How can you decode the encoded subject lines so as to see what it is and
then create a filter?
Things like:
=?ISO-8859-1?b?RUVOVCBjaGVjayBzdG9jayBjaGFydA==?=
=?ISO-8859-1?b?RUVOVCBQcm9kdWN0aW9uIFByb2dyZXNz?=
=?ISO-8859-1?B?SGk=?=
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
This is a perfect example of how an obfuscation method can be more
indicative than the content itself.
These are failing GIBBERISHSUB and ANTIGIBBERISHSUB.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http
Any one see legit coming from this domain? All I see are spam.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just
What is the OS that Imail is on and what is the OS of the DNS servers?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Kris McElroy
Sent: Wednesday, December 10, 2003 3:16
advice,
Jeffrey
-Original Message-
From: John Tolmachoff (Lists)
[mailto:[EMAIL PROTECTED]
Sent: Tuesday,
December 09, 2003 3:55 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail]
matching from and to addresses
CEOs and others that like
to send copies to themselves
that to get
around the very things we are trying to do.
I am willing to set up a private list service which would only allow members
by invite/approval for this purpose. I think Kevin or Kami or someone had
talked about this a while back but it has not gone anywhere.
Comments?
John Tolmachoff
with a vulnerability or broken sending e-mail client could format the header
to where a small HTML body could end up being in the header.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Danny
FYI, I have a support incident open with Ipswitch on this issue and have
passed on others information posted here. Here is there response this
morning:
John, We're looking into it a bit further, I've passed the info to RD for
some further insight. Thanks for your patience.
John Tolmachoff
There is no wildcard and certainly @ is not a wild card.
You need to use .optinmaildomain.com
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Ron Rushing
Sent: Monday
Can STARTSWITH be used with MAILFROM?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
OK, I have an idea. Scott, can we disable HOLD1, and if so would that
affect HOLD2 operation?
99.5% of messages held by HOLD1 end up passing.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL
There is only one Q file per message. If Declude locks it, Imail can do
nothing with it. In the cases I have seen, there is a line in the log
stating could not lock file.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED
That should be as follows per Scott:
HIDETESTS WEIGHT10 WEIGHT20 (andsoforth)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Sunday, December 07
Matthew, I have confirmed that this occurred on my server 4 times on
Thursday. That works out to 1/10 of 1%. A lot more than your figure. Like I
stated before, this is a concern as it let a virus through.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message
Some one's e-mail client keeps changing/fixing/correcting/whatever the
subject line and making it longer and longer.
Please fix it.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
Scott, since my own server only gets about 4000 messages per day, is there
any testing or logging I can do that will help track this down?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
at
making sure there is current AV on each computer, so that caught it.)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Friday, December 05, 2003 8:25 PM
When Hijack releases a message from HOLD1, does it go right back to spool,
or does it then get scanned for Virus and JunkMail?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came
by Imail
right as a queue run happened.
When Queue Manager makes a timed run, does it look at all Q files, or those
over a certain age or what?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
Scott, I take it you are passing this information on to them? Or do you want
me to forward to them under the incident I have open?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
If it will help Ipswitch decide to fix it...
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Saturday, December 06, 2003 12:35 PM
To: [EMAIL PROTECTED
In a filter file:
HEADERS (weight)CONTAINSX-IMAIL-SPAM-INVALIDFROM
Imail is checking to see if the sender exists and places that into the
header. (If you have Imail configured to add headers.)
HOWEVER, this does not work for @yahoo.com addresses.
John Tolmachoff
Engineer
FYI, I have filters set to look for those challenge/response messages and
add a high weight. :)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Burzin Sumariwalla
Sent
Actually what Chris was *supposed* to say was that the gateway version of
Alligate does a much better job than the Declude version, not Declude
itself.
Thanks for the clarification Brian.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses
Was the exact phrase Dump Declude used? If so, who did you speak with?
Yes, SpamManager is Alligate is NOXMail. (Original name.)
They have made a business decision and I hope them all the luck, as they are
doing very well.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
The issues seem to appear at high volumes.
Besides, I am more than willing to use those licenses for you. ;)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Jonathan
Sent
Brian, if you have Terminal Services or PCAnywhere installed, contact me off
list if you would like me to take a look at what happened.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
PERSONAL STORY
December 3, 1998. 9:03 AM
It was a clear crisp day in Fresno, CA.
Then, at the hands of 2 inattentive drivers, I nearly lost my life.
Driving/Operating a motor vehicle is a responsibility!
Please...Treat it with the respect it deserves.
Thank you.
John Tolmachoff
Engineer
Qeedf08fb02486d2c Could not lock
F:\Spool\Qeedf08fb02486d2c.SMD; timed out (j=2).
Imail 8.03 Declude 1.76i28
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
To help track this down, it would be helpful to do the following:
Compare the number of messages logged in C:\declude.log to the number logged
in the virus log in a 24 hour period.
Any one know how to do that?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message
Also another interesting finding.
It seems as when this is happening, the Imail Spam statistics header line
does not appear either. Any one else confirm this?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: John Tolmachoff (Lists) [mailto:[EMAIL
Why would this be caught with SPAMDOMAINS when closeout-sale.com is not in
the spamdomains.txt file?
X-RBL-Warning: SPAMDOMAINS: Spamdomain 'domain.moc' found: Address of
[EMAIL PROTECTED] sent from invalid
mail.closeout-sale.com.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
Bill, usort was not included in the files on the unixtools site you posted
before, but I was able to find it here:
http://www.profsoftware.com/unixdos/ud09.htm However, now when running the
command, I am getting an error saying needed dll udbase.dll not found.
John Tolmachoff
Engineer/Consultant
Bill, never mind. I just got the reference paper from you and it is listed
in there where it is at and such. Works. Thanks.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED]
Sent: Wednesday, December
And for the last 15 minutes I have been trying to figure out what I am doing
wrong to where I keep getting a result of 0. ;)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf
So back to my original idea, in my case, yesterday 5 messages did not make
it to Virus or JunkMail processing. That is barely over 1/10 of 1%.
What are others experiences? (I will also do this latter on the other
servers I work on.)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
ROLLING EYES
Of course, I have to take blame for this since I started the thread. NOT!
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Tuesday
Scott, feature request. (Sigh, another one.)
Can you add something like this:
SUBJECT 0 STARTSWITHSPACE
I am seeing a good amount of spam where the subject line starts with a space
and then some character and then the subject.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
On the per user configurations, any problems if the user has a period in the
name?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list
Does any one know if vianet.ca is a valid domain use of simpatico.ca mail
servers?
X-RBL-Warning: SPAMDOMAINS: Spamdomain 'sympatico.ca' found: Address of
[EMAIL PROTECTED] sent from invalid shimmer.vianet.ca.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail
I Don't think AOL allows forwarding.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Monday, December 01, 2003 12:34 PM
To: [EMAIL PROTECTED
That's just it, I am seeing the use of [] in spam subject lines.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Bill Landry
Sent: Monday, December 01, 2003 2:32 PM
Any one else seeing this in the headers, good or bad?
X-Mailer: Atriks Professional Email Deployment Service
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from
Create 2 SPAMCOP tests, the first one action WARN and the second action
HOLD.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of andyb
Sent: Monday, December 01, 2003 3:06 PM
It is a little harsh but allowable.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of serge
Sent: Monday, December 01, 2003 5:59 AM
To: [EMAIL PROTECTED]
Subject
The line I posted is what was seen in the headers, and would therefore be a
good line to use in a filter file.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Dave Doherty
Bill, it has been a lonnngg week.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E
name that. http://www.ahbl.org/responsecodes.php
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail
Logs and headers.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of andyb
Sent: Friday, November 28, 2003 8:26 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] holding
Everyone pats John on his back and assure him they have all gone through
similar experiences :)
Oh, I feel so much better now, thanks.
Actually, I found another one this morning. Turns out though it is a badly
broken header to where the body (html) ends up seen in the header.
John Tolmachoff
)
That is the line number in the MYFILTER test that caused it to be caught,
not the weight.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list
Can you post the full header for that message?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of andyb
Sent: Friday, November 28, 2003 12:25 PM
To: [EMAIL PROTECTED
outblaze.com
@usa.comoutblaze.com
@whoever.comoutblaze.com
@winning.comoutblaze.com
@witty.com outblaze.com
@writeme.comoutblaze.com
@yours.com outblaze.com
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses
the way a spam
test normally works).
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of andyb
Sent: Friday, November 28, 2003 5:16 PM
To: [EMAIL PROTECTED]
Subject: Re
Title: Reading the header..
Morning
Kami. The weight is the line weight in the filter file, in this case the weight
that line 346 lists.
Correct that the X-RBL-Warning only shows
one line caught if multiple, but I do not remember if the first or last caught.
John Tolmachoff
Title: Reading the header..
Yes, it would be helpful if it would list
each line caught with. J
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent: Thursday
I have 2 filters for that:
In my BASICFILTER:
SUBJECT 10 ISBLANK
In my GRAYFILTER4:
BODY 25 STARTSWITH g
It has been extremely effective on that.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL
Any body else seeing messages where the subject is only b or bbb and the
body is only b or bbb?
Could this be a spammer checking for valid addresses?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
Every one I see comes from @aol.ca but is not from a AOL.ca server. Does any
one know what the line would be for aol.ca in SPAMDOMAINS?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED
]).
---
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
2 things you can do with filters. (Only available in JunkMail Pro.)
1. Have Imail add a header for the URL list and then filter on that header
and add weight.
2. Create a URLFILTER filter file in Declude from the Imail URL list. You
can do this by using Excel.
John Tolmachoff
Engineer
it
form the config file.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of DLAnalyzer Support
Sent: Wednesday, November 26, 2003 6:52 PM
To: [EMAIL PROTECTED]
Subject: Re
Yes, the BODY ISBLANK has done well for me.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Thursday, November 27, 2003 12:11 PM
To: '[EMAIL
files, which
is used after all scanning and upon sending to the actual mail box.
Therefore, it works. :)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Alejandro Valenzuela
to use with it.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Andy Schmidt
Sent: Tuesday, November 25, 2003 7:13 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail
NJABL and AHBLSPAM - Do they FP on a lot of legit advertisements?
AHBLGOOD - Is this absolutely trustworthy and what types of servers does
it list?
I ran across AHBLGOOD and am testing it to see what happens.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail
Since the tests will be dead, remove them is best.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of serge
Sent: Thursday, November 27, 2003 6:43 PM
To: [EMAIL PROTECTED
for those tests should be INGNORE or LOG only, as
again if the tests failed means nothing. Only if the messages passes the
test is weight subtracted.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL
If the spool directory was on a RAM drive, though, it could speed things
up
quite a bit (the RFCs say this is not allowed, though), as the information
constantly changes.
Why would the RFCs care where the spool is? Performance wise, that would be
a great use if you had the funds.
John
on for others, I only use release versions. The only
time I use interim releases is when I am having a problem or need a specific
added feature.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
Attachment is pictures. zip
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Omar K.
Sent: Wednesday, November 26, 2003 4:18 PM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED
by request.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
Feature request:
Ability to save config file as.
Ability to run program with a saved named config file.
This would allow you to create different configuration files with the GUI,
and then run reports based on different configuration files.
John Tolmachoff
Engineer/Consultant/Owner
eServices
Hello Jeff. What exactly is happening?
Any C:\Declude.GPx files?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Jeff Kratka
Sent: Wednesday, November 26, 2003 9:10 PM
Anything in the logs?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Jeff Kratka
Sent: Wednesday, November 26, 2003 10:15 PM
To: [EMAIL PROTECTED]
Subject: RE
Also, go to a command prompt, change to the Imail directory, and type in
without the quotes:
declude -diag c:\decludediag.txt
Then post or send off list.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail
of blank subject line any more, less I get
FPs held.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Tuesday, November 25, 2003 5:07 AM
To: [EMAIL
Typical network administration function.
It is working fine now, max CPU is 3% momentarily. I have held.vbs checking
every minute and so far only about 10 notifications in the last hour, and
only 4-6 at a time.
I will continue to monitor and see what happens.
John Tolmachoff
Engineer/Consultant
Now with the added features, what is the order by type in which the tests
are run?
External
Filter
Fromfile
Ip4r
Rhsbl
And does the order in which they are listed in the global.cfg matter?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses
That first line was supposed to be frustration, not function. :(
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
Sent: Tuesday, November 25, 2003 1
???
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Tuesday, November 25, 2003 1:53 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Test
Scott, I am ROFLOL at this:
11/17/2003 12:12:20 Q2ba00068020856ba Triggered ISBLANK filter BASICFILTER
on THIS_STRING_SHOULD_NEVER_BE_IN_AN_EMAIL_OR_IT_WILL_BE_MARKED_AS_SPAM
[weight-5].
Some times, you are just too funny.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
If I were to create a custom DNS based blacklist on a DNS server, how would
that perform compared to a fromfile or filter file with MAILFROM ENDSWITH?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
Thanks.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Tuesday, November 25, 2003 4:51 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail
What version of JunkMail (Pro or Standard) and what version of Imail?
MAILBOX is only available in JunkMail Pro.
Could that message have been White Listed?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail
What would keep Deccon at 10-35% CPU for several minutes?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send
Q27ab021f0050285c Couldn't find console; starting...
(2).
11/24/2003 10:52:56 Q2953000100b4e6d1 Couldn't find console; starting...
(2).
11/24/2003 11:12:05 Q2dc9000c00ce524a Couldn't find console; starting...
(2).
11/24/2003 11:35:01 Q0287feb0cdc Couldn't create map1: 5
John Tolmachoff
Engineer
What are the normal forwarded message indicators in the subject line?
Fwd:
Fd:
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list
I am going to restart Hijack and have the log in Debug mode and see what
happens. It has been noted that at that time, the CPU was averaging 80% but
after stopping Hijack, the CPU settled back down to about 35%.
Once I have the log for a bit, I will send it off list.
John Tolmachoff
Engineer
Upon restarting Hijack, CPU usage went back up. Log file being sent off
list.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
Sent: Monday
running held.vbs every minute to test?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Monday, November 24, 2003 2:12 PM
To: [EMAIL PROTECTED]
Subject
NgpnbsvxdmyxOTgdlzzutcrzzw Agqlrtgychyms
gdwkphqwxmnmbjDIgkttlixddjglETgymzrjzcklne
.gmoqtcrbkgdjxt..gfscknibkksogf.
gqzriiidczwtbITggtubfzcsrb'Sgcxhfjsbhobqx Aghncgopcgled
PAgxuhsodcrpcpcoTCgqgsvnykhlxxeclHbr/i
br
TRUNCATED
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
John Tolmachoff
Engineer
Like Bill, I don't recall seeing Fd in legit E-mail.
That's what I thought. I have seen a few spam with a subject line that
starts with Fd:. I think I can safely filter on that with a small weight
like 5.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned
The problem I am seeing is the spammers
know that body filters are the most expensive in terms of processing and are
often limited to the first so many characters.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From:
[EMAIL PROTECTED
Is there any performance difference in using CONTAINS vs. ENDSWITH?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe
Another performance question.
Is there any performance difference between a filter file looking at
MAILFROM and fromfile, both containing the same amount of lines?
(Understanding that the MAILFROM weight ENDSWITH domain.com is the same as
a line in the fromfile.)
John Tolmachoff
Engineer
number, maybe 5 confirmed
cases per day. (4500 per day on my server.)
Ipswitch conspiracy? (Sorry, couldn't resist the temptation.)
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail
/DIVphr SIZE=1
Do you Yahoo!?br
ahref=http://us.rd.yahoo.com/slv/mailtag/*http://companion.yahoo.com/;Fre
e Pop-Up Blocker - Get it now
--949_50E0D0B2.BC200960--
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail was scanned for viruses by Declude Virus (http
=
ve/2003/capone/sep/osr/images/spacer.gif WIDTH=3D1 HEIGHT=3D90 alt=3D=
/TD
/TR
/TABLE
IMG SRC=3Dhttp://capitalone.bfi0.com/TAGH06CBF152C4836245D2E4AC5E7;
/BODY
/HTML
--ABCD-TATH06CBF112C4836245D2E4AC5E7-EFGH--
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
---
[This E-mail
601 - 700 of 1386 matches
Mail list logo
