[Declude.JunkMail]
unsubscribe Declude.JunkMail Greg Foulks attachment: winmail.dat
Re: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail
Goto declude.com and you'll see what it is you have to download. Greg Dan Geiser wrote: Is this guy serious when he says The test is available for download. What do we have to download? What version number includes this test? What is the format of the test? Is it just an IP4R test? What host name do we use? - Original Message - *From:* Barry @ CPHZ mailto:[EMAIL PROTECTED] *To:* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] *Sent:* Friday, July 09, 2004 10:35 AM *Subject:* New Multiple Threat Lookup Database test for Declude JunkMail We are pleased to let you know that today we have released a new test for all Declude JunkMail customers who are covered by a currently valid Support Agreement. The MTLDB test will test each E-mail against our database of IP addresses that have sent viruses. If the IP address is listed, the E-mail will fail the test. Otherwise, the E-mail will pass the test. The MTLDB test is used in the same way as other Declude JunkMail tests. For most customers, it would be used towards the weighting system, so that it is more likely that spam will get caught. However, like other tests in Declude JunkMail, it is possible to take a separate action for E-mails failing the MTLDB test (such as quarantining them with the HOLD action). The test is available for download www.declude.com http://www.declude.com/ Thanks for your support. Barry */Barry Simpson President CEO Computerized Horizons, LLC 65 Parker Street Unit 5 Newburyport, MA 01950 /* --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WAY WAY OT: Attn Greg Foulks
John, Thanks for the email this helped to find the problem. Your emails were being zapped because it was failing a mailfrom test (which right now I have no idea why it failed the mailfrom test because your address is not even listed in the file.) 06/29/2004 15:17:09 Qc01a098 SPammers:100 SPAMCHK:-25 . Total weight = 75. 06/29/2004 15:17:09 Qc01a098 Msg failed SPammers (try again later.BR). Action=WARN. 06/29/2004 15:17:09 Qc01a098 Msg failed SPAMCHK (Message failed SPAMCHK: -25.). Action=IGNORE. 06/29/2004 15:17:09 Qc01a098 Msg failed WEIGHT10 (Weight of 75 reaches or exceeds the limit of 10.). Action=IGNORE. 06/29/2004 15:17:09 Qc01a098 Msg failed WEIGHT14 (Weight of 75 reaches or exceeds the limit of 14.). Action=HOLD. 06/29/2004 15:17:09 Qc01a098 Msg failed WEIGHT40 (Weight of 75 reaches or exceeds the limit of 40.). Action=DELETE. 06/29/2004 15:17:09 Qc01a098 Deleting spam from [EMAIL PROTECTED] to [EMAIL PROTECTED] 06/29/2004 15:17:09 Qc01a098 Subject: RE: Demo Request (RESEND) 06/29/2004 15:17:09 Qc01a098 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 67.94.227.39 ID: A00CC68022C John Tolmachoff (Lists) wrote: Sent via list since he claims he has not received e-mails directly from me. It appears you are not receiving e-mail from me, even though your server accepted it: 29-06-2004 12:16:47Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) processing F:\Spool\Qc00c0c68022cd4c1.SMD 29-06-2004 12:16:47Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) [x] looking up nfti.com in HOSTS and MX 29-06-2004 12:16:47Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) Trying nfti.com (0) 29-06-2004 12:16:47Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) [x] Connecting socket to service SMTP on host nfti.com using protocol tcp 29-06-2004 12:16:47Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) Connect nfti.com [12.32.70.215:25] (1) 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 220 X1 Who is this 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) EHLO mail.eservicesforyou.com 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250-mail.nfti.com says hello 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250-SIZE 0 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250-8BITMIME 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250-DSN 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250-ETRN 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250-AUTH LOGIN 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250-AUTH=LOGIN 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250 EXPN 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) MAIL FROM:[EMAIL PROTECTED] 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250 ok 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) RCPT To:[EMAIL PROTECTED] 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250 ok its for [EMAIL PROTECTED] 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) DATA 29-06-2004 12:16:48Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 354 ok, send it; end with CRLF.CRLF 29-06-2004 12:16:51Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) . 29-06-2004 12:16:51Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 250 Message queued 29-06-2004 12:16:51Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) rdeliver nfti.com [EMAIL PROTECTED] (1) [EMAIL PROTECTED] 235342 29-06-2004 12:16:51Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) QUIT 29-06-2004 12:16:51Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) 221 Goodbye 29-06-2004 12:16:51Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) [u] closing socket (u) 29-06-2004 12:16:51Local7.Debug127.0.0.1 SMTP (c00c0c68022cd4c1) finished F:\Spool\Qc00c0c68022cd4c1.SMD status=1 John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send
Re: [Declude.JunkMail] AutoWhite by eServices
Never received a reply. I just sent a new request in. Thanks, Greg John Tolmachoff (Lists) wrote: You configuration is fine with one recommendation: You would off load additional workload from the main server by having it send all outbound e-mail through a smart host, that being the Ant-spam server. This way, the server does not have to do outbound resolution and communications with all the other Internet servers, it simply sends all outgoing to the next server. They way you are tiering your servers is actually a recommended way once a server reaches saturation. Example, a client I consult for is in the process of splitting the work load from one server to 2. The front server which will be configured for SF for all domains and will do all JunkMail scanning and do all the receiving and sending to the Internet. The main server will do all Imail functions and Declude Virus Scanning. But again, all incoming and outgoing will flow through the front server, the main server sending all outbound to it to offload that work from the main server. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of decjunkmail Sent: Wednesday, June 23, 2004 7:40 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AutoWhite by eServices Here's why we are converting our monolithic Imail/Declude servers to a multi-tier store forward configuration as follows: Incoming MX servers: Receives inbound mail from Internet Runs Declude anti-virus to delete all viruses (single global config) Forwards all mail to Anti-spam servers Anti-spam servers: Receives de-virused email from MX servers Runs Declude junkmail with per-domain settings Forwards mail to mailbox servers Mailbox servers: Runs IMAP, POP, WebMail Mailboxes Delivers outbound mail directly for - Locally originated email Internet-originated but SMTP authenticated remote mail The reason for this migration is a love/hate relationship with Ipswitch Imail: It's cost effective and has the features we need (plus the support for Declude plug- ins), BUT It is a CPU hog - WebMail or IMAP often spike the server It has been buggy at times (recent IMAP problems for example) It cannot be clustered - all functions for a domain must be on one server It does not have any HA (high-availability) or redundancy capability By offloading incoming MX, virus scanning, and spam blocking to other servers we are creating a much more robust configuration. Massive virus attacks or spam attacks will not affect our user's ability to access their existing email boxes via pop/imap/webmail. Scalability -- as virus and spam continue to grow much faster than real mail/mailboxes, we can put extra processing power where it is needed most. Currently, we had to prune our Declude rules/filters because they were spiking our boxes to 100% cpu too much. High-availability -- (partially) By isolating the mailbox functions (pop,imap,webmail) and keeping relatively simpler inbound handling/queuing on separate servers, we preserve the ability to receive inbound mail even if we have crashes/bugs/failures in mailbox processing. For our needs, we prefer several affordable servers distributing the tasks than one mega-server box -- better protection against human errors/mistakes which are more likely than hardware failures day-in and day-out. Finally, by modularizing the processing, we gain a little more freedom - in the future we might choose to replace one of the processing nodes with a different vendor/technology. Replacing one function is easier than trying to do an en masse migration the entire mail system. -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Wednesday, June 23, 2004 6:01 PM To: [EMAIL PROTECTED] Subject: RE: Re[2]: [Declude.JunkMail] AutoWhite by eServices A client has a pair of generic incoming MX servers. These then feed into a Declude server, storing and forwarding to the mailbox server. The mailbox server does its own outbound mail. I'd like to know if it will ever be possible to do this, perhaps by a routine that can parse the log on the mail box server(in the case of AutoWhite) or by remote interrogation of web address lists(in the case of Declude's whitelist feature). I fear that not enough people are using Declude as a store and forward device and therefore demand will not be high enough to justify the change. The issue as you have pointed out is that both Declude and AutoWhite for Declude need to see both incoming and outgoing to work. Generally speaking, it appears that most configurations where Imail/Declude scan the incoming only for a SF domain are in corporate configurations where it is used as a cost effective well balanced tool to fight incoming viruses and
Re: [Declude.JunkMail] Avoiding False Positives?
Brent, Something that I'm doing for my users is the use of a pass phrase. I've given all of my users a pass phrase (combination of letters and numbers, similar to a pin code) to give to their contacts who send email to them. Using Spamchk I've created a negative weight of 1000 whenever the pass phrase is found within the body of an email which will erase any all weight that has been assigned to an incoming email and thus saving it from ever being considered spam. Greg Brent Brashear wrote: I have numerous clients that report the problems of their client e-mails failing spam tests. They ask me why their clients fail -and what they can suggest to avoid failing some of the filters. I've heard some things like using all CAPS or backgrounds can hit some filters. My understanding of this is minimal. I know a lot has to do with what filters are being used -and how the administrator setup the domain. Is there any advise to give to legit e-mailers to help out in reducing their chances of getting caught in the spam filters? Regards, Brent --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AutoWhite by eServices
Anyone using the AutoWhite application from eServices? Care to give feedback as to how well/poorly it works? Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] No bounce
I've put in an option to bounce the email if the fails on a weight of 14 or higher. However none of these messages are being bounced and are being delivered. In my $default$ I have defined WEIGHT14 BOUNCE In the declude directory I have an eml file names WEIGHT14bounce.eml The text of the eml file is below. Any ideas as to why these messages are not being bounced? Thanks, Greg From: [EMAIL PROTECTED] To: %MAILFROM% Subject: WARNING: Failed Delivery This message was automatically generated. Please do not reply to this email. ### # WARNING # ### The Declud Spam Scanning software on nfti.com has reported that you sent an E-mail to %ALLRECIPS%, containing material that could be considered spam or is not RFC compliant. If you feel that your message was blocked incorrectly please contact the individual and request that the block be lifted from your address. Regards, Postmaster Original message follows: %FULLMSG% --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] No bounce
What I'm seeing in the declude log is this... 01/29/2004 00:00:36 Q93572c4 Warning: misconfiguration in following line in configuration file (BOUNCE is not an ACTION). May be a duplicate test definition? How can this not be a valid action? Greg Greg Foulks wrote: I've put in an option to bounce the email if the fails on a weight of 14 or higher. However none of these messages are being bounced and are being delivered. In my $default$ I have defined WEIGHT14 BOUNCE In the declude directory I have an eml file names WEIGHT14bounce.eml The text of the eml file is below. Any ideas as to why these messages are not being bounced? Thanks, Greg From: [EMAIL PROTECTED] To: %MAILFROM% Subject: WARNING: Failed Delivery This message was automatically generated. Please do not reply to this email. ### # WARNING # ### The Declud Spam Scanning software on nfti.com has reported that you sent an E-mail to %ALLRECIPS%, containing material that could be considered spam or is not RFC compliant. If you feel that your message was blocked incorrectly please contact the individual and request that the block be lifted from your address. Regards, Postmaster Original message follows: %FULLMSG% --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] No bounce
Scott, I've been a customer of yours now for a couple of years and I wouldn't post to the list if I didn't first read the manual and still have a question. What is it about what I've described would make you think I didn't first read the manual. I'm running 1.76i30 C:\IMaildeclude -diag Declude 1.76i30 (C) Copyright 2000-2003 Computerized Horizons. NoMaxQueProc Diagnostics ON (Declude v1.76i30). Declude JunkMail: Config file found (C:\IMail\Declude\global.CFG). Declude Virus: Config file found (C:\IMail\Declude\Virus.CFG). WARNING: Could not delete eicar.com file [2]! Declude Hijack:Not installed (no C:\IMail\Declude\Hijack.CFG file). Declude Confirm: Not installed (no C:\IMail\Declude\Confirm.CFG file). 63 spam tests defined: BlackHole-Senders IPBLACKLIST DSBL MONKEYFORMMAIL MONKEYP IMail reports Official Host Name as: mail.nfti.com. IMail's SendName registry seems OK: C:\IMail\DECLUDE.EXE. DNS Server: 12.127.16.67 R. Scott Perry wrote: I've put in an option to bounce the email if the fails on a weight of 14 or higher. However none of these messages are being bounced and are being delivered. Have you read the information on the BOUNCE action in the manual? Please do first. Are you running the latest beta? If so, you will need to rename the action (see the archives for details), in an attempt for us to minimize the number of our customers who end up becoming spammers. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Hey Scott - Here's a feature request
Scott, I found this website and thought that it would be really cool if you guys could write a program like this challenge/response that worked with Declude spam. I would absolutely pay for it! http://about.mailblocks.com/features/challenge.aspx Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Challenge/Response with Declude
I guess what I'm trying to say is that I like the concept I also agree with all of con's that have presented. It would be nice if there was someway we could automate the whitelist. What about this spin? What if Declude took the email address that the internal user was sending to and put it in the whitelist? If it's a good address going out then it must be good coming in, right? Greg Andy Schmidt wrote: Hi, I think the consensus is it is not acceptable Then let mine be the only opposing voice. I think because of Declude's weight features, Challenge/Response would be a very valuable and very usable option. Any messages with LOW weight pass. This addresses your concern of breaking e-commerce. If they want to make money, they better have their mail server set up appropriately. Any messages with HIGH weight, get held or deleted. I have yet to hear a complaint. In the middle are a small percentage of medium weights that do fail a spam test or two - but are possibly legitimate. Those few messages currently get a bounce message so that a false positive victim has a chance to intervene. I have gotten zero complaints from people saying hey, you spammed me with your bounce message, but every so often I do get a thank you from a false positive victim who, due to my bounce message, is able to address THEIR problem. It is those bounce messages, which in the future could come with a challenge/response URL, containing the URL with the queue-ID as a parameter to a web application that will release their message. It's a shame that we currently are forced to manually manage the false positives when Declude could automate that process! (Hm - now that I'm saying this - I should just write a little web application that copies the held D and Q file back to the spool and include the parameterized URL in my bounce messages... If I only had the time...) Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] BOUNCE action
So if I wanted to BOUNCE after a certain weight is there a way to incorporate the FORGED check that Declude viruses uses. This way if the return address is forged the bounce is not sent out. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] BOUNCE action
Let me rephrase... How does AUTOFORGE work? How does it know that the senders email address is forged? Greg John Tolmachoff (Lists) wrote: If a messages is quarantined or deleted by Declude Virus, JunkMail will never see it. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Greg Foulks Sent: Wednesday, January 28, 2004 12:45 PM To: Declude JunkMail Subject: [Declude.JunkMail] BOUNCE action So if I wanted to BOUNCE after a certain weight is there a way to incorporate the FORGED check that Declude viruses uses. This way if the return address is forged the bounce is not sent out. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IP4 Tests
I see that the Global config file on Decludes website has an updated list of IP4 tests and that the IP4 website also has a long list of IP4 tests. My question... what are some of your IP4 tests that you use that you find to be very effective? Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[spamchk] [s101] Is this legit?
I'm wondering if I could fitter on the following content of an html message? # Would any legit email these tags together? If it is legit how would one filter this message? HTMLHEADTITLEplatelet magnanimity/TITLE META http-equiv=Content-Type content=text/html; charset=iso-8859-1/HEAD BODYfont color=ffbzns lxkmpgvkxxlhjqqmhv jb/fontbr font face=Verdana size=3font color=ffirresolution/font Ju#115;!#3bt a #119;ay to !#1c#67;#65;NCEL your #68;EBT. font color=ffbisexual/font/FONTp -5? font face=Verdanafont size=3b#42;/B/FONT font size=210#48;#37; #77;on!#4yey #66;ack #71;uarantee font color=ffstyx/font/FONTbr bfont face=Verdana #115;#105;ze=3#42; /FONT/Bfont size=2 No con#115;o#108;#105;#100;at#105;on. No Ban#107;#114;up!#7dtcy. No #76;oan#115;. No Negat#105;ve Cre#100;#105;t Report./FONT/FONT/Pp -7? font face=Verdanafont size=3b#42;/B/FONT font size=2#115;top ALL Co#108;#108;ect#105;on#115; an#100; Hara#115;#115;ment Ca#108;#108;#115; font color=ffflimsy/font/FONT/Pfont size=2 p -6?nbsp;nbsp; !#3sE#108;#105;m#105;n!#0pate your #100;ebt #105;n ap#112;#111;x. 120 #100;ay#115; w#105;th no prob#108;em#115;#33;font color=ffandiron/fontbrnbsp;nbsp; Th#105;#115; #105;nc#108;u#100;e#115; your per#115;ona#108; #100;ebt, bank #108;oan#115;, an#100; cre#100;#105;t car#100; #100;ebt./FONT brfont face=Verdanafont size=3b#42;/B/FONTfont size=2 Fu#108;#108; #100;#105;#115;c#108;o#115;ure !#5kan#100; #105;nformat#105;on w#105;#108;#108; be g#105;ven to you before you #100;ec#105;#100;e./FONT/P p -0?font face=Verdana!#2z font size=3b#42;/B/FONTfont size=2 We have #115;ucce#115;#115;fu#108;#108;y E#108;#105;m#105;nate#100; #100;ebt for thou#115;an#100;#115; of cu#115;tomer#115;, #115;ee how #105;t'#115; !#0o#100;one for your#115;e#108;f./FONT/P p -2?font face=Verdanafont size=3b#42;/B/FONT font size=2 F#105;n#100; out to#100;ay what you w!#3ehere never #115;uppo#115;e#100; to know before the #76;aw#115; Ch!#4dang#101;#33;/FONTbrbrfont color=ffinnate/fontfont color=ffconsign/font a href=http://buddattribute#64;#119;#119;w#46;ms#116;oo#108;s#46;#98; #105;#122;#47;#100;eb#116;#112;ro#47;#63;ozv=45 font size=2 F#105;N#100; #79;UT #72;O!#6gW #105;T WORK#115; /Afont color=ffchowder/font/FONT/P/FONT/FONT !#0yfont color=fflmrnob sfqu dvjq z ncstq nmy upjeob gyvosssjna zm unaoivdu hbsxh jlahtl pcmjeulpicyi/font /BODY/HTML Thanks, Greg ~~ SpamChk Homepage: http://www.spamchk.com To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe list.
[Declude.JunkMail] Incoming email being blacklisted when not in the blacklist file
I had an email come in today that was deleted because it failed my blacklist test. However the email address is not listed in my blacklist so why did declude think it was? 11/11/2003 10:38:02 Q023124a BlackHole-Senders:30 NOABUSE:2 SPAMCHK:-15 . Total weight = 17 11/11/2003 10:38:02 Q023124a Msg failed BlackHole-Senders (). Action=DELETE. 11/11/2003 10:38:02 Q023124a Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. Q023124a Msg failed WEIGHT10 (Weight of 17 reaches or exceeds the limit of 10.). Action=IGNORE. 11/11/2003 10:38:02 Q023124a Msg failed WEIGHT14 (Weight of 17 reaches or exceeds the limit of 14.). Action=ATTACH. 11/11/2003 10:38:02 Q023124a Deleting spam from [EMAIL PROTECTED] to [EMAIL PROTECTED] I did a search in my blacklist file for @pg.com [EMAIL PROTECTED] and pg and nothing is listed in my blacklist file. Where did declude decide that this email is blacklisted? Thanks, Greg attachment: winmail.dat
RE: [Declude.JunkMail] Incoming email being blacklisted when not in the blacklist file not in the blacklist file
.de is what the problem was. I had a ton of spam coming from .de domains so I put .de in my blacklist. I don't understand why .de would block [EMAIL PROTECTED] when this email ends with the domain .com. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, November 11, 2003 11:46 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Incoming email being blacklisted when not in the blacklist file not in the blacklist file I had an email come in today that was deleted because it failed my blacklist test. However the email address is not listed in my blacklist so why did declude think it was? I'm guessing Declude thought it was listed because it was. :) One common example is that some people blacklist mail.com (as opposed to @mail.com), which will also blacklist mail from hotmail.com. 11/11/2003 10:38:02 Q023124a BlackHole-Senders:30 NOABUSE:2 SPAMCHK:-15 . Total weight = 17 11/11/2003 10:38:02 Q023124a Msg failed BlackHole-Senders (). Action=DELETE. 11/11/2003 10:38:02 Q023124a Deleting spam from [EMAIL PROTECTED] to [EMAIL PROTECTED] I did a search in my blacklist file for @pg.com [EMAIL PROTECTED] and pg and nothing is listed in my blacklist file. Where did declude decide that this email is blacklisted? I would double-check the file for things like .de or tler.de or pg.com (not just @pg.com). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments on this ?
spammers are getting smarter and are findings ways to get around our tests. I'm getting to the point to where I am about to cut off everyone from sending email to us and setting up a phone number so that people who want to send us email have to call in and subscribe. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of IS - Systems Eng. (Karl Drugge) Sent: Friday, November 07, 2003 11:41 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Comments on this ? I have a client that is getting HAMMERED by mass SPAM emailings. In excess of 500,000 emails a month are getting deleted on an 80 user network. His Internet connection is totally flooded. I've been working with him over the past 9 months or so and have been trying to track things down to a single spammer or set of spammers. First, he is the target of the 'reflected email attack/delivery system. He was getting loads of these. He still gets these, but only about 100-150,000 a month. The rest are pure garbage items, at a much heavier than normal load of SPAM for a site of his size. What's curious is that I have been attempting to run MID level logging in order to get the connecting IP's, reasoning that if I could find the IP ranges, I could blow them off at the firewall and spare DECLUDE from having to process the emails. But, to my surprise, after running a few PERL scripts on the logs, the number of offending IP's, even listing those with over 50 deletes, is something on the order of over 2,000 ! There are no real ranges that I can find. If I include servers sending 10 emails that DECLUDE deletes, I have over 5 thousand for the month. It's a massive deluge from thousands of servers sending 4 or 5 emails a day. It's beginning to look that whoever is sending the mail has hundreds of zombie 'bots out on the internet and can direct them at will. Short of telling him he needs to just dump his domain name and get a new one, or co-locate a server upstream at an ISP for Declude, I am out of answers. Is anyone else seeing this type of attack ? Are Spammers now using zombie 'bots ? Karl Drugge --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. attachment: winmail.dat
[Declude.JunkMail] Test Autowhitelist
Is it possible to test the Autowhitelist On feature? Or is there a command line option that can verify that the option is turned on? Thanks, Greg attachment: winmail.dat
[Declude.JunkMail] Per user blacklist
Is it possible to create/setup a per-user blacklist that each user can maintain? Thanks, Greg attachment: winmail.dat
RE: [Declude.JunkMail] Test Autowhitelist
Well Scott it doesn't appear to be working. Here are the logs and showing points assigned from Spamchk but declude should have whitelisted because the from addy is in my webmail address book. 11/04/2003 11:39:00, file C:\IMail\spool\Dd620200.SMD, Result 0H 0L 15K, total 15 From:[EMAIL PROTECTED] To:[EMAIL PROTECTED] Subject:Society Feedback 0.63 Filename is C:\IMail\spool\Dd620200.SMD 0.63 Read 1382 bytes from file C:\IMail\spool\Dd620200.SMD 0.63 Header is 661 bytes, body is 717 bytes 0.63 X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0) 0.64 Number of words:98, 7 bytes per word 0.64 Longest word is 20 bytes long 0.64 Checkword 1-800 found 1 times (15 points) 0.64 Checkwords found: 1-800 11/04/2003 11:39:00 Qd620200 SPAMCHK:15 . Total weight = 15 11/04/2003 11:39:00 Qd620200 Msg failed SPAMCHK (Message failed SPAMCHK: 15.). Action=IGNORE. 11/04/2003 11:39:00 Qd620200 Msg failed WEIGHT10 (Weight of 15 reaches or exceeds the limit of 10.). Action=IGNORE. 11/04/2003 11:39:00 Qd620200 Msg failed WEIGHT14 (Weight of 15 reaches or exceeds the limit of 14.). Action=ATTACH. 11/04/2003 11:39:00 Qd620200 L1 Message OK 11/04/2003 11:39:00 Qd620200 Subject: Society Feedback 11/04/2003 11:39:00 Qd620200 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 10.0.0.55 ID: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, November 04, 2003 11:11 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Test Autowhitelist Is it possible to test the Autowhitelist On feature? Or is there a command line option that can verify that the option is turned on? If you have a line AUTOWHITELIST ON in the global.cfg file, with no other lines beginning with AUTOWHITELIST, then it should be on. To test it, you could send yourself an E-mail with a return address that is listed in your web messaging address book, and make sure that it gets whitelisted. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test Autowhitelist
Found the problem (just needed to upgrade to the latest version) Question... I noticed that the common addresses in the users webmail address book are not used in the Autowhitelist search. Only the users addresses are used. Why is this? Is it possible to also use the common addresses? Thanks, Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Greg Foulks Sent: Tuesday, November 04, 2003 11:46 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Test Autowhitelist Well Scott it doesn't appear to be working. Here are the logs and showing points assigned from Spamchk but declude should have whitelisted because the from addy is in my webmail address book. 11/04/2003 11:39:00, file C:\IMail\spool\Dd620200.SMD, Result 0H 0L 15K, total 15 From:[EMAIL PROTECTED] To:[EMAIL PROTECTED] Subject:Society Feedback 0.63 Filename is C:\IMail\spool\Dd620200.SMD 0.63 Read 1382 bytes from file C:\IMail\spool\Dd620200.SMD 0.63 Header is 661 bytes, body is 717 bytes 0.63 X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0) 0.64 Number of words:98, 7 bytes per word 0.64 Longest word is 20 bytes long 0.64 Checkword 1-800 found 1 times (15 points) 0.64 Checkwords found: 1-800 11/04/2003 11:39:00 Qd620200 SPAMCHK:15 . Total weight = 15 11/04/2003 11:39:00 Qd620200 Msg failed SPAMCHK (Message failed SPAMCHK: 15.). Action=IGNORE. 11/04/2003 11:39:00 Qd620200 Msg failed WEIGHT10 (Weight of 15 reaches or exceeds the limit of 10.). Action=IGNORE. 11/04/2003 11:39:00 Qd620200 Msg failed WEIGHT14 (Weight of 15 reaches or exceeds the limit of 14.). Action=ATTACH. 11/04/2003 11:39:00 Qd620200 L1 Message OK 11/04/2003 11:39:00 Qd620200 Subject: Society Feedback 11/04/2003 11:39:00 Qd620200 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 10.0.0.55 ID: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, November 04, 2003 11:11 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Test Autowhitelist Is it possible to test the Autowhitelist On feature? Or is there a command line option that can verify that the option is turned on? If you have a line AUTOWHITELIST ON in the global.cfg file, with no other lines beginning with AUTOWHITELIST, then it should be on. To test it, you could send yourself an E-mail with a return address that is listed in your web messaging address book, and make sure that it gets whitelisted. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test Autowhitelist
That's right! I'm using Killerwebmail to setup a common address book for the group. By editing the config_CommonAddrBook.cgi file you can create a common address book for all users. Sorry about the mix up.. But it would be cool if declude could also read this file. Thanks, Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, November 04, 2003 12:21 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Test Autowhitelist I noticed that the common addresses in the users webmail address book are not used in the Autowhitelist search. Only the users addresses are used. Why is this? Is it possible to also use the common addresses? That's because IMail doesn't have common addresses, AFAIK. Are you using a third-party addon? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DNS Report
Is anyone able to get to the site? www.dnsreport.com Just want to make sure that it's just not me that is having problems. Thanks, Greg attachment: winmail.dat
RE: [Declude.JunkMail] DNS Report
Seems like it just came back up. Thanks, Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, October 13, 2003 10:36 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] DNS Report Yes, I can. * 817-329-5275 PH 817-329-1189 FX intercityweb.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, October 13, 2003 9:30 AM To: Declude JunkMail (E-mail) Subject:[Declude.JunkMail] DNS Report Is anyone able to get to the site? www.dnsreport.com Just want to make sure that it's just not me that is having problems. Thanks, Greg attachment: winmail.dat
[Declude.JunkMail] Strange Email getting past checks
I have this email a user forwarded to me that he received yesterday. By all indications in the logs the message should have been deleted because of all the tests it failed. I delete emails with a weight of 40 or more. This email had a weight of 141 and was still attached and sent to the user. Here is the declude log showing what happened to the email. Does anyone have any ideas why this email was still able to be delivered? (Do I need to remove the WEIGHT50 action?) 10/05/2003 12:12:23 Q42df204 EASYNET-DNSBL:20 SPAMCOP:40 SECURITYSAGE:20 MAILPOLICE-BULK:40 REVDNS:2 SPAMCHK:19 . Total weight = 141 10/05/2003 12:12:23 Q42df204 Msg failed EASYNET-DNSBL (Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html). Action=WARN. 10/05/2003 12:12:23 Q42df204 Msg failed SPAMCOP (Blocked - see http://www.spamcop.net/bl.shtml?69.60.142.7). Action=WARN. 10/05/2003 12:12:23 Q42df204 Msg failed SECURITYSAGE (mail07.emailpls.com.blackhole.securitysage.com.). Action=WARN. 10/05/2003 12:12:23 Q42df204 Msg failed MAILPOLICE-BULK (This E-mail came from mail07.emailpls.com, a potential spam source listed in MAILPOLICE-BULK.). Action=WARN. 10/05/2003 12:12:23 Q42df204 Msg failed REVDNS (This E-mail was sent from a MUA/MTA 69.60.142.7 with no reverse DNS entry.). Action=IGNORE. 10/05/2003 12:12:24 Q42df204 Msg failed SPAMCHK (Message failed SPAMCHK: 19.). Action=IGNORE. 10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT10 (Weight of 141 reaches or exceeds the limit of 10.). Action=IGNORE. 10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT14 (Weight of 141 reaches or exceeds the limit of 14.). Action=ATTACH. 10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT16 (Weight of 141 reaches or exceeds the limit of 16.). Action=IGNORE. 10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT20 (Weight of 141 reaches or exceeds the limit of 20.). Action=IGNORE. 10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT26 (Weight of 141 reaches or exceeds the limit of 26.). Action=IGNORE. 10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT30 (Weight of 141 reaches or exceeds the limit of 30.). Action=IGNORE. 10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT40 (Weight of 141 reaches or exceeds the limit of 40.). Action=DELETE. 10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT50 (Weight of 141 reaches or exceeds the limit of 50.). Action=IGNORE. 10/05/2003 12:12:24 Q42df204 Deleting spam from [EMAIL PROTECTED] to [EMAIL PROTECTED] 10/05/2003 12:12:24 Q42df204 Subject: RE: Are you a Christian Single? 10/05/2003 12:12:24 Q42df204 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 69.60.142.7 ID: JAA80040 Greg Foulks NewFound Technologies, Inc. [EMAIL PROTECTED] http://www.nfti.com 614.318.5036 attachment: winmail.dat
RE: [Declude.JunkMail] Strange Email getting past checks
Scott, Okay so I checked the logs again and found two emails with the same subject for this person. The other email with the weight of 17 should have been deleted because I have a blacklisted the .pn01.com domain... Why didn't it catch it? Here are the logs for both emails... 10/06/2003 00:27:34 Qef1a1d8 MAILPOLICE-BULK:40 SPAMCHK:17 . Total weight = 57 10/06/2003 00:27:34 Qef1a1d8 Msg failed MAILPOLICE-BULK (This E-mail came from 22.pn01.com, a potential spam source listed in MAILPOLICE-BULK.). Action=WARN. 10/06/2003 00:27:34 Qef1a1d8 Msg failed SPAMCHK (Message failed SPAMCHK: 17.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT10 (Weight of 57 reaches or exceeds the limit of 10.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT14 (Weight of 57 reaches or exceeds the limit of 14.). Action=ATTACH. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT16 (Weight of 57 reaches or exceeds the limit of 16.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT20 (Weight of 57 reaches or exceeds the limit of 20.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT26 (Weight of 57 reaches or exceeds the limit of 26.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT30 (Weight of 57 reaches or exceeds the limit of 30.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT40 (Weight of 57 reaches or exceeds the limit of 40.). Action=DELETE. 10/06/2003 00:27:34 Qef1a1d8 Msg failed WEIGHT50 (Weight of 57 reaches or exceeds the limit of 50.). Action=IGNORE. 10/06/2003 00:27:34 Qef1a1d8 Deleting spam from [EMAIL PROTECTED] to [EMAIL PROTECTED] 10/06/2003 00:27:34 Qef1a1d8 Subject: RE: Christian Single? 10/06/2003 00:27:34 Qef1a1d8 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 69.6.28.29 ID: PAA18749 10/06/2003 13:00:11 Q9f791da SPAMCHK:17 . Total weight = 17 10/06/2003 13:00:11 Q9f791da Msg failed SPAMCHK (Message failed SPAMCHK: 17.). Action=IGNORE. 10/06/2003 13:00:11 Q9f791da Msg failed WEIGHT10 (Weight of 17 reaches or exceeds the limit of 10.). Action=IGNORE. 10/06/2003 13:00:11 Q9f791da Msg failed WEIGHT14 (Weight of 17 reaches or exceeds the limit of 14.). Action=ATTACH. 10/06/2003 13:00:11 Q9f791da Msg failed WEIGHT16 (Weight of 17 reaches or exceeds the limit of 16.). Action=IGNORE. 10/06/2003 13:00:11 Q9f791da L1 Message OK 10/06/2003 13:00:11 Q9f791da Subject: RE: Christian Single? 10/06/2003 13:00:11 Q9f791da From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 69.6.28.28 ID: CAA09196 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, October 07, 2003 9:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Strange Email getting past checks I have this email a user forwarded to me that he received yesterday. By all indications in the logs the message should have been deleted because of all the tests it failed. I delete emails with a weight of 40 or more. Are you *positive* that the user received the same E-mail that the log file entries refer to? 10/05/2003 12:12:24 Q42df204 Msg failed WEIGHT40 (Weight of 141 reaches or exceeds the limit of 40.). Action=DELETE. This one shows that the DELETE action was going to be used on this E-mail, unless a WHITELIST entry was there to override it. 10/05/2003 12:12:24 Q42df204 Deleting spam from [EMAIL PROTECTED] to [EMAIL PROTECTED] And this one shows that Declude JunkMail deleted it. I'm guessing these log file entries were for a different E-mail. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Strange Email getting past checks
Scott, Here are a couple of lines from my blacklist file @hungermail.com [EMAIL PROTECTED] [EMAIL PROTECTED] .pn01.com @4hermail.com @mho.net @mynet.com I am currently running 1.75 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, October 07, 2003 10:51 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Strange Email getting past checks Okay so I checked the logs again and found two emails with the same subject for this person. The other email with the weight of 17 should have been deleted because I have a blacklisted the .pn01.com domain... Why didn't it catch it? Are you blacklisting based on the return address ([EMAIL PROTECTED])? What does the line in your blacklist file say? Which version of Declude JunkMail are you running (\IMail\Declude -diag from a command prompt will show you)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Strange Email getting past checks
I've seen a couple others that are not working and honestly I have just started to look at it so I don't recall which of the other's are not working. No I do not see any spaces or tabs at the end of the .pn01.com line. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, October 07, 2003 11:23 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Strange Email getting past checks Here are a couple of lines from my blacklist file @hungermail.com [EMAIL PROTECTED] [EMAIL PROTECTED] .pn01.com @4hermail.com @mho.net @mynet.com Are other lines from your blacklist file working? Could there be any spaces/tabs at the end of the .pn01.com line? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Strange Email getting past checks
Karen, Blacklisted meaning I've created a blacklist file of known spamming return addresses that if found adds a weight of 50 which would exceed the delete action of 40. Not sure what you mean by weightrange... My rules are very simple ignore up to 10 attach between 11-39 and delete everything over 40. No spaces at the end of what? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Karen D. Oland Sent: Tuesday, October 07, 2003 11:49 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Strange Email getting past checks Your logs would be much easier to read (and your rules more clear) if you used weightrange instead of weight for your tests (unless you are adding labels and not doing some type of route/hold/delete action. Even with labels, the users' rules could get confused trying to deal with mail that failed all the weight tests, unless they are in the exact order of testing highest weight first, then each lower weight in order. If you are deleting on 40, you don't really need a test for a higher weight, do you? what exactly do you mean by blacklisted? do you have a rule with delete action? if so, what is it - in global.cf, $junkmail and the actual line in the filter file (make sure no spaces at the end of it)? --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] eBay - scam..
Title: Message WOW - Thanks for the info. I put a block on this website at the firewall so just in case I have that one user that falls for it at least they are protected while at work. Greg -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Kami RazvanSent: Thursday, October 02, 2003 9:16 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] eBay - scam.. I sent it to [EMAIL PROTECTED] and requested clarifications since we had not seen it before. Here is the response. === Thank you for contacting eBay's Trust and Safety Department about email solicitations that are falsely made to appear to have come from eBay. These emails, commonly referred to as "spoof" messages, are sent in an attempt to collect sensitive personal information from recipients who reply to the message or click on a link to a Web page requesting this information. The email you reported did not originate from, nor is it endorsed by, eBay. We are very concerned about this problem and are working diligently to address the situation. We have investigated the source of this email and have taken appropriate action. You may rest assured that your account standing has not changed and that your listings have not been affected. We advise you to be very cautious of email messages that ask you to submit information such as your credit card number or your email password. eBay will never ask you for sensitive personal information such as passwords, bank account or credit card numbers, Personal Identification Numbers (PINs), or Social Security numbers in an email itself. If you ever need to provide information to eBay please open a new Web browser, type www.ebay.com, and click on the "site map" link located at the top the page to access the eBay page you need.If you have any doubt about whether an email message is from eBay, please forward it immediately to [EMAIL PROTECTED] and do not respond to itor click on any of the links in the email message. Please do not change the subject line or forward the email as an attachment. So I guess they have filters that picked up that URL in their autoresponse. Regards, Kami -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill LandrySent: Thursday, October 02, 2003 9:06 AMTo: [EMAIL PROTECTED]Subject: Re: [Declude.JunkMail] eBay - scam.. Yep, been catching this one for quite a while now. It is surprising, however,that E-Bay has not gone after these guys since it is so blatant in its attempt to steal E-Bay user account information. Bill - Original Message - From: Kami Razvan To: [EMAIL PROTECTED] Sent: Thursday, October 02, 2003 1:06 AM Subject: [Declude.JunkMail] eBay - scam.. Hi; An interesting email was just caught with a barely hold value. It is asking for the recipient to click to update their eBay records. The only URL in the body that is suspicious is: info-update-ebay.com The Whois is anything but eBay. The email has full eBay logo and TRUSTe information - coming with links from eBay. This is the way the email starts.. Your eBay account is in jeopardy! To secure your account please continue by clicking the link below. Secure your eBay account now! = Has anyone else seen this? You may want to filter that URL. Regards, Kami
[Declude.JunkMail] Explanation of failed tests
Where can I find an explanation of the following tests that are being failed by one of our customers? IPWHOIS, FIVETEN-FREE, NOABUSE I'm trying to help them correct their MX settings but am not sure what these tests mean. Thanks, Greg attachment: winmail.dat
RE: [Declude.JunkMail] Log message
Title: Log message I think we need to - I've read here on this list that the site is down but then again I've read here that it will come back up again sometime in the future. I guess we'll commit it out and see what happens. Greg -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Sharyn SchmidtSent: Wednesday, September 03, 2003 11:10 AMTo: Declude Junkmail ListSubject: [Declude.JunkMail] Log message I am seeing these in my logs Msg failed OSRELAY (Please stop using relays.osirusoft.com) Should I comment out that test? Sharyn
RE: [Declude.JunkMail]Review of Spamchk - was More and more email getting past Declude
So far so good - I really like what I see! Thanks, Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Todd - Smart Mail Sent: Tuesday, September 02, 2003 9:06 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail]Review of Spamchk - was More and more email getting past Declude Greg, we have been using SpamCheck for about 1 1/2 months now and have had No problems with it. Pros 1. Easy to Install 2. Support has been good 3. Highly flexible 4. Catches a lot of spam that passes DNS and RFC tests 5. Allows you to give emails + or - weights 6. Cost $0 Cons 1. Config files can require a good deal of time and customization for your needs 2. I understand CPU utilization can be high - but they are working on that. 3. Its Beta(?) software so you take it As Is(Correct me if wrong on this anyone) 4. Did I mention it takes some time to get the config files setup :) I have not looked at any of the other external testing programs so I cannot say how it compares. For us SpamCheck has been Great. Todd Hunter Progressive Systems - Original Message - From: Greg Foulks [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, September 02, 2003 12:26 PM Subject: RE: [Declude.JunkMail]Review of Spamchk - was More and more email getting past Declude Scott, What is your opinion of Spamchk? How well does it work with Declude and have you seen any issues with using? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, September 02, 2003 1:17 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] More and more email getting past Declude It just seems like that recently the spam we've been getting is clean. Which makes it hard for declude to block it when it passes all of the rules. That's because companies that feel that they are legitimate E-mailers (ones that technically *do* have your permission to send the mail!) are the ones that are very likely to have everything in order. Their mail isn't likely to have header problems, DNS problems, anti-filter devices, etc. For this type of spam, the best answer is often a content filtering program (such as Message Sniffer or Alligate) that can work in conjunction with Declude, which is better able to catch this type of spam. But, note that there's a fine line here in determining what is spam and what is not. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- -- -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] More and more email getting past Declude
Is it just me or have spammers found other ways to get past scanners? I've been getting slammed lately with more and more spam that is getting past declude without a single hit. Greg Foulks NewFound Technologies, Inc. [EMAIL PROTECTED] http://www.nfti.com 614.318.5036 attachment: winmail.dat
RE: [Declude.JunkMail] More and more email getting past Declude
Scott, I doubt it's a setup issue because I'm using the same setup that I've used for a year now. Also I am not the only one receiving more spam.. All of my users are as well... Anyway here is a piece of spam recently received (I've already blacklisted the sender) but it seems as soon as I blacklist a sender a new one is created. Received: from p.advertisingbymail.com [64.119.218.212] by mail.nfti.com (SMTPD32-6.06) id A91816D01A4; Tue, 02 Sep 2003 08:12:08 -0400 To: [EMAIL PROTECTED] Date: Tue, 2 Sep 2003 04:20:23 -0800 Message-ID: [EMAIL PROTECTED] From: Weight Solution [EMAIL PROTECTED] Return-Path: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Subject: Lose 10lbs in 1 Week X-MimeOLE: Prodigy Compatibility V 4.5c810f26 or later Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Declude-Sender: [EMAIL PROTECTED] [64.119.218.212] X-Declude-Spoolname: D89181a4.SMD X-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for spam. X-Spam-Tests-Failed: None X-Weight: 0 X-Note: This E-mail was sent from p.advertisingbymail.com ([64.119.218.212]). X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 359866453 Status: U Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, September 02, 2003 9:53 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] More and more email getting past Declude Is it just me or have spammers found other ways to get past scanners? I've been getting slammed lately with more and more spam that is getting past declude without a single hit. The two most common reasons for this are [1] A setup issue (a gateway/backup that Declude doesn't know about, bad DNS server, etc.), or [2] quasi-legitimate E-mail (for example, E-mail that you get after giving your E-mail address to a company but forgetting to uncheck the box that says It's OK to give my E-mail address to your affiliates or whatever). If you can post the full headers (including Received: headers; no need for the message body), I can probably provide some pointers for how to improve spam detection. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] More and more email getting past Declude
Scott, Correct I have not added/removed any gateways or backup mailservers, changed any IP's for DNS or changed a DNS responsibility. What I'm seeing in spam lately is that it looks more legit than in the past. Usually a piece of spam will fail at least one of our tests. like a RFC problem, a bad reverse, etc... It just seems like that recently the spam we've been getting is clean. Which makes it hard for declude to block it when it passes all of the rules. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, September 02, 2003 11:01 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] More and more email getting past Declude I doubt it's a setup issue because I'm using the same setup that I've used for a year now. Also I am not the only one receiving more spam.. All of my users are as well... So in the past year, you haven't added/removed any gateways or backup mailservers, haven't changed IPs for DNS servers, haven't had a DNS server changed to be authoritative only, etc.? Note that a configuration change that causes problems will usually be noticeable by all users of the server. Received: from p.advertisingbymail.com [64.119.218.212] by mail.nfti.com (SMTPD32-6.06) id A91816D01A4; Tue, 02 Sep 2003 08:12:08 -0400 Given that this is sent from an IP that has a reverse DNS entry that matches the HELO/EHLO, and that it has an obvious domain name (advertisingbymail.com), by first guess is that it is: [2] quasi-legitimate E-mail (for example, E-mail that you get after giving your E-mail address to a company but forgetting to uncheck the box that says It's OK to give my E-mail address to your affiliates or whatever). In this case, you'll need to do some work to block this type of E-mail. In this case, you may want to try a filter that blocks all E-mail with advertisingbymail.com in the reverse DNS entry. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] More and more email getting past Declude
I have not replaced any of the asirusfot.com tests but have added a few others. Here is my current configuration DSBLip4r list.dsbl.org * 30 0 MONKEYFORMMAIL ip4rformmail.relays.monkeys.com * 30 0 MONKEYPROXIES ip4rproxies.relays.monkeys.com * 30 0 NJABL ip4r dnsbl.njabl.org 127.0.0.2 10 0 VOX ip4r vox.schpider.com 127.0.0.2 30 0 BLITZEDALL ip4r opm.blitzed.org * 20 0 EASYNET-DNSBL ip4rblackholes.easynet.nl 127.0.0.2 60 0 EASYNET-PROXIES ip4rproxies.blackholes.easynet.nl * 20 0 IPWHOIS ip4ripwhois.rfc-ignorant.org127.0.0.6 5 0 SORBS-HTTP ip4rdnsbl.sorbs.net 127.0.0.2 7 0 SORBS-SOCKS ip4rdnsbl.sorbs.net 127.0.0.3 7 0 SORBS-MISC ip4rdnsbl.sorbs.net 127.0.0.4 7 0 SORBS-SMTP ip4rdnsbl.sorbs.net 127.0.0.5 7 0 SORBS-SPAM ip4rdnsbl.sorbs.net 127.0.0.6 7 0 SORBS-WEB ip4rdnsbl.sorbs.net 127.0.0.7 7 0 SORBS-BLOCK ip4rdnsbl.sorbs.net 127.0.0.8 3 0 SORBS-ZOMBIEip4rdnsbl.sorbs.net 127.0.0.9 7 0 SPAMBAG ip4rblacklist.spambag.org 127.0.0.2 10 0 UCEBip4rblackholes.uceb.org * 20 0 ORDBip4r relays.ordb.org * 10 0 OSDUL ip4rrelays.osirusoft.com127.0.0.3 5 0 OSFORM ip4rrelays.osirusoft.com127.0.0.8 9 0 OSLIST ip4rrelays.osirusoft.com127.0.0.7 9 0 OSRELAY ip4rrelays.osirusoft.com127.0.0.2 9 0 OSSMART ip4rrelays.osirusoft.com127.0.0.5 9 0 OSSOFT ip4rrelays.osirusoft.com127.0.0.6 9 0 OSSRC ip4rrelays.osirusoft.com127.0.0.4 9 0 SPAMCOP ip4r bl.spamcop.net127.0.0.2 10 0 NJABL ip4r dnsbl.njabl.org127.0.0.2 10 0 FABELSOURCESip4r spamsources.fabel.dk 127.0.0.2 10 0 FIVETEN-SPAMip4r blackholes.five-ten-sg.com 127.0.0.2 10 0 FIVETEN-BULKip4r blackholes.five-ten-sg.com 127.0.0.4 10 0 FIVETEN-MULTISTAGE ip4r blackholes.five-ten-sg.com 127..0.0.5 10 0 FIVETEN-SPAMSUPPORT ip4r blackholes.five-ten-sg.com 127.0.0.7 10 0 FIVETEN-MISCip4r blackholes.five-ten-sg.com 127.0.0.9 10 0 FIVETEN-SINGLESTAGE ip4r blackholes.five-ten-sg.com 127.0.0.6 25 0 FIVETEN-FREEip4r blackholes.five-ten-sg.com 127.0.0.12 10 0 INTERSILip4r blackholes.intersil.net127.0.0.2 10 0 SPAMHAUSip4r sbl.spamhaus.org 127...0.0.2 55 0 CBL ip4r cbl.abuseat.org127.0..0.2 45 0 DSN rhsbl dsn.rfc-ignorant.org127.0.0.2 4 0 NOABUSE rhsbl abuse.rfc-ignorant.org 127.0.0.4 2 0 NOPOSTMASTERrhsbl postmaster.rfc-ignorant.org 127.0.0.3 4 0 SECURITYSAGErhsbl blackhole.securitysage.com * 20 0 SORBS-BADCONF rhsbldnsbl.sorbs.net127.0.0.11 3 0 SORBS-NOMAILrhsbldnsbl.sorbs.net127.0.0.12 1 0 MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 45 0 MAILPOLICE-PORN rhsbl porn.rhs.mailpolice.com 127.0.0.2 55 0 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Todd Hunter Sent: Tuesday, September 02, 2003 12:15 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] More and more email getting past Declude Greg, I doubt it's a setup issue because I'm using the same setup that I've used for a year now. This probably goes without saying but you have removed the osirusoft.com tests and replaced them with something appropriate? I have email accounts that I monitor that get Huge amounts of spam. We were seeing some spam that would pass the DNS based tests and for that reason we added SpamCheck. Now Nothing get through. And we have fewer FPs. Todd Hunter Progressive Systems At 10:16 AM 9/2/2003
RE: [Declude.JunkMail]Review of Spamchk - was More and more email getting past Declude
Scott, What is your opinion of Spamchk? How well does it work with Declude and have you seen any issues with using? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, September 02, 2003 1:17 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] More and more email getting past Declude It just seems like that recently the spam we've been getting is clean. Which makes it hard for declude to block it when it passes all of the rules. That's because companies that feel that they are legitimate E-mailers (ones that technically *do* have your permission to send the mail!) are the ones that are very likely to have everything in order. Their mail isn't likely to have header problems, DNS problems, anti-filter devices, etc. For this type of spam, the best answer is often a content filtering program (such as Message Sniffer or Alligate) that can work in conjunction with Declude, which is better able to catch this type of spam. But, note that there's a fine line here in determining what is spam and what is not. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AUTO Whitelist question
How does AUTO Whitelist work? Wouldn't users have to have their address books stored on the Imail server for this to work? Greg Foulks NewFound Technologies, Inc. [EMAIL PROTECTED] http://www.nfti.com 614.318.5036 attachment: winmail.dat
RE: [Declude.JunkMail] AUTO Whitelist question
What - I missed something... autolist by who you send email to? This would be awesome! Then I could block all email coming in and then my users could still get email from those they specify Where do I get this? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Robert Grosshandler Sent: Friday, August 29, 2003 11:20 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Also, check out autowhite. It automatically whitelists an e-mail address when you send e-mail to that address. While it has more flexibility than that, that's the simplest description. I immediately went to Outlook, and sent e-mail to anybody I cared about, and now I know that I'll get whatever they send me, even if it normally would trigger all of the anti-spam (but not anti-virus) stuff we have running. I don't have a great link for it, but it is in the archive. Rob === Robert N. Grosshandler www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] AUTO Whitelist question
I don't see it either -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Danny Klopfer Sent: Friday, August 29, 2003 3:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Kami, Are you talking about the AUTOWHITELIST ON option or are you talking about the 3rd party software from John? If the AUTOWHITE from John how much is it? I don't see a price on his website. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan Sent: Friday, August 29, 2003 9:32 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Hi; For what it is worth... We have been using AutoWhitelist for a long long time... It will dramatically help you with False Positives. It has given us much more freedom to be strict with our rules and has reduced FP's to zero... Of course mailing lists not included. Highly recommend it... Hope it is OK to mention a 3rd party tool in this list... :) Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks Sent: Friday, August 29, 2003 11:34 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question What - I missed something... autolist by who you send email to? This would be awesome! Then I could block all email coming in and then my users could still get email from those they specify Where do I get this? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Robert Grosshandler Sent: Friday, August 29, 2003 11:20 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] AUTO Whitelist question Also, check out autowhite. It automatically whitelists an e-mail address when you send e-mail to that address. While it has more flexibility than that, that's the simplest description. I immediately went to Outlook, and sent e-mail to anybody I cared about, and now I know that I'll get whatever they send me, even if it normally would trigger all of the anti-spam (but not anti-virus) stuff we have running. I don't have a great link for it, but it is in the archive. Rob === Robert N. Grosshandler www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Cannot receive messages from Comcast.net accounts
What is up with the repeat messages? I've received 4 at this list and 3 or 4 on the declude Virus list Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bridges, Samantha Sent: Tuesday, August 26, 2003 10:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Cannot receive messages from Comcast.net accounts Sorry for the confusion. I just received this message. Is the Web slow or is it me or is it Declude. Anyone noticing anything strange? I still cannot receive from Comcast.net accounts though. Thanks Samantha -Original Message- From: Bridges, Samantha Sent: Tuesday, August 26, 2003 10:25 AM To: Junkmail 'Declude. (E-mail) Subject: [Declude.JunkMail] Cannot receive messages from Comcast.net accounts Cannot receive messages from @Comcast.net accounts. When I send to another server not running JunkMail the headers are as follows: Microsoft Mail Internet Headers Version 2.0 Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by xmail1.macombisd.org with Microsoft SMTPSVC(5.0.2195.6713); Tue, 26 Aug 2003 10:17:06 -0400 Received: from rwcrwbc02 (unknown[204.127.197.112](misconfigured sender)) by comcast.net (rwcrmhc12) with SMTP id 2003082614142401400g18ple; Tue, 26 Aug 2003 14:14:24 + Received: from [64.88.82.8] by rwcrwbc02; Tue, 26 Aug 2003 14:14:20 + From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: sdfsdf - test to exmail directlry Date: Tue, 26 Aug 2003 14:14:20 + X-Mailer: ATT Message Center Version 1 (Jul 22 2003) X-Authenticated-Sender: a21vdHlrYUBjb21jYXN0Lm5ldA== Return-Path: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 26 Aug 2003 14:17:07.0065 (UTC) FILETIME=[BAFD5E90:01C36BDC] Any clue why JunkMail would be blocking @Comcast.net accounts. I see a line above that says, misconfigured sender. Is that the reason Declude is not delivering this mail? Thanks for any help. Samantha Bridges --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] attachment: winmail.dat
RE: [Declude.JunkMail] [IMail Forum] Cannot receive messages from Comcast.net accounts
Put the senders address in your whitelist this way you can continue to use the hold on spamheaders Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bridges, Samantha Sent: Tuesday, August 26, 2003 1:02 PM To: Junkmail 'Declude. (E-mail) Subject: RE: [Declude.JunkMail] [IMail Forum] Cannot receive messages from Comcast.net accounts I looked at the SMTP logs. Looks like IMail is receiving the mail fine. Here are the SMTP log: 08:26 12:05 SMTPD(005A0190) [64.88.0.98] connect 204.127.198.39 port 49643 08:26 12:05 SMTPD(005A0190) [204.127.198.39] EHLO rwcrmhc13.comcast.net 08:26 12:05 SMTPD(005A0190) [204.127.198.39] MAIL FROM:[EMAIL PROTECTED] 08:26 12:05 SMTPD(005A0190) [204.127.198.39] RCPT TO:[EMAIL PROTECTED] 08:26 12:05 SMTPD(005A0190) [204.127.198.39] D:\IMAIL\spool\D8539005a01905c5c.SMD 708 08:26 12:05 SMTPD(005A0190) performing antispam checks Here is the message that failed and why. I know it is failing because of SpamHeaders. How can I correct this without taking the hold off Spamheaders? I need to get mail from comcast.com accounts. The spamheaders is blocking legitimate mail. Please help. Below is the message that failed. Received: from rwcrmhc13.comcast.net [204.127.198.39] by apollo.misd.net with ESMTP (SMTPD32-8.00) id A5395A0190; Tue, 26 Aug 2003 12:05:13 -0400 Received: from rwcrwbc05 (unknown[204.127.197.115](misconfigured sender)) by comcast.net (rwcrmhc13) with SMTP id 2003082615515901500bhgnoe; Tue, 26 Aug 2003 15:51:59 + Received: from [64.88.82.8] by rwcrwbc05; Tue, 26 Aug 2003 15:51:56 + From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: test Date: Tue, 26 Aug 2003 15:51:56 + X-Mailer: ATT Message Center Version 1 (Jul 22 2003) X-Authenticated-Sender: a21vdHlrYUBjb21jYXN0Lm5ldA== Message-Id: [EMAIL PROTECTED] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-RBL-Warning: IPNOTINMX: X-Declude-Sender: [EMAIL PROTECTED] [204.127.198.39] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOPOSTMASTER, IPNOTINMX, SPAMHEADERS [4] sfsdf --- [This E-mail scanned for viruses by Declude Virus] I am only Warning for REVDNS so that shouldn't be blocking it. Any other ideas? -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 26, 2003 10:41 AM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Cannot receive messages from Comcast.net accounts Cannot receive messages from @Comcast.net accounts. When I send to another server not running JunkMail the headers are as follows: The headers that are received by another mailserver won't be too useful in this case (it would take a lot of time to manually check the IP(s) against spam databases, check the reverse DNS, etc.). Also, without knowing if there are any of your own filters/blacklists/etc. involved, it's nearly impossible to say what the problem may be. You should first check the IMail SMTP log file to see if the E-mail even arrived at your server. Then, you can check the Declude JunkMail log file to see what test(s) it failed, and what action was taken on the E-mail. That will let you know exactly what happened. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] attachment: winmail.dat
[Declude.JunkMail] Feature Suggestion
It's tough when I've gone a couple of days without going through my Junkmail Box where Junkmail passed the filters. Scanning through the headers of 200 + emails looking for he sender address and then to put that address in my blacklist is quite a task. It would be awesome if Declude was capable of catching forwarded emails to an account and strip the original X-DecludeSender address and automatically put that address in the blacklist file. Sure would save me many hours of doing it by hand. Greg attachment: winmail.dat
RE: [Declude.JunkMail] Sobig Assault
I've removed my notice .eml template to users... I've found that they really don't want to see them at all. As far as they are concerned if it's been blocked why should they care. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Malcolm Kynoch Sent: Thursday, August 21, 2003 1:12 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Sobig Assault Hi, Many of our users are getting plowed by Sobig, Declude and Fprot do there job well, but the users mailbox is getting clogged with the notices of detection. Is there a way to turn off notices for a particular virus? For now I've removed the mail templates. Any ideas? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Fwd: Declude Virus caught a virus
Thanks Scott -- I'll give that a go. Greg At 02:27 PM 6/3/2003 -0400, you wrote: Were getting a increase in emails with that contain viruses. I want to block the sender but the sender address is being forged. I have the remote IP/domain where the email's are coming from. Can I just include the domain in my blacklist even though it's not the sender? You could use an IP blacklist (not a sender blacklist), but Declude Virus takes priority, so Declude JunkMail won't see it. In this case, you can use the IMail Control Access file to block the IP. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Exclude Local Users from the Wordfilter test
Is it possible to exclude local users from the Wordfilter test. I have some users that are trying to send out group messages but some of the content is being caught in the wordfilter and they have a legitimate reason to use some of these words. Thanks, Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005
RE: [Declude.JunkMail] Exclude Local Users from the Wordfilter test
John, Good point. Questions though about the order that test are run. If adding a fromfile test how would that effect spam that is sent to in to our mail server with an internal user as the return address? Thanks, Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Thursday, January 16, 2003 10:50 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Exclude Local Users from the Wordfilter test Here is an idea for you. The word filter tests are in one file as one test. Create a new test as a fromfile and list the from addresses of your uses and use a negative fail weight equal to or more than the wordfilter test. Example: WORDFILTER1 filter C:\imail\declude\wordfilter1.txt x 20 0 LOCALUSER fromfile C:\imail\declude\localuser.txt x -20 0 John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Exclude Local Users from the Wordfilter test
Just like what Scott said. What if I create this fromfile and add a negative weight of 20 and a Spam message comes in with a From or Return address that matches one of the address in the fromfile. Won't it then take 20 points away from the weight of the message? I guess the other part of the question was What is the order of tests that are executed? is it... -Global -Blacklist -wordfilter -fromfile -ipfilter or some other order? I ask this because it will determine how I assign the values of the weights. Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Thursday, January 16, 2003 11:44 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Exclude Local Users from the Wordfilter test Good point. Questions though about the order that test are run. If adding a fromfile test how would that effect spam that is sent to in to our mail server with an internal user as the return address? Greg, do you mean an e-mail sent to your local users which has the return or from address the same as the to address? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Found an email that was not scanned by Declude JunkMail
I'm going through some emails that I've saved up that I've received and am in the process of adding them to my black list. I found an email that was not scanned by Declude. I say this because it doesn't have any of the Declude tags added to the header. Here is what the header looks like. Received: from emx02.exitrequest.com [198.77.63.35] by mail.nfti.com with ESMTP (SMTPD32-6.06) id A2B050176; Fri, 10 Jan 2003 17:01:20 -0500Received: (from tppn@localhost)by emx02.exitrequest.com (8.11.6/8.11.6) id h0AM42R13226for [EMAIL PROTECTED]; Fri, 10 Jan 2003 17:04:02 -0500Date: Fri, 10 Jan 2003 17:04:02 -0500Message-Id: [EMAIL PROTECTED]From: Perfect Skin [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: Finally, perfect Skin at any age...At No ChargeContent-type: text/htmlX-RCPT-TO: [EMAIL PROTECTED]X-UIDL: 318944106Status: U Normally our headers look like this... Received: from rev1.listadps248.com [64.70.45.26] by mail.nfti.com with ESMTP (SMTPD32-6.06) id AC0FEB0390; Fri, 10 Jan 2003 16:33:03 -0500Received: from [10.0.1.15]by rev1.listadps248.com (10.0.1.33) with QMQP; 10 Jan 2003 17:33:24 +Message-Id: 1soljn$[EMAIL PROTECTED]To: [EMAIL PROTECTED]Date: Fri, 10 Jan 2003 10:02:00 -0800Reply-To: [EMAIL PROTECTED]From: new year giveaway [EMAIL PROTECTED]Subject: Two Complimentary Airline TicketsMIME-Version: 1.0X-Mailer-Version: v 11130388Content-type: text/htmlX-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?64.70.45.26X-Declude-Sender: [EMAIL PROTECTED] [64.70.45.26]X-Declude-Spoolname: D3c0f390.SMDX-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for spam.X-Spam-Tests-Failed: SPAMCOP, SPAMCOP2, WEIGHT10X-Weight: 18X-Note: This E-mail was sent from rev1.listadps248.com. ([64.70.45.26]).X-RCPT-TO: [EMAIL PROTECTED]X-UIDL: 318944083Status: U Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005
RE: [Declude.JunkMail] Found an email that was not scanned by Declude JunkMail
John, I do have those turned on. Here is what my INHeader looks like CONSOLE OFF XINHEADER X-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for spam. XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% XINHEADER X-Weight: %WEIGHT% #IPBYPASS 127.0.0.1 XSENDER ON XSPOOLNAME ON XINHEADER X-Note: This E-mail was sent from %REVDNS% ([%REMOTEIP%]). Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Wednesday, January 15, 2003 1:37 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Found an email that was not scanned by Declude JunkMail I will add that it is very useful to have in the Global.cfg file: XSENDER ON XSPOOLNAME ON XINHEADER X-Tests-Failed: %TESTSFAILED% Those three lines go a long way to helping to quickly know what is going on. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Found an email that was not scanned by Declude JunkMail
Scott, No they do not. Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, January 15, 2003 1:16 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Found an email that was not scanned by Declude JunkMail I'm going through some emails that I've saved up that I've received and am in the process of adding them to my black list. I found an email that was not scanned by Declude. I say this because it doesn't have any of the Declude tags added to the header. Do your Declude JunkMail log file show any entries for this E-mail? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Found an email that was not scanned by Declude JunkMail
Hey Scott- I do have gp1 and gp2 files. Should I send them to [EMAIL PROTECTED]? Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, January 15, 2003 3:04 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Found an email that was not scanned by Declude JunkMail No they do not. If there is nothing in the log files, most likely Declude didn't see the E-mail at all. This should rarely ever happen, but could if for example you were upgrading IMail at the time (if IMail overwrote the Declude registry entry, and the E-mail arrived before Declude was back in place). Another possibility is that something went wrong internally within Declude. If this was the case, there should be C:\Declude.gp1 and C:\Declude.gp2 files, which you can send to me and I can check to see what happened. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Email blocked by word filter
I had an email fail the word filter search but I can't seem to find which word triggered the block. Any suggestions on how I can find the word that triggered the block? Thanks, Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Email blocked by word filter
Thanks Scott- Couple more questions... 1) How do I find out which version I am running? 2) I don't use WARN and if I'm not using 1.65 do you have any other way of finding what line of the test it failed? Thanks, Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, December 23, 2002 10:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Email blocked by word filter I had an email fail the word filter search but I can't seem to find which word triggered the block. Any suggestions on how I can find the word that triggered the block? If you are running the latest release (1.65), and use LOGLEVEL HIGH, Declude JunkMail will record the line number in the filter file that triggered the test. It will also appear in the headers if you use the WARN action. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Email blocked by word filter
John, Looking at the declog I see this as the error for the email that failed. 12/23/2002 11:05:47 Q33ef3e4 Msg failed MYFILTER (Message failed MYFILTER test (21)). Are you saying that the (21) is the line that the message failed at? Thanks, Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Monday, December 23, 2002 10:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Email blocked by word filter I had an email fail the word filter search but I can't seem to find which word triggered the block. Any suggestions on how I can find the word that triggered the block? If you have set to WARN action, then there will be a number in () after the test name in the headers that indicate the last line number of the filter that failed. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Email blocked by word filter
Found it. I had a filter in the body defined for xxx this triggered the test and the email was blocked. Funny but I didn't have a single reference in the body of the email xxx but I did have a couple of attachment and when looking at the raw ext of the email with the attachments I found the xxx reference. Very Strange Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, December 23, 2002 12:34 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Email blocked by word filter 1) How do I find out which version I am running? You can type \IMail\Declude -diag (exactly like that, from a command prompt) to find out. 12/23/2002 11:05:47 Q33ef3e4 Msg failed MYFILTER (Message failed MYFILTER test (21)). This indicates that the E-mail triggered the filter on line 21. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Delog
It's a cool tool but I don't understand the interface. Can anyone help with a couple of questions? 1) The meter-Does this show how much spam is sent to the domain as a percentage of the total amount of email sent to the domain? 2) Interactive mode doesn't seem to work that well 3) Failed counter- failed what? Thanks for any help! Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Strange problem
I had a user today come to me and say that none of the emails they sent today where delivered even though they left the users outbox. After a general look over I found that every email they were sending it was being blocked and deleted as spam by declude global.cfg Not sure what the problem was and none of my other users are having this problem. I added this user to the white list even though the mail server is already on the white list and now they are able to send email and have them get past declude. Has anyone else seen this problem? Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Strange problem
I found the problem. I have a block on the word c u m (take out the spaces) in my wordfilter list and the users name is ac u mmings (take out the spaces). How can I block the word c u m(take out the spaces) without affecting this user? Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of R. Scott Perry Sent: Tuesday, October 22, 2002 2:34 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Strange problem I had a user today come to me and say that none of the emails they sent today where delivered even though they left the users outbox. After a general look over I found that every email they were sending it was being blocked and deleted as spam by declude global.cfg Not sure what the problem was ... Have you checked the Declude JunkMail log file to see which test(s) the E-mail failed? Have you checked your \IMail\Declude\global.cfg file to see what tests are set to DELETE? and none of my other users are having this problem. I added this user to the white list even though the mail server is already on the white list and now they are able to send email and have them get past declude. Has anyone else seen this problem? It's not a problem -- it is the standard operation of Declude JunkMail. If you scan outgoing E-mail and have it deleted when it fails certain tests, well, it will get deleted if it fails those tests. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Strange problem
I use the delete action. How can I find the email in the archives? Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of R. Scott Perry Sent: Tuesday, October 22, 2002 3:08 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Strange problem How can I block the word c u m(take out the spaces) without affecting this user? If the E-mail I sent to the list was blocked on your server, you'll need to go through your hold directory to find it. If you use the DELETE action, well, you'll need to search the archives. :) -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Strange problem
okay send it again Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of R. Scott Perry Sent: Tuesday, October 22, 2002 3:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Strange problem I use the delete action. How can I find the email in the archives? If you can turn off that test temporarily, I can re-send it for you. Or, you can look at the link below to find the URL to the archives. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Strange problem
Scott, It did not come through. Could you send the email to [EMAIL PROTECTED] or maybe point to where I might find info about this in the documentation? Thanks, Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of R. Scott Perry Sent: Tuesday, October 22, 2002 3:35 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Strange problem I use the delete action. How can I find the email in the archives? If you can turn off that test temporarily, I can re-send it for you. Or, you can look at the link below to find the URL to the archives. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] FW: WARNING: YOU WERE SENT A VIRUS
I don't know how it is... But I still keep getting emails that pass through Declude when they have been black listed. ??? Greg -Original Message- From: Nicki Bloch [mailto:[EMAIL PROTECTED]] Sent: Tuesday, August 20, 2002 8:43 AM To: Greg Subject: FW: WARNING: YOU WERE SENT A VIRUS -Original Message- From: Postmaster [mailto:[EMAIL PROTECTED]] Sent: Monday, August 19, 2002 6:14 PM To: [EMAIL PROTECTED] Subject: WARNING: YOU WERE SENT A VIRUS The Declude Virus Scanner software on mail.nfti.com has reported that you were sent an E-mail from [EMAIL PROTECTED], containing the Unknown Virus virus in the Unknown File attachment. The subject of the E-mail was W32.Elkern removal tools. The E-mail containing the virus has been quarantined to prevent further damage. Headers Follow: Received: from postoffice.inreach.com [209.142.2.45] by mail.nfti.com with ESMTP (SMTPD32-6.06) id ADA9C7100FA; Mon, 19 Aug 2002 18:14:01 -0400 Received: from Ljz ([65.68.74.215]) by postoffice.inreach.com (Post.Office MTA v3.5.3 release 223 ID# 0-68376U62000L6200S0V35) with SMTP id com for [EMAIL PROTECTED]; Mon, 19 Aug 2002 15:13:51 -0700 From: bcal [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: W32.Elkern removal tools MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=JhzwE3Is17sYkT0a8 Message-Id: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FW: WARNING: YOU WERE SENT A VIRUS
Now that make sense. then I should but this sender in the Imail kill file? This would stop them from getting past the email server right? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John Tolmachoff Sent: Thursday, August 29, 2002 1:39 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] FW: WARNING: YOU WERE SENT A VIRUS If they are blacklisted in JunkMail, JunkMail is processed after Virus. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How did this one get through
I have this email address blocked [EMAIL PROTECTED] Yet it is still getting passed my Declude Scanner. Can anyone help with this? Received: from postoffice.inreach.com [209.142.2.45] by mail.nfti.com with ESMTP (SMTPD32-6.06) id A3B91450046; Sun, 11 Aug 2002 02:27:05 -0400 Received: from Dqnf ([65.66.218.213]) by postoffice.inreach.com (Post.Office MTA v3.5.3 release 223 ID# 0-68376U62000L6200S0V35) with SMTP id com for [EMAIL PROTECTED]; Sat, 10 Aug 2002 23:26:54 -0700 From: manxminx [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: A special good tool MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=CT3W66032BOb391463O59Y1rHfN0qG8 Message-Id: [EMAIL PROTECTED] X-Declude-Sender: [EMAIL PROTECTED] [209.142.2.45] X-Declude-Spoolname: D03b9046.SMD X-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for spam. X-Spam-Tests-Failed: None X-Weight: 0 X-Note: This E-mail was sent from ([209.142.2.45]). Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How did this one get through
It's in the sender blacklist... and it's is not in my whitelist. greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Monday, August 12, 2002 10:04 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] How did this one get through I have this email address blocked [EMAIL PROTECTED] Yet it is still getting passed my Declude Scanner. Can anyone help with this? Where is it blocked? In a sender blacklist (fromfile)? Are other blocked E-mail addresses getting blocked? Do you have any whitelists that would allow the E-mail through (which would override any blacklists)? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] I was spammed by myself
I get this email that say that it was sent from myself to myself. However I see some other interesting things in the header. What can I use in this header to keep this from happening again? Received: from $domain [80.16.228.101] by mail.nfti.com (SMTPD32-6.06) id AB048501B4; Thu, 27 Jun 2002 12:19:16 -0400 From: [EMAIL PROTECTED] Received: from nfti.com by 687RSR1MQ.nfti.com with SMTP for [EMAIL PROTECTED]; Thu, 27 Jun 2002 12:20:34 -0500 Message-Id: [EMAIL PROTECTED] Content-Type: multipart/alternative; boundary==_NextPart_958_86848855000616454165 Date: Thu, 27 Jun 2002 12:20:34 -0500 Reply-To: [EMAIL PROTECTED] X-Encoding: MIME To: [EMAIL PROTECTED] Subject: Mortgage Rates Have Never Been Lower MIME-Version: 1.0 Content-Transfer-Encoding: Quoted-Printable X-Declude-Sender: [EMAIL PROTECTED] [80.16.228.101] X-Declude-Spoolname: D3b041b4.SMD X-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for spam. X-Spam-Tests-Failed: None X-Note: This E-mail was sent from host101-228.pool22816.interbusiness.it. ([80.16.228.101]). X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 318925206 Status: U Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] I was spammed by myself
Thanks Scott When will this beta release move to production code? Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, June 27, 2002 2:01 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] I was spammed by myself What is the HELOBOGUS test? I've not seen that one. That's in the latest beta version, and detects bogus HELO/EHLO data (for example, if a server sends HELO $domain or EHLO i.am.a.spammer). You say that the spam headers would detect... why didn't it? Because I forgot to mention that only the latest beta version would detect it with the SPAMHEADERS test. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] I was spammed by myself
No but I do WHITELIST my domain.. greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of David Stavert Sent: Thursday, June 27, 2002 2:08 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] I was spammed by myself Do you have WHITELISTTO postmaster? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Greg Foulks Sent: Thursday, June 27, 2002 12:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] I was spammed by myself What is the HELOBOGUS test? I've not seen that one. You say that the spam headers would detect... why didn't it? In fact it did not fail one test. greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, June 27, 2002 1:13 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] I was spammed by myself I get this email that say that it was sent from myself to myself. However I see some other interesting things in the header. What can I use in this header to keep this from happening again? Received: from $domain [80.16.228.101] by mail.nfti.com (SMTPD32-6.06) id AB048501B4; Thu, 27 Jun 2002 12:19:16 -0400 Here's the first key that it is spam: $domain. The HELOBOGUS and SPAMHEADERS tests will detect that; a custom filter could be used too with the latest beta. What else do you see in the headers that is interesting? There is a good chance that we will add a test that will look for the same To/From addresses, which is becoming more and more popular (even though it is common to see in legitimate mail, too). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] I was spammed by myself
I guess what I am asking is... Is the beta stable enough now to take care of this $domain issue... I've been getting way too many of these. or Should I wait until the release is gold? What do you think? Greg BTW- If I move to the newer (beta) version. What becomes of my current configuration? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, June 27, 2002 2:14 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] I was spammed by myself When will this beta release move to production code? I don't know. It could be within the next few weeks, or it could take a month or so (mostly depending on what new features we may decide to add). My guess is closer to the few weeks side, as the new filtering ability has been requested quite often. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Is there a feature list for the JunkMail beta? Fw: [Declude.JunkMail] New filter test
damn your good! I just added a list of new domains and addresses to block from a posting on this list. I found it deep in the middle a domain was being blocked mail.com I added a @ so it now reads @mail.com Works fine now. Let this be a lesson to us all. Use the block lists at your own risks! Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Thursday, June 27, 2002 4:31 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Is there a feature list for the JunkMail beta? Fw: [Declude.JunkMail] New filter test Now I noticed that my emails from hotmail are not getting through. I can't figure out why. The declude log says that match the BlackHoleSender list but the address I am sending from is not in the BlackHole. Let me guess, you've told Declude to look for any return address with mail.com in it? That would catch any @hotmail.com address. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] FW: Win $5,000.00 a Week for Life from Publishers Clearing House
How did this email get through my scanner? Notice the header does not have any of the declude headers. greg -- Received: from gz-5.com [66.197.94.198] by mail.nfti.com (SMTPD32-6.06) id A27C7E025A; Wed, 26 Jun 2002 10:41:00 -0400 Received: (from root@localhost)by gz-5.com (8.10.2/8.10.2) id g1FEqFq01889;26 Jun 2001 10:40:38 -0500 Date: 26 Jun 2001 10:40:38 -0500 Message-Id: [EMAIL PROTECTED] Content-Type: text/html From: Weekly PayChecks [EMAIL PROTECTED] Subject: Win $5,000.00 a Week for Life from Publishers Clearing House To: [EMAIL PROTECTED] X-Message-ID1: CRKNWGLNEPRPSXVUQHJNJJBJECIRUSULAHEGMOSJBCQWAGVFQE:1115432:2389 X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 318925016 Status: U -Original Message- From: Weekly PayChecks [mailto:[EMAIL PROTECTED]] Sent: Tuesday, June 26, 2001 11:41 AM To: [EMAIL PROTECTED] Subject: Win $5,000.00 a Week for Life from Publishers Clearing House The payment schedule below will be established in your name, if you're selected the winner. Just click on one of the special links in this Bulletin to continue the entry process. The weekly paychecks will be made out and delivered to you, should you win. $ 5,000.00 A WEEK FOR LIFE YEAR 1: $ 260,000.00 YEAR 2: $ 260,000.00 YEAR 3: $ 260,000.00 YEAR 4: $ 260,000.00 YEAR 5: $ 260,000.00 YEAR 6: $ 260,000.00 YEAR 7: $ 260,000.00 YEAR 8: $ 260,000.00 YEAR 9: $ 260,000.00 YEAR 10:$ 260,000.00 As the chart at right indicates, the winner of the $ 5,000.00 weekly paycheck prize will have an annual income that ranks among the top 1% of all households in the United States! That amount of money would give the winner tremendous financial independence without having to work another day in his or her life! Even if you love your job, wouldn't you love to add $ 260,000.00 a year to your income? Buy that summer home, boat, luxury car! You could have it all and more if you click now and complete your $ 5,000.00 Weekly Paychecks for Life Entry Form now and have it selected the winner. Completing this form will allow us to begin distribution of $ 5,000.00 weekly checks for the rest of your life should you be the winner! To claim this thrilling entry opportunity simply click here. Follow the directions and we'll make sure you receive $ 5,000.00 every single week if you win! So I urge you to take just a moment to respond. This is a truly exciting prize, and we don't want you to miss out on it! Weekly Compensation: $ 5,000.00 Yearly Compensation: $ 260,000,000 » Winner guaranteed weekly paychecks for life. » The entrant address on winning entry form will be paycheck mailing address. $ 5,000.00 X 52 Weeks = $ 260,000.00 This is a post-only message, please do not reply. If you have any question regarding Publishers Clearing House or other pch.com sweepstakes, please visit the pch.com Info Center by clicking here. Privacy Policy Publishers Clearing House, pch.com, and their agencies are not responsible for any incorrect or inaccurate information or formatting, whether caused by internet users or by any of the equipment, programming or software associated with or utilized in connection with the Sweepstakes. © 2002 Publishers Clearing House Click here to remove yourself from any further mailings from GZ Media. http://www.gz-5.com/sending/unsubscribe.php --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] FW: Win $5,000.00 a Week for Life from Publishers Clearing House
Well here is what the log says 06/26/2002 10:41:03 Qd27c25a Triggered fromfile on @gz-5.com. 06/26/2002 10:41:47 Qd27c25a WARNING: Could not unlock file due to 2 error. Greg -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, June 26, 2002 10:49 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] FW: Win $5,000.00 a Week for Life from Publishers Clearing House How did this email get through my scanner? Notice the header does not have any of the declude headers. Have you checked the Declude JunkMail log file to see what it says for this E-mail (you would need to check the IMail SMTP log file to get the spool file name to cross-reference it with the Declude log file)? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] OT- View queue
Does anyone know of a tool that will allow me to view the queue in real-time? Without having to use the View Queue.. button on Imail. Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Whitelist recipient address
I could use more WHITELIST space. I have many users who get email from AOL, YAHOO and MSN users. I do not want to WHITELIST the entire domain because of the spam problems from these domains but I do want to WHITELIST specific users so the 200 limit gets used up quickly. Thanks, Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Friday, May 17, 2002 12:52 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelist recipient address We do run JunkMail Pro, with version 1.53, so that's great! Does is matter where we place the whitelist section in the global.cfg file, or can we just list them all at the bottom of the file? They can go anywhere in the file. Why is there currently a hard limit of 200 whitelist entries? I can't see where we will need more than 200 initially, but will this limit be increased in some future release? We will likely increase the limit in the future. Given the way it was coded, a limit needed to be placed. The WHITELIST was originally designed for whitelisting E-mail from a few specific servers that fail a lot of spam tests, so it wasn't envisioned that it would be used extensively. However, with the WHITELIST TO (and WHITELIST TODOMAIN), and people that like to whitelist lots of domains (even at the risk of letting more spam through), it looks like we need to allow unlimited whitelisting. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Deleting spam based on test results
I wouldn't suggest it We also get legitimate email that fail the SPAMCOP and OSSRC tests. Try holding the mail then decide if it should be deleted or not. Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Glenn \ WCNetSent: Friday, May 17, 2002 1:29 PMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Deleting spam based on test results How risky is it to out-right delete messages that fail the SPAMCOP or OSSRC tests? Those soundpretty accurate for catching known spammers. Are any of the many tests on the "DNS-based Spam Databases" worth putting into effect to get more accuracy out of Junk-Mail? Glenn Z.
Re: [Declude.JunkMail] Blacklist
You may already know this but you can also use the following.. [EMAIL PROTECTED] (Any mail from this address will be blocked) a2.mediatrec.com (Any mail from this 3rd level domain will be blocked) mediatrec.com (Any mail from this entire domain will be blocked) If you never want to see another email from this domain again use the later. Greg - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, May 15, 2002 8:16 AM Subject: Re: [Declude.JunkMail] Blacklist When I create my own blacklist, which address in the message headers do I blacklist? The blacklist uses the return address of the E-mail (the address that bounce messages go to, the MAIL FROM in the SMTP envelope). It's the same address used by IMail's Kill List. If you use the Declude JunkMail XSENDER option, or have a header with %MAILFROM% in it, you can use the header that Declude JunkMail adds. However, you can not reliably use a header that was already in the E-mail (From: or Reply-To:). For instance, give the message header below, do I blacklist protege.myz.com (real origin) or a2.mediatrec.com (real from)? X-Note: RDNS Real Origin: protege.myz.com. ([65.105.159.70]) X-Note: SMTP Real From: mailto:[EMAIL PROTECTED][EMAIL PROTECTED] In this case, I'm guessing you have a line XINHEADER X-Note: SMTP Real From: %MAILFROM% in the \IMail\Declude\global.cfg file. If that is the case, then you would use [EMAIL PROTECTED] -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] File Extensions
Pg 232 in the Imail Users guide. smd and smp - files being processed. fwd and fwp - forwarded messages lst- list messages tmp- web messaging or mail to beeper/pager or mail to fax files gse and gsp - error messages being returned to sender. Generated by the server(postmaster) Files with ~ are locked files that are in process. These files also have an underscore as the first characters in the file name. Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Helpdesk Sent: Monday, April 29, 2002 9:50 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] File Extensions Scott, Could you give a quick explanation of what the following file extensions mean/indicate in the IMail spool directory? .SMP .SMD .~MD .GSE .GSC .VAP Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Will this ever be possible?
Not everyone uses outlook and would rather that the filtering took place at the server level. Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, April 24, 2002 4:03 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Will this ever be possible? Using any recent version of Outlook / Outlook Express: Right click on the message in the message list, select 'Junk Email' select 'Add to junk senders list' Any new mail received from that send is routed according to the junk mail rule. Usually deleted or sent to a junk mail file. It's on a per user basis, each user can go in and maintain the junk senders list in their own machine. [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Charles Frolick Sent: Tuesday, April 23, 2002 9:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Will this ever be possible? The problem is, neither Declude nor Imail supports per user black lists, but Imail filters can be set per user to send mail from a domain or email address to delete. They don't need some fancy program to manage it though, they can always use the filter manager in Webmail. Chuck Frloick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Greg Foulks Sent: Tuesday, April 23, 2002 9:02 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Will this ever be possible? A, but make the black list based on a per user environment. So that if [EMAIL PROTECTED] no longer want mail from yahoo.com it won't bother anyone else on the mail server. If they want it changed then they will have come through the network admin. Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, April 23, 2002 9:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Will this ever be possible? Sounds like you want a program that is like SpamCop for your server, sounds cool actually. It could integrate with Imail's black lists or Declude's. You could use a program alias in Imail to dump to the parser. Wish I had the time to write it. Although, it would not work if you have malicious (or clueless) users. For example, someone signs up for eBay, and starts getting marketing messages from them. Spam! they say, and bam! Nobody who uses eBay can use it anymore. Of course, that assumes an ISP-type environment; a business would likely have fewer issues. Then, there's the question of whether to blacklist based on the return address makemoney$$$NOW$$$@yahoo.com, the domain @yahoo.com, or the IP it comes from (likely the best option). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Will this ever be possible?
It would be really cool if let's say a user gets a message and it's SPAM. They could forward the message to a IMAL mailbox and declude would intercept the message scan the headers of the message and add it's self to the blacklist. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] Will this ever be possible?
A, but make the black list based on a per user environment. So that if [EMAIL PROTECTED] no longer want mail from yahoo.com it won't bother anyone else on the mail server. If they want it changed then they will have come through the network admin. Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Tuesday, April 23, 2002 9:53 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Will this ever be possible? Sounds like you want a program that is like SpamCop for your server, sounds cool actually. It could integrate with Imail's black lists or Declude's. You could use a program alias in Imail to dump to the parser. Wish I had the time to write it. Although, it would not work if you have malicious (or clueless) users. For example, someone signs up for eBay, and starts getting marketing messages from them. Spam! they say, and bam! Nobody who uses eBay can use it anymore. Of course, that assumes an ISP-type environment; a business would likely have fewer issues. Then, there's the question of whether to blacklist based on the return address makemoney$$$NOW$$$@yahoo.com, the domain @yahoo.com, or the IP it comes from (likely the best option). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: [Declude.JunkMail] DSBL
I'm new to Declude JunkMail these two lists that you mention. Should I add them to my GLOBAL.cfg file? Where do I go to get updates for my GLOBAL.cfg file? Also the section that says # # The following tests are commented out by default because they require a subscription, # or are not commonly used. # Where do I go to subscribe? Does anyone know how much the subscription is? Thanks, Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry Sent: Wednesday, April 10, 2002 9:46 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] DSBL It appears that DSBL is now three lists ... the two confirmed ones are: list.dsbl.org for single-stage relays tested by trusted users, multihop.dsbl.org That is correct. The multihop.dsbl.org was announced yesterday. I haven't noticed any hits on these with Declude ... are they working? We've had occasional hits, but not many. The DSBL zone only started working about a week ago (the first week or so of its existence it didn't have any hits) I'm using the format: DSBL ip4r list.dsbl.org * 10 0 DSBL ip4r multihop.dsbl.org * 10 0 I do hope that you are going to have different names for those tests, such as: DSBL ip4r list.dsbl.org * 10 0 DSBLMULTI ip4r multihop.dsbl.org * 10 0 -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] Help with HEADER message
My current HEADER action prints this to the top of the email body. ### WARNING ### This email was scanned and could be SPAM! If you feel that this message is SPAM please forward the email and all header information to [EMAIL PROTECTED] and request that the sender be blocked. Error Messages = BADHEADERS, BADHEADERS2, WEIGHT10 Begin Message: How can I format this so I can get it to look like this... # # WARNING # # #This email did not pass the# #spam scanner and could be spam.# #If you would like emails from # #address to be blocked, please # #forward this complete message # #to [EMAIL PROTECTED] # # # Error Messages # # #%ALLRECIPS% #%HEADERS% #%INOROUT% #%TESTNAME% #%TESTDOMAIN% #%TESTSFAILD% #%WARNING% #Original Email Follows# Body of original email Greg Foulks, MCP NewFound Technologies, Inc. http://www.nfti.com Email: [EMAIL PROTECTED] Voice: 614.318.5036 Fax: 614.318.5005 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
