[Declude.JunkMail] 8001 error
I re-installed Imail 8.22 but when I tried to reinstall Declude 3.0.25 it failed with an 8001 (Cant write to the target). Imail was intalled to C:\Imail as usual but users mail is stored on a different drive. Havent had this problem before. The new server is an AMD 64. Could that be the problem? Jonas Fornander System Administrator Netwood Communications,LLC Tel: 310-442-1530 Fax: 310-820-3125 Find Out Why We're Better * Now offering Fiber Optic Internet service throughout the continental USA. Speeds start at 5Mbps/2Mbps. Go to www.netwood.net and fill in a prequal request. * Home is where my computer is ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
RE: [Declude.JunkMail] 8001 error
I tried that and I still got the same error. Very strange. Any other ideas? Jonas Fornander System Administrator Netwood Communications,LLC Tel: 310-442-1530 Fax: 310-820-3125 Find Out Why We're Better * Now offering Fiber Optic Internet service throughout the continental USA. Speeds start at 5Mbps/2Mbps. Go to www.netwood.net and fill in a prequal request. * Home is where my computer is From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Patterson Sent: Monday, July 10, 2006 11:40 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] 8001 error I saw that one before, try creating a declude folder within c:/Imail and run the install again. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jonas Fornander Sent: Monday, July 10, 2006 1:50 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] 8001 error I re-installed Imail 8.22 but when I tried to reinstall Declude 3.0.25 it failed with an 8001 (Cant write to the target). Imail was intalled to C:\Imail as usual but users mail is stored on a different drive. Havent had this problem before. The new server is an AMD 64. Could that be the problem? Jonas Fornander System Administrator Netwood Communications,LLC Tel: 310-442-1530 Fax: 310-820-3125 Find Out Why We're Better * Now offering Fiber Optic Internet service throughout the continental USA. Speeds start at 5Mbps/2Mbps. Go to www.netwood.net and fill in a prequal request. * Home is where my computer is ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] Filter on country chain
Imail 8.22, Declude 3.05 Standard. Is there a way to filter on COUNTRYCHAIN? So far we haven't found a valid mail that is sent through 3 or more countries. However there doesn't seem to be a way to add weight to a message that is sent this way. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.392 / Virus Database: 268.5.6/339 - Release Date: 5/14/2006 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How can I block all the stock spams?
Here is the header of one of them from my Outlook. How can they send a message from an IANA reserved IP and have it come through? It's like it passes all tests without a glitch. Received: from SMTP32-FWD by malibuonline.com (SMTP32) id A8B5F01330DA4; Wed, 3 May 2006 03:52:29 -0700 Received: from MX4.NetWood.net [209.247.184.2] by malibuonline.com with ESMTP (SMTPD-8.22) id AB5F02B8; Wed, 03 May 2006 03:52:15 -0700 X-Greylist: delayed 306 seconds by postgrey-1.24 at mx4.netwood.net; Wed, 03 May 2006 03:51:53 PDT Received: from dsl88-247-21587.ttnet.net.tr (unknown [88.247.84.83]) by MX4.NetWood.net (Postfix) with SMTP id E4ED3605F2 for [EMAIL PROTECTED]; Wed, 3 May 2006 03:51:53 -0700 (PDT) Received: from ouo ([88.247.189.90]) by dsl88-247-21587.ttnet.net.tr (8.13.4/8.13.4) with SMTP id k43As5FT008132; Wed, 3 May 2006 13:54:05 +0300 Message-ID: [EMAIL PROTECTED] From: May Morales [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: bowling Date: Wed, 3 May 2006 13:50:22 +0300 MIME-Version: 1.0 Content-Type: multipart/related; type=multipart/alternative; boundary==_NextPart_000_000F_01C66EB8.C44B8810 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600. X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600. X-RBL-Warning: HELOBOGUS: Domain dsl88-247-21587.ttnet.net.tr has no MX or A records [0301]. X-Declude-Sender: [EMAIL PROTECTED] [88.247.84.83] X-Declude-Spoolname: D8b5f01330da4.smd X-Declude-Note: Scanned by Declude 3.0.5.22 for spam. http://www.declude.com/x-note.htm; X-Declude-Scan: Incoming Score [5] at 03:52:29 on 03 May 2006 X-Declude-Fail: HELOBOGUS [5] X-Country-Chain: [IANA Reserved]-UNITED STATES-destination X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 357629068 X-IMail-ThreadID: 8b6d075c321b Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, May 01, 2006 5:25 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How can I block all the stock spams? You might be able to come up with some filters for them, but I think of Declude more an enabler than a filter in itself. Darin. - Original Message - From: Jonas Fornander [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, May 01, 2006 8:13 PM Subject: RE: [Declude.JunkMail] How can I block all the stock spams? So Declude can't block these? Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, May 01, 2006 5:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How can I block all the stock spams? Sniffer does a good job of it. I can't think of the last one that has slipped through. Darin. - Original Message - From: Jonas Fornander [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, May 01, 2006 7:47 PM Subject: [Declude.JunkMail] How can I block all the stock spams? Imail 8.22, Declude 3.0.5 Does anyone have a solution on how to block all the penny-stock spams that are circulating? The ones that are blocked seems to be so because the message triggers spamcop etc. However, there seems to be no filter that can remove them because of the content or headers. Some of them pass through with a weight of only 3 or 4. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.1/327 - Release Date: 4/28/2006 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe
[Declude.JunkMail] How can I block all the stock spams?
Imail 8.22, Declude 3.0.5 Does anyone have a solution on how to block all the penny-stock spams that are circulating? The ones that are blocked seems to be so because the message triggers spamcop etc. However, there seems to be no filter that can remove them because of the content or headers. Some of them pass through with a weight of only 3 or 4. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.1/327 - Release Date: 4/28/2006 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How can I block all the stock spams?
So Declude can't block these? Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Monday, May 01, 2006 5:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] How can I block all the stock spams? Sniffer does a good job of it. I can't think of the last one that has slipped through. Darin. - Original Message - From: Jonas Fornander [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, May 01, 2006 7:47 PM Subject: [Declude.JunkMail] How can I block all the stock spams? Imail 8.22, Declude 3.0.5 Does anyone have a solution on how to block all the penny-stock spams that are circulating? The ones that are blocked seems to be so because the message triggers spamcop etc. However, there seems to be no filter that can remove them because of the content or headers. Some of them pass through with a weight of only 3 or 4. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.1/327 - Release Date: 4/28/2006 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.1/327 - Release Date: 4/28/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.1/327 - Release Date: 4/28/2006 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamReview
There were some talk on the list about SpamReview earlier. Is anyone except John using it? Does it work OK? We use Imail 8.22 and really would like to find a way to work with all the messages in /spam/hold directories. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.0/325 - Release Date: 4/26/2006 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamReview
Thanks for the offer but you don't have to. I'm currently testing Darrell's fpReview and it works great. Highly recommended. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Thursday, April 27, 2006 4:59 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] SpamReview FYI, I have not got back to you Jonas as I have been quite busy. I will see what I can do to send you the instructions by Saturday. John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Jonas Fornander Sent: Thursday, April 27, 2006 12:23 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] SpamReview There were some talk on the list about SpamReview earlier. Is anyone except John using it? Does it work OK? We use Imail 8.22 and really would like to find a way to work with all the messages in /spam/hold directories. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find Out Why We're Better - 310-442-1530 Now offering Fiber Optic Internet service throughout the Continental USA. Speeds start at 5Mbps/2Mbps Go to www.netwood.net to fill in a qualification request -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.0/325 - Release Date: 4/26/2006 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.0/325 - Release Date: 4/26/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.0/325 - Release Date: 4/26/2006 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist is maxed out
What happens when the whitelist entries are maxed out? How do I overcome the 200 line limit? Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Gateway and web server
The ideal solution, however, would be to fix any problems with the web servers. If the E-mail they send can get blocked by Declude JunkMail, it can get blocked on other mailservers as well. So fixing the problem rather than using whitelisting is a better solution (although not as easy). It looks to me like most webserver form submissions get caught by Declude. By caught I mean that they get a weight more than 10. Seems like they fail the valid mail client test and legit content. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Gateway and web server
We have 2 mail gateways and I have put their IP addresses in IPBYPASS in global.cfg. We also have some web servers on the same C block as the gateways so I WHITELIST'd the whole C block because otherwise form submissions would get blocked. Most of the web sites are assigned IP addresses which was the reason to whitelist the whole C block. I have a hunch that this is not the correct way of doing it. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Failed whitelist
I wonder if someone could be so kind and help me analyze a header from a message. The message is from a mailing list and I have WHITELIST the original IP address. However I don't understand why X-Declude-Sender has 2 different IP addresses and it doesn't look like the original sender is whitelisted because the messages still fails. The first one is the whitelisted IP address that the message originated from (68.173.225.12). The second is the IP address of the recipient (our customer at 63.209.65.179). I have IPBYPASS the C block that belongs to our customer because most of the IP addresses in that block belongs to web sites and some form submissions failed Declude. We have 2 Imgate gateways (mx3 and mx4) and both of those IP addresses are IPBYPASS. Here is the header: Received: from MX4.NetWood.net [209.247.184.2] by netwood.net with ESMTP (SMTPD32-7.15) id AF9C189800F8; Sun, 19 Oct 2003 04:03:56 -0700 Received: from centurymedia.com (mail.centurymedia.com [63.209.65.179]) by MX4.NetWood.net (Postfix) with ESMTP id AF8613EE426 for [EMAIL PROTECTED]; Sun, 19 Oct 2003 04:02:57 -0700 (PDT) (envelope-from [EMAIL PROTECTED]) Received: from MX3.NetWood.net [209.247.184.13] by centurymedia.com with ESMTP (SMTPD32-7.15) id A02D15013A; Sun, 19 Oct 2003 04:06:21 -0700 Received: from k1s3k2 (68-173-225-12.nyc.rr.com [68.173.225.12]) by MX3.NetWood.net (Postfix) with SMTP id ECDAE40E61 for [EMAIL PROTECTED]; Sun, 19 Oct 2003 04:03:48 -0700 (PDT) (envelope-from [EMAIL PROTECTED]) From: goregiasticrecords.com [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: POSSIBLE SPAM:Pre-Order NOW: New PUSTULATED, SAPROFFAGO, IMPURE CAEDERE! Sender: goregiasticrecords.com [EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: text/html; charset=iso-8859-1 Date: Sun, 19 Oct 2003 07:02:05 -0400 Message-Id: [EMAIL PROTECTED] X-RBL-Warning: EASYNET-DYNA: 12.225.173.68.dynablock.easynet.nl. X-RBL-Warning: HELOBOGUS: Domain k1s3k2 has no MX or A records. X-Declude-Sender: [EMAIL PROTECTED] [68.173.225.12] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: EASYNET-DYNA, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, WEIGHT10, WEIGHT12 [14] X-Declude-Sender: [EMAIL PROTECTED] [63.209.65.179] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 366374215 Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Failed whitelist
Are you running two IMail/Declude servers? It looks like the E-mail went to your MX3.NetWood.net (Postfix), which sent to it to centurymedia.com (IMail) which sent it to MX4.NetWood.net (Postfix) which sent it to netwood.net (IMail). This is correct. For some reason the email should not have been received originally by mx3 because that's the backup Imgate but that shouldn't matter anyhow. On the Imail server that host centurymedia.com I have WHITELIST the IP of the original sender but I'm sending WEIGHT12 to a separate mailbox on a different Imail server via mx4. However the message should never be sent there because the IP is WHITELIST'd. Strange. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 It looks like the first IMail server (centurymedia.com) marked it as spam, but the second whitelisted it. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Does it check outgoing mail?
I just want to confirm, is it correct that DJM standard is NOT checking outgoing mail? Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude and IMgate
We use Imgate as a mail gateway for incoming/outgoing mail. Imgate delivers incoming mail to Imail. Should I set HOP in global.cfg to 1 under this scenario? Declude seems to be work fine with it set to 0. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How does this spam trick work
We route WEIGHT20 mail to a special mailbox. After checking this mailbox I noticed something that I wasn't aware of. Some messages when viewed in Imail web messaging was regular spam BUT when I viewed the same message using the Imail client that is installed on the server with Imail it was a regular message albeit faked. Most likely to fool messages sniffers. Look at this. Here is the full header from the message in Imail web messaging. Check the subject line. It's a spam about financing (the prefix POSSIBLE SPAM is what we add on at WEIGHT10): Received: from MX4.NetWood.net [209.247.184.2] by netwood.net with ESMTP (SMTPD32-7.15) id AEB6273900AA; Thu, 09 Oct 2003 13:01:58 -0700 Received: from mx168.rewardd3.us (unknown [204.29.185.168]) by MX4.NetWood.net (Postfix) with ESMTP id 27CF33EE429 for [EMAIL PROTECTED]; Thu, 9 Oct 2003 13:00:47 -0700 (PDT) (envelope-from [EMAIL PROTECTED]) Message-ID: [EMAIL PROTECTED] From: Joy Raquel [EMAIL PROTECTED] To: Kristine Alexandria Gisladottir [EMAIL PROTECTED] Subject: POSSIBLE SPAM:Kristine, Venice locale-4.50% - Don't Wait Date: Thu, 9 Oct 2003 20:00:55 -0700 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_NextPart_000_2BF831_01C38E75.C126D010 Thread-Index: AcOOn0EeLDQzJkTVRCqLk7KsbjkTEg== Content-Class: urn:content-classes:message X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?204.29.185.168 X-RBL-Warning: EASYNET-DNSBL: Blacklisted by easynet.nl DNSBL - http://blackholes.easynet.nl/errors.html X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL9062 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 204.29.185.168 with no reverse DNS entry. X-Declude-Sender: [EMAIL PROTECTED] [204.29.185.168] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SPAMCOP, EASYNET-DNSBL, SBL, IPNOTINMX, NOLEGITCONTENT, REVDNS, WEIGHT10, WEIGHT20 [25] X-RCPT-TO: [EMAIL PROTECTED] Status: R X-UIDL: 365644892 Here is the content of the message in Imail client. This is the only text, nothing of the spam is there. Another black hole was discovered in a galaxy less than 21 million light years from Earth. This black hole has a mass of more than 40 million suns. In Galaxy NGC 6240, almost 300 million light years from Earth, astronomers believe to have found a black hole during observations of two colliding galaxies. The black hole is caught between the two galaxies and is expected to merge with them in the next few hundred million years. It has a mass 10 to 100 times larger than any black hole ever found. It has the mass of the Milky Way in 1/10,000th the area. I assume that they must do this to try to avoid content filtering. I was never aware of that they could fake messages like this. Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How do I deal with leased IP modems?
We have a problem with some of our dialup customers. We lease our dialup modems so their mail fails the IPNOTINMX, EASYNET and other tests. We flag WEIGHT10 mail as possible spam so their mail now gets flag. Since I can't whitelist every single local email address in all the different domains we host, would it be appropriate to white list the dialup modem pool we're using? Any flipside to this approach? Is there a better way? Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelist
How do you whitelist IP addresses in different subnets? Should they be listed after each other like this: WHITELIST IP a.b.c.d e.f.g.h Or a new line for each IP address/block? Like this: WHITELIST IP a.b.c.d WHITELIST IP e.f.g.h Similarly, how should whitelisted email addresses be entered? After each other on one line or separate lines? Jonas Fornander - System Administrator Netwood Communications,LLC - www.netwood.net Find out why we're better - 310-442-1530 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of DLAnalyzer Support Sent: Thursday, October 02, 2003 9:09 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] whitelist Whitelisting supports CIDR notation.. I just grabbed this paragraph out of the manual, because it explains it better than I could. To whitelist an IP address, add a line WHITELIST IP 127.0.0.1 to the \IMail\Declude\global.cfg file (replacing 127.0.0.1 with the IP you wish to whitelist). If you wish to whitelist a range of IP addresses, such as 127.0.0.0 through 127.0.0.255, you can do so by adding a line WHITELIST IP 127.0.0. (which will whitelist any E-mails from mail servers with an IP address that contains 127.0.0.). You can also use a CIDR range, such as WHITELIST IP 127.0.0.0/8 or WHITELIST IP 192.0.2.0/24 (see the DNSstuff.com site's CIDR tool for assistance). Darrell Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com andyb writes: How do I white list all of my IP addresses? The line I had in there is not working. thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
