[Declude.JunkMail] all_list.dat

2007-06-29 Thread Bonno Bloksma
Hi, I'm using the all-list.dat from may 2007. Occasionaly I was checking the declude junkmail logs to see if any new problems with unknown networks would arise. But today I found out that information is not in the Declude log at level high. In the headers of a mail I found: X-Country-Chain:

RE: [Declude.JunkMail] Re: PDF spam detection

2007-06-29 Thread David Barker
Just a quick question I have noticed that these PDF files all have the following string in the first line is there something I am missing ? I have been using it to catch these spams any thoughts ? BODY 3 PCRE (JVBERi0xLjMgCjEgMCBvYmoKPDwKPj4KZW5kb2JqCjIgMCBvYmo)

Re[2]: [Declude.JunkMail] Re: PDF spam detection

2007-06-29 Thread Pete McNeil
Use caution. The first part of the PDF file is common to many PDF files and coding for that will lead to false positives. The PDFs we're seeing are essentially boiler plate up to the first 12 lines (or so) of base64 encoded data, then there are some variable segments where the image display

re: [Declude.JunkMail] all_list.dat

2007-06-29 Thread Gary Steiner
The corrupt RIPE data should be referring to 145.53.30.139. Though if you go to www.ripe.net and do a search, 145.53.0.0/16 is listed as belonging to Planet Technologies with an email address of [EMAIL PROTECTED] and being in The Netherlands. Which is essentially the same as the listing for

Re: [Declude.JunkMail] all_list.dat

2007-06-29 Thread Bonno Bloksma
Hi, I understand the dynamic nature of the network assingments. That was why I wrote part 2 of my message. I like to have a way to see how many errors I get about corrupt data. If it's just a few per week, no problem. If it gets to be sever a day maybe it's time for a new all_list.dat. Right

RE: [Declude.JunkMail] all_list.dat

2007-06-29 Thread Colbeck, Andrew
I believe that the data isn't actually corrupt. The crux of the issue: What R Scott Perry objected to when he was the sole programmer was that the EU is a political body, and that the RIPE data should be stating the exact country that the IP allocation is in. If the IP is in the Netherlands,

[Declude.JunkMail] invURIBL 3.0.7 Released

2007-06-29 Thread Darrell ([EMAIL PROTECTED])
For those using invURIBL with Declude we have released an update today. For more information http://www.invariantsystems.com/invuribl/ Any questions let me know, Darrell -- Check out http://www.invariantsystems.com for utilities for Declude, Imail, and