RE: [Declude.JunkMail] Image spam
Until you make a decision on a specific software try adding the filter David mentioned from the earlier post. We added it about two weeks ago and have noticed a definite reduction of image spam. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Thursday, March 08, 2007 10:06 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Image spam I'm confused. I understood that if you host multiple email domains on a mail server that you're considered a hosting company and can't purchase commtouch? At least I vaguely recall something to that affect. I checked Declude's site and I don't see commtouch listed on there anywhere (it used to be) other than under technology partners. Obviously, I'm missing something. So what is the scoop? I need an image spam solution. I followed this discussion, but I didn't see much talk about what people are actually using that currently works well for them. I would most appreciate it if you would share your method for dealing with image spam. We have on particular spam that comes through multiple times every day. Its getting tiring. There isn't enough other things wrong with the message to block it. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kelly Scotto Sent: Wednesday, February 21, 2007 1:04 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Image spam Thank you I will check these out. Kelly _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, February 21, 2007 12:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Image spam Declude and Image based spam - 4 methods 1. COMMTOUCH Commtouch Recurrent Pattern Detection contains an intrinsic mechanism to exact-match recurrent patterns across similar but not-identical messages. However in the case of images, the minute the spammer makes even the smallest changes to an image, the image-encoded data appears completely different. Commtouch identified this trend in the earliest days of image-based spam, and made the necessary enhancements to its detection engine in order to defend against this new threat with a sophisticated protection shield. Commtouch invested significant resources into developing a method for decoding the images and then sampling them using the proven RPD approach. The result is a significantly improved spam detection rate, while maintaining the same low false-positive rate. 2. CLAMWIN Using ClamAV as a virus scanner with Declude you can download the MSRBL-Images.hdb file which has additional signatures (MD5 sigs) which contains signatures created from images contained within spam emails. http://www.msrbl.com/site/msrblimagesdownload 3. FILTER-CID Identifies emails which contains images increasing the weight suffeciently on spam messages to reach the spam threshold. #EXCEPTIONS BODYENDNOTCONTAINScid: BODYENDNOTCONTAINSContent-Type: image/ #IMAGES BODY3CONTAINSsrc=3Dcid: BODY3CONTAINSsrc=cid: BODY3CONTAINSsrc='cid: BODY3CONTAINSimg src=cid: BODY3CONTAINSimg src=3Dcid: BODY3CONTAINS/cid: #IMAGE TYPES BODY2CONTAINSContent-Type: image/gif; BODY2CONTAINSContent-Type: image/jpeg; 4. VAMSOFT IMAGE SPAM AGENT This tool is an External Agent for ORF 2.1 and newer versions that improves ORF by image spam detection capabilities, but can be used by Declude. http://www.vamsoft.com/vsimagespam/vsimagespam.zip VSIMAGE externalnonzero[path]\Declude\VSIMAGE\imgspamagent.exe -check 40 David Barker Director of Product Management Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kelly Scotto Sent: Wednesday, February 21, 2007 11:47 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Image spam Has there been a declude filter created for blocking or identifying image spam? If so can somebody post it for me to try. Thank You, Kelly --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL
RE: [Declude.JunkMail] Image spam
Thank you I will check these out. Kelly _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, February 21, 2007 12:08 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Image spam Declude and Image based spam - 4 methods 1. COMMTOUCH Commtouch Recurrent Pattern Detection contains an intrinsic mechanism to exact-match recurrent patterns across similar but not-identical messages. However in the case of images, the minute the spammer makes even the smallest changes to an image, the image-encoded data appears completely different. Commtouch identified this trend in the earliest days of image-based spam, and made the necessary enhancements to its detection engine in order to defend against this new threat with a sophisticated protection shield. Commtouch invested significant resources into developing a method for decoding the images and then sampling them using the proven RPD approach. The result is a significantly improved spam detection rate, while maintaining the same low false-positive rate. 2. CLAMWIN Using ClamAV as a virus scanner with Declude you can download the MSRBL-Images.hdb file which has additional signatures (MD5 sigs) which contains signatures created from images contained within spam emails. http://www.msrbl.com/site/msrblimagesdownload 3. FILTER-CID Identifies emails which contains images increasing the weight suffeciently on spam messages to reach the spam threshold. #EXCEPTIONS BODYENDNOTCONTAINScid: BODYENDNOTCONTAINSContent-Type: image/ #IMAGES BODY3CONTAINSsrc=3Dcid: BODY3CONTAINSsrc=cid: BODY3CONTAINSsrc='cid: BODY3CONTAINSimg src=cid: BODY3CONTAINSimg src=3Dcid: BODY3CONTAINS/cid: #IMAGE TYPES BODY2CONTAINSContent-Type: image/gif; BODY2CONTAINSContent-Type: image/jpeg; 4. VAMSOFT IMAGE SPAM AGENT This tool is an External Agent for ORF 2.1 and newer versions that improves ORF by image spam detection capabilities, but can be used by Declude. http://www.vamsoft.com/vsimagespam/vsimagespam.zip VSIMAGE externalnonzero[path]\Declude\VSIMAGE\imgspamagent.exe -check 40 David Barker Director of Product Management Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kelly Scotto Sent: Wednesday, February 21, 2007 11:47 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Image spam Has there been a declude filter created for blocking or identifying image spam? If so can somebody post it for me to try. Thank You, Kelly --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Blank Bkgrd.gif Description: GIF image
[Declude.JunkMail] Image spam
Has there been a declude filter created for blocking or identifying image spam? If so can somebody post it for me to try. Thank You, Kelly --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Blank Bkgrd.gif Description: Blank Bkgrd.gif
RE: [Declude.JunkMail] Specific filter for individual users
Just to be sure, I don't have to add a path that points to the xyz.com subfolder I added in the Declude folder. All I did was create the subfolder xyz.com, then copied the junkmail file and changed the name to customer.default.junkmail. Then I lowered the weights for these individual customers. Does this sound correct? Thank you, Kelly -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kelly Scotto Sent: Tuesday, January 23, 2007 4:38 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Specific filter for individual users Thank you Gary -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, January 23, 2007 3:41 PM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] Specific filter for individual users What you will have to do is set up a $default$.junkmail file for each user that wants a unique configuration. Check out http://manuals.declude.com/ProcOnlineHelp/JunkMail_4.0.8_Per-User_Configurat ion.htm Original Message From: Kelly Scotto [EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 1:04 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Specific filter for individual users Can someone show an example of how to create individual filters for different users. I have a few customers who would like stronger filtering, for instance I delete at a weight of 8. For some users I would like to delete at 6. Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ext. 1801 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Specific filter for individual users
Thank you for the help David. Kelly -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Wednesday, January 24, 2007 12:19 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Specific filter for individual users You do not need to add a path eg. \declude\xyz.com The $default$.junkmail file should be renamed to user.junkmail eg. Joe.junkmail David Barker Director of Product Management Your Email security is our business 978.499.2933 office 978.988.1311 fax [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kelly Scotto Sent: Wednesday, January 24, 2007 1:07 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Specific filter for individual users Just to be sure, I don't have to add a path that points to the xyz.com subfolder I added in the Declude folder. All I did was create the subfolder xyz.com, then copied the junkmail file and changed the name to customer.default.junkmail. Then I lowered the weights for these individual customers. Does this sound correct? Thank you, Kelly -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kelly Scotto Sent: Tuesday, January 23, 2007 4:38 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Specific filter for individual users Thank you Gary -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, January 23, 2007 3:41 PM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] Specific filter for individual users What you will have to do is set up a $default$.junkmail file for each user that wants a unique configuration. Check out http://manuals.declude.com/ProcOnlineHelp/JunkMail_4.0.8_Per-User_Configurat ion.htm Original Message From: Kelly Scotto [EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 1:04 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Specific filter for individual users Can someone show an example of how to create individual filters for different users. I have a few customers who would like stronger filtering, for instance I delete at a weight of 8. For some users I would like to delete at 6. Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ext. 1801 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Specific filter for individual users
Thank you for the advice John. I'll need to get more familiar with this product before I start using scripts and such. I do appreciate the suggestion. Baby steps for right now. Kelly -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Wednesday, January 24, 2007 1:01 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Specific filter for individual users Correct. Now, some advice. I have created a script I use when ever I make changes to tests including adding or removing. This script then updates the Global.cfg file and the $default$.junkmail file as well as any other .junkmail files that are per user or per domain. If you are going to use per domain or per user .junkmail files, you may want to consider this so they do not get forgotten. John T eServices For You Life is a succession of lessons which must be lived to be understood. Ralph Waldo Emerson (1802-1882) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kelly Scotto Sent: Wednesday, January 24, 2007 10:07 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Specific filter for individual users Just to be sure, I don't have to add a path that points to the xyz.com subfolder I added in the Declude folder. All I did was create the subfolder xyz.com, then copied the junkmail file and changed the name to customer.default.junkmail. Then I lowered the weights for these individual customers. Does this sound correct? Thank you, Kelly -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kelly Scotto Sent: Tuesday, January 23, 2007 4:38 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Specific filter for individual users Thank you Gary -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, January 23, 2007 3:41 PM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] Specific filter for individual users What you will have to do is set up a $default$.junkmail file for each user that wants a unique configuration. Check out http://manuals.declude.com/ProcOnlineHelp/JunkMail_4.0.8_Per-User_Configurat ion.htm Original Message From: Kelly Scotto [EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 1:04 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Specific filter for individual users Can someone show an example of how to create individual filters for different users. I have a few customers who would like stronger filtering, for instance I delete at a weight of 8. For some users I would like to delete at 6. Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ext. 1801 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Specific filter for individual users
Can someone show an example of how to create individual filters for different users. I have a few customers who would like stronger filtering, for instance I delete at a weight of 8. For some users I would like to delete at 6. Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ext. 1801 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Blank Bkgrd.gif Description: Blank Bkgrd.gif
RE: [Declude.JunkMail] Specific filter for individual users
Thank you Gary -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Tuesday, January 23, 2007 3:41 PM To: declude.junkmail@declude.com Subject: re: [Declude.JunkMail] Specific filter for individual users What you will have to do is set up a $default$.junkmail file for each user that wants a unique configuration. Check out http://manuals.declude.com/ProcOnlineHelp/JunkMail_4.0.8_Per-User_Configurat ion.htm Original Message From: Kelly Scotto [EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 1:04 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Specific filter for individual users Can someone show an example of how to create individual filters for different users. I have a few customers who would like stronger filtering, for instance I delete at a weight of 8. For some users I would like to delete at 6. Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ext. 1801 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelist Auth
Title: Whitelist Auth Looks like all our users are failing the cmdspace test. From the manual it seems I can use the Whitelist Auth to bypass this test for our users only. Can somebody show an example if this, I am not sure how to set it up. Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ext. 1801
[Declude.JunkMail] E-mail size filter
Title: E-mail size filter Can someone show an example or two on how to filter out e-mail over 12mb. My users Imail mailboxes will except mail over 10mb even though the limit is set at 10mb thus causing a blockage when the try to DL mail. This always results in a call to me. It seems to be the same people over and over, no matter what I tell them it goes in one ear and out the other. I need to put an end to this, any ideas will be appreciated. Kelly
[Declude.JunkMail] Weight
Title: Weight I am curious about why you use such a high weight of 200. I use the default 10 14 and 20. Is there any benefit to using higher weights? Regards, Kelly Scotto Assistant Network Administrator Speedee Cash Management 850-682-0475 ex.1801
