balance to you.
TESTSFAILED END CONTAINS XBL
TESTSFAILED END CONTAINS SPAMCOP
BODY -10 PCRE (?i:Content-Type: application/pdf;)
etc. ...
Andrew.
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, June
Just a quick question I have noticed that these PDF files all have the
following string in the first line is there something I am missing ? I have
been using it to catch these spams any thoughts ?
BODY 3 PCRE
(JVBERi0xLjMgCjEgMCBvYmoKPDwKPj4KZW5kb2JqCjIgMCBvYmo)
Create a filter eg FILTER-PDF.txt and use the following lines. Adjust your
weights accordingly. Also ensure you are running Declude 4.3.46
BODY 3 PCRE
(JVBERi0xLjMgCjEgMCBvYmoKPDwKPj4KZW5kb2JqCjIgMCBvYmo)
BODY 5 PCRE (-+[0-9]+\r\n(?:[a-zA-Z\-]+:
or is this searhcing for some common
element present in the PDF Spams?
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, July 02, 2007 1:35 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm?
Create a filter eg FILTER
.
Any ideas ?
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
This would match on all you have provided, the . meaning any character
including a space {0,1} means min of 0 max of 1
(206.{0,1}888.{0,1}2083)
If you wanted to use detect O as well as the 0 [o0] also you could use the ?i:
meaning case insensitive:
(?i:2[o0]6.{0,1}888.{0,1}2[o0]83)
David B
lol, I will have to find out Thursday as the office is closed today. I will
post then.
From: Colbeck, Andrew [EMAIL PROTECTED]
Sent: Wednesday, July 04, 2007 3:37 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Country code
Effing
Can you provide an IP that had this code ?
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott
Fisher
Sent: Wednesday, July 04, 2007 12:57 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Country code
I'm detecting a new country code *F.
Can you enlighten
Todd,
Ensure you have version 4.3.46 of Declude. The format of an expression is:
LOCATIONWEIGHT PCRE(EXPRESSION)
Eg.
BODY5 PCRE(?i:Hello World)
Post some examples that you are using but not getting hits.
David
-Original Message-
)
BODY20 PCRE(?i:ERMX)
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, July 06, 2007 10:18 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] PCRE tests
Todd,
Ensure you have version
I have seen these if this is what you referring to the second line is
looking for an IP. You could try this in a filter:
BODYEND NOTCONTAINS SEEING YOUR CARD
BODY20 PCRE
(http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9
]|[01]?[0-9][0-9]?)/)
David
Cloudmark is similar to ZEROHOUR the main difference is Cloudmark is user
driven which means that the identity of spam messages comes from their user
base, where as Commtouch uses network traffic analysis and Recurrent Pattern
Detection (RPDT)
David
From: [EMAIL PROTECTED] [mailto:[EMAIL
Check your tests in the global for negative weights which bring the value
down, the negative weights are defined in the last column of your tests.
Most common are IPNOTINMX or NOLEGITCONTENT or FROMNOMATCH which are hidden
from the headers. The last column either adds or subtracts weight if the
missed in the addition: ASUNTO. ( 3 + 3
). If hidden, like NOLEGITCONTENT, should subtract '5', not '6'.
Should I stop/start declude after modifying the filters ?
TIA
Andres.
-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de David
Barker
Enviado el: Jueves
http://tools.declude.com/ Declude Header Code Test
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Troy D.
Hilton
Sent: Wednesday, July 25, 2007 2:19 PM
To: Declude Junkmail Forum
Subject: [Declude.JunkMail] BADHEADER lookup tool
Does Declude still support their BADHEADER
,
Dermot
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, July 25, 2007 2:41 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] BADHEADER lookup tool
http://tools.declude.com/ Declude Header Code Test
From
This is what I configured but did not find it to be anything out of the
ordinary.
David
#---
---
#http://www.dnswl.org/
#Categories (127.0.X.y):
# 2 - Financial services
# 3 - Newsletters
# 4 - Organisations
as they could easily be forged.
I did this with the dnsbl test. You could also do it by adding
DUL/DYNA/(there is another one too I think) in the test name.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, July 30, 2007 7:53 AM
Available from downloads section under Declude My Account home page.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just
Todd,
If this is not resolved yet please contact [EMAIL PROTECTED]
Thanks
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd
Richards
Sent: Sunday, August 05, 2007 5:19 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] FW: Problems
Of David
Barker
Sent: Monday, July 02, 2007 12:35 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm?
Create a filter eg FILTER-PDF.txt and use the following lines. Adjust your
weights accordingly. Also ensure you are running Declude 4.3.46
BODY 3
sent you a bunch of samples. If you can update the filter before you
knock off for the day I'd appreciate it. We've probably had 50 of them get
through already today.
Thanks,
Dave
_
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday
Ok this should hold it over till I can look at it some more tomorrow.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, August 07, 2007 6:45 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm
] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, August 07, 2007 6:23 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm?
Ok this should hold it over till I can look at it some more tomorrow.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL
Of David
Barker
Sent: Tuesday, August 07, 2007 6:23 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] New PDF worm?
Ok this should hold it over till I can look at it some more tomorrow.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent
Available from Declude, My Account page.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of David Barker
Sent: Thursday, August 16, 2007 11:52 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] New All_list.dat 16 Aug 07
Available from Declude, My Account page.
David Barker
VP Operations
Email your smartermail key and host name so [EMAIL PROTECTED] and we will
get you activated.
David Barker
VP Operations | Declude
Your Email Security is our business
O: 978.499.2933 x7007
F: 978.988.1311
E: [EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto
.
Declude RULES.
Thanks David!
--SJ
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, August 21, 2007 9:39 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] New Spam
Filter Line:
BODY10 PCRE(?i:(Click
Version 4.x has built in AVG which is an additional virus scanner depending
on your previous virus configuration this would be a good place to start.
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin
Stanford
Sent: Tuesday, August 21, 2007
Try this ...
(?i:\b(?!dick?)(m(\W?|_){0,3}e(\W?|_){0,3}g(\W?|_){0,[EMAIL
PROTECTED])?(\W?|_){0,3}d(\
W?|_){0,3}[|li1í!](\W?|_){0,3}[ck]{1,2}\b)
Will match on obfuscated dick (ie. D!ck) but NOT dick, can include mega
obfuscated.
David
-Original Message-
From: [EMAIL PROTECTED]
of the line wrap after the d. Putting it all on one line works. Duh.
Thanks again,
John Olden
David Barker wrote:
This does match M eg ad ik as you have described below
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John
Olden
Sent: Tuesday, August 21
Updated filter line to:
(?i:(Click|login|link).{0,50}http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?
)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Tuesday, August 21, 2007 10:14 AM
Olden
David Barker wrote:
This does match M eg ad ik as you have described below
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John
Olden
Sent: Tuesday, August 21, 2007 2:34 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] ED Spam
BODY10 PCRE
(href=http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-
4][0-9]|[01]?[0-9][0-9]?)/http://www)
Will catch any IP:
a
href=http://68.183.201.153/;http://www.youtube.com/watch?v=YxmwjEj2TtE/a
David Barker
VP Operations Declude
Your Email security is our
is of that domain.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dean
Lawrence
Sent: Monday, August 27, 2007 10:35 AM
that it only work for @example.com
ALLRECIPS END NOTCONTAINS @example.com
This is the counter weight
TESTSFAILED -8 CONTAINS SPAMCOP
This enables you to exclude certain unwanted scoring.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x
?
Dean
On 8/27/07, David Barker [EMAIL PROTECTED] wrote:
Correct. If you want to exclude specific tests you can negate the weights
by
using a filter eg.
In your global.cfg
--
SPAMCOP ip4rbl.spamcop.net 127.0.0.2
8 0
In your
Fixed . tools are now located at http://tools.declude.com
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Thursday, September 06, 2007 12:30 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Knowledgebase Article has broken link
Can you post an example ?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mon
Mariola - Rubén
Sent: Wednesday, September 12, 2007 10:23 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Filter for Football
Somebody has been able to make a
Mariola, S.L.
- Original Message -
From: David Barker
To: declude.junkmail@declude.com
Sent: Wednesday, September 12, 2007 4:36 PM
Subject: RE: [Declude.JunkMail] Filter for Football
Can you post an example ?
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe
I would suggest trying the interim 4.3.57 available from you're my Account
page, to see if this resolves your issue.
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heimir
Eidskrem
Sent: Monday, September 17, 2007 2:57 PM
To:
You could try commenting out the following:
#WAITFORMAIL100
#WAITFORTHREADS 10
#WAITBETWEENTHREADS 50
Also set your WAITFORMAIL 2500
I think the biggest improvement was the fact you increased your threads.
David
-Original Message-
From: [EMAIL
] Upgrade to version 4 causes processor to
skyrocket
Thank you David.
Does it matter if I set the WAITFORMAIL TO 2500 If it is going to be
commented out anyway?
Kevin
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Thursday, September 20
1. Is your user required to authenticate with the server ?
2. Do you have WHITELISTAUTHin your global.cfg ?
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message-
From
You need to have a virus.cfg file which determines the location of the
quarantined files. To help me understand, what is it you would like to do?
Turn off all virus scanning and vulnerability detection ?
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007
4.3.? exactly ?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick
Hogue
Sent: Thursday, October 04, 2007 3:59 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Decludeproc stops for no reason
Yes the service stops. The event viewer
?
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Thursday, October 04, 2007 9:52 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Decludeproc stops for no reason
4.3.? exactly ?
-Original Message-
From: [EMAIL PROTECTED
As an FYI this test can be useful if you are concerned that not all users
should be whitelisted when authenticated.
BYPASSWHITELIST
This optional test instructs Declude to bypass any whitelisting for E-mails
with at least a specific number of recipients and at least a specific
weight.
For
that it could be of some
use to others as well and a good weapon to be added to Declude's great
arsenal.
Best,
Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent
PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 3:10 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option for authenticated
messages
Have you tried using
CATCHALLMAILS catchallmails x x 0 0
,
Adolfo Justiniano
Santa Cruz BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, October 12, 2007 4:04 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test
I will have this resolved this week. Thanks for pointing this out.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Thursday, October 18, 2007 4:03 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] RE: More Confusion - Home
BBS
e-mail: [EMAIL PROTECTED]
http://www.scbbs.net
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Monday, October 15, 2007 9:53 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Test or filtering option
The older versions of Declude the host name is tied to the key. If you
change your host name you need a new key.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Troy D.
Hilton
Sent: Thursday, November 01, 2007 5:46 PM
To: Declude Junkmail Forum
Subject:
Currently the best way is to email me the Ref-Id's and then I report them
directly to CT.
David
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(lists)
Sent: Saturday, November 24, 2007 2:19 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] CommTouch FP
Hi Guys,
I am back checking my thousands of emails and catching up. I will get a new
all_list.dat generated over the next couple of days. Happy New Year all!
David Barker
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy
Schmidt
Sent: Friday
Available from Declude, My Account page.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED
It is recorded in the Q file for IMail. If I remember correctly it would be
capital A eg.
[EMAIL PROTECTED]
Declude filters do not check q(envelope) files though.
David B
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T
(lists)
Sent: Thursday, January 24,
Ok ;)
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of IS -
Network Systems Eng (B Cole)
Sent: Monday, January 28, 2008 4:37 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] unsubscribe Declude.JunkMail
unsubscribe Declude.JunkMail
Barton Cole
Systems
The directive is AVAFTERJM
We can look at setting an option for DELETE only.
David B
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno
Bloksma
Sent: Wednesday, February 06, 2008 9:28 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] AFTERJM
Hi,
this...?
David:
The first one does not work.
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Wednesday, February 06, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE
] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Friday, 08 February 2008 3:56 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?
How so, can you show the X-Declude-Sender line that it did not work on ?
-Original Message-
From: [EMAIL
] On
Behalf Of David Barker
Sent: Friday, February 08, 2008 1:40 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] How can I filter this...?
This is what Chuck requested.
Now the declude sender is [EMAIL PROTECTED] but I want to filter
the sender name
of vigara
and
the email address is always different.
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
David Barker
Sent: Friday, February 08, 2008 1:56 PM
To: declude.junkmail@declude.com
Subject: RE
This guy is very good at keeping an eye on RBL's
http://www.dnsbl.com/2007/06/status-of-dnsbltqmcubecom-abandoned.html
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message-
From: [EMAIL
Just an FYI
TQM cube is back up and running. Rumor has it that someone poisoned their
DNS cache. They've since gone in and fixed it.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]
-Original Message
to stay out of my global.cfg file.
Andrew.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of David Barker
Sent: Thursday, February 21, 2008 10:05 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Is Tqmcube.com dead
MAILFROM
This test checks the SMTP envelope Mail From: address (which should be the
sender of the E-mail) and makes sure that the domain name it is coming from
is valid. This way, if mail is sent from [EMAIL PROTECTED], it will
get caught (since $$$success$$$.com is not a valid domain).
David B
: [Declude.JunkMail] new Declude release
What ever happened to the new release that was scheduled for January?
David Barker
Thu, 24 Jan 2008 09:41:20 -0800
I hear you. Looking to do a release by the end of the month.
David B
Scott Fisher
Director of IT
Farm Progress Companies
SmarterTools standard version protection policy covers all purchases made
within 45 days of that products major release.
If you are going to be buying SM - best to do so before the release. I have
heard the target date is 15 March.
David B
PS. Just in case you thought of going anywhere else.
?
Hello David
Do we have to pay any fees to switch from declude Imail to declude SM ?
TIA
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Monday, March 10, 2008 9:23 PM
Subject: RE: AW: [Declude.JunkMail] Hardware upgrade -Software
Scott the only way I have done a NOT is in the following example where this
will match on the expression but NOT on levitra using (?!levitra)
(?i:(?!levitra)\bl.{0,2}e.{0,2}v.{0,2}[|li1í!].{0,2}t.{0,2}r.{0,[EMAIL
PROTECTED])
I have attempted to work this type of expression into
was not triggered in
the SmarterMail envelope as token was changed from cmdspc instead of
cmdspace we check for both.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing
was not triggered in
the SmarterMail envelope as token was changed from cmdspc instead of
cmdspace we check for both.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]
---
This E-mail came from the Declude.Virus mailing list
Any increase on False Positives with SORBS being experienced ?
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
978.988.1311 fax
[EMAIL PROTECTED]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E
11:08 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] SORBS
Increase from a lot of FP's to exactly how many more?
:)
Matt
David Barker wrote:
Any increase on False Positives with SORBS being experienced ?
David Barker
VP Operations Declude
Your Email security is our
-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David
Barker
Sent: Thursday, March 27, 2008 8:13 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] SORBS
Was working with a customer who was claiming that SORBS was producing a
lot
FP's over the last few
It is expected to work with 10 but will only know when it is released.
David B
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Tuesday, April 01, 2008 5:08 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] IMail
Hi Andy,
Your example is with our engineers. we will get back to you as soon as we have
a answer. Should be today.
David
From: Andy Schmidt [EMAIL PROTECTED]
Sent: Tuesday, April 01, 2008 6:34 PM
To: declude.junkmail@declude.com
Subject:
before it are things like integration with the new message sniffer dll in
development. A new test being evaluated called FST. Compatibility with SM 5.x –
Compatibility with IMAIL 10.x etc etc.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 x 7007 office
You have to use CIDR range as the example you provided:
WHITELIST IP 198.107.21.0/24
However remember that users who authenticate with the server are automatically
whitelisted.
David B
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon
on this one...so far nothing has affected this problem.
Jon Lucas
Poly-Cast, Inc.
503-648-5357
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Barker
Sent: Thursday, April 03, 2008 8:46 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail
We use 2 filters to address the issue which work well for us. I will make
them available on our website this week.
David B
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim
Comerford
Sent: Thursday, April 03, 2008 2:46 PM
To: declude.junkmail@declude.com
Subject:
not exist in our email system, so I would like to keep them
from getting into the queue manager.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Barker
Sent: Thursday, April 03, 2008 12:25 PM
To: declude.junkmail@declude.com
Subject: RE
I have posted the backscatter filters we use under the download section of
Declude, any feedback is welcome.
David B
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck,
Andrew
Sent: Thursday, April 03, 2008 6:42 PM
To: declude.junkmail@declude.com
Subject: RE:
We have been made aware of this and are currently looking into the cause, it
seems to be AVG that is the source, if used in combination with a 3rd party
scanner. We are trying to replicate the issue to have it resolved.
David B
From: Adolfo Justiniano
: Friday, April 04, 2008 7:09 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] 4.4.00 Released
Andre -
Colbeck, Andrew wrote:
David Barker said:
DEC ADD Added date, Time, Email, Spool name, Weight and Tests
failed
to the BLKLST log
I thinks its
Spaces before the phrase are not used as the line is normalized. Also the
regular CONTAINS is not case sensitive.
It would be better to use
SUBJECT 0 PCRE(?i:(discount|off).{0,2}Co(upon|de))
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
You can use the settings in Declude.cfg to stop certain character sets.
David B
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell
Ard
Sent: Tuesday, April 08, 2008 7:41 AM
To: Declude
Subject: [Declude.JunkMail] Need help in setting up filter please
We are getting
PCRE (?i:google.{3,10}pagead/iclk)
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Monday, April 07, 2008 8:58 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
David
08, 2008 11:32 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker
Hi David,
The filter is not triggering. That IS the issue I am reporting! I provided
log snippets showing that the filter does run, but is not triggering. This
is the problem
We're almost always Bcc'd
Consider using BCC
This test will catch E-mail that has a lot of local recipients that are not
listed in the E-mail headers. This test is normally only used in advanced
setups, as most mailing list E-mail has many recipients not listed in the
headers.
BCC
Websense says that hackers have streamlined their anti-CAPTCHA tools and can
attack Microsoft's Live Hotmail service in about 6 seconds.
Websense has been on the CAPTCHA case for a while and the latest
http://securitylabs.websense.com/content/Blogs/3063.aspx attack on
Microsoft's Hotmail is an
Ard
- Original Message -
From: David Barker mailto:[EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Tuesday, April 08, 2008 10:12 AM
Subject: RE: [Declude.JunkMail] Need help in setting up filter please
You can use the settings in Declude.cfg to stop certain character
lately but the others
that I’ve seen were a lot more expensive.
Everyone has to choose the product that works for them. Declude works for me.
Dan
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Wednesday, April 02, 2008 11:58 AM
To: declude.junkmail
I'm still getting
*From: =?koi8-r?B?58XOzsHEycog98HTyczYxdfJ3g==?= [EMAIL PROTECTED]
mailto:[EMAIL PROTECTED]*
Subject: X-IMail-SPAM =?koi8-r?B?58/S0d3JxSDQ1dTF18vJIQ==?=
*
Thanks very much
Ferrell Ard
- Original Message -
*From:* David Barker mailto:[EMAIL PROTECTED
This is known as backscatter you can read about it here.
http://www.spamresource.com/2007/02/backscatter-what-is-it-how-do-i-stop-it.
html
If you go to the Declude My Account home page you will find a link to
download a zip file which contains 2 filters you can use against
backscatter.
part de David
Barker
Envoyé : 22 avril, 2008 11:32
À : declude.junkmail@declude.com
Objet : RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their
FROM email
This is known as backscatter you can read about it here.
http://www.spamresource.com/2007/02/backscatter-what-is-it-how-do-i
The E-mail failed the BADHEADERS test. This means the email failed with a
violation of the RFC. This specific code indicates a incorrect Message-ID:
in the header.
David B
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave
Beckstrom
Sent: Wednesday,
401 - 500 of 658 matches
Mail list logo
