[Declude.JunkMail] Increased Spam?
Was just curious if anyone else is seeing the HUGE increase we've seen. I hate to be paranoid, but it seems to coincide with the introduction of the government's do not call list. I've heard of threats by telemarketing companies to begin sending out huge amounts of junk email and snail mail. I've seen probably a 50% increase in the junk that's not getting caught within the last week. Just curious if anyone else has seen this, and if so, what you did to cut it back down. Thanks, Koree --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Need A Recommendation
Dan, In a perfect BOFH world, I would just block 211.0.0.0/8 :D But, I'd say the best way to filter out that subject line would be just by using the the Imail filters. It's very unlikely that a legit message would ever use that *exact* subject, so I think you'd be okay. Koree Dan Geiser wrote: Hello, All, I have a question concerning the best way to go about filtering out a specific e-mail message. For an overview of the current state of our spam filtering setup please see an e-mail I just sent to the list with the subject Where I'm At Now and Where Should I Be Going?. OK, below I have included the headers for an e-mail that one of my users forwarded to me. I have removed the username... == From [EMAIL PROTECTED] Fri Feb 28 00:58:23 2003 Received: from SMTP32-FWD by pagerover.com (SMTP32) id A116C; Fri, 28 Feb 2003 00:58:23 -0500 Received: from mdkpower.dkpower.com [211.241.219.3] by pagerover.com with ESMTP (SMTPD32-6.06) id AA7C27540134; Fri, 28 Feb 2003 00:58:20 -0500 Received: from smtp0210.mail.yahoo.com ([206.169.238.250]) by mdkpower.dkpower.com with Microsoft SMTPSVC(5.0.2195.4453); Fri, 28 Feb 2003 15:01:02 +0900 Date: Fri, 28 Feb 2003 05:59:32 GMT From: mcgough [EMAIL PROTECTED] X-Priority: 3 To: user@pagerover.com Subject: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Return-Path: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] X-OriginalArrivalTime: 28 Feb 2003 06:01:03.0063 (UTC) FILETIME=[C651D670:01C2DEEE] X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED] X-RBL-Warning: IPNOTINMX: X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [6000110f]. X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [6000110f]. X-Declude-Sender: [EMAIL PROTECTED] [211.241.219.3] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOPOSTMASTER, IPNOTINMX, ROUTING, SPAMHEADERS [8] X-UIDL: 8513 Status: R == The current hold weight for PAGEROVER.COM is WEIGHT12. Obviously the weight of this message is substantially lower than that. I could use my SENDERBLOCK list to block this individual sender ([EMAIL PROTECTED]) but that seems to specific a solution, i.e. a waste of a perfectly good entry which could so so much more. And I can't go too general and use the domain (comcast.net) because I'm sure there's much legitimate e-mail emanating from the domain name. I know there has to be a test built into Declude for situations like this but I'm not quite sure where to look. Does anyone have a suggestion as to how they would handle this situation? All feedback is appreciated. Thanks, Much! Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] how much is junk?
I see around the same amount. Sometimes as much as 98%. I'd say probably 2% of that mail is legit mail that is accidentally caught... Koree Kami Razvan wrote: I read a statistics a month ago... More than 92% of all email in the world is SPAM. So go figure... Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of paul Sent: Thursday, February 13, 2003 2:37 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] how much is junk? Ok guys, what do you see in ratio of junk vs good mail per day? Do you get more junk than legit? Here I notice we're killing more than 50% of incoming mail. Average messages processed per day range from 13K to 23K. Using the log analyzer I found that January we processed 615,082 messages, and 53% we deleted by Declude, that's alot! Granted, near daily updates to my kill file and filters help boost the number. Paul --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelist Question
I agree on that one. The people that don't want the filtering don't want spam, they want the message from their 5th cousin that lives in BFE, Oklahoma. So, I, more than likely, won't be on a CC list from their cousin, but could be on a CC list for a piece of spam. So, they get their email message from their cousin, and I don't get spam that has me listed in the CC. They don't get the spam either, but that's okay. Koree R. Scott Perry wrote: Maybe if we all bombard Ipswitch with this request, it will get notice? Do you really want it though? I haven't heard of a single case where this was really an issue. The cost of making this change could be huge. For example, IMail right now will have a difficult time sending a mailing list to 2,000 users (100 E-mails each with 20 recipients). If that were 1,000 E-mails each with 1 recipient, it would take a much longer time to deliver. The real question is how often does a company send out an E-mail to multiple recipients (meaning they all get the *exact* same E-mail, so no personal/confidential information is included), where one or more recipients think it is spam, but it is important to the another recipient? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How To Get Spam
Register a domain using that email address. Post on usenet. Post on Slashdot or any other message boards. Sign up for iwon.com, or other such websites. Koree Dan Geiser wrote: Hello, All, I have an odd question. I work for a small company. Everyone in the company gets tons of junk mail except for me. I think it's because I've done a good job of keeping my address hidden from my prying eyes. Anyway I have been charged with testing Declude JunkMail for our server. I have set everything up to filter spam for NEXUSTECHGROUP.COM. In addition I have created a test e-mail address called [EMAIL PROTECTED] I would somehow like Spam to be attracted to that address so I can test the effectiveness of Declude JunkMail in recognizing spam and also test it for any false positives and basically any other tests I might like to try. Does anyone know of a good method I can use to quickly attract spam to a specific e-mail address? Thanks In Advance, Dan Geiser [EMAIL PROTECTED] This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelist Troubles
These are the whitelist entries: #Exceptions for [EMAIL PROTECTED] WHITELIST ANYWHERE[EMAIL PROTECTED] WHITELIST FROM [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TO [EMAIL PROTECTED] WHITELIST TODOMAIN @lotsharp.com Basically, these are people who do not want Spam filtering. Koree R. Scott Perry wrote: I have a few whitelists, but am wondering why this particular message was whitelisted. I don't have anything in these headers that is whitelisted. However, I noticed that the X-Rcpt-To header has a different address in it than what mine is. I checked my whitelists, and *that* address is not whitelisted either. Any clues? What are your whitelist entries? The most likely culprit is a WHITELIST ANYWHERE entry. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] New Version
Any word on when a new version of Declude Junkmail will be released? Thanks, Koree A. Smith -- Network Administrator Mount Vernon Net, Incorporated --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New Version
Do you have any syntax available for the MAILBOX action? Thanks, Koree R. Scott Perry wrote: Any word on when a new version of Declude Junkmail will be released? The next beta version is due out within a couple of days, the next released version should be ready within about one to two weeks. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Country-based DNSRBLs
The way that I've done it is as such: CHINAip4rcn.rbl.cluecentral.net 127.0.0.2 5 0 in your global.cfg. Then, use the CHINA test as you would any other test. Do this for each country you wish to block. Koree Larry French wrote: I would love to block almost all foreign countries. How can this be done from this list? Larry French Marion Computer Center, Inc. 740.382.2881 -Original Message- From: Koree A. Smith [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 14, 2002 5:29 PM To: declude.junkmail Subject: [Declude.JunkMail] Country-based DNSRBLs Has anyone seen these before? Have any of you used any of them? http://www.cluecentral.net/rbl/ I hate to block entire countries from sending Spam, but there are a few that have 1) Huge numbers of open relays, 2) Spam companies that send out stuff for people all over the world. Thanks, Koree --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Country-based DNSRBLs
Has anyone seen these before? Have any of you used any of them? http://www.cluecentral.net/rbl/ I hate to block entire countries from sending Spam, but there are a few that have 1) Huge numbers of open relays, 2) Spam companies that send out stuff for people all over the world. Thanks, Koree --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Common Configurations
Ladies and Gentlemen: Just curious what the best configuration for Declude Junkmail has been for you? I find that a lot of the tests catch a lot of legit mail, but if I release those tests, that Spam increases tenfold. Osirusoft and ORDB seem to be good test. Anyone care to share with me what tests/actions they use? Thanks, Koree A. Smith --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST for Client
R. Scott Perry wrote: Is it possible to have a whitelist on an indivdual basis? like in the clientname.junkmail No, that is not currently possible. Will it ever be possible? Koree --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
