[Declude.JunkMail] Auto Sales Spam

Has anyone come up with a filter to deal with the rash of new car sales spam that has recently gotten bad? There doesn't seem to be much to filter on from a content standpoiint. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.

RE: [Declude.JunkMail] No one at Declude?

Was anyone able to download the all_list.dat file from the interim directory that David posted? Everything else downloaded for me except that file. -Original Message- From: David Barker [mailto:david.bar...@mailsbestfriend.com] Sent: Thursday, April 18, 2013 8:37 AM To: Declude.JunkMail@d

RE: [Declude.JunkMail] No one at Declude?

t: Re: [Declude.JunkMail] No one at Declude? HI Dave, Maybe we are looking at different cross-sections of the spam problem, but on our systems we see a lot from spammy domains that are not brand new. Darin. From: Dave Beckstrom <mailto:db...@atving.com> Sent: Wednesday, April 17, 2013

[Declude.JunkMail] Sample global.cfg ?

Is there a current sample global.cfg available? I haven't looked through mine in awhile and I may have some outdated RBLs, etc. Would like to see the current sample just to get an idea of what may have changed. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, ju

RE: [Declude.JunkMail] Thank you for your email. I will be out of the office from 4/15/2013 until 4/19/2013. Dur

Everyone better add a filter to delete messages with Dan's name until he gets back. Can you say viscious circle? -Original Message- From: Daniel Slentz [mailto:dsle...@oasisol.com] Sent: Saturday, April 13, 2013 3:19 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Thank y

RE: [Declude.JunkMail] No one at Declude?

Someone should start up a new discussion list that everyone can join before this one goes away. It would be good to have a place to continue collboration. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsub

[Declude.JunkMail] Whois Tests?

A significant number of spams are referencing links to domains that were created within say the last 7 - 10 days. I believe its because they are created with bad credit cards. The spam is sent and by the time the registrar finds out the credit card was bad the spammer is done using the domain and

[Declude.JunkMail] Joe Jobs

Hi All, This isn't specifically a Declude question but I thought I'd ask anyway as its still of interest to the group, I think. I have one domain that is being referenced in a Joe Job. Essentially, a spammer sends out thousands of emails using various compromised computers. In the "FROM" field,

[Declude.JunkMail] Whitelist emails with attachments?

Is there a way in declude to either whitelist or set a filter giving credit (negative weight), when an email sent to a specific user/domain has an attachment attached to it? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.c

RE: [Declude.JunkMail] Dealing with Joe Jobs?

f the bounces. Usually the joe-job lasts for 1-2 weeks and then it's over. Hope this helps, Darin. - Original Message - From: "Dave Beckstrom" To: Sent: Tuesday, December 06, 2011 7:12 PM Subject: [Declude.JunkMail] Dealing with Joe Jobs? Hi All, This isn't a D

[Declude.JunkMail] Dealing with Joe Jobs?

Hi All, This isn't a Declude topic but is relevant to dealing with a sort of spam issue. I hope nobody minds discussing this. I would appreciate hearing any advice you might have to offer. I have a customer who's domain is being used for Joe Jobs. Someone is randomizing email addresses for thi

RE: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body?

I get the same behavior with smartermail. I also run into (frequently) situations where it strips off attachments and people complain they don't receive their files. I have also seen where spam will skate right on past filters that should have triggered. I suspect there is some very specific ser

[Declude.JunkMail] ISIPP SuretyMail Accredited email - spammer?

Just received a spam with these headers: X-IADB-IP: 65.98.250.238 X-IADB-IP-REVERSE: 238.250.98.65 X-IADB-URL: http://www.isipp.com/iadb.php Received: from AGENT-01.ED.SAC ([10.10.0.24]) X-Mailer: EDM List-Unsubscribe: <

RE: [Declude.JunkMail] Idea for new Declude add-on

sion of Declude was created to work with Smartermail. John T eServices For You -----Original Message- From: "Dave Beckstrom" Sent 2/18/2011 9:46:15 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Idea for new Declude add-on I installed autowhite. This

RE: [Declude.JunkMail] Idea for new Declude add-on

Sanford, I'm not complaining. I'm saying that there is an opportunity for someone to write the utility I suggested. I'd write it except the languages I code wouldn't be a good choice for something like this. -Original Message- From: Sanford Whiteman [mailto:sa...@cypressintegrated.com]

RE: [Declude.JunkMail] Idea for new Declude add-on

n. If a user emails a recipient in what scenario would we not want to whitelist the recipients address ? -Original Message- From: Dave Beckstrom [mailto:db...@atving.com] Sent: Thursday, February 17, 2011 8:45 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Idea for new Decl

RE: [Declude.JunkMail] Idea for new Declude add-on

ubject: RE: [Declude.JunkMail] Idea for new Declude add-on Great idea Dave thanks. Question. If a user emails a recipient in what scenario would we not want to whitelist the recipients address ? -----Original Message- From: Dave Beckstrom [mailto:db...@atving.com] Sent: Thursday, February 17

[Declude.JunkMail] Idea for new Declude add-on

I have an idea for something I think would be a useful add-on for declude. Every time someone sends an outbound SMTP email to someone, the add-on would add an entry to a filter giving the recipient's "to" address a weight of minus one. Therefore, giving the recipient a credit. Any time the re

RE: [Declude.JunkMail] Filter for this?

no, I'm not seeing this particular domain or destination IP in the last 45 days. Andrew. -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Monday, February 14, 2011 2:07 PM To: declude.junkmail@declude.com Subject: [Declude.J

[Declude.JunkMail] Filter for this?

Anyone put together a filter for this? http://en.marriedcomb.com/LsyRi_xEczPyAVLP-6RXIfBHyQKlpLloCVCdRiUQj80C BkFIRsplDbsWp-UntnvcapomnOB34oekSnZlNAVa7SoEUKZSJf38K79Yq79zOT6qBNCTYzL5B1Gh PqJ5DauCbtWAubdB8kPQoicfAlkPQyyuRB1333A1YAWUvJhpVPksIVa9IVTj5SmfPzJBU23BtNGm LCRUhh-f7TYUkYiSFW1IMFkxyEq98Jf

RE: [Declude.JunkMail] Blocking on no REV DNS?

show that he may have FOUND the problem by trying to email US, but that in fact, his emails to most places on the Internet are being silently deleted, held or flagged as SPAM - without giving him a warning as WE do. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave

[Declude.JunkMail] Blocking on no REV DNS?

Years ago it was recommended not to block mail on a missing reverse DNS because many legitimate mail servers were mis-configured. We know services like AOL block on missing DNS. Just wondering, do you block on missing REV DNS? If not, do you at least add weight? I'm getting to the point w

RE: [Declude.JunkMail] Good filter?

clude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Good filter? Provided the prefix to these is either www or http:// the regex will trigger on these From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Monday, October 18, 2010 10:02 AM To: declude.ju

RE: [Declude.JunkMail] Good filter?

General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm _ From: "Dave Beckstrom" Sent: Monday, October 18, 2010 9:38 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Good filter? There is pervasive spammer who

RE: [Declude.JunkMail] Good filter?

ticket: https://www.skywaves.com/content/secure/support_ticket.htm _ From: "Dave Beckstrom" Sent: Monday, October 18, 2010 9:38 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Good filter? There is pervasive spammer who's uri pattern for the linked spam site i

[Declude.JunkMail] Good filter?

There is pervasive spammer who's uri pattern for the linked spam site is pretty consistent. They all have a "/" followed by some kind of home-grown obfuscation which his server recognizes: http://cja244.larickcoppas.com/

[Declude.JunkMail] Server AV Scanner

Hi Everyone, I sold off the lion's share of my web business 3 years. I still host a few sites for some people who have been with me for a really long time. But I don't have the revenue I once did and hence can't afford to renew Declude (I'm running an older version) or buy any software. I used

RE: [Declude.JunkMail] Regex to block this?

only lower case hex codes so you can exclude (g-z) > I've seen lots of .info and a few .nets as additional tld. > Very active spammer here > > (?i:href=.+\.(com|info|net)/[a-f0-9]{37,38}">) > > -Original Message- > From: supp...@declude.com [mailto:sup

[Declude.JunkMail] Regex to block this?

I'm getting hit by one spammer who manages to get through most of my filters. His spam consistently uses the format of: http://gcc128.blinksroads.com/5768cbbeb6bba86c3157116a6de8e54b31dab5";> http://gcc128.blinksroads.com/images/157286c08.jpg"; How would I write a regex that would look for .

[Declude.JunkMail] Blocking domains by DNS server?

There is a pervasive spammer out there, where the common denominator in the jerk's spam is the fact that all of the domains in the body of the email are served by DNS servers NS1.domainsite.com - NS4.domainsite.com. I want to block all email where a link in the body is resolved by one of those DN

[Declude.JunkMail] PowerMTA

I'm seeing a lot of spam with this in the headers: PowerMTA(TM) v3.0c2 Is powerMTA mainly a spam tool or do legitimate mailers use it too? Just trying to decide if I can add some weight if that header exists. Also of late I'm seeing a lot of spam containing ssl in part of the domain name: Retu

[Declude.JunkMail] Testing Spamcop blocked?

Does the spamblock IP4R always return "blocked" if an IP is found or can it return something less severe than blocked? Just wondering if there is a way to hold on "blocked" and warn on a less severe hit. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send

[Declude.JunkMail] 3rd party tool to call registrar/whois lookup?

Much of the spam we receive contains embedded links for, or from, domains registered within the last 2 - 3 weeks. Is there a 3rd party utility that could be called from Declude which would check the domain registration date and either block or add weight to any domain registered within the last

[Declude.JunkMail] Senderbase

I would like to use senderbase with Declude. Does anyone happen to know if there is a way to extract the entire list of IPs with a POOR reputation from senderbase? I know that it can be done vie export but it seems to be limited to certain IP ranges at a time. Does senderbase have any kind of

RE: [Declude.JunkMail] Mailfrom Processing

ive the > ability to look for patterns rather than straight matches. > > > David Barker > VP Operations Declude > Your Email security is our business > 978.499.2933 office > 978.988.1311 fax > dbar...@declude.com > > > > -Original Message- >

RE: [Declude.JunkMail] Spam Score?

would still like to see some people post their ip4r tests to the list. I have a hunch I'm missing some valuable tests in my list. Thanks, Dave > -Original Message- > From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave > Beckstrom > Sent: 2009

RE: [Declude.JunkMail] Spam Score?

MNOMATCH > > David Barker > VP Operations Declude > Your Email security is our business > 978.499.2933 office > 978.988.1311 fax > dbar...@declude.com > > > > -Original Message- > From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave &

[Declude.JunkMail] Spam Score?

Something is happening with our spam score that I don't quite understand. If you look below at the (sanitized) email headers you'll see that the CBL test scored 6 and spamheaders scored 3 and yet the final score for this email was Spam Score: [1] Shouldn't the score have been 9? On another note,

RE: [Declude.JunkMail] Regex

Regex > > I would say you have it pretty much down. If I did it I would have this > > (?i:as.{0,2}seen.{0,2}on.{0,2}(?:oprah|60.{0,2}minutes)) > > You have an extra . between seen and on > > David B > > -Original Message- > From: supp...@declude

[Declude.JunkMail] Regex

Trying to filter on: Asseenon Oprah As seen on Oprah As seen on 60 minutes Asseenon 60 minutes As seen on 60-minutes This regex matches on, for example, "asseen on 60 minutes" but does not match on "asseenon 60 minutes" What did I do wrong? Is there a better way to code this? ANYWHERE

RE: [Declude.JunkMail] Mailfrom Processing

> David Barker > VP Operations Declude > Your Email security is our business > 978.499.2933 office > 978.988.1311 fax > dbar...@declude.com > > > > > -Original Message- > From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave > Beck

RE: [Declude.JunkMail] Mailfrom Processing

What filter will trigger on the words "John Cummuta" when the from address is formatted like: From: "John Cummuta" Neither the mailfrom or headers filters are triggering on this. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@d

RE: [Declude.JunkMail] Mailfrom Processing

hdr or q*.smd) and matches > just on the email address. > > > David Barker > VP Operations Declude > Your Email security is our business > 978.499.2933 office > 978.988.1311 fax > dbar...@declude.com > > > > -Original Message- > From: supp...@d

[Declude.JunkMail] Mailfrom Processing

I have a question about the MAILFROM processing. Does this look at the display name too or just at the actual email address? I was trying to block the Loud N Clear ads by referencing the display name because it seemed to be pretty consistent while the email address itself didn't change. I set

RE: [Declude.JunkMail] BadHeaders?

dicates a incorrect Message-ID: > in the header. > > David B > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave > Beckstrom > Sent: Wednesday, April 30, 2008 12:36 PM > To: declude.junkmail@declude.com > Subject: [Dec

[Declude.JunkMail] BadHeaders?

Hi Everyone, We have an application that generates email using Cold Fusion. The application sends email to me. The email never goes outside of our servers. Declude is flagging the email as having BadHeaders: X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8004000e].

[Declude.JunkMail] No Reverse DNS pointer?

Hi Everyone, I have two questions: 1) If a mail server is configured without a reverse DNS pointer, is that enough to prevent email from reaching AOL, Yahoo, Hotmail, etc? 2) Do you block email coming from mail servers with no reverse DNS? Thanks, Dave --- This E-mail came from the De

[Declude.JunkMail] INVURIBL WEIGHT?

Hi everyone, I would appreciate hearing some opinions. How heavy are you weighing INVURIBL? Would half of the hold weight be too much weight? Would you hold on INVURIBL alone? Thanks, Dave No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database:

RE: [Declude.JunkMail] Filters not triggering - David Barker

ot triggering - David Barker > > Dave, > > Do you have a ticket number ? if so email me so I can follow up on the > ticket for you - this needs to be addressed with support, not on the lists. > > Thanks > David B > > -Original Message----- > From: [EMAIL PR

RE: [Declude.JunkMail] Filters not triggering - David Barker

t; > > > > -Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave > Beckstrom > Sent: Monday, April 07, 2008 8:58 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker > >

RE: [Declude.JunkMail] Filters not triggering - David Barker

etter to use > > SUBJECT 0 PCRE(?i:(discount|off).{0,2}Co(upon|de)) > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave > Beckstrom > Sent: Monday, April 07, 2008 2:42 PM > To: declude.junkmail@declude.com >

RE: [Declude.JunkMail] Filters not triggering

antsystems.com for utilities for Declude, > Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, > SURBL/URI integration, MRTG Integration, and Log Parsers. > > > Dave Beckstrom wrote: > > Hi Darrell, > > > > Yes, there are spaces and/or tabs between the

RE: [Declude.JunkMail] Filters not triggering

w Queue Monitoring, > SURBL/URI integration, MRTG Integration, and Log Parsers. > > > Dave Beckstrom wrote: > > Hi Everyone. > > > > I have a filter set up to delete an email if the subject line contains the > > keyword in the filter. For some odd reason, the

[Declude.JunkMail] Filters not triggering

Hi Everyone. I have a filter set up to delete an email if the subject line contains the keyword in the filter. For some odd reason, the filter is not triggering and it really has me baffled. I could use some suggestions on this one. The filter is called: Filter_Subject_delete.txt Here are th

RE: [Declude.JunkMail] OT: Yahoo Blocking Email

Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, February 21, 2008 12:59 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] OT: Yahoo Blocking Email Rob, We are using domain keys and reverse DNS as well as

RE: [Declude.JunkMail] OT: Yahoo Blocking Email

o stop. > > Never send bulk E-mail from a hosted mail server, and it is > > also good to > > use a different domain for bulk mailing. I'm not saying that is the > > case here, but bulk mailing can trip Yahoo. > > > > In the mean time, you might want to se

[Declude.JunkMail] OT: Yahoo Blocking Email

Hi All, Has anyone figured out how to stop Yahoo from blocking email? They've blocked all email from our servers for about 3 weeks. I've submitted their forms but it hasn't done any good. Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail

RE: [Declude.JunkMail] Blackice Server Settings

supports blackice and it is no longer in production , what > are users replacing it with ? > > > Howard Smith > . > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave > Beckstrom > Sent: Wednesday, September

RE: [Declude.JunkMail] Interesting Spam

atever service > you're using to look up the registrations is probably using a database > at least a day behind. > > I use (for example) this site to my satisfaction: > > http://whois.domaintools.com/sdsdm.com > > > > Andrew. > > > > -Original M

RE: [Declude.JunkMail] Interesting Spam

're using to look up the registrations is probably using a database > at least a day behind. > > I use (for example) this site to my satisfaction: > > http://whois.domaintools.com/sdsdm.com > > > > Andrew. > > > > -Original Message- >

[Declude.JunkMail] Interesting Spam

We're getting a rash of spam that doesn't score high enough to be blocked. In the past I've looked up the domain owner of the site listed in the spam and been able to identify sometimes dozens of domains owned by the spammer, then I've put that list into a filter and blocked the domains before they

RE: [Declude.JunkMail] New PDF worm?

ailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 9:02 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? It didn't work. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesd

RE: [Declude.JunkMail] New PDF worm?

TECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 5:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? David, I just sent you a bunch of samples. If you can update the filter before you knock off for the day I&

RE: [Declude.JunkMail] New PDF worm?

leave today. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 5:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? David, I just sent you a bunch of samples. If you can update the filter before you

RE: [Declude.JunkMail] New PDF worm?

PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 3:15 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? I installed the filter below and we've had about 50 PDFs that came through today. Does the filter need to be revised or is there s

RE: [Declude.JunkMail] New PDF worm?

I installed the filter below and we've had about 50 PDFs that came through today. Does the filter need to be revised or is there some other method I should be looking into using? Thanks! Dave _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Mon

RE: [Declude.JunkMail] Spam Increase?

Sorry guys...I've not been able to stay on top of discussions here for a few weeks and I'm sure I missed discussion about how you're catching the PDF spam. Does someone have a filter they are using for PDF spam that they could post for me? Thanks, Dave > -Original Message- > From: [EMAI

[Declude.JunkMail] OT: Yahoo Email Problems

Sorry about the off-topic post. This is the only email server software related list that I am on. I tried to send a couple of email to a Yahoo group and received this message back: Reason: Remote host said: 451 qq unable to read configuration (#4.3.0) Is that a problem with Yahoo or are they

RE: [Declude.JunkMail] Image spam

I'm confused. I understood that if you host multiple email domains on a mail server that you're considered a hosting company and can't purchase commtouch? At least I vaguely recall something to that affect. I checked Declude's site and I don't see commtouch listed on there anywhere (it used t

RE: [Declude.JunkMail] Need help - mail server sending out stock reports email - process found "ssm"

Our black ice display has been showing: "[Suspicious Activity] This signature detects PE/COFF executable files that have been packed using the UPX tool. While the presence of a UPX packed executable does not in itself represent an attack, it can be considered an anomaly. The UPX tool is commo

RE: [Declude.JunkMail] SmarterMail 4.0 is released

> > SmarterTools just released the next major version of SmarterMail. It has been > rewritten in ASP.NET 2.0 from which they claim across the board performance > improvements. Major new features include greylisting and built-in ClamAV, as well as > better features for use as a gateway. For a l

[Declude.JunkMail] Image Spam

Sniffer tags some of the image spam we receive but much of it doesn't score high enough for a hold weight. Is Declude or anyone else working on anything new that will be more effective at catching image spam? We're not eligible for Interceptor because we host email for some other companies. Wh

RE: [Declude.JunkMail] OT: Yahoo delivery problems

Thank you all who replied to my inquiry about the Yahoo deliver problems! Good to know I'm not on a blacklist. This was the first we've encountered problems with yahoo so we must have just hit it at a time they were having problems. Thanks again, Dave --- This E-mail came from the Decl

[Declude.JunkMail] OT: Yahoo delivery problems

Hi Everyone, This isn't a Declude question but with all of the expertise here I knew someone could help. Please forgive the off-topic message. I'm receiving a bunch of deliver failures today for Yahoo. The message is: Failed Recipient: [EMAIL PROTECTED] Reason: Remote host said: 451 Message te

RE: [Declude.JunkMail] RE: Declude's To-Do List

David, You also need to add a new whitelist tag (whitelistunique?) that only whitelists the "TO" recipient if it's the only recipient for the email. This bit about whitelisting all recipients if one is whitelisted is a problem. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EM

RE: [Declude.JunkMail] Whitelisting flaw in Declude?

message go through to one recipient and not to others, except in the situation of lists which is a whole other topic. Darin.  - Original Message -From: "Dave Beckstrom" <[EMAIL PROTECTED]>To: Sent: Tuesday, October 17, 2006 3:11 PMSubject: RE: [Declude.JunkMail] Whitelisting

RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker

ll postmaster and > abuse addresses for all domains. > > That way we don't have a need to whitelist to these addresses, and we have > fine-grained control over what we let through to them. > > Darin. > > > - Original Message - > From: "Dave Becks

RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker

iltering system > > alter that. Add to the header, yes. Alter the recipients, no. > > > > Also, I have not come across a situation where I wanted to let a > > message go through to one recipient and not to others, except in the > > situation of lists which is a whol

[Declude.JunkMail] OT: Stupid Spammer Humor

Received a paypal phishing scheme spam this morning. Note the url: www.chainmailstore.com/scamerchantsrow/phpSecurePages/www.paypal.com/cgi-bin /us/cmd/webscr-cmd=_login/index.php I got a kick out of the scamerchantsrow in the url. Scammer --- This E-mail came from the Declude.Jun

RE: [Declude.JunkMail] Whitelisting flaw in Declude?

one recipient and not to others, except in the situation of lists > which is a whole other topic. > > Darin. > > > - Original Message - > From: "Dave Beckstrom" <[EMAIL PROTECTED]> > To: > Sent: Tuesday, October 17, 2006 3:11 PM > Subject: R

RE: [Declude.JunkMail] Whitelisting flaw in Declude?

gt; Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG > Integration, and Log Parsers. > > - Original Message - > From: "Dave Beckstrom" <[EMAIL PROTECTED]> > To: > Sent: Tuesday, October 17, 2006 11:18 AM > Subject: [Declude.

[Declude.JunkMail] Whitelisting flaw in Declude?

If an email is received that is addressed to multiple recipients, one of whom is whitelisted, does Declude treat the email as whitelisted for all recipients? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubs

RE: [Declude.JunkMail] Interesting SMTP connection patterns

uldn't provide any support. > > -Jay > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave > Beckstrom > Sent: Thursday, October 12, 2006 7:38 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Interesting SM

RE: [Declude.JunkMail] Interesting SMTP connection patterns

are sending spam to... > > Darrell > --- > Check out http://www.invariantsystems.com for utilities for Declude, Imail, > mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI > integration, MRTG Integration, and Log Pars

RE: [Declude.JunkMail] Interesting SMTP connection patterns

automatically. > > Its pretty slick. > > Kindest Regards > Craig Edmonds > 123 Marbella Internet > W: www.123marbella.com > > > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave > Beckstrom > Sent: T

[Declude.JunkMail] Interesting SMTP connection patterns

Yesterday I took a snapshot of the SMTP connections active on our server. I then did a reverse IP to find out where they were from. Below are the results. You can see someone from Thailand had 5 SMTP connections active and Spain had 4. You can also see that only 3 of the IPS connected were for

RE: [Declude.JunkMail] picture spam

>You guys should have made a deal with Pete instead of CommTouch.  Sniffer blows it >out of the water and he has no licensing restrictions.  IMO of course. > >Matt Matt, They should have made a deal with Pete and done it so as to keep the cost down. At $295 a year it wasn't priced unreas

RE: [Declude.JunkMail] picture spam

Chris,   According to Declude’s web site, any business that provides email to customers can’t use commtouch.  That pretty well rules out most of the people on this list.   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of chris Sent: Thursday, October 12, 2006 9:1

[Declude.JunkMail] INV-URIBL Scoring?

Hi Guys, Considering that INV-URIBL looks at just the links contained in known spam, is it safe to set the weight on this test so high that this single test would trigger a hold or delete weight? Right now I have it set to score fairly low, and it adds to the total score, but would not cause a h

RE: [Declude.JunkMail] Blocking these?

> -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dave > Beckstrom > Sent: Wednesday, October 04, 2006 8:42 PM > To: declude.junkmail@declude.com > Subject: [Declude.JunkMail] Blocking these? > > > How are you guys blocking s

RE: [Declude.JunkMail] Blocking these?

mmm... I thought it did run with the old data file. At the very least you > could run with the trial key, which would use an older rulebase. > > Note that running an old rulebase will mean much of this rapidly changing > spam will get through. > > Headers would help... >

RE: [Declude.JunkMail] Blocking these?

of these. What do the headers look like? > > Darin. > > > - Original Message - > From: "Dave Beckstrom" <[EMAIL PROTECTED]> > To: > Sent: Wednesday, October 04, 2006 11:42 PM > Subject: [Declude.JunkMail] Blocking these? > > > How

[Declude.JunkMail] Blocking these?

How are you guys blocking something like the spam below? There is no URL to block on. They keep bastardizing words in the body of the email to the point where you can't hardly block based on the content. What do you guys do with these? -Original Message- From: Louis Rubin [mailto:[

RE: [Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7

Chris, Will Declude be repackaging the install with the defaults set to mimic the old behavior?   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of chris Sent: Friday, September 29, 2006 9:29 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Cri

RE: [Declude.JunkMail] Blackice Server Settings

I’m leaving town in a little bit and I won’t be back until Sunday.  If someone reminds me on Sunday or Monday I’d be happy to post the settings.   Are we able to post attachments to this list?   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mike Wiegers Sent:

[Declude.JunkMail] Blackice Server (was] Spam Spike)

is it to configure this? Current price I find is $300. > > G.Z. > > > ----- Original Message - > From: "Dave Beckstrom" <[EMAIL PROTECTED]> > To: > Sent: Wednesday, September 20, 2006 1:08 PM > Subject: RE: [Declude.JunkMail] Spam Spike > > >

RE: [Declude.JunkMail] Spam Spike

I run Blackice Server on the mail server. It drops the connecting IP if we receive more than a user specified number of attempts for non-existent email addresses within a user specified time limit. It then blocks that IP for a user specified amount of time before removing the block. It prevents

RE: [Declude.JunkMail] 4.3.x and 3.1.x planned release

Still no fix for the broken image spam? > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David > Barker > Sent: Friday, September 15, 2006 7:59 AM > To: declude.junkmail@declude.com; declude.virus@declude.com > Subject: [Declude.JunkMail] 4.3.x and

RE: [Declude.JunkMail] Re: Why is Declude Not Scanning This?

I see about 10 - 20 per day where Declude is broken and where it doesn't scan the email and puts the Declude headers at the bottom. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin > Bilbee > Sent: Monday, September 04, 2006 10:10 PM > To: declu

[Declude.JunkMail] Message Sniffer vs Commtouch?

My message sniffer is up for annual renewal. Commtouch is over 50% less expensive than message sniffer ($445 vs $195) I have to choose between the more expensive message sniffer renewal or trying commtouch. I was wondering if anyone here has tried both products and if so which of the two worked

  1   2   >