[Declude.JunkMail] Auto Sales Spam

2013-04-19 Thread Dave Beckstrom
Has anyone come up with a filter to deal with the rash of new car sales spam that has recently gotten bad? There doesn't seem to be much to filter on from a content standpoiint. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to

RE: [Declude.JunkMail] No one at Declude?

2013-04-18 Thread Dave Beckstrom
Was anyone able to download the all_list.dat file from the interim directory that David posted? Everything else downloaded for me except that file. -Original Message- From: David Barker [mailto:david.bar...@mailsbestfriend.com] Sent: Thursday, April 18, 2013 8:37 AM To:

[Declude.JunkMail] Sample global.cfg ?

2013-04-17 Thread Dave Beckstrom
Is there a current sample global.cfg available? I haven't looked through mine in awhile and I may have some outdated RBLs, etc. Would like to see the current sample just to get an idea of what may have changed. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,

RE: [Declude.JunkMail] No one at Declude?

2013-04-17 Thread Dave Beckstrom
: [Declude.JunkMail] No one at Declude? HI Dave, Maybe we are looking at different cross-sections of the spam problem, but on our systems we see a lot from spammy domains that are not brand new. Darin. From: Dave Beckstrom mailto:db...@atving.com Sent: Wednesday, April 17, 2013 2:22 PM

RE: [Declude.JunkMail] Thank you for your email. I will be out of the office from 4/15/2013 until 4/19/2013. Dur

2013-04-13 Thread Dave Beckstrom
Everyone better add a filter to delete messages with Dan's name until he gets back. Can you say viscious circle? -Original Message- From: Daniel Slentz [mailto:dsle...@oasisol.com] Sent: Saturday, April 13, 2013 3:19 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Thank

RE: [Declude.JunkMail] No one at Declude?

2013-04-09 Thread Dave Beckstrom
Someone should start up a new discussion list that everyone can join before this one goes away. It would be good to have a place to continue collboration. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type

[Declude.JunkMail] Joe Jobs

2012-11-28 Thread Dave Beckstrom
Hi All, This isn't specifically a Declude question but I thought I'd ask anyway as its still of interest to the group, I think. I have one domain that is being referenced in a Joe Job. Essentially, a spammer sends out thousands of emails using various compromised computers. In the FROM field,

[Declude.JunkMail] Whitelist emails with attachments?

2012-06-19 Thread Dave Beckstrom
Is there a way in declude to either whitelist or set a filter giving credit (negative weight), when an email sent to a specific user/domain has an attachment attached to it? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to

RE: [Declude.JunkMail] Dealing with Joe Jobs?

2011-12-07 Thread Dave Beckstrom
weeks and then it's over. Hope this helps, Darin. - Original Message - From: Dave Beckstrom db...@atving.com To: Declude.JunkMail@declude.com Sent: Tuesday, December 06, 2011 7:12 PM Subject: [Declude.JunkMail] Dealing with Joe Jobs? Hi All, This isn't a Declude topic but is relevant

[Declude.JunkMail] Dealing with Joe Jobs?

2011-12-06 Thread Dave Beckstrom
Hi All, This isn't a Declude topic but is relevant to dealing with a sort of spam issue. I hope nobody minds discussing this. I would appreciate hearing any advice you might have to offer. I have a customer who's domain is being used for Joe Jobs. Someone is randomizing email addresses for

RE: [Declude.JunkMail] RE: email being delivered with blank body. What happened to body?

2011-04-04 Thread Dave Beckstrom
I get the same behavior with smartermail. I also run into (frequently) situations where it strips off attachments and people complain they don't receive their files. I have also seen where spam will skate right on past filters that should have triggered. I suspect there is some very specific

[Declude.JunkMail] ISIPP SuretyMail Accredited email - spammer?

2011-02-25 Thread Dave Beckstrom
Just received a spam with these headers: X-IADB-IP: 65.98.250.238 X-IADB-IP-REVERSE: 238.250.98.65 X-IADB-URL: http://www.isipp.com/iadb.php http://www.isipp.com/iadb.php Received: from AGENT-01.ED.SAC ([10.10.0.24]) X-Mailer: EDM List-Unsubscribe:

RE: [Declude.JunkMail] Idea for new Declude add-on

2011-02-18 Thread Dave Beckstrom
scenario would we not want to whitelist the recipients address ? -Original Message- From: Dave Beckstrom [mailto:db...@atving.com] Sent: Thursday, February 17, 2011 8:45 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Idea for new Declude add-on I have an idea for something I

RE: [Declude.JunkMail] Idea for new Declude add-on

2011-02-18 Thread Dave Beckstrom
Sanford, I'm not complaining. I'm saying that there is an opportunity for someone to write the utility I suggested. I'd write it except the languages I code wouldn't be a good choice for something like this. -Original Message- From: Sanford Whiteman

RE: [Declude.JunkMail] Idea for new Declude add-on

2011-02-18 Thread Dave Beckstrom
with Smartermail. John T eServices For You -Original Message- From: Dave Beckstrom db...@atving.com Sent 2/18/2011 9:46:15 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Idea for new Declude add-on I installed autowhite. This product is not ready

[Declude.JunkMail] Idea for new Declude add-on

2011-02-17 Thread Dave Beckstrom
I have an idea for something I think would be a useful add-on for declude. Every time someone sends an outbound SMTP email to someone, the add-on would add an entry to a filter giving the recipient's to address a weight of minus one. Therefore, giving the recipient a credit. Any time the

RE: [Declude.JunkMail] Idea for new Declude add-on

2011-02-17 Thread Dave Beckstrom
for new Declude add-on Great idea Dave thanks. Question. If a user emails a recipient in what scenario would we not want to whitelist the recipients address ? -Original Message- From: Dave Beckstrom [mailto:db...@atving.com] Sent: Thursday, February 17, 2011 8:45 AM To: Declude.JunkMail

[Declude.JunkMail] Blocking on no REV DNS?

2011-02-14 Thread Dave Beckstrom
Years ago it was recommended not to block mail on a missing reverse DNS because many legitimate mail servers were mis-configured. We know services like AOL block on missing DNS. Just wondering, do you block on missing REV DNS? If not, do you at least add weight? I'm getting to the point

RE: [Declude.JunkMail] Blocking on no REV DNS?

2011-02-14 Thread Dave Beckstrom
to show that he may have FOUND the problem by trying to email US, but that in fact, his emails to most places on the Internet are being silently deleted, held or flagged as SPAM - without giving him a warning as WE do. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave

[Declude.JunkMail] Filter for this?

2011-02-14 Thread Dave Beckstrom
Anyone put together a filter for this? a href=http://en.marriedcomb.com/LsyRi_xEczPyAVLP-6RXIfBHyQKlpLloCVCdRiUQj80C BkFIRsplDbsWp-UntnvcapomnOB34oekSnZlNAVa7SoEUKZSJf38K79Yq79zOT6qBNCTYzL5B1Gh PqJ5DauCbtWAubdB8kPQoicfAlkPQyyuRB1333A1YAWUvJhpVPksIVa9IVTj5SmfPzJBU23BtNGm

RE: [Declude.JunkMail] Filter for this?

2011-02-14 Thread Dave Beckstrom
domain or destination IP in the last 45 days. Andrew. -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Monday, February 14, 2011 2:07 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Filter for this? Anyone put

[Declude.JunkMail] Good filter?

2010-10-18 Thread Dave Beckstrom
There is pervasive spammer who's uri pattern for the linked spam site is pretty consistent. They all have a / followed by some kind of home-grown obfuscation which his server recognizes: http://cja244.larickcoppas.com/6878d778dcffdc763118115082cc190a3c0343

RE: [Declude.JunkMail] Good filter?

2010-10-18 Thread Dave Beckstrom
://www.skywaves.com/content/secure/support_ticket.htm _ From: Dave Beckstrom db...@atving.com Sent: Monday, October 18, 2010 9:38 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Good filter? There is pervasive spammer who's uri pattern for the linked spam site is pretty consistent

RE: [Declude.JunkMail] Good filter?

2010-10-18 Thread Dave Beckstrom
General and Non-Emergency support ticket: https://www.skywaves.com/content/secure/support_ticket.htm _ From: Dave Beckstrom db...@atving.com Sent: Monday, October 18, 2010 9:38 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Good filter? There is pervasive spammer

RE: [Declude.JunkMail] Good filter?

2010-10-18 Thread Dave Beckstrom
@declude.com Subject: RE: [Declude.JunkMail] Good filter? Provided the prefix to these is either www or http:// the regex will trigger on these From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Monday, October 18, 2010 10:02 AM To: declude.junkmail

[Declude.JunkMail] Server AV Scanner

2010-08-12 Thread Dave Beckstrom
Hi Everyone, I sold off the lion's share of my web business 3 years. I still host a few sites for some people who have been with me for a really long time. But I don't have the revenue I once did and hence can't afford to renew Declude (I'm running an older version) or buy any software. I used

[Declude.JunkMail] Regex to block this?

2010-07-20 Thread Dave Beckstrom
I'm getting hit by one spammer who manages to get through most of my filters. His spam consistently uses the format of: a href=http://gcc128.blinksroads.com/5768cbbeb6bba86c3157116a6de8e54b31dab5; img src=http://gcc128.blinksroads.com/images/157286c08.jpg; How would I write a regex that

RE: [Declude.JunkMail] Regex to block this?

2010-07-20 Thread Dave Beckstrom
you can exclude (g-z) I've seen lots of .info and a few .nets as additional tld. Very active spammer here (?i:href=.+\.(com|info|net)/[a-f0-9]{37,38}) -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Tuesday, July 20, 2010 8

[Declude.JunkMail] Blocking domains by DNS server?

2010-07-01 Thread Dave Beckstrom
There is a pervasive spammer out there, where the common denominator in the jerk's spam is the fact that all of the domains in the body of the email are served by DNS servers NS1.domainsite.com - NS4.domainsite.com. I want to block all email where a link in the body is resolved by one of those

[Declude.JunkMail] PowerMTA

2010-01-13 Thread Dave Beckstrom
I'm seeing a lot of spam with this in the headers: PowerMTA(TM) v3.0c2 Is powerMTA mainly a spam tool or do legitimate mailers use it too? Just trying to decide if I can add some weight if that header exists. Also of late I'm seeing a lot of spam containing ssl in part of the domain name:

[Declude.JunkMail] Testing Spamcop blocked?

2010-01-08 Thread Dave Beckstrom
Does the spamblock IP4R always return blocked if an IP is found or can it return something less severe than blocked? Just wondering if there is a way to hold on blocked and warn on a less severe hit. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an

[Declude.JunkMail] 3rd party tool to call registrar/whois lookup?

2009-02-24 Thread Dave Beckstrom
Much of the spam we receive contains embedded links for, or from, domains registered within the last 2 - 3 weeks. Is there a 3rd party utility that could be called from Declude which would check the domain registration date and either block or add weight to any domain registered within the

[Declude.JunkMail] Senderbase

2009-02-21 Thread Dave Beckstrom
I would like to use senderbase with Declude. Does anyone happen to know if there is a way to extract the entire list of IPs with a POOR reputation from senderbase? I know that it can be done vie export but it seems to be limited to certain IP ranges at a time. Does senderbase have any kind

[Declude.JunkMail] Spam Score?

2009-02-19 Thread Dave Beckstrom
Something is happening with our spam score that I don't quite understand. If you look below at the (sanitized) email headers you'll see that the CBL test scored 6 and spamheaders scored 3 and yet the final score for this email was Spam Score: [1] Shouldn't the score have been 9? On another

RE: [Declude.JunkMail] Spam Score?

2009-02-19 Thread Dave Beckstrom
978.499.2933 office 978.988.1311 fax dbar...@declude.com -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Thursday, February 19, 2009 9:33 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spam Score

RE: [Declude.JunkMail] Spam Score?

2009-02-19 Thread Dave Beckstrom
would still like to see some people post their ip4r tests to the list. I have a hunch I'm missing some valuable tests in my list. Thanks, Dave -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: 2009-02-19 08:56

[Declude.JunkMail] Regex

2009-02-18 Thread Dave Beckstrom
Trying to filter on: Asseenon Oprah As seen on Oprah As seen on 60 minutes Asseenon 60 minutes As seen on 60-minutes This regex matches on, for example, asseen on 60 minutes but does not match on asseenon 60 minutes What did I do wrong? Is there a better way to code this? ANYWHERE3

RE: [Declude.JunkMail] Regex

2009-02-18 Thread Dave Beckstrom
have it pretty much down. If I did it I would have this (?i:as.{0,2}seen.{0,2}on.{0,2}(?:oprah|60.{0,2}minutes)) You have an extra . between seen and on David B -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Wednesday

RE: [Declude.JunkMail] Mailfrom Processing

2009-02-09 Thread Dave Beckstrom
What filter will trigger on the words John Cummuta when the from address is formatted like: From: John Cummuta startover-4676...@allstockdirect.com Neither the mailfrom or headers filters are triggering on this. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,

RE: [Declude.JunkMail] Mailfrom Processing

2009-02-09 Thread Dave Beckstrom
978.988.1311 fax dbar...@declude.com -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Monday, February 09, 2009 4:53 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Mailfrom Processing What filter

RE: [Declude.JunkMail] Mailfrom Processing

2009-02-03 Thread Dave Beckstrom
) and matches just on the email address. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent

[Declude.JunkMail] Mailfrom Processing

2009-01-05 Thread Dave Beckstrom
I have a question about the MAILFROM processing. Does this look at the display name too or just at the actual email address? I was trying to block the Loud N Clear ads by referencing the display name because it seemed to be pretty consistent while the email address itself didn't change. I

[Declude.JunkMail] BadHeaders?

2008-04-30 Thread Dave Beckstrom
Hi Everyone, We have an application that generates email using Cold Fusion. The application sends email to me. The email never goes outside of our servers. Declude is flagging the email as having BadHeaders: X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8004000e].

RE: [Declude.JunkMail] BadHeaders?

2008-04-30 Thread Dave Beckstrom
: in the header. David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Wednesday, April 30, 2008 12:36 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] BadHeaders? Hi Everyone, We have an application

[Declude.JunkMail] INVURIBL WEIGHT?

2008-04-22 Thread Dave Beckstrom
Hi everyone, I would appreciate hearing some opinions. How heavy are you weighing INVURIBL? Would half of the hold weight be too much weight? Would you hold on INVURIBL alone? Thanks, Dave No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database:

[Declude.JunkMail] No Reverse DNS pointer?

2008-04-22 Thread Dave Beckstrom
Hi Everyone, I have two questions: 1) If a mail server is configured without a reverse DNS pointer, is that enough to prevent email from reaching AOL, Yahoo, Hotmail, etc? 2) Do you block email coming from mail servers with no reverse DNS? Thanks, Dave --- This E-mail came from the

RE: [Declude.JunkMail] Filters not triggering - David Barker

2008-04-08 Thread Dave Beckstrom
PROTECTED] On Behalf Of Dave Beckstrom Sent: Monday, April 07, 2008 8:58 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Filters not triggering - David Barker David, I implemented your regular expression in the filter and a spam skated right through (filter did

RE: [Declude.JunkMail] Filters not triggering - David Barker

2008-04-08 Thread Dave Beckstrom
you have a ticket number ? if so email me so I can follow up on the ticket for you - this needs to be addressed with support, not on the lists. Thanks David B -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, April 08

[Declude.JunkMail] Filters not triggering

2008-04-07 Thread Dave Beckstrom
Hi Everyone. I have a filter set up to delete an email if the subject line contains the keyword in the filter. For some odd reason, the filter is not triggering and it really has me baffled. I could use some suggestions on this one. The filter is called: Filter_Subject_delete.txt Here are

RE: [Declude.JunkMail] Filters not triggering

2008-04-07 Thread Dave Beckstrom
. Dave Beckstrom wrote: Hi Everyone. I have a filter set up to delete an email if the subject line contains the keyword in the filter. For some odd reason, the filter is not triggering and it really has me baffled. I could use some suggestions on this one. The filter is called

RE: [Declude.JunkMail] Filters not triggering

2008-04-07 Thread Dave Beckstrom
/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dave Beckstrom wrote: Hi Darrell, Yes, there are spaces and/or tabs between the contains and the data that I want to filter on. I was under the understanding that those were ignored? Dave

RE: [Declude.JunkMail] OT: Yahoo Blocking Email

2008-02-25 Thread Dave Beckstrom
- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, February 21, 2008 12:59 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] OT: Yahoo Blocking Email Rob, We are using domain keys and reverse DNS as well as SPF records. Do you

[Declude.JunkMail] OT: Yahoo Blocking Email

2008-02-21 Thread Dave Beckstrom
Hi All, Has anyone figured out how to stop Yahoo from blocking email? They've blocked all email from our servers for about 3 weeks. I've submitted their forms but it hasn't done any good. Dave --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail

RE: [Declude.JunkMail] OT: Yahoo Blocking Email

2008-02-21 Thread Dave Beckstrom
if you can just switch your IP address to see if that will work. Matt Dave Beckstrom wrote: Hi All, Has anyone figured out how to stop Yahoo from blocking email? They've blocked all email from our servers for about 3 weeks. I've submitted their forms but it hasn't

RE: [Declude.JunkMail] Blackice Server Settings

2008-01-05 Thread Dave Beckstrom
, what are users replacing it with ? Howard Smith . -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Wednesday, September 27, 2006 5:58 PM To: declude.junkmail@declude.com Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail

RE: [Declude.JunkMail] Interesting Spam

2007-09-07 Thread Dave Beckstrom
using a database at least a day behind. I use (for example) this site to my satisfaction: http://whois.domaintools.com/sdsdm.com Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, September 06

RE: [Declude.JunkMail] Interesting Spam

2007-09-07 Thread Dave Beckstrom
. I use (for example) this site to my satisfaction: http://whois.domaintools.com/sdsdm.com Andrew. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, September 06, 2007 3:07 PM To: declude.junkmail

[Declude.JunkMail] Interesting Spam

2007-09-06 Thread Dave Beckstrom
We're getting a rash of spam that doesn't score high enough to be blocked. In the past I've looked up the domain owner of the site listed in the spam and been able to identify sometimes dozens of domains owned by the spammer, then I've put that list into a filter and blocked the domains before

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
I installed the filter below and we've had about 50 PDFs that came through today. Does the filter need to be revised or is there some other method I should be looking into using? Thanks! Dave _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent:

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 3:15 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? I installed the filter below and we've had about 50 PDFs that came through today. Does the filter need to be revised or is there some other method I

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
today. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 5:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? David, I just sent you a bunch of samples. If you can update the filter before you knock

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 5:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? David, I just sent you a bunch of samples. If you can update the filter before you knock off for the day I'd appreciate

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 9:02 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? It didn't work. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, August

RE: [Declude.JunkMail] Spam Increase?

2007-08-04 Thread Dave Beckstrom
Sorry guys...I've not been able to stay on top of discussions here for a few weeks and I'm sure I missed discussion about how you're catching the PDF spam. Does someone have a filter they are using for PDF spam that they could post for me? Thanks, Dave -Original Message- From: [EMAIL

[Declude.JunkMail] OT: Yahoo Email Problems

2007-03-29 Thread Dave Beckstrom
Sorry about the off-topic post. This is the only email server software related list that I am on. I tried to send a couple of email to a Yahoo group and received this message back: Reason: Remote host said: 451 qq unable to read configuration (#4.3.0) Is that a problem with Yahoo or are

RE: [Declude.JunkMail] Image spam

2007-03-08 Thread Dave Beckstrom
I'm confused. I understood that if you host multiple email domains on a mail server that you're considered a hosting company and can't purchase commtouch? At least I vaguely recall something to that affect. I checked Declude's site and I don't see commtouch listed on there anywhere (it used

RE: [Declude.JunkMail] Need help - mail server sending out stock reports email - process found ssm

2007-02-07 Thread Dave Beckstrom
Our black ice display has been showing: [Suspicious Activity] This signature detects PE/COFF executable files that have been packed using the UPX tool. While the presence of a UPX packed executable does not in itself represent an attack, it can be considered an anomaly. The UPX tool is

RE: [Declude.JunkMail] SmarterMail 4.0 is released

2007-01-11 Thread Dave Beckstrom
SmarterTools just released the next major version of SmarterMail. It has been rewritten in ASP.NET 2.0 from which they claim across the board performance improvements. Major new features include greylisting and built-in ClamAV, as well as better features for use as a gateway. For a list

[Declude.JunkMail] Image Spam

2007-01-06 Thread Dave Beckstrom
Sniffer tags some of the image spam we receive but much of it doesn't score high enough for a hold weight. Is Declude or anyone else working on anything new that will be more effective at catching image spam? We're not eligible for Interceptor because we host email for some other companies.

[Declude.JunkMail] OT: Yahoo delivery problems

2006-11-02 Thread Dave Beckstrom
Hi Everyone, This isn't a Declude question but with all of the expertise here I knew someone could help. Please forgive the off-topic message. I'm receiving a bunch of deliver failures today for Yahoo. The message is: Failed Recipient: [EMAIL PROTECTED] Reason: Remote host said: 451 Message

RE: [Declude.JunkMail] OT: Yahoo delivery problems

2006-11-02 Thread Dave Beckstrom
Thank you all who replied to my inquiry about the Yahoo deliver problems! Good to know I'm not on a blacklist. This was the first we've encountered problems with yahoo so we must have just hit it at a time they were having problems. Thanks again, Dave --- This E-mail came from the

RE: [Declude.JunkMail] RE: Declude's To-Do List

2006-10-25 Thread Dave Beckstrom
David, You also need to add a new whitelist tag (whitelistunique?) that only whitelists the TO recipient if it's the only recipient for the email. This bit about whitelisting all recipients if one is whitelisted is a problem. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL

RE: [Declude.JunkMail] Whitelisting flaw in Declude?

2006-10-19 Thread Dave Beckstrom
of lists which is a whole other topic.Darin.- Original Message -From: Dave Beckstrom [EMAIL PROTECTED]To: declude.junkmail@declude.comSent: Tuesday, October 17, 2006 3:11 PMSubject: RE: [Declude.JunkMail] Whitelisting flaw in Declude?I would call that a flaw, then, in how Declude processes

[Declude.JunkMail] OT: Stupid Spammer Humor

2006-10-18 Thread Dave Beckstrom
Received a paypal phishing scheme spam this morning. Note the url: www.chainmailstore.com/scamerchantsrow/phpSecurePages/www.paypal.com/cgi-bin /us/cmd/webscr-cmd=_login/index.php I got a kick out of the scamerchantsrow in the url. Scammer --- This E-mail came from the

RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker

2006-10-18 Thread Dave Beckstrom
- From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude processes the whitelist. I have a listserver email

RE: [Declude.JunkMail] Whitelisting flaw in Declude? - David Barker

2006-10-18 Thread Dave Beckstrom
have a need to whitelist to these addresses, and we have fine-grained control over what we let through to them. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 18, 2006 12:06 PM Subject: RE

[Declude.JunkMail] Whitelisting flaw in Declude?

2006-10-17 Thread Dave Beckstrom
If an email is received that is addressed to multiple recipients, one of whom is whitelisted, does Declude treat the email as whitelisted for all recipients? --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type

RE: [Declude.JunkMail] Whitelisting flaw in Declude?

2006-10-17 Thread Dave Beckstrom
, and Log Parsers. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 11:18 AM Subject: [Declude.JunkMail] Whitelisting flaw in Declude? If an email is received that is addressed to multiple recipients, one

RE: [Declude.JunkMail] Whitelisting flaw in Declude?

2006-10-17 Thread Dave Beckstrom
is a whole other topic. Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 17, 2006 3:11 PM Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude? I would call that a flaw, then, in how Declude

RE: [Declude.JunkMail] picture spam

2006-10-12 Thread Dave Beckstrom
Chris, According to Decludes web site, any business that provides email to customers cant use commtouch. That pretty well rules out most of the people on this list. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of chris Sent: Thursday, October 12, 2006 9:11 AM

RE: [Declude.JunkMail] picture spam

2006-10-12 Thread Dave Beckstrom
You guys should have made a deal with Pete instead of CommTouch.  Sniffer blows it out of the water and he has no licensing restrictions.  IMO of course. Matt Matt, They should have made a deal with Pete and done it so as to keep the cost down. At $295 a year it wasn't priced

[Declude.JunkMail] Interesting SMTP connection patterns

2006-10-12 Thread Dave Beckstrom
Yesterday I took a snapshot of the SMTP connections active on our server. I then did a reverse IP to find out where they were from. Below are the results. You can see someone from Thailand had 5 SMTP connections active and Spain had 4. You can also see that only 3 of the IPS connected were for

RE: [Declude.JunkMail] Interesting SMTP connection patterns

2006-10-12 Thread Dave Beckstrom
: www.123marbella.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, October 12, 2006 11:24 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Interesting SMTP connection patterns Yesterday I took

RE: [Declude.JunkMail] Interesting SMTP connection patterns

2006-10-12 Thread Dave Beckstrom
--- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dave Beckstrom writes: Yesterday I took a snapshot

RE: [Declude.JunkMail] Interesting SMTP connection patterns

2006-10-12 Thread Dave Beckstrom
- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, October 12, 2006 7:38 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Interesting SMTP connection patterns Blackice runs perfect on Windows 2003 server. I posted

[Declude.JunkMail] INV-URIBL Scoring?

2006-10-10 Thread Dave Beckstrom
Hi Guys, Considering that INV-URIBL looks at just the links contained in known spam, is it safe to set the weight on this test so high that this single test would trigger a hold or delete weight? Right now I have it set to score fairly low, and it adds to the total score, but would not cause a

RE: [Declude.JunkMail] Blocking these?

2006-10-05 Thread Dave Beckstrom
? Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, October 04, 2006 11:42 PM Subject: [Declude.JunkMail] Blocking these? How are you guys blocking something like the spam below? There is no URL to block

RE: [Declude.JunkMail] Blocking these?

2006-10-05 Thread Dave Beckstrom
would use an older rulebase. Note that running an old rulebase will mean much of this rapidly changing spam will get through. Headers would help... Darin. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Thursday, October 05

RE: [Declude.JunkMail] Blocking these?

2006-10-05 Thread Dave Beckstrom
and get your company to reimburse you next month and send them a check for the 12 months and it's done. I'd hate to think what's getting though without some sort of added filter like sniffer. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dave

[Declude.JunkMail] Blocking these?

2006-10-04 Thread Dave Beckstrom
How are you guys blocking something like the spam below? There is no URL to block on. They keep bastardizing words in the body of the email to the point where you can't hardly block based on the content. What do you guys do with these? -Original Message- From: Louis Rubin

RE: [Declude.JunkMail] Crisis after upgrade to 4.3.14 from 4.3.7

2006-09-29 Thread Dave Beckstrom
Chris, Will Declude be repackaging the install with the defaults set to mimic the old behavior? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of chris Sent: Friday, September 29, 2006 9:29 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail]

RE: [Declude.JunkMail] Blackice Server Settings

2006-09-21 Thread Dave Beckstrom
Im leaving town in a little bit and I wont be back until Sunday. If someone reminds me on Sunday or Monday Id be happy to post the settings. Are we able to post attachments to this list? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mike Wiegers Sent:

RE: [Declude.JunkMail] Spam Spike

2006-09-20 Thread Dave Beckstrom
I run Blackice Server on the mail server. It drops the connecting IP if we receive more than a user specified number of attempts for non-existent email addresses within a user specified time limit. It then blocks that IP for a user specified amount of time before removing the block. It prevents

[Declude.JunkMail] Blackice Server (was] Spam Spike)

2006-09-20 Thread Dave Beckstrom
price I find is $300. G.Z. - Original Message - From: Dave Beckstrom [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Wednesday, September 20, 2006 1:08 PM Subject: RE: [Declude.JunkMail] Spam Spike I run Blackice Server on the mail server. It drops the connecting IP

RE: [Declude.JunkMail] 4.3.x and 3.1.x planned release

2006-09-15 Thread Dave Beckstrom
Still no fix for the broken image spam? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Friday, September 15, 2006 7:59 AM To: declude.junkmail@declude.com; declude.virus@declude.com Subject: [Declude.JunkMail] 4.3.x and 3.1.x

RE: [Declude.JunkMail] Re: Why is Declude Not Scanning This?

2006-09-04 Thread Dave Beckstrom
I see about 10 - 20 per day where Declude is broken and where it doesn't scan the email and puts the Declude headers at the bottom. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, September 04, 2006 10:10 PM To:

[Declude.JunkMail] Message Sniffer vs Commtouch?

2006-08-28 Thread Dave Beckstrom
My message sniffer is up for annual renewal. Commtouch is over 50% less expensive than message sniffer ($445 vs $195) I have to choose between the more expensive message sniffer renewal or trying commtouch. I was wondering if anyone here has tried both products and if so which of the two

RE: [Declude.JunkMail] Upcoming Declude Release

2006-07-26 Thread Dave Beckstrom
David, What is happening that a fix for the broken image spam is never forthcoming? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, July 26, 2006 8:10 AM To: declude.junkmail@declude.com; declude.virus@declude.com

RE: [Declude.JunkMail] Declude 4.3

2006-07-18 Thread Dave Beckstrom
Email only makes money for spammers. Declude and the other mail tools are an expense not a revenue generator. Adding CommTouch just adds to overhead without generating any revenue. I'm glad its an option and doesn't affect the rest of Declude. Declude is already at the upper limit of what

RE: [Declude.JunkMail] Declude 4.3

2006-07-18 Thread Dave Beckstrom
With that said, as an add-on in the same regard as things like Sniffer, CommTouch might be a good solution (if it performs well) for those that can pay the $195/year, however it still irks me that after two years and lots of promises, these things are being added at an extra expense and not

  1   2   >