I am using Imail/Declude VirusJunkmail as a gateway for my mail server.
Works wonderfully on mail coming in.
I'd like to route all outbound mail through the Imail/Declude gateway but only to
virus check. I guess I'd like to exclude Junkmail testing on the IP Address of my mail
server.
Can
-3
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail scanned for viruses by Farm Progress Companies using Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list
Do a replace of (the date) with ^l(the date). Ie. Replace 02/24/2004 with ^l02/24/2004
ctrl-a to select all
ctrl-x to cut
switch back to log and paste into the end.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 02/24/04 07:20PM
I thought I would try out Declude v1.78i3
Is somebody is using the spamdomains filter to detect paypal, ebay phish e-mails?
Could you please share the appropriate entries?
Or is using the spamdomains filter to do this a bad idea?
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail scanned for viruses by Farm Progress
be failing other tests (the travel sites always get
hit with Message Sniffer in my case).
I've read it is recommended to only search one hop on it, so it should be named
BONDEDSENDER-DYNA
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/09/04 04:06PM
Does anyone have any
on the
mailing list.
If I add a new test, I check the database to see how it is doing, is it getting too
many false positive, I may then remove it or lower it's weight.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/09/04 07:40PM
Is the $default.junkmail and global.cfg files
I'd love to see a current spam domains list that deals with non-US ISP's.
I seem to have lots of spam coming apparently from non-US ISPs.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/10/04 10:36AM
I've seen a few posts to this list (from myself and a few others
Where is Kami's list? I haven't been able to find it.
If you wouldn't mind sharing, I'd like to see your your spamdomains file. I really
need more non-US entries.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/10/04 11:32AM
Hello, Jeffrey,
Kami's spamdomains list
in the log:
WARNING: DNS server x.x.x.x returned a SERVER FAILURE error for MX or A for 775rgt.com.
Examining some of these, I see that these are SPAM from forged non-existent domains.
I wonder if this could be the basis for a new test?
Scott Fisher
Director of IT
Farm Progress Companies
/04
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/23/04 03:37PM
I see a fair amount of junkmail which doesn't fail the Countries Test but
the country is shown as ARIN Unlisted or Unknown. Is there a way to show
these results as failing the test and subsequently add
I downloaded Sunday 3/21. I will downloaded again now to see what happens.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/23/04 04:44PM
I too have some IP's that come up with no country. Is there somewhere we
can go to verify where they belong?
You can go to http
Mailpure's foreign-TLD and badcountrynorevdns are also good examples of country
filters that are prebuilt and may be easy to implement with few changes.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/23/04 07:12PM
So how do we use this functionality? Per your
#cialis where
the # represents a space. Declude won't let you do this to the best of my knowledge.
I run spamchk as an external test that allows me to catch a few choice words, as
spamchk will let you search for spaces.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/24/04
WEIGHT40,SNIFFER-NOTFOUND
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
you've made your filters public. I use a bunch of them, and
they've certainly been learning tool in writing some of my own filters.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/26/04 11:32AM
This is generally a bad idea because you might be blacklisting something
I wouldn't mind seeing a permanent link to the latest all_list.dat file.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 03/26/04 02:57PM
From reading these messages, I just learned of
http://www.declude.com/tools/spamsend.htmlhttp://www.declude.com/tools
I use this as my phish filter:
@paypal.com .paypal.
@ebay.com .ebay.
citibank.com.ssmb.com
fleet.com .bkb.com
wellsfargo.com .norwest.com
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/13/04 04:06AM
Anyone has a SPAMDOMAINS entry for ebay?
Markus
but they
are different types of test (spamcop and message sniffer scams for instance).
If you use any one test to subject line/hold/delete, you'll definitely get some false
positives.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/13/04 04:39PM
What do ya'll have set for your weights
Yes, it will add 2 points.
But:
I've received 188 e-mails with the country of EU (I use country not countries) since I
added my country test.
Approximately 1/3 were not spam.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 10:34AM
Hello, All,
Occasionally I'll
I know [EMAIL PROTECTED] has new filters out in his Beta area that don't utilize the
anti-gibberish test.
There is just a gibberish and a gibberish-sub tests.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 09:57AM
I have been using the SPAM filters from
They are posted in the beta section. See this link for the link:
http://www.mail-archive.com/[EMAIL PROTECTED]/msg17542.html
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 12:02PM
I know [EMAIL PROTECTED] has new filters out in his Beta area that
don't utilize
] [66.36.241.111]
X-Declude-Spoolname: D7b986efb00442884.SMD
X-Note: Spam tests: SNIFFER-OBFUSCATION, OBFUSCATION, COUNTRY-FILTER, WEIGHT20,
WEIGHT25, WEIGHT25COPY.
X-Note: Total spam weight of this e-mail is 27.
X-Note: Reverse DNS sls-cb9p8.dca2.superb.net .
Scott Fisher
Director of IT
Farm
I see, I missed that.
I just like to lay down extra points on the phish schemes.
Thanks
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 02:33PM
Because the sender was not listed as @paypal.com. Look at this line:
X-Declude-Sender: [EMAIL PROTECTED
I agree. It took 10 minutes to get this test working.
And many of the domains listed were in my e-mails that are (hopefully were) falling
into that gray area.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/14/04 04:48PM
The command script that downloads the SURBL
Will the release notes be updated now that 1.79 is a beta?
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail
all_list.dat uses the IP address to calculate the country code. Used with the COUNTRY
and COUNTRIES tests.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/15/04 08:47AM
Hello,
Was just wondering what this file was? I missed a few days and didn't
see anything
and the NOLEGITCONTENT tests. If these tests were already calculated
into the weight at the time of the SKIPIFWEIGHT is examined, I would be running the
filter tests less. Does HIDETESTS play into this?
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses
combinations of actions that will not
work together (such as DELETE and HOLD, which logically can't both be used), but most
will. Also, if you use the weighting system, you should set the weights of the second
test to 0, so that you do not end up with double the weight.
Scott Fisher
Director
after 5 points)
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
As for the maxweight, perhaps someone can do it better, but this works for me:
In the variables ection add:
set V_Maxweight=20
In the code after if not %v_weight%== echo SKIPIFWEIGHT %v_weight%
surbl.filter.tmp
add:
if not %v_maxweight%== echo MAXWEIGHT %v_maxweight% surbl.filter.tmp
Scott
My results from a business setting are very positive also.
294 hits.
292 SPAM
2 NotSpam (both from the declude mailing list hitting on webhosting.yahoo.com)
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/16/04 03:25AM
It will take a day or two before the log
I see that the Spamhaus XBL returns values 127.0.0.4-6.
I'm currently using 127.0.0.4.
Can anyone tell me what return values 127.0.0.5 and 127.0.0.6 refer to?
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com
My favorite new filter has been the NOTENDSWITH...
But I've found a problem.
COUNTRY 5 NOTENDSWITH US
Using the above line, every country including the US gets five points.
May I also suggest a NOIS filter test?
Scott Fisher
Director of IT
Farm Progress Companies
, MX servers with
different domain names).
If you end up using more than one, beware of double-dipping with domains like:
online.de and worldonline.de
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/19/04 07:09AM
Thanks.. I've received a couple so far, so if you don't
Many thanks, I couldn't find that info anywhere (else).
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/16/04 05:33PM
Not surprising that you missed this one, based on the subject line:
http://www.mail-archive.com/[EMAIL PROTECTED]/msg17684.html
Sorry if this has
For Declude Virus
BANNAME fileattachment.ext
example:
BANNAME deleted0.txt
I know it came up that file names with spaces weren't being blocked properly. I don't
know if Scott had fixed that yet.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/19/04 03:27PM
I want
a work around.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/19/04 09:18AM
My favorite new filter has been the NOTENDSWITH...
But I've found a problem.
COUNTRY 5 NOTENDSWITH US
Using the above line, every country including the US gets five points
a filter on that.
CLEANSUBJECT 10 CONTAINS VIAGARA
which would stop the V I.AG A,RA variants.
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list
and the bodyURL's are some of
the last tests run.
If you run SPAMCHK, it logs out all of the URL's it finds.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/21/04 02:52PM
I just saved some processing power..
One of my most important text filters is the BODY search
I working on trapping more Nigerian Scams.
Is there any way to limit a filter a minimum weight. If the Nigerian filter gets
tripped for at least 3 points, I would like for it to be implemented. If it is less
than 3 points, I'd like to ignore the filter.
Can I do this with minweight
Scott
If a test false positived 37% of the time, I certainly wouldn't be weighing it that
high.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/22/04 12:57PM
Hi, Markus,
Thanks for responding.
Well I went ahead and did it. I've rescaled everything to have 100 points
You guys are correct, I should have I shouldn't have said false positive with regards
to the test.
I just kept seeing the mostly good 37% of the mail 73% toward failing and false
positives kept ringing in my head.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/22/04
Regarding the bug with subject filter that Matt reported Thursday with his
gibberishsub filter.
I too have noticed some oddities with the Gibberishsub filter results.
Matt said it was happening at the end of the subject.
I believe it may also be happening at the beginning of the subject. Also
A new interim release today...
That's excellent, I was going through interim release withdrawl.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/23/04 06:08AM
Regarding the bug with subject filter that Matt reported Thursday with his
gibberishsub filter.
I too have
://www.mail-archive.com/[EMAIL PROTECTED]/msg15578.html
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/22/04 10:45PM
Scott,
I working on trapping more Nigerian Scams.
What would you do in a filter? Search the body for phrases that are
found in these types of e
.
Do normal tests.
Sounds like more hassle than it would be worth.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/23/04 03:21AM
No -- that determines a weight at which filter processing
will stop. But it sounds like you want the filter to only
return a weight
I have taken Roger Eriksson's SURBL batch file and using the magic of copy and paste
have altered it to use the Big Evil SURBL.
This list is much larger than the Spamcop SURBL so your performance may suffer.
Attached renamed exclusion file and the cmd file.
You'll need to rename the
I have taken Roger Eriksson's SURBL batch file and using the magic of copy and paste
have altered it to use the Spam Assassin SURBL.
This list is much larger than the Spamcop SURBL so your performance may suffer.
Attached renamed exclusion file and the cmd file.
You'll need to rename the
I was afraid of those size when I ran them.
It's too bad there isn't a SKIPIFWEIGHTLESSTHAN command for the filters.
Used with a SKIFIFWEIGHT command, it could only be called on those pesky e-mails that
fall into that grey area.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL
to put a high CPU test on.
5257 scored over 42 weight which should have triggered the skipifweight bypass in the
Body-URL filters.
It's all about saving CPU time.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/23/04 01:39PM
It's too bad there isn't a SKIPIFWEIGHTLESSTHAN
I believe you are only allowed two columns in the spam domain line.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/11/04 03:40PM
I just had an email fail spamdomains for [EMAIL PROTECTED]
X-RBL-Warning: SPAMDOMAINS: Spamdomain 'swbell.net' found: Address of
[EMAIL
than hoping to
catch the right word in a search of the mail-archive.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/11/04 12:13PM
It would be a great help if you can indicate what is the latest interim
number- for one big reason...
It will reduce the load on your server
trap addresses
I guess in my dreamland, I am hoping that Computerized Horizons being acquired will
bring more resources for you, so you would be freed of the documentation and light
support (busy?)work to concentrate on improving Declude.
Scott Fisher
Director of IT
Farm Progress Companies
One thing you could do is to put a space after the HGH to make it match HGH(Space).
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/10/04 02:53PM
Hi,
I am seeing e-mails with base64 attachments such as PowerPoint, Word,
Excel etc and because it is encoded
I know this has been requested before, but if more people request it, won't it get
higher on the list...
The TESTSFAILED filter type just begs for the NOTCONTAINS parameter.
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http
10 IS c8000246
BADHEADERS 10 IS c8000247
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
I'm running 179i7.
I'm not getting any matches on ALLRECIPS filters with the IS. Anyone have any tips?
ALLRECIPS 20 IS [EMAIL PROTECTED]
I am getting matches with the CONTAINS filter.
ALLRECIPS 20 CONTAINS[EMAIL PROTECTED]
Scott Fisher
Director of IT
Farm
No matches with the [EMAIL PROTECTED] format either.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/14/04 09:43AM
I'm not getting any matches on ALLRECIPS filters with the IS. Anyone have
any tips?
ALLRECIPS 20 IS [EMAIL PROTECTED]
If you change
The END in the weight column is valid starting somewhere in the 1.77s.
It causes the filter to immediately end with the current score.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/14/04 03:01PM
Hi, Kami,
I don't even know how to mentally parse the below code
-Bulk.
Out of the 363 matches on the MailPolice-REVDNS, 2 were also matched on
MailPolice-Porn.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/13/04 05:34PM
Here's a working config for MailPolice's dynamic test (PPP/DSL/cable)
that test's both the reverse DNS entry
It's working now.
That'll drop a bunch of stuff out of hold status.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/14/04 03:07PM
No matches with the [EMAIL PROTECTED] format either.
Actually, it needs to be [EMAIL PROTECTED], [EMAIL PROTECTED] (where the
first
For log level high,
I'd like to see the failure line for fromfile test logged.
Current log line:
04/28/2004 00:14:52 Q3dca01de026a2147 Msg failed BLACKLIST-DOMAIN (). Action=WARN.
Desired log line;
04/28/2004 00:14:52 Q3dca01de026a2147 Msg failed BLACKLIST-DOMAIN (@bestdeals.com).
Action=WARN.
I feel bad now that was listed in the fine print of the manual.
A quick copy and paste in Excel and I have descriptions.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/30/04 06:38AM
For log level high,
I'd like to see the failure line for fromfile test logged
I've had to put edu.au in the SpamCop SURBL exclusion list.
It looks like edu.au is listed on the list.
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing
Here's some of my April results on SBBL and FiveTen.
SBBL 562 hits out of 191,422 mails.
1 e-mail that would would have slipped into my tag weight from my hold weight if I
wasn't using this test.
FiveTen:
191,422 mails
SPAM consider weight 32
Possible SPAM weight 17-32
Not SPAM weight 17
Does anyone have a list of Spanish keywords that they filter on? I'd love to have one.
Now that my Chinese and English language SPAM is under control, I have two users who
are getting SPAMed in Spanish?
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This
Does anyone know a good spamdomains entry for the domain freeserve.co.uk?
dnsstuff.com returns no mx records.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to
One thought:
You'd have to use Blacklist if you didn't have JunkMail Pro. Only Pro has filtering.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/03/04 02:26PM
I want to block anything sent from onlinelifetime.com. I could use
BLACKLIST fromfile C:\iMail\Declude
There is a BASE64 test that part of Declude.
I don't weight it very highly. For my company so far in April, 10% of the items that
failed the BASE64 test were non-SPAM e-mails. The 10% are predominately .gov, .edu and
states with a .us TLD.
Scott Fisher
Director of IT
Farm Progress Companies
weight the test 12 points on my tag scale of 20, so I am a believer in
it.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 04/27/04 03:33PM
Is it safe to simply delete an email flagged with spamcop?
TIA
Doris
---
[This E-mail was scanned for viruses by Declude Virus (http
I'd be leary of a spamdomain
att.net .airdata.com
If you received e-mail from catt.net, it would fail the above line. I made up
catt.net, but valid non-ATT domains ending in att.net may exist.
perhaps
mobile.att.net .airdata.com
@att.net .att.net
or
.att.net.airdata.com
@att.net
For me:
spffail 0.89% of May's mail
spfpass 1.18% of May's mail
for spffail:
221 SPAM (weight 33) 99.1% (pretty good test)
2 NotSpam (weight 17)
for spfpass
43 SPAM ( weight 33)
1 Possible SPAM (weight 17-33)
249 Not Spam ( weight 17)(85%, poor to average test)
Scott Fisher
Director
PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Friday, May 14, 2004 10:37 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] ALLRECIPs filter trouble
I'm running 179i7.
I'm not getting any matches on ALLRECIPS filters with the IS. Anyone
have
any tips
I find the Mcafee is the best at detecting viruses within encrupted zips.
Otherwise they are pretty even.
I'd recommend using F-Prot and Mcafee.
Mcafee for the DOS command line scanner is dirt cheap. I'll see if I can find my price
tomorrow.
[EMAIL PROTECTED] 5/15 12:29p
Can anyone tell me
Netsky.P that McAfee did not catch. These are usually corrupt variants.
McAfee 260 caught, F-prot 251.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/17/04 08:13AM
For the folks using multiple scanners, do you have any stats on how
often the secondary scanner found
On March 18, McAfee VirusScan for DOS was CDW part number 458401, and it was $11.00
Of course no one wants to jump through any hoops for $11 (It probably costs more for
CDW to process the license paperwork than $11
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/18/04
My McAfee License Grant calls the product
Mcfe ViruScan Command Line Std
1 node
It is actually a 2 year license, with one year of Prime Support.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/18/04 04:26PM
On 18 May 2004 at 13:56, Imail Admin wrote:
I'd like
and -ALL for
small scores that may be false positives.
Can you expound on your COMBO-DUL test again?
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list
My feeling is since it can be done to some extent using testsfailed filters, I'd
rather see development on things we can't do. The NOTCONTAINS arguement has simplified
these COMBO filters so most only take one filter to perform.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL
I'm pretty sure NOTCONTAINS requires 1.79i7
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/20/04 04:05PM
Goran,
Not a difference of opinion, a difference in description, but they were
all accurate.
Test actions have no effect on the score (weight) applied by tests
Can the maxweight / minweight be changed in the middle of a filter?
I can't really think of a reason to use it, just curious.
maxweight 3
subject 5 contains URGENT REQUEST
maxweight 6
body 10 contains NIGERIAN OIL COMPANY
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail
Someone else countered with a number of lines failed that sounded interesting.
I'll call it MINFAILURES
You would only score the filter if the number of matched lines was equal to or
exceeded the MINFAILURES value.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/21
and scored 10
e-mail 3 contained SCOTTFISHER3 and scored 5
Now is this useful?
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/21/04 10:30AM
Can the maxweight / minweight be changed in the middle of a filter?
I can't really think of a reason to use it, just curious.
maxweight
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/24/04 12:45PM
Is order in a filter important for these commands? Specifically can I
have the END in front of the SKIPIFWEIGHT and MAXWEIGHT?
ALLRECIPS END NOTCONTAINS @domain.com
SKIPIFWEIGHT 60
Starting in the 1.78 versions:
New tests dow and hour, to allow hour and day-of-week detection. IE HOUR hour 9
16 0 0 for local 9AM-4:59PM. DOW dow 1 5 0 0 for Monday through Friday.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/25/04 11:56AM
Can someone tell me
I've definitely seen more Stock Promotion SPAM in the last two weeks.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/26/04 02:49PM
http://internetweek.com/e-business/showArticle.jhtml?articleID=21100229
Time to add new filters..
Kami
---
[This E-mail
I believe you need to add the IP address of the GW server to your hosts file for
resolution.
You are pulling out an MX record somewhere that is saying send to the Trend server. At
least that's how I get to my GW server.
hosts:
192.0.0.1 domain.com
Scott Fisher
Director of IT
Farm Progress
2 thoughts.
Are you positive they gave you the correct IP address of the GroupWise server. They
may be accustomed to handing out the IP address of the Trend server.
Their firewall could be redirecting all port 25 traffic to the trend micro machine.
Scott Fisher
Director of IT
Farm Progress
You could have them assigned with a 0 weight in the global.cfg.
You can then use your filters to assign weights as described below.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 05/28/04 10:05AM
Is it possible to run the DNS RBL tests in a file other than the global
corruption during peak times (dictionary
attacks).
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
am thinking of something like this to punish ebay phishs:
DISPLAYMAILFROMENDNOTCONTAINSEBAY.COM
MAILFROM END CONTAINSEBAY.COM
MAILFROM10 NOTCONTAINS EBAY.COM
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned
TESTSFAILED 12 CONTAINSSPAMHAUS-SBL
TESTSFAILED 12 CONTAINSSPAMCOP-DYNA
TESTSFAILED 12 CONTAINSNJABL-SOURCES
TESTSFAILED 12 CONTAINSAHBL-SOURCES
TESTSFAILED 12 CONTAINSAHBL-DOMAINS
Scott Fisher
Director of IT
Farm
WHITELIST will whitelist the mail and bypass all junkmail processing.
To bypass the specific filter use an END
SUBJECT END CONTAINS [Declude.JunkMail]
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 06/01/04 09:51AM
I've been playing with the WHITELIST in a filter
be a help.
Current:
05/31/2004 21:26:48 Qe95f07b1024cc15c Triggered CONTAINS filter DRUG-KEYWORDS on
Aspirin
Requested change:
05/31/2004 21:26:48 Qe95f07b1024cc15c Triggered BODY CONTAINS filter DRUG-KEYWORDS on
Aspirin
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned
to learn from.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 06/04/04 03:33PM
My question: does everyone run them stock or are there particular
configs / settings / etc., that people are implementing to make
Declude even more effective than it is out of the box?
Run them
NOTENDSWITH .edu
MAILFROMEND IS
MAILFROM-60 ENDSWITH.edu
Scott Fisher
Director of IT
Farm Progress Companies
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
My company gets lots of e-mail from state agencies.
Here's a filter that has been working good to credit good gov (mailfrom and revdns
both .us)
I set the negative weight to credit enough points to counteract a one hit from a
strong test like sbl/sniffer/spamcop.
I've seen virus bounces get
My company gets lots of e-mail from US government agencies.
Here's a filter that has been working good to credit good gov (mailfrom and revdns
both .gov)
I set the negative weight to credit enough points to counteract a one hit from a
strong test like sbl/sniffer/spamcop.
I've seen virus
tests for XBL. Mailpure's zombie's test cover these.
Scott Fisher
Director of IT
Farm Progress Companies
[EMAIL PROTECTED] 06/04/04 02:35PM
We've seen more and more junk getting through on our servers. No doubt our
config files are not up to date.
I've downloaded the latest patch with the included
only need to maintain this list in one
area. I used to do END statements in all of my filters and updating them was a pain.
Now one statement ends across all of the body filters (while most, virus hoax, phish
and malware filters always get run).
Sorry I'm rambling...
Scott Fisher
Director
1 - 100 of 607 matches
Mail list logo
