow the RFCs exactly (specifically, it had a space in one of the SMTP commands where it should not have). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] CMDSPACE failure on OE auto-responder
So the problem is with the sending mail server at 64.72.97.82, not the sending client (OE 6)? Just trying to understand. Glenn Z. - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 12:46 PM Subject: Re: [Declude.JunkMail] CMDSPACE failure on OE auto-responder I'm curious what caused this message to fail CMDSPACE? It failed because the mailserver sending the E-mail doesn't follow the RFCs exactly (specifically, it had a space in one of the SMTP commands where it should not have). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] CMDSPACE failure on OE auto-responder
So the problem is with the sending mail server at 64.72.97.82, not the sending client (OE 6)? Just trying to understand. The E-mail came from 64.72.97.82, so the SMTP software running on there is at fault (it could be a mail client or a mail server -- SMTP does not distinguish between the two). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Default GLOBAL.CFG Out of Date?
Is there a working interim link yet? Yes, the new link to interim releases is http://www.declude.com/version/interim/ . -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Default GLOBAL.CFG Out of Date?
Scott,Is there a working interim link yet?Neal M.[EMAIL PROTECTED] wrote: -To: [EMAIL PROTECTED]From: "R. Scott Perry" <[EMAIL PROTECTED]>Sent by: [EMAIL PROTECTED]Date: 04/14/2004 12:46PMSubject: Re: [Declude.JunkMail] Default GLOBAL.CFG Out of Date?The Declude JunkMail Manual, http://www.declude.com/Articles.asp?ID=116http://www.declude.com/Articles.asp?ID=116, appears to be ponting to an old version of GLOBAL.CFG, http://www.declude.com/version/release/GLOBAL.CFGhttp://www.declude.com/version/release/GLOBAL.CFG. I haven't looked very deep but the thing that immediately jumped outwas that the MONKEYS.COM and EASYNET.NL IP4R entries are enabled.Am I correct that this GLOBAL.CFG is way out of date and is unreliable? If so, does anyone know where I can get the latest andgreat version of GLOBAL.CFG?The correct one is now online. :)If anyone else notices any other issues with the website, please besure to let me know, and I'll make sure that they get taken care of. -Scott---Declude JunkMail: The advanced anti-spam solution for IMailmailservers since 2000.Declude Virus: Ultra reliable virus detection and the leader inmailserver vulnerability detection.Find out what you've been missing: Ask for a free 30-day evaluation.---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: SmarterMail any good?
My experience with SmarterMail is as an end user. The hosting company for my hobby site made it available as a way to handle email via Web pages. It's pretty good. What else do you want to know? On or off list? Keith Purtell, Web/Network Administrator VantageMed Corporation (Kansas City office) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jose Gosende Sent: Wednesday, April 14, 2004 12:35 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: SmarterMail any good? Do any of you run SmarterMail? What are your opinions? As part of a hosting package SmarterMail is being given to us for free and I'd like to know what other people's experiences have been with it before we use it in a production environment. Thanks, Jose --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: SmarterMail any good?
My experience with SmarterMail is as an end user. The hosting company for my hobby site made it available as a way to handle email via Web pages. It's pretty good. What else do you want to know? On or off list? What, an IT person with time for a hobby? How dare you. ;-) John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Default GLOBAL.CFG Out of Date?
Much obliged! :)Neal M.[EMAIL PROTECTED] wrote: -To: [EMAIL PROTECTED]From: "R. Scott Perry" <[EMAIL PROTECTED]>Sent by: [EMAIL PROTECTED]Date: 04/14/2004 02:26PMSubject: Re: [Declude.JunkMail] Default GLOBAL.CFG Out of Date?Is there a working interim link yet?Yes, the new link to interim releases is http://www.declude.com/version/interim/. -Scott---Declude JunkMail: The advanced anti-spam solution for IMailmailservers since 2000.Declude Virus: Ultra reliable virus detection and the leader inmailserver vulnerability detection.Find out what you've been missing: Ask for a free 30-day evaluation.---[This E-mail was scanned for viruses by Declude Virus(http://www.declude.com)]---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Paypal phish not detected by spamdomains
This paypal phish got through without being detected by the spamdomains. Can anyone explain it? Spamdomains line: @paypal.com .paypal. Headers: Received: from imail.Farmprogress.com by farmprogress.com; Tue, 13 Apr 2004 18:45:39 -0500 Received: from web.numberoneserver.com [66.36.241.111] by imail.Farmprogress.com with ESMTP (SMTPD32-8.05) id AB986EFB0044; Tue, 13 Apr 2004 18:45:28 -0500 Received: (from [EMAIL PROTECTED]) by web.numberoneserver.com (8.11.6/8.11.6) id i3E00bo13908; Tue, 13 Apr 2004 20:00:37 -0400 Date: Tue, 13 Apr 2004 20:00:37 -0400 Message-Id: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [JSpamFilter-25]Notification of PayPal Limited Account Access From: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Errors-To: [EMAIL PROTECTED] X-Mailer: MSOUTLOOK / 4.3.2 Content-type: text/html; charset=iso-8859-1 X-Declude-Sender: [EMAIL PROTECTED] [66.36.241.111] X-Declude-Spoolname: D7b986efb00442884.SMD X-Note: Spam tests: SNIFFER-OBFUSCATION, OBFUSCATION, COUNTRY-FILTER, WEIGHT20, WEIGHT25, WEIGHT25COPY. X-Note: Total spam weight of this e-mail is 27. X-Note: Reverse DNS sls-cb9p8.dca2.superb.net . Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Paypal phish not detected by spamdomains
Because the sender was not listed as @paypal.com. Look at this line: X-Declude-Sender: [EMAIL PROTECTED] [66.36.241.111] John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Wednesday, April 14, 2004 12:23 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Paypal phish not detected by spamdomains This paypal phish got through without being detected by the spamdomains. Can anyone explain it? Spamdomains line: @paypal.com .paypal. Headers: Received: from imail.Farmprogress.com by farmprogress.com; Tue, 13 Apr 2004 18:45:39 -0500 Received: from web.numberoneserver.com [66.36.241.111] by imail.Farmprogress.com with ESMTP (SMTPD32-8.05) id AB986EFB0044; Tue, 13 Apr 2004 18:45:28 -0500 Received: (from [EMAIL PROTECTED]) by web.numberoneserver.com (8.11.6/8.11.6) id i3E00bo13908; Tue, 13 Apr 2004 20:00:37 -0400 Date: Tue, 13 Apr 2004 20:00:37 -0400 Message-Id: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [JSpamFilter-25]Notification of PayPal Limited Account Access From: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Errors-To: [EMAIL PROTECTED] X-Mailer: MSOUTLOOK / 4.3.2 Content-type: text/html; charset=iso-8859-1 X-Declude-Sender: [EMAIL PROTECTED] [66.36.241.111] X-Declude-Spoolname: D7b986efb00442884.SMD X-Note: Spam tests: SNIFFER-OBFUSCATION, OBFUSCATION, COUNTRY-FILTER, WEIGHT20, WEIGHT25, WEIGHT25COPY. X-Note: Total spam weight of this e-mail is 27. X-Note: Reverse DNS sls-cb9p8.dca2.superb.net . Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SURBL filter script
Hi again, This version of the SURBL filter script only works under Windows 2000 and later. I will try to adjust the script so that it also can be used on Windows NT 4. /Roger Hi, The command script that downloads the SURBL rbldns zone file, converts it to a body filter, and updates the existing filter file is available for download at http://www.botany.gu.se/download/decludescript/SURBL_filter.zip. I have included a short readme file and added comments to the script. It will take a day or two before the log analysis and test check scripts are available, since I must adjust them to handle all log levels. /Roger --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] tricks for dealing with null senders?
Using Imail 6.05, and Declude 1.79 beta on NT4.0 I've had a spate of crud flowing in the last week or so from @variousaddresses addressed to [EMAIL PROTECTED], which of course get turned away as the addressee is unknown to my mail server. Unfortunately there seems to be such a flood of the damned things that it ends up stalling the iwebmsg service and consuming 100% cpu so a number of times a day I have to shut the iwebmsg service down, which can take up to 20 minutes to accomplish. I've had to turn off accepting null senders just to grab my breath. Whats the quick and dirty solution, some sort of hold action? is there a way to configure a declude test to action these messages? please forgive if this seems a stupid question, i'm pretty foggy after a 4 AM hard drive replacement on a different machine Thanks for any answers Royce Burnett CICI --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Paypal phish not detected by spamdomains
I see, I missed that. I just like to lay down extra points on the phish schemes. Thanks Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/14/04 02:33PM Because the sender was not listed as @paypal.com. Look at this line: X-Declude-Sender: [EMAIL PROTECTED] [66.36.241.111] John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Wednesday, April 14, 2004 12:23 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Paypal phish not detected by spamdomains This paypal phish got through without being detected by the spamdomains. Can anyone explain it? Spamdomains line: @paypal.com .paypal. Headers: Received: from imail.Farmprogress.com by farmprogress.com; Tue, 13 Apr 2004 18:45:39 -0500 Received: from web.numberoneserver.com [66.36.241.111] by imail.Farmprogress.com with ESMTP (SMTPD32-8.05) id AB986EFB0044; Tue, 13 Apr 2004 18:45:28 -0500 Received: (from [EMAIL PROTECTED]) by web.numberoneserver.com (8.11.6/8.11.6) id i3E00bo13908; Tue, 13 Apr 2004 20:00:37 -0400 Date: Tue, 13 Apr 2004 20:00:37 -0400 Message-Id: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [JSpamFilter-25]Notification of PayPal Limited Account Access From: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Errors-To: [EMAIL PROTECTED] X-Mailer: MSOUTLOOK / 4.3.2 Content-type: text/html; charset=iso-8859-1 X-Declude-Sender: [EMAIL PROTECTED] [66.36.241.111] X-Declude-Spoolname: D7b986efb00442884.SMD X-Note: Spam tests: SNIFFER-OBFUSCATION, OBFUSCATION, COUNTRY-FILTER, WEIGHT20, WEIGHT25, WEIGHT25COPY. X-Note: Total spam weight of this e-mail is 27. X-Note: Reverse DNS sls-cb9p8.dca2.superb.net . Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SURBL filter script
The command script that downloads the SURBL rbldns zone file, converts it to a body filter, and updates the existing filter file is available for download at http://www.botany.gu.se/download/decludescript/SURBL_filter.zi p. I have included a short readme file and added comments to the script. Wow! Great script. Downloaded, unpacked, set the script location, works fine! Any suggestions on how often we should update the file? Hourly, daily, ... Thank you Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Gibberish and Anti-Gibberish Testing
Scott is of course correct. If you are using Declude 1.78+ (beta and interim releases), there are single file versions of these filters that will only show a hit when they actually score, and they are also a lot more efficient. They can be found in the following location: http://www.mailpure.com/software/decludefilters/beta/ Matt Scott Fisher wrote: I know [EMAIL PROTECTED] has new filters out in his Beta area that don't utilize the anti-gibberish test. There is just a gibberish and a gibberish-sub tests. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/14/04 09:57AM I have been using the SPAM filters from MailPure and I have notices that the Anti-Gibberish Test has been triggered a lot more than the Gibberish test (5:1 ratio) The Anti-Gibberish Test has been causing a lot of SPAM to go through by applying negative weight to the message. I was wondering if there was a way to skip the Anti-Gibberish Test if the Gibberish is not triggered. (This goes to all the test that contain an "Anti-" test) Isaias Hernandez Internet Tech Support [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
Re: [Declude.JunkMail] Gibberish and Anti-Gibberish Testing
Sheldon, I did decide last year not to try to keep two different sets of files updated at the same time. Those using 1.78+ should definitely be using the versions in the beta directory because they have additional counterbalances and other improvements. Matt Sheldon Koehler wrote: I know [EMAIL PROTECTED] has new filters out in his Beta area that don't utilize the anti-gibberish test. There is just a gibberish and a gibberish-sub tests. I was beginning to wonder as nothing new has been posted at http://www.mailpure.com/software/decludefilters/ since last year. Sheldon Sheldon Koehler, Sr. SysAdminhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] SURBL filter script
I agree. It took 10 minutes to get this test working. And many of the domains listed were in my e-mails that are (hopefully were) falling into that gray area. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/14/04 04:48PM The command script that downloads the SURBL rbldns zone file, converts it to a body filter, and updates the existing filter file is available for download at http://www.botany.gu.se/download/decludescript/SURBL_filter.zi p. I have included a short readme file and added comments to the script. Wow! Great script. Downloaded, unpacked, set the script location, works fine! Any suggestions on how often we should update the file? Hourly, daily, ... Thank you Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 1.79 release notes
Will the release notes be updated now that 1.79 is a beta? Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 1.79 release notes
Will the release notes be updated now that 1.79 is a beta? They were, but the new web site needs the new information. We're in the process of going through the changes to the old web site that haven't made it to the new web site, but somehow tech support seems to be taking priority. :) -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ARGOLINKs SPAM Graph
OT, A little, any body got it going? I got it to display just the page with the word GRAPH on it. Using Windows 2003.
Re: [Declude.JunkMail] tricks for dealing with null senders?
Hi Royce- How are you rejecting the messages? Do you use a nobody alias with an autoresponse, or do you just let Imail return the standard error message? Any idea how many you're getting? It seems odd that this would effect iwebmsg. Look for another problem somewhere. How many files do you have in your spool directory? -Dave - Original Message - From: Royce Burnett [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 3:43 PM Subject: [Declude.JunkMail] tricks for dealing with null senders? Using Imail 6.05, and Declude 1.79 beta on NT4.0 I've had a spate of crud flowing in the last week or so from @variousaddresses addressed to [EMAIL PROTECTED], which of course get turned away as the addressee is unknown to my mail server. Unfortunately there seems to be such a flood of the damned things that it ends up stalling the iwebmsg service and consuming 100% cpu so a number of times a day I have to shut the iwebmsg service down, which can take up to 20 minutes to accomplish. I've had to turn off accepting null senders just to grab my breath. Whats the quick and dirty solution, some sort of hold action? is there a way to configure a declude test to action these messages? please forgive if this seems a stupid question, i'm pretty foggy after a 4 AM hard drive replacement on a different machine Thanks for any answers Royce Burnett CICI --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New test
I'd like to test it also. -Dave - Original Message - From: Bud Durland To: Declude List Sent: Wednesday, April 14, 2004 8:58 AM Subject: [Declude.JunkMail] New test I am testing a small external test program. A message fails the test if there is an discernable IP address in the HELO entry of the message. These fail the test: Received: from host-68-212-107-146.msy.bellsouth.net [68.212.107.146] by mrpcap.com Received: from ip-62-129-160-91.evhr.net [62.129.160.91] by mrpcap.com Received: from acs-24-154-41-142.zoominternet.net [24.154.41.142] by mrpcap.comOnly the bolded part of the line (HELO name) is tested. Basically, dashes become 'dots', and anything other than numbers and dots are stripped out. If what remains looks like a valid 4-octet IP address, the test fails.These entries would NOT fail -- stray number make the location of the IP ambiguous Received: from wbar3.lax1-4-8-227-083.dsl-verizon.net [4.8.227.83] by mrpcap.com Received: from c-24-125-42-12.va.client2.attbi.com [24.125.42.12] by mrpcap.com For testing, I set it up with 0 weight and a HOLD action. So far, it has not flagged anything that was not spam.If anyone is interested in trying it out, let me know. I'll probably be putting it up for download from my web site later this week.-- --- illigitimi non carborundum --- Bud Durland, CNE Mold-Rite Plastics Network Administrator http://www.mrpcap.com ---
Re: [Declude.JunkMail] ARGOLINKs SPAM Graph
Terry, I orginally looked at the argolink spam graph, but as the doc's mentioned it goes through the full log file from beginning to end. Our log files are big, but it would tie up the cpu for a bit ~10-15 minutes. We just finished a seperate program that can be used with MRTG to graph junkmail stats. The program is done and I am using it. I just have to package it up and write some small doc's on it. I am in the process of finishing up the program that can be used to link Imail to MRTG as well. Both will be made available for free shortly. I will send a note out when everything is posted on our site.. Darrell Terry Parks writes: OT, A little, any body got it going? I got it to display just the page with the word GRAPH on it. Using Windows 2003. Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.invariantsystems.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Notification to customers of change of ownership
We are likely going to be moving from Imail for our student email server to an Exchange 2003 server (as a mate to the staff faculty server). You might then be interested in MilterSink (announced earlier), which will incorporate limited support for Declude (all tests, but not all actions, are expected to be available). --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Notification to customers of change of ownership
I subscribed to that other list - but have yet to see any emails? Is that to be expected? (I'm in Digest mode). Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Wednesday, April 14, 2004 11:42 PM To: Richard Edge Subject: Re[2]: [Declude.JunkMail] Notification to customers of change of ownership We are likely going to be moving from Imail for our student email server to an Exchange 2003 server (as a mate to the staff faculty server). You might then be interested in MilterSink (announced earlier), which will incorporate limited support for Declude (all tests, but not all actions, are expected to be available). --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] Notification to customers of change of ownership
I subscribed to that other list - but have yet to see any emails? Is that to be expected? (I'm in Digest mode). That list's Digest mode is both size-based and time-based, but you wouldn't have received messages yet in either case, as I just sent the first official message to the list about an hour ago. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
I have been using this program for months with no problem but you guys managed to break it in a matter of hours. :) I guess that I should have called it a BETA release! Anyway, that's what I call it now (v1.4B). I have fixed the problems that you have pointed out to me and have added the following: 1) The output file (wamlog.txt) goes in the same folder as the log file. 2) There is a progress counter so you know it is working. If you find any more problems PLEASE let me know. Thanks, Bill The new version is as of 11:40 am CDT 4/14/04. www.wamusa.com/wamtools Hi, I have a utility to do a quick analysis of my decMMDD.log file to discover test effectiveness. If anyone would like to use it, I have it available for free from my website: http://www.wamusa.com/wamtools The program is designed for LOGLEVEL MID but it may work for other levels. My system analyzed this 120Mb decMMDD.log in less than one minute. This is a sample output: Message Recipient Test Name Fail Count %Fail Count % WEIGHT10 116362 96 169684 96 SNIFFER2 114790 94 167322 95 WEIGHT15 112700 93 165299 94 WEIGHT20 108443 89 159758 91 WEIGHTDEL 108443 89 159758 91 SPAMCOP 84740 70 129602 73 SBL 52552 43 53879 30 AHBL 48506 40 57094 32 CBL 46445 38 89827 51 DSBL 39527 32 77743 44 SORBS-DUHL 29673 24 58427 33 REVDNS 28996 23 41544 23 BADHEADERS 27493 22 34922 19 SORBS-SPAM 25119 20 27995 15 NOPOSTMASTER 22488 18 46530 26 NOABUSE 21746 17 42732 24 SPAMHEADERS 19613 16 20587 11 SPAM-DOMAINS 15263 12 33776 19 ROUTING 120419 25060 14 FOREIGN 100988 163309 GIBBERISH90727 99325 DSN84847 137557 SORBS-HTTP65845 124597 SORBS-SOCKS65085 126977 SPFFAIL49544 65273 BLITZEDALL33502 59913 BASE6422521 29561 MAILFROM16841 28411 COMMENTS13281 20561 MYFILTERFAIL11590 17230 WAMO 58506090 MYFILTERPASS 5120 12390 SORBS-MISC 50409230 SORBS-SMTP 4450 11320 OBFUSCATION 36004570 ORDB 31606540 SORBS-WEB 31605140 SORBS-ZOMBIE 28002800 SPFPASS 20802340 BONDEDSENDER 620 620 @LINKED 100 140 HABEAS 40 40 WAMCHECK 10 20 Message Count 120934 175163 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] [Declude.Virus] Scott, what do you use to generate this report
Some low priority suggestions: - Change fail wording in the header to trigger or hit or something. - Ignore Declude directives, e.g. LOOSENSPAMHEADERS, HOPHIGH, CONSOLE, PREWHITELIST ... Thanks for the suggestions. I did try to ignore Declude directives but I went by the manual. These are the directives that I am ignoring: WHITELIST LOGFILE LOGLEVEL CODE HOP XINHEADER XOUTHEADER XSENDER XSPOOLNAME HIDETESTS IPBYPASS DNS AUTOWHITELIST WHITELISTFILE If anyone can provide me with a complete list, I will make the modification. Thanks, Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
