unsubscribe Declude.JunkMail Greg Foulks
attachment: winmail.dat
Goto declude.com and you'll see what it is you have to download.
Greg
Dan Geiser wrote:
Is this guy serious when he says The test is available for
download. What do we have to download? What version number includes
this test? What is the format of the test? Is it just an IP4R test?
What
John,
Thanks for the email this helped to find the problem. Your emails were
being zapped because it was failing a mailfrom test (which right now I
have no idea why it failed the mailfrom test because your address is not
even listed in the file.)
06/29/2004 15:17:09 Qc01a098 SPammers:100
Never received a reply. I just sent a new request in.
Thanks,
Greg
John Tolmachoff (Lists) wrote:
You configuration is fine with one recommendation: You would off load
additional workload from the main server by having it send all outbound
e-mail through a smart host, that being the Ant-spam
Brent,
Something that I'm doing for my users is the use of a pass phrase. I've
given all of my users a pass phrase (combination of letters and numbers,
similar to a pin code) to give to their contacts who send email to them.
Using Spamchk I've created a negative weight of 1000 whenever the pass
Anyone using the AutoWhite application from eServices? Care to give
feedback as to how well/poorly it works?
Thanks,
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an
I've put in an option to bounce the email if the fails on a weight of 14
or higher. However none of these messages are being bounced and are
being delivered.
In my $default$ I have defined
WEIGHT14 BOUNCE
In the declude directory I have an eml file names WEIGHT14bounce.eml
The text of the
What I'm seeing in the declude log is this...
01/29/2004 00:00:36 Q93572c4 Warning: misconfiguration in following line
in configuration file (BOUNCE is not an ACTION). May be a duplicate test
definition?
How can this not be a valid action?
Greg
Greg Foulks wrote:
I've put in an option
Scott,
I've been a customer of yours now for a couple of years and I wouldn't
post to the list if I didn't first read the manual and still have a
question. What is it about what I've described would make you think I
didn't first read the manual.
I'm running 1.76i30
C:\IMaildeclude -diag
Scott,
I found this website and thought that it would be really cool if you
guys could write a program like this challenge/response that worked with
Declude spam. I would absolutely pay for it!
http://about.mailblocks.com/features/challenge.aspx
Greg
---
[This E-mail was scanned for viruses
I guess what I'm trying to say is that I like the concept I also
agree with all of con's that have presented. It would be nice if there
was someway we could automate the whitelist.
What about this spin? What if Declude took the email address that the
internal user was sending to and put it
So if I wanted to BOUNCE after a certain weight is there a way to
incorporate the FORGED check that Declude viruses uses.
This way if the return address is forged the bounce is not sent out.
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Greg Foulks
Sent: Wednesday, January 28, 2004 12:45 PM
To: Declude JunkMail
Subject: [Declude.JunkMail] BOUNCE action
So if I wanted to BOUNCE after a certain weight is there a way to
incorporate
I see that the Global config file on Decludes website has an updated
list of IP4 tests and that the IP4 website also has a long list of IP4
tests.
My question... what are some of your IP4 tests that you use that you
find to be very effective?
Thanks,
Greg
---
[This E-mail was scanned for
I'm wondering if I could fitter on the following content of an html message?
#
Would any legit email these tags together? If it is legit how would one
filter this message?
HTMLHEADTITLEplatelet magnanimity/TITLE
META http-equiv=Content-Type content=text/html;
charset=iso-8859-1/HEAD
BODYfont
I had an email come in today that was deleted because it failed my blacklist
test. However the email address is not listed in my blacklist so why did
declude think it was?
11/11/2003 10:38:02 Q023124a BlackHole-Senders:30 NOABUSE:2 SPAMCHK:-15 .
Total weight = 17
11/11/2003 10:38:02 Q023124a Msg
.de is what the problem was. I had a ton of spam coming from .de domains so
I put .de in my blacklist. I don't understand why .de would block
[EMAIL PROTECTED] when this email ends with the domain .com.
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of
spammers are getting smarter and are findings ways to get around our tests.
I'm getting to the point to where I am about to cut off everyone from
sending email to us and setting up a phone number so that people who want to
send us email have to call in and subscribe.
Greg
-Original
Is it possible to test the Autowhitelist On feature? Or is there a command
line option that can verify that the option is turned on?
Thanks,
Greg
attachment: winmail.dat
Is it possible to create/setup a per-user blacklist that each user can
maintain?
Thanks,
Greg
attachment: winmail.dat
Well Scott it doesn't appear to be working.
Here are the logs and showing points assigned from Spamchk but declude
should have whitelisted because the from addy is in my webmail address book.
11/04/2003 11:39:00, file C:\IMail\spool\Dd620200.SMD, Result 0H 0L 15K,
total 15
From:[EMAIL
,
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Greg Foulks
Sent: Tuesday, November 04, 2003 11:46 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Test Autowhitelist
Well Scott it doesn't appear to be working.
Here are the logs and showing
That's right! I'm using Killerwebmail to setup a common address book for the
group.
By editing the config_CommonAddrBook.cgi file you can create a common
address book for all users.
Sorry about the mix up.. But it would be cool if declude could also read
this file.
Thanks,
Greg
-Original
Is anyone able to get to the site? www.dnsreport.com Just want to make sure
that it's just not me that is having problems.
Thanks,
Greg
attachment: winmail.dat
Seems like it just came back up.
Thanks,
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
Sent: Monday, October 13, 2003 10:36 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] DNS Report
Yes, I can.
*
] to
[EMAIL PROTECTED]
10/05/2003 12:12:24 Q42df204 Subject: RE: Are you a Christian Single?
10/05/2003 12:12:24 Q42df204 From:
[EMAIL PROTECTED] To:
[EMAIL PROTECTED] IP: 69.60.142.7 ID: JAA80040
Greg Foulks
NewFound Technologies, Inc.
[EMAIL PROTECTED]
http://www.nfti.com
614.318.5036
attachment
Scott,
Okay so I checked the logs again and found two emails with the same subject
for this person. The other email with the weight of 17 should have been
deleted because I have a blacklisted the .pn01.com domain... Why didn't it
catch it?
Here are the logs for both emails...
10/06/2003 00:27:34
Scott,
Here are a couple of lines from my blacklist file
@hungermail.com
[EMAIL PROTECTED]
[EMAIL PROTECTED]
.pn01.com
@4hermail.com
@mho.net
@mynet.com
I am currently running 1.75
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent:
I've seen a couple others that are not working and honestly I have just
started to look at it so I don't recall which of the other's are not
working.
No I do not see any spaces or tabs at the end of the .pn01.com line.
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Karen,
Blacklisted meaning I've created a blacklist file of known spamming return
addresses that if found adds a weight of 50 which would exceed the delete
action of 40.
Not sure what you mean by weightrange... My rules are very simple ignore up
to 10 attach between 11-39 and delete everything
Title: Message
WOW -
Thanks for the info. I put a block on this website at the firewall so just in
case I have that one user that falls for it at least they are protected while at
work.
Greg
-Original Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On Behalf Of
Where can I find an explanation of the following tests that are being failed
by one of our customers?
IPWHOIS, FIVETEN-FREE, NOABUSE
I'm trying to help them correct their MX settings but am not sure what these
tests mean.
Thanks,
Greg
attachment: winmail.dat
Title: Log message
I
think we need to - I've read here on this list that the site is down but then
again I've read here that it will come back up again sometime in the
future.
I
guess we'll commit it out and see what happens.
Greg
-Original Message-From:
[EMAIL PROTECTED]
the config files setup :)
I have not looked at any of the other external testing programs so I
cannot say how it compares.
For us SpamCheck has been Great.
Todd Hunter
Progressive Systems
- Original Message -
From: Greg Foulks [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday
Is it just me or have spammers found other ways to get past scanners? I've
been getting slammed lately with more and more spam that is getting past
declude without a single hit.
Greg Foulks
NewFound Technologies, Inc.
[EMAIL PROTECTED]
http://www.nfti.com
614.318.5036
attachment: winmail.dat
Scott,
I doubt it's a setup issue because I'm using the same setup that I've used
for a year now. Also I am not the only one receiving more spam.. All of my
users are as well...
Anyway here is a piece of spam recently received (I've already blacklisted
the sender) but it seems as soon as I
Scott,
Correct I have not added/removed any gateways or backup mailservers, changed
any IP's for DNS or changed a DNS responsibility.
What I'm seeing in spam lately is that it looks more legit than in the past.
Usually a piece of spam will fail at least one of our tests. like a RFC
problem, a bad
I have not replaced any of the asirusfot.com tests but have added a few
others.
Here is my current configuration
DSBLip4r list.dsbl.org * 30
0
MONKEYFORMMAIL ip4rformmail.relays.monkeys.com * 30 0
Scott,
What is your opinion of Spamchk? How well does it work with Declude and have
you seen any issues with using?
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Tuesday, September 02, 2003 1:17 PM
To: [EMAIL PROTECTED]
Subject:
How does AUTO Whitelist work?
Wouldn't users have to have their address books stored on the Imail server
for this to work?
Greg Foulks
NewFound Technologies, Inc.
[EMAIL PROTECTED]
http://www.nfti.com
614.318.5036
attachment: winmail.dat
What - I missed something... autolist by who you send email to?
This would be awesome! Then I could block all email coming in and then my
users could still get email from those they specify
Where do I get this?
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
... Of
course mailing lists not included.
Highly recommend it...
Hope it is OK to mention a 3rd party tool in this list... :)
Regards,
Kami
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks
Sent: Friday, August 29, 2003 11:34 AM
To: [EMAIL PROTECTED
What is up with the repeat messages? I've received 4 at this list and 3 or 4
on the declude Virus list
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Bridges,
Samantha
Sent: Tuesday, August 26, 2003 10:38 AM
To: [EMAIL PROTECTED]
Subject: RE:
Put the senders address in your whitelist this way you can continue to use
the hold on spamheaders
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Bridges,
Samantha
Sent: Tuesday, August 26, 2003 1:02 PM
To: Junkmail 'Declude. (E-mail)
Subject: RE:
It's tough when I've gone a couple of days without going through my Junkmail
Box where Junkmail passed the filters. Scanning through the headers of 200 +
emails looking for he sender address and then to put that address in my
blacklist is quite a task.
It would be awesome if Declude was capable
I've removed my notice .eml template to users... I've found that they really
don't want to see them at all. As far as they are concerned if it's been
blocked why should they care.
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Malcolm Kynoch
Sent:
Thanks Scott -- I'll give that a go.
Greg
At 02:27 PM 6/3/2003 -0400, you wrote:
Were getting a increase in emails with that contain viruses. I want to
block the sender but the sender address is being forged. I have the
remote IP/domain where the email's are coming from. Can I just include
Is it possible to exclude local
users from the Wordfilter test. I have some users that are trying to send out
group messages but some of the content is being caught in the wordfilter and
they have a legitimate reason to use some of these words.
Thanks,
Greg Foulks, MCP NewFound Technologies
John,
Good point. Questions though about the order that test are run. If adding a fromfile
test how would that effect spam that is sent to
in to our mail server with an internal user as the return address?
Thanks,
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL
of the question was
What is the order of tests that are executed?
is it...
-Global
-Blacklist
-wordfilter
-fromfile
-ipfilter
or some other order? I ask this because it will determine how I assign the values of
the weights.
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email
PROTECTED]X-UIDL:
318944083Status: U
Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email:
[EMAIL PROTECTED] Voice:
614.318.5036 Fax: 614.318.5005
ON
XSPOOLNAME ON
XINHEADER X-Note: This E-mail was sent from %REVDNS% ([%REMOTEIP%]).
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED
Scott,
No they do not.
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Wednesday, January 15, 2003 1:16
Hey Scott- I do have gp1 and gp2 files. Should I send them to [EMAIL PROTECTED]?
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf
I had an email fail the word filter search but I can't seem to find which word
triggered the block. Any suggestions on how I can
find the word that triggered the block?
Thanks,
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax
Thanks Scott-
Couple more questions...
1) How do I find out which version I am running?
2) I don't use WARN and if I'm not using 1.65 do you have any other way of finding
what line of the test it failed?
Thanks,
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL
John,
Looking at the declog I see this as the error for the email that failed.
12/23/2002 11:05:47 Q33ef3e4 Msg failed MYFILTER (Message failed MYFILTER test (21)).
Are you saying that the (21) is the line that the message failed at?
Thanks,
Greg Foulks, MCP
NewFound Technologies, Inc.
http
reference.
Very Strange
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Monday, December 23, 2002 12:34
counter- failed what?
Thanks for any help!
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from
was and none of my other users are having this problem. I
added this user to the white list even though
the mail server is already on the white list and now they are able to send email and
have them get past declude.
Has anyone else seen this problem?
Greg Foulks, MCP
NewFound Technologies, Inc
I found the problem.
I have a block on the word c u m (take out the spaces) in my wordfilter list and the
users name is ac u mmings (take out the
spaces).
How can I block the word c u m(take out the spaces) without affecting this user?
Greg Foulks, MCP
NewFound Technologies, Inc.
http
I use the delete action. How can I find the email in the archives?
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner;declude.com
okay send it again
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
-Original Message-
From: [EMAIL PROTECTED]
[mailto:Declude.JunkMail-owner;declude.com]On Behalf Of R. Scott Perry
Sent: Tuesday, October 22
Scott,
It did not come through. Could you send the email to [EMAIL PROTECTED] or maybe
point to where I might find info about this in
the documentation?
Thanks,
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
I don't know how it is... But I still keep getting emails that pass through Declude
when they have been black listed.
???
Greg
-Original Message-
From: Nicki Bloch [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 20, 2002 8:43 AM
To: Greg
Subject: FW: WARNING: YOU WERE SENT A VIRUS
Now that make sense. then I should but this sender in the Imail kill file? This would
stop them from getting past the email server
right?
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff
Sent: Thursday, August 29, 2002 1:39 PM
To:
I have this email address blocked
[EMAIL PROTECTED]
Yet it is still getting passed my Declude Scanner. Can anyone help with this?
Received: from postoffice.inreach.com [209.142.2.45] by mail.nfti.com with ESMTP
(SMTPD32-6.06) id A3B91450046; Sun, 11 Aug 2002 02:27:05 -0400
Received: from
It's in the sender blacklist... and it's is not in my whitelist.
greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Monday, August 12, 2002 10:04 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] How did this one get
I get this email that say that it was sent from myself to myself. However I see some
other interesting things in the header. What
can I use in this header to keep this from happening again?
Received: from $domain [80.16.228.101] by mail.nfti.com
(SMTPD32-6.06) id AB048501B4; Thu, 27 Jun 2002
Thanks Scott
When will this beta release move to production code?
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Thursday, June 27, 2002 2:01 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] I was spammed by myself
?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Greg Foulks
Sent: Thursday, June 27, 2002 12:50 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] I was spammed by myself
What is the HELOBOGUS test? I've not seen that one. You say that the spam
I guess what I am asking is...
Is the beta stable enough now to take care of this $domain issue... I've been getting
way too many of these.
or
Should I wait until the release is gold?
What do you think?
Greg
BTW- If I move to the newer (beta) version. What becomes of my current
damn your good!
I just added a list of new domains and addresses to block from a posting on this list.
I found it deep in the middle a domain was
being blocked mail.com I added a @ so it now reads @mail.com
Works fine now. Let this be a lesson to us all. Use the block lists at your own risks!
How did this email get through my scanner? Notice the header does not have any of the
declude headers.
greg
--
Received: from gz-5.com [66.197.94.198] by mail.nfti.com
(SMTPD32-6.06) id A27C7E025A; Wed, 26 Jun 2002 10:41:00 -0400
Received: (from root@localhost)by gz-5.com
Well here is what the log says
06/26/2002 10:41:03 Qd27c25a Triggered fromfile on @gz-5.com.
06/26/2002 10:41:47 Qd27c25a WARNING: Could not unlock file due to 2 error.
Greg
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent:
Does anyone know of a tool that will allow me to view the queue in real-time? Without
having to use the View Queue.. button on
Imail.
Thanks,
Greg
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.
I could use more WHITELIST space. I have many users who get email from AOL, YAHOO and
MSN users. I do not want to WHITELIST the
entire domain because of the spam problems from these domains but I do want to
WHITELIST specific users so the 200 limit gets used
up quickly.
Thanks,
Greg Foulks
I wouldn't
suggest it We also get legitimate email that fail the SPAMCOP and OSSRC
tests. Try holding the mail then decide if it should be deleted or
not.
Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email:
[EMAIL PROTECTED] Voice:
614.318.5036 Fax: 614.318.5005
You may already know this but you can also use the following..
[EMAIL PROTECTED] (Any mail from this address will be blocked)
a2.mediatrec.com (Any mail from this 3rd level domain will be blocked)
mediatrec.com (Any mail from this entire domain will be blocked)
If you never want to see another
with ~ are locked files that are in process. These files also have an underscore
as the first characters in the file name.
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
-Original Message-
From: [EMAIL PROTECTED
Not everyone uses outlook and would rather that the filtering took place at the server
level.
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
It would be really cool if let's say a user gets a message and it's SPAM. They could
forward the message to a IMAL mailbox and
declude would intercept the message scan the headers of the message and add it's self
to the blacklist.
Greg
---
[This E-mail was scanned for viruses by Declude Virus
A, but make the black list based on a per user environment. So that if
[EMAIL PROTECTED] no longer want mail from yahoo.com
it won't bother anyone else on the mail server. If they want it changed then they will
have come through the network admin.
Greg Foulks, MCP
NewFound Technologies
used.
#
Where do I go to subscribe? Does anyone know how much the subscription is?
Thanks,
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED
%
#%WARNING%
#Original Email Follows#
Body of original email
Greg Foulks, MCP
NewFound Technologies, Inc.
http://www.nfti.com
Email: [EMAIL PROTECTED]
Voice: 614.318.5036
Fax: 614.318.5005
---
[This E-mail was scanned
85 matches
Mail list logo
