[Declude.JunkMail]

2011-06-21 Thread Matt Robertson
http://danjacoby.de/modules/Search/life.html

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re: [Declude.JunkMail] Declude 4.3

2006-07-19 Thread Matt Robertson

On 7/19/06, Kevin Bilbee <[EMAIL PROTECTED]> wrote:

If revenue would not be lost without it and it costs you money to provide then 
what is the business case for providing the service?


In 2006, for any small operator, nothing insofar as the service itself
is concerned.  You only do it to provide a complete solution for
customers, and you do it at a loss.  If I could cut out email I could
cut out 50% of the server resources I have in place (and which I just
finished tripling).  The increasingly difficult model for the small
ISP dictated my shift into an emphasis on contract programming and
away from design and hosting.

So when a company that caters to the small business -- who as a body
are pretty much all in the same boat -- and seeks to increase their
costs in a market where consumer perception is that they're already an
expensive choice (I am cutting fees to existing customers to keep
them... not raising them)... well thats going to be a mighty tough
sell to anyone who is in the trenches and understands fully what they
are up against.

I came into this thread a little late and if my read on the posts from
Declude is any indication, some of this is sinking in.  I'll make a
decision after I see what the revenue sharing program looks like.

As an aside to Declude to explain where I am coming from: I was a
Declude user for a couple of years and left it for an open source
solution, which I am still reasonably happy with, but -- since I am
already going to the trouble of rebuilding all of my mail services on
new servers right now -- am willing to reconsider if I can get a
qualitative advantage for a justifiable cost.

--
[EMAIL PROTECTED]
Janitor, MSB Web Systems
mysecretbase.com


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re: [Declude.JunkMail] Declude 4.3

2006-07-19 Thread Matt Robertson

On 7/19/06, Kevin Bilbee <[EMAIL PROTECTED]> wrote:

So then indirectly it does generate revenue. Because without it revenue
would be lost.


Hardly.  Carry that argument out to prove how wrong it is.  By virtue
of the fact that they allow me to be in business in the first place I
can expect a knock on the door from Microsoft since they make the
server o/s... and Dell since they make the servers.  So just being a
part of the show lets the pig belly up to the trough.

Not in this universe.

--
[EMAIL PROTECTED]
Janitor, MSB Web Systems
mysecretbase.com


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re: [Declude.JunkMail] Declude 4.3

2006-07-19 Thread Matt Robertson

On 7/14/06, Scott Fisher <[EMAIL PROTECTED]> wrote:

Another hand raised. End User (business) here. Apparantly I missed the
Exchange memo.


Put yourr hand down :-)  According to the definition you are a service
provider.  Quoted with emphasis added:

"definition: a business which provides their customers with delivery
of their Email communications AND/OR USERS with access to their own
Email

I'm curious about CommTouch and coming back to Declude but the
implications of what I am seeing are indeed disturbing

--
[EMAIL PROTECTED]
Janitor, MSB Web Systems
mysecretbase.com


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



Re: [Declude.JunkMail] SmarterMail 3.x

2006-02-09 Thread Matt Robertson
I'm looking at going back to Declude with the release of SM 3.0.

First thing I saw on the Declude home page is something called a "BOUNDRY LAYER"

Saw the same spelling error repeated on another graphic.

I can't be the only guy to have noticed this, I would think.  The
signature graphic explaining the product's place in the universe, and
the first word on it is misspelled.

OUCH.  How embarrassing.

--
--mattRobertson--
Janitor, MSB Web Systems
mysecretbase.com
N�f����Ƨ��_����y�nu�
0u�%�ל�d���&j)\jg���r[�x���Ƣ�f��)��+-N�r��z;��ǧu�ę�j)l��^r[�y�&jwmʗ��˛���m��r[�x���Ƣ�8^j�!���q��y�.�֭��i��0�f���܆+�r�

Re: [Declude.JunkMail] Declude with SmarterMail 3.0

2005-10-31 Thread Matt Robertson
I'm really surprised.  My experience with SmarterTools has been
nothing short of stellar.  I've had two separate instances over the
last year or so where I've had problems that a tech has made it his
personal business to work through with me.  One was a nightmarish
install of a gateway in front of SM (i.e. not really their fault) and
another was a mysterious problem where the mail server suddenly
started eating bandwidth for no reason (it wasn't sending or receiving
anything, and a reinstall eventually fixed the problem) and they wound
up walking me thru a safe reinstall.  When I gratefully asked if they
wanted my cc# as this was a for-pay support call I was told that only
comes into play with users who abuse the privilege of tech support and
call them over and over.

A week or so ago I posted on their forum asking how to migrate a bunch
of smartermail domains from one server and integrate them into another
one thats already running.  They wrote up and posted a special KB
article for that circumstance.

So it ain't all bad.

--
--mattRobertson--
Janitor, MSB Web Systems
mysecretbase.com
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] IMail Server Vulnerabilities...

2005-05-24 Thread Matt Robertson
> So, question is... will Ipswitch create hotfixes or workarounds for versions
> before 8.2?  Or is everyone forced to upgrade to 8.2?

Wanna make a bet on which? :-)

-- 
--mattRobertson--
Janitor, MSB Web Systems
mysecretbase.com
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: Re[4]: [Declude.JunkMail] Imail 8.2 / smartermail

2005-04-29 Thread Matt Robertson
On 4/29/05, David Sullivan <[EMAIL PROTECTED]> wrote:
> So there is an inherent delay in the delivery of all messages? How
> long?

Whatever you set it to be.  Mine is 30 seconds.

-- 
--mattRobertson--
Janitor, MSB Web Systems
mysecretbase.com
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Imail 8.2 / smartermail

2005-04-28 Thread Matt Robertson
On 4/28/05, Robert Grosshandler <[EMAIL PROTECTED]> wrote:
> Why didn't you point your CF server at smartermail?

It gave me an entirely separate mail engine.  I have customers with
(legitimate) association mailing lists and in (small) part this lets
me split the load.  SM could handle that load, but I also had major
issues with my SM configuration, which uses ASSP as an antispam
gateway in front of SM, and this complicated my life a fair bit. 
Bypassing that setup and letting Imail be a ColdFusion-smtp-only
engine solved some annoying config problems between with that gateway
tucked into the picture.

-- 
--mattRobertson--
Janitor, MSB Web Systems
mysecretbase.com
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Imail 8.2 / smartermail

2005-04-28 Thread Matt Robertson
My Imail license is relegated to SMTP traffic generated by a
ColdFusion server.  SmarterMail took over the public-facing mail
chores shortly after Ipswitch killed Imail in favor of ICS.

Second the comment about the web interface.  Its as if grownups
designed it versus hobbyists.  Sounds harsh but you have to see it in
action.

I still have a Declude Virus and Spam license.  May bring back the
Virus as I always liked FProt but my antispam went to an ASSP gateway
well over a year ago.  It manages the spam... not me.  And does a dam
fine job of it on its own I might add.

-- 
--mattRobertson--
Janitor, MSB Web Systems
mysecretbase.com
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] OT: Help with AOL Filtering Bulk Mail for a Client

2005-03-21 Thread Matt Robertson
What Don is doing is something thats been around for quite a while,
and not just in ColdFusion.  In CF its commonly called a FakeURL and
the intent of it is to make a url search engine safe by removing the
?'s and &'s and replacing them with slashes.

Its been around for years.  I've never heard of anything like what AOL
is doing.  If they're serious about blacklisting this sort of thing
then it would break zillions of web sites, or more accurately any
email pointing to them.

-- 
--mattRobertson--
Janitor, MSB Web Systems
mysecretbase.com
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] OT: File archiving tool

2005-02-18 Thread Matt Robertson
SyncBack is incredible.  Spend the $15 for the registered "SE"
version.  It has a much better ftp engine, among other things, or so
the authors say.  In the last week or so I've switched over all of my
online synching to it.

-- 
--mattRobertson--
Janitor, MSB Web Systems
mysecretbase.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] DNSstuff Website

2004-05-20 Thread Matt Robertson
>My plan B in those situations is another tech who's still on site :)

want a new job?  (just kidding :)

I'm a 1-man shop.  Works great so long as you never take a vacation or get hit by a 
bus.



--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] DNSstuff Website

2004-05-20 Thread Matt Robertson
Nick wrote:
>Scott is on a cruise. No internet. No phone. 

Ugh.  Don't say that.  I'm going to Cabo for two weeks next month - first vacation in 
years - and I am absolutely *praying* that the place we're going is wired up, in case 
of exactly this kind of scenario.

I have a Plan B (int'l cellular modem) but to use it would cost more than the whole 
vacation if I dare.

--
-------
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] DNSstuff Website

2004-05-20 Thread Matt Robertson
>I have been using the backup.dnsstuff.com

But is it gone and they just forgot to whack the backup?  dnsreport.com was (is?) the 
best dns report on the planet.



--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] f-prot

2004-05-18 Thread Matt Robertson
Darin Cox wrote:
>The DOS version is the one with the command line scanner if that isn't
>obvious.  If you buy the Windows version, you get the DOS version as
well.

I'm pretty sure the Windows version of that command-line scanner is
32-bit and the DOS version is only 16, so there's a big reason to not
use the DOS version.  Also the Windows version easier to keep upated
since you can set the scheduler for hourly updates or whatever.  Don't
think you can do that in the DOS version but I could be wrong.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Fw: [Declude.JunkMail] Notification to customers of change of ownership

2004-04-11 Thread Matt Robertson



Congratulations, Scott!  Looking forward to 
seeing you get some well-deserved hi-visibility.
 
--Matt Robertson--
MSB Designs, Inc.


[Declude.JunkMail] X-Declude-Status: Waiting for activation code

2004-04-08 Thread Matt Robertson
I have the above header in my mail.  Just showed up not too long ago.  

I have JM Pro and Visur Standard.  Virus Standard is running and I have disabled JM 
Pro by renaming my global.cfg.

Whats happening here?  I've got a service agreement.


--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Yahoo, Sendmail to test antispam system

2004-02-24 Thread Matt Robertson
>Anyone have any comments on how effective this will be (or not...)?

What good is this if *everyone* doesn't use it?

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Remove dns lookups and just do filter/blacklist?

2004-02-21 Thread Matt Robertson
OK, thanks anyway.  Is this something realistic to ask for as a new
feature?  No idea if it's a reasonable request with the current code
base.

--Matt--

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, February 20, 2004 9:44 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Remove dns lookups and just do
filter/blacklist?



>Is there a way to get Declude JM Pro to *just* do blacklist lookups and
>run filters?  I have my global.cfg chopped down to this, but
>loglevel=debug shows Declude is still toing revdns lookups.  Can this
>and anything else 'extra' be switched off?

Unfortunately, there is currently no way to turn off the reverse DNS
lookups.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Remove dns lookups and just do filter/blacklist?

2004-02-20 Thread Matt Robertson
Is there a way to get Declude JM Pro to *just* do blacklist lookups and
run filters?  I have my global.cfg chopped down to this, but
loglevel=debug shows Declude is still toing revdns lookups.  Can this
and anything else 'extra' be switched off?

Thx,

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Vacation Message Dilema

2004-02-10 Thread Matt Robertson
Yes.  My solution was to remove the vacation message option from the web
mail template menu.  One of the few times I've done something like that
without polling customers.  Vacation messages are eee-ville.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com
  -  -  -  -  -  -  -  -  -  -  -  -  -  -  
 Site Design and ColdFusion Developer Tools


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] OT: Domain Registrar recommendation

2004-01-31 Thread Matt Robertson
Go with GoDaddy as a *reseller* thru their Wild West Domains subsidiary.

I used to just handle this for clients.  Now I make a fair income in
commissions.  Disgusting that it's a revenue stream I used to ignore.

Go to my web site and click 'register domains'.  That's their standard
reseller page, with my customized prices on it (I bump them up a tad to
increase my income... This isn't what I'm paying).

I both register stuff for clients and direct them here to buy their own.
Commission checks are direct-deposited monthly.  I especially like the
ability to determine expirations globally across all accounts.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com
  -  -  -  -  -  -  -  -  -  -  -  -  -  -  
 Site Design and ColdFusion Developer Tools


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Test order of execution? Time taken per test?

2004-01-28 Thread Matt Robertson
Yes, that's the order they are in in global.cfg

I had totally forgotten about running those tests in parallel.

Thx for the info!

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com
  -  -  -  -  -  -  -  -  -  -  -  -  -  -  
 Site Design and ColdFusion Developer Tools


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Test order of execution? Time taken per test?

2004-01-28 Thread Matt Robertson
Currently I have my ip4r tests running first, then the rhsbl's, then the
badheaders, base64, comments (etc.) tests.  Then come the fromfiles and
last come the filters.

Is there a more efficient way to order this, or do I have it wired, more
or less?  The way its set up now the filters often go untouched as they
all have skipifweight and maxweight inside them.  

Scott, it sure seems like it would be nice if we could do maxweight and
skipifweight on EVERYTHING, or would that impose an unacceptable
overhead penalty?

And is there a way to determine the time taken by each test?  Seems like
when log mode is debug all I get is a total value, unless I'm missing
something.  If there are any dogs in there (i.e. slow ip4r and rhsbl
tests) I want to try and find 'em.  I'm using a Declude build d/l'd
yesterday.

Cheers,

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com
  -  -  -  -  -  -  -  -  -  -  -  -  -  -  
 Site Design and ColdFusion Developer Tools


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] evaluating declude

2004-01-28 Thread Matt Robertson
Jim,

I think everyone here will agree that Declude is largely a hands-on
product, at least until you get it tweaked right.  I used to fool around
with it almost daily, although in recent weeks this tinkering is much
less necessary thanks to the hard work and generosity of some other list
members here.

I'd be happy to share my global.cfg with you, and how I do updates.
Contact me off-list for details.

Cheers,

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com
  -  -  -  -  -  -  -  -  -  -  -  -  -  -  
 Site Design and ColdFusion Developer Tools


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Imail and Spyware Protection

2004-01-26 Thread Matt Robertson
Get yourself a copy of Spybot Search & Destroy.  Free and the best,
imho.  Its also the right tool for the job, which I don't think anything
associated with email is; if for no other reason than a boatload of
intrusive software (i.e. most of it) comes in thru other avenues.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Manual

2004-01-24 Thread Matt Robertson
Markus, 

Good ideas you have there.  If I may comment briefly:

Dynamic disabling of resource-intensive tests would be an absolute
godsend.  Since I have enabled filtering I went from a server that had
gobs of extra overhead to one that is taxed and often redlines both
processors.  A load-smart system would be wonderful.

Holding and retesting and possibly requeueing:  Same thing.  Great idea.


No clue whether either is reasonably feasible.


 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Manual

2004-01-23 Thread Matt Robertson
DITTO!

The manual is completely updated right now, unless you have volunteered yourself for 
the beta program. :-)



--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] In case you wonder..

2004-01-02 Thread Matt Robertson
This one has been around for quite awhile as well.

http://www.hiveware.com/enkoder_form.php

Cheers,


--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] OT - What works?

2003-12-26 Thread Matt Robertson
I use Cloudmark SpamNet (cloudmark.com) to supplement my home inbox.  US$2 monthly.  
Its far less effective than Declude, of course, but it helps.

--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Shut down outgoing scanning?

2003-12-23 Thread Matt Robertson
Yep, I'm trying to stop Declude from performing the tests at all on system-generated 
outgoing mail, so I can indeed determine the originating IP.  I had already commented 
out the tests long ago (thanks for trying to help, Bill).

Wasn't aware of prewhitelist.  This should really save my bacon.

--Matt--

-- Original Message --
From: "R. Scott Perry" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Tue, 23 Dec 2003 18:26:47 -0500


>Is there some way to stop Declude from doing outgoing mail scanning?  I 
>have Pro and don't need this functionality.  Its really kicking my mail 
>server's butt.

Not directly.  But if you are using lots of filters, you may want to 
consider something like "WHITELIST IP 192.0.2.0/24" and use "PREWHITELIST 
ON" to bypass scanning of E-mails from your local users.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Shut down outgoing scanning?

2003-12-23 Thread Matt Robertson
Is there some way to stop Declude from doing outgoing mail scanning?  I have Pro and 
don't need this functionality.  Its really kicking my mail server's butt.

--
-------
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] ColdFusion-based filter updater

2003-12-23 Thread Matt Robertson
For those who have asked, here's a link to the ColdFusion-based updater that takes 
advantage of Kami Razvan's filter repository, along with a copy of my global.cfg.

http://mysecretbase.com/deliver.cfm?FN=2247B5E2198F464BA033DD5312D09F69

The app displays its progress onscreen via cfflush, which renders it incompatible with 
versions of CF prior to CF5.  Just remove the cfflush commands and it'll be compatible 
back to at least v4.5 and probably 4.01.

The app updates and uploads one filter at a time, so uploads of individual filters are 
nearly instant on a fast connection.  My server isn't particularly busy and I can get 
away with uploading directly to my Declude filters folder, but you may not.

Set all parameters in application.cfm, including your ftp account info and the list of 
files you want to revise.  I use 32 of Kami's filters and fromfiles.  When I get 
around to scheduling it (I run this manually now) I'll do twice-daily updates.

All the routine does at present is revise skipifweight and maxweight settings in 
filter files.  If the file has 'filter' in its filename the weight setting update 
routine is triggered.

One thing I've noticed is that maybe the individual weight settings might need to be 
adjusted as well.  I'm thinking over how to create a generic method doing this to any 
filter file.

Cheers,

--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] GIBBERISH 2.0.1, single file filter with END functionality. functionality.

2003-12-22 Thread Matt Robertson
I understand all that stuff, George, but I disagree completely that you
can't apply global, updated rules to some aspects of the problem.  As
such a global filter repository can make a huge dent in virtually
everyone's workload.  Do we really all need to create our own filters to
remove p.en1s pi11z from our inbox?  Is having the ability to more
quickly react to new spam bad?

Think of this as a virus definitiion list, except given Declude's
modularity individuals can decide which virii they will allow themselves
to be infected with.

Nothing in this world is going to be perfect, and certainly you can
write your own filters until you're blue in the face.  I've been
tinkering constantly with Declude for something like two years, and I
expect to continue.  But I also expect to automate as much of this -- or
any other job -- as possible.  I have more profitable and less
aggravating things to do than this.  I'm sure you do too.

The community can benefit from some standardization and shared effort.
Some here have already gone miles toward this goal, as many on this list
know.  I'm saying a Next Step should be taken, and anyone who wants to
ignore the initiative is welcome to do so.

--Matt--


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] GIBBERISH 2.0.1, single file filter with END functionality. functionality.

2003-12-22 Thread Matt Robertson
>My quandary now is to decide whether to use the new control functions 
>of SKIPIFWEIGHT, MAXWEIGHT and END to reduce processing overhead or to 
>collect a full set of evaluation data by letting everything run.  It's 
>truly a catch-22 situation.  

I came into this thread late, so my comments may not be strictly on point, but it 
seems to me the solution to this is to only use filters that work.  Duh, right?  In 
other words let the community validate and update Filter X and you simply plug in what 
you please.

That means a centralized filter storage, update and distribution site.  We actually 
aren't so far off that mark now.  Look at Kami Razvan's ftp site and you'll find a 
treasure trove of filters there.  

A centralized filter repository would turn analysis of filter results into an academic 
exercise to satisfy curiosity, rather than the general necessity it is today.

I implemented most of Kami's stuff last week (supplementing most of the filters 
already installed that came from Matt Bramble and the result is a massive surge in my 
attach-to-kill ratio (on the kill side).  There are so many I had to aggressively 
reorganize my global.cfg, but the results have been splendid, with the most 
processor-intensive filters not kicking in unless needed.

I wrote a ColdFusion routine that downloads my selected filters, alters them to suit 
my skip and max weights, and uploads them to my mail server (the filters are regularly 
updated).  Anyone who wants a copy let me know.


--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Getting exec time on less than DEBUG mode?

2003-12-15 Thread Matt Robertson
I think this is a feature request:

Is there some way to get the ms exec time on Declude without going to
debug log mode?  I just revamped my tests (adding a bunch of filters)
and it sure would be nice to be able to compare before/after execution
times without getting bombed by debug mode.  My logs are godzilla-sized
as it is.

Just a thought.  Happy Monday,


 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com
  -  -  -  -  -  -  -  -  -  -  -  -  -  -  
 Site Design and ColdFusion Developer Tools


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Spamchk fine tuning?

2003-12-03 Thread Matt Robertson
Thanks Markus.  I am using SpamChk with about 70 other tests.  One thing
that helped solve the fp problem was going to your weight 100 scheme.
By adding a zero to every weight it brought spamchk's results into
proportion with everything else.

I didn't want to mess with the config for precisely the reason you point
out; some stuff was clearly threshold values and not weights, but I
wasn't 100% on what was what and didn't want to break it.

Here are the headers from one of the error messages your list server
threw.  The mails had no content.  Only the subject you see here.  I got
subscribed just fine with the other link you sent me.  It appears that
this other link doesn't ask for my name, as that's the only diff I saw
between the two links.


Received: from mail.spamchk.com [217.199.0.33] by msb1.mysecretbase.net
with ESMTP
  (SMTPD32-8.02) id A58B4050086; Tue, 02 Dec 2003 09:02:03 -0800
Date: Tue,  2 Dec 2003 17:59:15 +0100
Message-Id: <[EMAIL PROTECTED]>
From: [EMAIL PROTECTED] (List Server)
To: [EMAIL PROTECTED]
Subject: Invalid Syntax!
X-RBL-Warning: IPNOTINMX: 
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail
detected.
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 4.
X-Declude-Sender: [EMAIL PROTECTED] [217.199.0.33]
X-Declude-Spoolname: Dc58b04050086dd14.SMD
X-Note: This E-mail was sent from ns1.zcom.it ([217.199.0.33]).
X-Note: This E-mail was scanned by MSB Designs Inc. Anti-Spam Services.
X-Spam-Tests-Failed: IPNOTINMX, NOLEGITCONTENT, SPAMCHK
X-Spam-Message-Weight: 4
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 369357513


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] ATTACH action question

2003-12-02 Thread Matt Robertson
Thanks for the clarification, Scott.

Cheers,


--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] ATTACH action question

2003-12-02 Thread Matt Robertson
I'm using the attach action rather than holding, bouncing etc.  Every month I prepare 
a report for my customers that tells them how much mail got delivered, how much got 
blocked etc.

If an item is given an ATTACH action, does Imail ever see it?  Does Declude attach and 
deliver directly?  

Knowing this will make a big difference in my log analysis, which seems to show a big 
drop in mail that I can only explain if the answers to the above are "No" and "Yes", 
respectively.


--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Spamchk fine tuning?

2003-12-02 Thread Matt Robertson
A couple of posters offered some help on this, where I don't have the original 
messages (they're at home and I'm at work).  The FP rate is fairly heavy on spamchk so 
far... including bagging about half of the traffic on this list today.  I'm sure its 
something easily fixed.

I'd love to see a config file AND see what exactly the penalty weight spots are so I 
can halve them (its not clear to me sometimes whether I'm looking at a penalty weight 
or a thresahold on some things).  

I understand nobody has perfect answers.  Just looking for a leg up on the learning 
curve.

Cheers,


--
-------
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Spamchk fine tuning?

2003-12-02 Thread Matt Robertson
Markus wrote:
>hmm... I've tried to un- and the subscribe without any problem.

Thats because you're using the link that works :-O.  Go to the installation 
instructions here

http://www.spamchk.com/modules.php?name=News&file=article&sid=2

And try the subscribe link on that page.  You'll get a nastygram rather than a 
subscription :-).

Just tried the link you sent and it gave me a different format.  I'm sure thats the 
problem.  Thx!


--
-------
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Spamchk fine tuning?

2003-12-02 Thread Matt Robertson
I just set up spamchk and was wondering if anyone can share some
fine-tuning info with me?  Updated keyword lists and such?  I tried
subscribing to their list but all I get back is an Invalid Syntax email
from their mail server.

Cheers,


 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Filtering on Imail spam tests

2003-11-30 Thread Matt Robertson
Nick wrote:
> Have you tried SPAMCHK? It takes some configging but for me at least it
does a
> great job - and its free. http://www.spamchk.com

Never heard of it, but you can bet I'm going to look it over very closely.
Thanks for the tip!

Cool site banner.

--Matt--

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Filtering on Imail spam tests

2003-11-29 Thread Matt Robertson
I got the domain list to work fine as a blacklist, with performance times
being acceptable at around 250ms for a complete run-thru of all of the
70-odd tests I run in Declude.

I also turned it into a body filter file and it was absolutely stellar in
its performance.  Spam catching performance, that is.  It was a disaster in
terms of what it did to the server and I had to take it down after a day.
Not a big surprise; running 17000 tests on the body of each mail piece.

As soon as I can afford it I'm buying Message Sniffer.  Running it as a
trial, it proved itself to be an obvious winner.

--Matt Robertson--
MSB Designs, Inc.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Filtering on Imail spam tests

2003-11-29 Thread Matt Robertson
Nick wrote:
> These Imail tests occur *after* DJM has run?

Yes.

I wrote a ColdFusion program that converts the Imail files into Declude
filter file and blacklist format, so I can run them from inside Declude as
properly weighted tests.  You're welcome to them if you can use CF.

Cheers,

--Matt Robertson--
MSB Designs, Inc.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] EasyNet Replacements

2003-11-25 Thread Matt Robertson
My experience with NJABL has been its absolutely solid.  Not maybe what
others have had.  Just my 0.02.



 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] @LINKED & IPLINKED v1.0.2 - Great for scam detection

2003-11-21 Thread Matt Robertson
>Marc Catuogno wrote:
Wouldn't Whitelist Auth stop JMPro from testing outgoing mail?

Unless I'm mistaken, whitelisting makes something automatically pass all
tests.  It doesn't prevent the tests from being run.

Besides, the mailing is being generated by ColdFusion 4.5, which doesn't
support SMTP AUTH.  I have to allow the unauthenticated mail to come in
via a whitelisted IP in Imail.

--------
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] @LINKED & IPLINKED v1.0.2 - Great for scam detection

2003-11-20 Thread Matt Robertson
John wrote:
>The problem with body filters is the big performance hit the server 
>takes in high volumes setups. 
>Comments?

Or big filters.  As an experiment I took the Imail domain blacklist
(17000 entries) and turned it into a mongo BODY CONTAINS filter file.
It worked magnificently.  The flow of spam was choked almost to death.  

So was the server.  Despite a strong dual-proc box with gobs of memory
and moderate mail flow, I had to shut it off after 24 hours.  The system
was able to handle it until I had a client send out a big mailer of a
few thousand individual mailpieces to their membership.  Declude spawned
a boatload of processes as it scanned all the outgoing mail and gagged
the system.

If there was a way for JMPro to NOT test outgoing mail that would be
great.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Get JM Pro to NOT scan outgoing mail?

2003-11-20 Thread Matt Robertson
Is there a way I can get JunkMail Pro to not scan outgoing mail?  I've
already commented out all of the outgoing actions, but I have a client
that is a large association, and their outgoing mailers are kicking my
server's butt.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] How do you handle held messages??

2003-11-18 Thread Matt Robertson
Chuck,

I recently moved to using Attach for spam that hasn't gotten to a delete weight yet.  
Sender is 'you have spam' and subject is the spam sender's address.  This lets the 
user skim the mail and delete from the list without individual mailpiece scanning.

Coupled to that are instructions that tell them how to move mail to folders inside of 
Outlook, Messenger etc.

I thought I'd get complaints, but only a smattering so far.  Within a couple of weeks 
I'll have time to set up an action to route to a specific mailbox, and charge a couple 
of bucks to set it up.  I'm not fond of it but I've had specific requests for that.

--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Imail blacklist, phrase list converter

2003-11-18 Thread Matt Robertson
Mark wrote:
>Isn't the Imail URL Blacklist a list of url's that appear in spam
email?
>You reference it in (2.) below as a sender blacklist.

Yes.  This converts those urls to a sender blacklist.  So if the domain
'buymystuff.com' is in the Imail blacklist, the program converts that to
'@buymystuff.com' and blocks mail coming from it.  Its not perfect for
obvious reasons, but so far my logs show it to be working surprisingly
well.

The phrase list is going like gangbusters as a filter file.  Many more
hits than the blacklist.

The next thing I'm going to try is making the blacklist into a filter
file, where if the domain is in the body of the message it gets dinged.
This will be essentially the same behavior as Imail, I believe.
Processing time will be the issue to watch on that one.  

I wonder, though, if I'm really losing any speed.  I was doing this in
Imail.  Now I'm not, so have I just shifted load from something I
couldn't effectively measure (Imail) to something I can (Declude)?


 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Analogs to Imail stuff?

2003-11-17 Thread Matt Robertson
If you couldn't already tell, I'm phasing out my use of some of Imail's anti-spam 
features by moving them into Declude where they can be run more responsibly.

What I want is for Declude to be on the front line, but have Imail bat cleanup if it 
can do things Declude can't.  With that in mind, Imail has the ability to 

Verify MAIL FROM address
Perform a RevDNS on the connecting mail server
Verify HELO/EHLO

and delete (only :( ) at a threshold I specify.

I already use Declude for the reverse DNS.  Can it do the other two somehow?  If not, 
I'd be considering dropping the RevDNS test in Declude and running the Imail versions, 
with a delete if all three hit.  Does this sound like a good, bad or awful idea?

--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Imail blacklist, phrase list converter

2003-11-17 Thread Matt Robertson
OK, I've completed what I suppose you could call the first version of my 
Imail-to-Declude black- and phrase-list converter.  Get it here:

http://foohbar.com/declude_importer.zip

It turned into a complete ColdFusion application.  The system will 

1. Retrieve source files from ftp.ipswitch.com
2. Convert the url blacklist into a Declude sender blacklist (skipping any entries you 
have placed in a separate skip list)
3. Convert the phrase list into a Declude filter file.  Filters will be created for 
matches in subject and body.
4. FTP the newly minted files to the location you specify.

NOTES:
a. All settings are made in application.cfm, including filter weights.
b. You can use the browser interface (index.cfm) to run all tests in sequence 
automatically, or individually.
c. Since they can be run individually, you can opt to schedule the files to run 
automatically.
d. You have to set up global.cfg and $default$.junkmail to use the new tests and files.
e. With these tests in place, all mail tests take about 250ms per email tested.  
However, this is on MY server with MY configuration.  Your mileage may vary.
f. On a very fast server (dual 2ghz xeon with gobs of ram, super-duper scsi) the 
download/conversion/upload process takes just under three minutes.  Most of this is 
the processing of the 17,000-entry url blacklist.  On a slow server, it takes a lot 
longer.

External dependencies:
1. The app uses the pkzip Command Line tool to unzip the Imail source files.  You can 
alter the batch file and import01.cfm to use whatever command line unzip program you 
use.
2. cf_ProgressMeter is used to display a progress bar.  This is a $5 tool I *highly* 
recommend.  If you don't own it or don't want to buy it just go in and remove the 
calls to it in import02.cfm and import03.cfm.

I'm in the process of rolling out a new web site in the next couple of days.  I'll add 
this and anything else useful I can think of in the spamfighting section.  If anyone 
has improvements to this, please pass 'em on!

Cheers,

--
-------
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Imail blacklist, phrase list converter

2003-11-17 Thread Matt Robertson
Scott,

Can I set up a blacklist as follows, where the blacklisted url is also the url's 
description?  I want to be able to see the failed url in the logs.  

@zthub.ct.flasail.com zthub.ct.flasail.com
@zthub.oo.flasail.com zthub.oo.flasail.com
@zthub.wc.flasail.com zthub.wc.flasail.com
@ztjxr.ct.flasail.com ztjxr.ct.flasail.com

If so, whats the char limit?  Accepts special chars like % ?

Thx,


--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Imail blacklist, phrase list converter

2003-11-17 Thread Matt Robertson
OK, give me a bit to spiff it up a bit.  I'm going to add in the ability to download 
and unzip the source files from the Ipswitch site, and have it check a 'skip list' 
before adding domains, so you only have to remove unwanted blacklistings once.

In response to another off-list query, I have averaged the performance I'm getting, 
and with logs set to 'debug' I averaged 245ms per mailpiece over several dozen 
receipts.  No idea what it was before I added the phrase and black list checking.



--
-------
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Imail blacklist, phrase list converter

2003-11-17 Thread Matt Robertson
I've written a ColdFusion program that converts Imail blacklist entries
to Declude format.  The same program takes the Imail phrase list and
creates a Declude filter file, where the text of each line in the
original file becomes a SUBJECT CONTAINS and BODY CONTAINS test.

Don't know how many CF'ers there are out there.  If you want a copy let
me know.  Suggestions for improvement gladly accepted.  

Cheers,

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Blacklist format question

2003-11-17 Thread Matt Robertson
Is this the proper format for a blacklist entry in global.cfg (I use
tabs in my actual file instead of spaces)

I-BLACKLIST fromfile z:\blah\blah\i-bl.txt x 6 0

And inside that file, are these sample entries properly formatted?

@05.pn01.com I-Blacklist
@05vvec.gq.nu I-Blacklist
@05world.co.kr I-Blacklist

Just checking.  I installed a new blacklist but it hasn't caught
anything yet.

Cheers,

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Spamattach.eml Format

2003-11-07 Thread Matt Robertson
I figured that half the annoyance of spam is just flat out seeing the
original subject in the first place.  

Using the email address -- which as we all know is usually an
immediately recognizable string of kaka -- has been a pretty painless
way to instantly, visually identify the sender while giving minimal
exposure to spammage.


 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Burzin
Sumariwalla
Sent: Friday, November 07, 2003 9:24 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Spamattach.eml Format


Thanks for the idea Matt.  I never considered using other variables.  I 
could also setup the
subject line to read:

Spam Warning: [%SUBJECT%]

Of course I have balance usefulness against varying degrees or 
sensibilities.  Some of my users would
be very offended to know that they have spam, and then see the explicit 
subject message.  I figure they're
all adults so "How bad could it be?"  Then I too get the lastest
creative 
suggestion.

Oh well.

Burzin


At 10:55 AM 11/7/2003, you wrote:
>FWIW, I'm copying my format below.  Changes are as follows:
>
>1. The From address just says "You Have Spam" and points back to an
>address that works on the customer's domain.
>
>2. The subject lists the sender's email.
>
>3. The text message describing the sitation:  Altered both the opening
>and added a closer.
>
>What this does is allow, on a summary view in web mail, Outlook,
>Netscape et al, to see the parade of caught spam and decide, without
>clicking on the message, whether its garbage or not (messages from
accts
>with gibberish strings and russian domains, for example, probably can
be
>zapped out of hand).
>
>Makes for much faster inbox scanning and generic presentation, The
>latter of which is important for me as an ISP.
>
>HtH,
>
>
>  Matt Robertson   [EMAIL PROTECTED]
>  MSB Designs, Inc.  http://mysecretbase.com
>
>
>
>
>Message-ID: <[EMAIL PROTECTED]>
>From: "You Have Spam" <[EMAIL PROTECTED]>
>To: <%ALLRECIPS%>
>Subject: From %MAILFROM%
>Date: %RFCDATETIME%
>MIME-Version: 1.0
>Content-Type: multipart/mixed;
> boundary="%RANDOMSTRING%"
>
>This is a multi-part message in MIME format.
>
>--%RANDOMSTRING%
>Content-Type: text/plain;
> charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>
>We stopped this message from being delivered in its original
>format, but are attaching it in case our system incorrectly
>assessed its nature.
>
>Subject:%SUBJECT%
>From:   %MAILFROM%
>Tests Failed:   %TESTSFAILED%
>
>To view the E-mail, just click the attachment.
>
>Do not reply directly to this email.  If you have questions,
>contact your server administrator directly.
>
>--%RANDOMSTRING%
>Content-Type: message/rfc822;
> name="spam.eml"
>Content-Transfer-Encoding: 7bit
>Content-Disposition: attachment;
> filename="spam.eml"
>
>---
>[This E-mail was scanned for viruses by Declude Virus 
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>---
>[This E-mail scanned for viruses by Declude Virus]

--
Burzin Sumariwalla   Phone: (314) 994-9411 x291
[EMAIL PROTECTED]  Fax:   (314) 997-7615
   Pager: (314) 407-3345

Networking and Telecommunications Manager
Information Technology Services
St. Louis County Library District
1640 S. Lindbergh Blvd.
St. Louis, MO  63131 

---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Spamattach.eml Format

2003-11-07 Thread Matt Robertson
FWIW, I'm copying my format below.  Changes are as follows:

1. The From address just says "You Have Spam" and points back to an
address that works on the customer's domain.

2. The subject lists the sender's email.

3. The text message describing the sitation:  Altered both the opening
and added a closer.

What this does is allow, on a summary view in web mail, Outlook,
Netscape et al, to see the parade of caught spam and decide, without
clicking on the message, whether its garbage or not (messages from accts
with gibberish strings and russian domains, for example, probably can be
zapped out of hand).  

Makes for much faster inbox scanning and generic presentation, The
latter of which is important for me as an ISP.

HtH,

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com




Message-ID: <[EMAIL PROTECTED]>
From: "You Have Spam" <[EMAIL PROTECTED]>
To: <%ALLRECIPS%>
Subject: From %MAILFROM%
Date: %RFCDATETIME%
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="%RANDOMSTRING%"

This is a multi-part message in MIME format.

--%RANDOMSTRING%
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

We stopped this message from being delivered in its original 
format, but are attaching it in case our system incorrectly 
assessed its nature.

Subject:%SUBJECT%
From:   %MAILFROM%
Tests Failed:   %TESTSFAILED%

To view the E-mail, just click the attachment.

Do not reply directly to this email.  If you have questions, 
contact your server administrator directly.

--%RANDOMSTRING%
Content-Type: message/rfc822;
name="spam.eml"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="spam.eml"

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] OT: Do you use ColdFusion?

2003-11-06 Thread Matt Robertson
Ditto here.  Solid as a rock if left in capable hands.


 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Opinions on web interface

2003-11-06 Thread Matt Robertson
Have you thought of giving users more control over the process?  As in a db tie-in to 
tests, weights and actions?  I use CF as well and I'm figuring on doing something that 
will allow enablement of a particular test, or its disablement, coupled to setting the 
test weight and action performed.  Should be fairly simple to use cffile to write out 
a Declude file with the dangerous stuff hardcoded into it.  Probably 30 days away from 
having the time to finally do it.

I get customization requests daily from this or that user.  Nobody wants the same 
thing.  Frankly I'm sick of hearing it and am ready to turn the process over to the 
user and let them have at it if they want to be the antispam genius.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-05 Thread Matt Robertson
John wrote:
>BTW, the catchallmails has called other problems before.

I'm not surprised.  I had no idea I was running it.  Must've del'd the comment by 
accident as I've never used the thing.  Easy to fix.  Unfortunately a short time after 
I received more of the same, so that wasn't it.  :-(

--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-05 Thread Matt Robertson
John wrote:
>Where was the message sent from?

Various spammers all over the planet.  Since this morning Scott and I have been 
trading detailed debug logs, and doing stuff to try to track this down.  I had to sit 
back for a bit while a client of mine did a big mailer to their membership (I throttle 
down their mail xmit rate via ColdFusion, so the wait was awhile).  Can't have a debug 
log when something like that is passing thru.

Just got a reading and am passing it off to Scott.  I did find that I had 
catchallmails enabled, although it wasn't actually doing anything.  That may have been 
the problem.

-- Original Message --
From: "John Tolmachoff \(Lists\)" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Wed, 5 Nov 2003 13:02:04 -0800

> I also have WHITELIST AUTH set in global.cfg.


Time for a DEBUG log.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


--
-------
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-05 Thread Matt Robertson
Kami wrote:
>I highly recommend that you reconsider your WHITELIST FROM entries.

Good idea.  Until recently I've been letting Declude run on autopilot
without much attention to new features other than tests.  Missing out on
a lot.  Thx!

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-05 Thread Matt Robertson
I do have an external whitelist, but it consists of stuff like

WHITELIST FROM @amazon.com
WHITELIST FROM @ebay.com
WHITELIST FROM @expedia.com

And is a total of 22 entries long.

Then I have AUTOWHITELIST ON so my users can make their own white lists.
There are only two entries in my book (aliases.txt), and of course this
is affecting everyone; not just me.  Interestingly, there appears to be
a blank line in my address book drop-down; both in the selector in the
Compose window and in the addr book editor.  I tried deleting it in the
editor but no soap.  Supposed to be there?  The line -- which is on the
first position in the webmail drop-down -- is not in the physical file.
Looks like its built in to Imail's html select box for some reason.

I also have WHITELIST AUTH set in global.cfg.




-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Wednesday, November 05, 2003 8:27 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah.


Look at last action, Ignore. Is there a White list anywhere that could
affect that?

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Matt Robertson
> Sent: Wednesday, November 05, 2003 7:58 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] ATTACH Still not working. Bah.
> 
> OK, I did what John said last nite (with the logs set to 'high' and
the
> spool name on) and what Scott said (use the interim release) this
> morning.
> 
> Here's the log entry.  I picked something going to me so I could say
for
> sure it showed up in my inbox (it did, and it most definitely was
spam).
> 
> Set the logs to 'debug' and will follow up with a sample shortly.
> 
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Triggered CONTAINS filter
> GIBBERISHSUB on qr [weight->0; qr7].
> 11/05/2003 07:46:12 Q1ad9014900d05f2b GIBBERISHSUB:3 NOABUSE:3
> NOPOSTMASTER:3 REVDNS:5 .  Total weight = 14
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Using [incoming] CFG file
> C:\IMail\Declude\$default$.junkmail.
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed GIBBERISHSUB (Message
> failed GIBBERISHSUB test (78)). Action=WARN.
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOABUSE (Not
supporting
> [EMAIL PROTECTED]). Action=WARN.
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOPOSTMASTER (Not
> supporting [EMAIL PROTECTED]). Action=WARN.
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed IPNOTINMX ().
> Action=WARN.
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOLEGITCONTENT (No
> content unique to legitimate E-mail detected.). Action=WARN.
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed REVDNS (This E-mail
was
> sent from a MUA/MTA 221.196.22.47 with no reverse DNS entry.).
> Action=WARN.
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed WEIGHT1319 (Total
> weight between 13 and 19.). Action=ATTACH.
> 11/05/2003 07:46:12 Q1ad9014900d05f2b L1 Message OK
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Subject: hello1nqr7
> 11/05/2003 07:46:12 Q1ad9014900d05f2b From: [EMAIL PROTECTED] To:
> [EMAIL PROTECTED]  IP: 221.196.22.47 ID:
> 11/05/2003 07:46:12 Q1ad9014900d05f2b Last action = IGNORE.
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-05 Thread Matt Robertson
OK, I did what John said last nite (with the logs set to 'high' and the
spool name on) and what Scott said (use the interim release) this
morning.

Here's the log entry.  I picked something going to me so I could say for
sure it showed up in my inbox (it did, and it most definitely was spam).

Set the logs to 'debug' and will follow up with a sample shortly.

11/05/2003 07:46:12 Q1ad9014900d05f2b Triggered CONTAINS filter
GIBBERISHSUB on qr [weight->0; qr7].
11/05/2003 07:46:12 Q1ad9014900d05f2b GIBBERISHSUB:3 NOABUSE:3
NOPOSTMASTER:3 REVDNS:5 .  Total weight = 14
11/05/2003 07:46:12 Q1ad9014900d05f2b Using [incoming] CFG file
C:\IMail\Declude\$default$.junkmail.
11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed GIBBERISHSUB (Message
failed GIBBERISHSUB test (78)). Action=WARN.
11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOABUSE (Not supporting
[EMAIL PROTECTED]). Action=WARN.
11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOPOSTMASTER (Not
supporting [EMAIL PROTECTED]). Action=WARN.
11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed IPNOTINMX ().
Action=WARN.
11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed NOLEGITCONTENT (No
content unique to legitimate E-mail detected.). Action=WARN.
11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed REVDNS (This E-mail was
sent from a MUA/MTA 221.196.22.47 with no reverse DNS entry.).
Action=WARN.
11/05/2003 07:46:12 Q1ad9014900d05f2b Msg failed WEIGHT1319 (Total
weight between 13 and 19.). Action=ATTACH.
11/05/2003 07:46:12 Q1ad9014900d05f2b L1 Message OK
11/05/2003 07:46:12 Q1ad9014900d05f2b Subject: hello1nqr7
11/05/2003 07:46:12 Q1ad9014900d05f2b From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED]  IP: 221.196.22.47 ID: 
11/05/2003 07:46:12 Q1ad9014900d05f2b Last action = IGNORE.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-04 Thread Matt Robertson
I wrote:
>I'm setting it back to bounce again to see what happens.

I did and its back to normal log entries and behavior using 1.79b




--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-04 Thread Matt Robertson
Paul wrote:
>How can it be OK and failing at the same time?? Am I misreading
>something here?

No, you aren't missing anything.  This isn't supposed to happen.  ere's a msg from 
11/2, a couple of days ago.  This one was a bounce as expected.

The only real difference is that in $default$.junkmail the test is set to ATTACH 
instead of BOUNCE.  I'm setting it back to bounce again to see what happens.

11/02/2003 00:16:12 Qbd3d0d5500eaf766 CBL:6 SDERB:3 SPAMCOP:6 .  Total weight = 15
11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed CBL (Blocked - see 
http://cbl.abuseat.org/lookup.cgi?ip=62.204.117.193). Action=WARN.
11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed SDERB (Usenet Message-ID spam source, 
see http://www.msgid.bl.gweep.ca/>.). Action=WARN.
11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed SPAMCOP (Blocked - see 
http://www.spamcop.net/bl.shtml?62.204.117.193). Action=WARN.
11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed IPNOTINMX (). Action=WARN.
11/02/2003 00:16:12 Qbd3d0d5500eaf766 Msg failed WEIGHT1319 (Total weight between 13 
and 19.). Action=BOUNCE.
11/02/2003 00:16:12 Qbd3d0d5500eaf766 Subject: buy vicdoin at homexyxc4j
11/02/2003 00:16:12 Qbd3d0d5500eaf766 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]  
IP: 62.204.117.193 ID: 



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-04 Thread Matt Robertson
Yup.  Pro Registered jm and std reg virus.

Here's the text from the spamattach email.


Message-ID: <[EMAIL PROTECTED]>
From: "Declude JunkMail" <[EMAIL PROTECTED]>
To: <%ALLRECIPS%>
Subject: You have spam
Date: %RFCDATETIME%
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="%RANDOMSTRING%"

This is a multi-part message in MIME format.

--%RANDOMSTRING%
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

You have spam!

Subject:%SUBJECT%
From:   %MAILFROM%
Tests Failed:   %TESTSFAILED%

To view the E-mail, just click the attachment.



--%RANDOMSTRING%
Content-Type: message/rfc822;
name="spam.eml"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="spam.eml"



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-04 Thread Matt Robertson
>What version of Declude?
1.76b.  Downloaded it yesterday.

>What does the log show?
See below for the latest arrival in my inbox.  Included are the headers, plus Declude 
and Imail logs; the latter of which looks pretty normal.

If I switch back to "bounce" they bounce as expected.


Complete headers from the mailpiece:


Received: from hcimail2.hostcentric.net [216.65.31.208] by msb1.mysecretbase.net with 
ESMTP
  (SMTPD32-8.02) id AFC224F002A; Tue, 04 Nov 2003 13:53:06 -0800
Received: from SMTP32-FWD by msbdesigns.com
  (SMTP32) id A04F4; Tue,  4 Nov 2003 16:45:45 -0500
Received: from 200-208-213-20.papalegua.com.br [200.208.213.20] by 
hcimail2.hostcentric.net
  (SMTPD32-7.15) id AE07FBF00E8; Tue, 04 Nov 2003 16:45:43 -0500
Message-ID: <[EMAIL PROTECTED]>
From: "Garry Glover" <[EMAIL PROTECTED]>
Reply-To: "Garry Glover" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Fwd: attention free great offer hxx e ohzsrh
Date: Tue, 04 Nov 2003 23:40:03 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="B1DEFA..910.54"
X-IMAIL-SPAM-VALFROM: (38731818)
X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: HELOBOGUS: Domain hcimail2.hostcentric.net has no MX or A records.
X-RBL-Warning: IPNOTINMX: 
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected.
X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63.
X-Declude-Sender: [EMAIL PROTECTED] [216.65.31.208]
X-Note: This E-mail was sent from hcimail2.hostcentric.net ([216.65.31.208]).
X-Note: This E-mail was scanned by MSB Designs Inc. Anti-Spam Services.
X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, HELOBOGUS, IPNOTINMX, NOLEGITCONTENT, 
SNIFFER, WEIGHT1319
X-Spam-Message-Weight: 18
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: R
X-UIDL: 366233215 

DECLUDE LOG:
---
11/04/2003 13:54:02 Q1fc2024f002acd29 NOABUSE:3 NOPOSTMASTER:3 HELOBOGUS:5 SNIFFER:7 . 
 Total weight = 18
11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOABUSE (Not supporting [EMAIL 
PROTECTED]). Action=WARN.
11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOPOSTMASTER (Not supporting [EMAIL 
PROTECTED]). Action=WARN.
11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed HELOBOGUS (Domain 
hcimail2.hostcentric.net has no MX or A records.). Action=WARN.
11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed IPNOTINMX (). Action=WARN.
11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed NOLEGITCONTENT (No content unique to 
legitimate E-mail detected.). Action=WARN.
11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed SNIFFER (Message failed SNIFFER: 
63.). Action=WARN.
11/04/2003 13:54:02 Q1fc2024f002acd29 Msg failed WEIGHT1319 (Total weight between 13 
and 19.). Action=ATTACH.
11/04/2003 13:54:02 Q1fc2024f002acd29 L1 Message OK
11/04/2003 13:54:02 Q1fc2024f002acd29 Subject: Fwd: attention free great offer hxx e 
ohzsrh
11/04/2003 13:54:02 Q1fc2024f002acd29 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]  
IP: 216.65.31.208 ID: A04F4

IMAIL LOG:
-
11:04 13:53 SMTPD(024F002A) [216.198.221.162] connect 216.65.31.208 port 3718
11:04 13:53 SMTPD(024F002A) [216.65.31.208] EHLO hcimail2.hostcentric.net
11:04 13:53 SMTPD(024F002A) [216.65.31.208] MAIL FROM:<[EMAIL PROTECTED]>
11:04 13:53 SMTPD(024F002A) [216.65.31.208] RCPT To:<[EMAIL PROTECTED]>
11:04 13:53 SMTPD(024F002A) [216.65.31.208] C:\IMail\spool\D1fc2024f002acd29.SMD 2820
11:04 13:53 SMTPD(024F002A) performing antispam checks
11:04 13:54 SMTP-(111C00F1) processing C:\IMail\spool\Q1fc2024f002acd29.SMD
11:04 13:54 SMTP-(111C00F1) ldeliver mysecretbase.com matt-main (1) [EMAIL PROTECTED] 
3551
11:04 13:54 SMTP-(111C00F1) finished C:\IMail\spool\Q1fc2024f002acd29.SMD status=1
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] ATTACH Still not working. Bah.

2003-11-04 Thread Matt Robertson
Per Scott's earlier suggestion I fixed the spamattach.eml.  I've gotten three of these 
in the last several minutes: a completely intact spam with no sign of Declude acting 
on it except for the headers (below).  No proper 'you've got spam' attachment msgs 
rcvd yet

The WEIGHT1319 test is a weight range test that is set to an action of ATTACH.

The other tests failed are all set to WARN.  As you can see weight was 14; one *over* 
the trip limit, so this pup should have been worked into an attachment.

What am I doing wrong?

X-IMAIL-SPAM-VALFROM: (23724132)
X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: HELOBOGUS: Domain hcimail2.hostcentric.net has no MX or A records.
X-RBL-Warning: HEUR10: Heuristic spam detection level 10 [1.00]
X-RBL-Warning: IPNOTINMX: 
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected.
X-Declude-Sender: [EMAIL PROTECTED] [216.65.31.208]
X-Note: This E-mail was sent from hcimail2.hostcentric.net ([216.65.31.208]).
X-Note: This E-mail was scanned by MSB Designs Inc. Anti-Spam Services.
X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, HELOBOGUS, HEUR10, IPNOTINMX, 
NOLEGITCONTENT, WEIGHT1319
X-Spam-Message-Weight: 14
X-RCPT-TO: <[EMAIL PROTECTED]>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Action=ATTACH. What am I missing?

2003-11-04 Thread Matt Robertson
Scott wrote:
>Does the first line begin with "Message-ID:"?  If not, IE destroyed the

>file -- in that case, you can right-click the link and choose "Save
Target 
>As" to get the proper file.

Cowabunga.  

Did as suggested and got quite a different file.

Thanks!  

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Action=ATTACH. What am I missing?

2003-11-04 Thread Matt Robertson
OK, I just confirmed that a test I had set to ATTACH (I have Pro) is
doing nothing.

I have a spamattach.eml in the /declude/ folder, and it is identical to
the Declude.com download.

I have this in my $default$.junkmail:

WEIGHT1319 ATTACH

That test is a weight range test that formerly was "WEIGHT1319 BOUNCE"

There is this entry in my Declude log (this was a false positive).  It
looks like everything is working, but neither I nor anyone else is
getting the mail.  The imail log is devoid of this sender.  

Anyone have any ideas as to whats going on?  Could Imail's antispam be
involved?

11/04/2003 09:14:33 Qde5a001e008e4e8b BADHEADERS:8 REVDNS:5 .  Total
weight = 13
11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed BADHEADERS (This E-mail
was sent from a broken mail client [802c].). Action=WARN.
11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed IPNOTINMX ().
Action=WARN.
11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed NOLEGITCONTENT (No
content unique to legitimate E-mail detected.). Action=WARN.
11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed REVDNS (This E-mail was
sent from a MUA/MTA 65.222.115.28 with no reverse DNS entry.).
Action=WARN.
11/04/2003 09:14:33 Qde5a001e008e4e8b Msg failed WEIGHT1319 (Total
weight between 13 and 19.). Action=ATTACH.
11/04/2003 09:14:33 Qde5a001e008e4e8b L1 Message OK
11/04/2003 09:14:33 Qde5a001e008e4e8b Subject: 
11/04/2003 09:14:33 Qde5a001e008e4e8b From: [EMAIL PROTECTED] To:
[EMAIL PROTECTED]  IP: 65.222.115.28 ID: 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] WhiteList option questions

2003-11-03 Thread Matt Robertson
Just upgrading Declude after a fair amount of time.  The docs say that the white list 
file should go into $default$.junkmail.  Just wanted to confirm it goes there and not 
global.cfg.

The autowhitelist feature is a godsend.  Finally a way to allow clients to manage 
their own whitelists without me having to write a front end.

Is there a downside to whitelist auth?  Seems like its purpose is to ensure mail that 
originates from my server gets delivered to recipients on that same server.

Cheers,

--
---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Message Sniifer

2003-10-09 Thread Matt Robertson
Fred wrote:
>I have been using it for over a year.

How do you update it?  Is it an automated process?  How frequent are the
updates?

Their site says the system is updated "several times a day" and, in
another area, that updates are emailed. No specifics that I saw, but I
didn't scour the site, exactly.

Does anyone have the experience to make a comparison between Message
Sniffer and Alligate?  

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Alligate for Declude?

2003-10-09 Thread Matt Robertson
I just signed up for the 30-day trial for Alligate (as a Declude
add-in).  I'm stopping more spam but the volume is so great that I need
some outside help.  Imail's anti-spam system is so full of holes I've
had to emasculate the thing.  What was once a 25% effective rate (i.e.
whacks 25% of the mail still around after Declude) is now down to 14%.

Anyone have any thoughts on their false positive rate?  The service in
general?  If Alligate flags it how certain should I be that its spam?

Cheers,

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] ImageFX Kill List

2003-09-29 Thread Matt Robertson
Title: Message



I just 
checked mine.  No entries dated after 8/25.  It still caught almost 
1 spams between the two lists in September so far.  

 
What a 
bummer.  Replacemenst?
 
 Matt 
Robertson  
[EMAIL PROTECTED] MSB Designs, Inc.  http://mysecretbase.com  


  
  -Original Message-From: 
  [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
  On Behalf Of Sharyn SchmidtSent: Monday, September 29, 2003 
  4:45 AMTo: Declude Junkmail ListSubject: 
  [Declude.JunkMail] ImageFX Kill List
  Morning, 
  I know this was sorta mentioned briefly a few weeks 
  ago but I don't think we ever heard from Tom. 
  Is this file not being updated anymore? 
  Thanks, Sharyn 


RE: [Declude.JunkMail] Spam lists

2003-09-25 Thread Matt Robertson
Dave Marchette wrote:
>Sawmill seems enthusiastic 

I use Sawmill to analyze both Imail and Declude logs.  The author, Greg Ferrar, is 
very responsive to adding log formats.  I'm not sure how he is about custom test 
types, though.  Can't hurt to ask.  Especially if a lot of us are users and approach 
him.  If he can do it I'd certainly pay for an upgrade to my ISP copy.

If there's enough of us, mebbe we can pool our wish list and make a group request?  No 
idea how many of us here use Sawmill.

--
-------
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] SORBS-SPAM

2003-09-02 Thread Matt Robertson
Keith wrote:
>I plugged pink contracts into Google and here's the first link that
came up...

Well, doesn't that just suck?  Hopefully the 2001 date on that post is
indicative of a changed landscape, otherwise they're pretty much *all*
in league with the devil.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] SORBS-SPAM

2003-09-02 Thread Matt Robertson
Phillip wrote:
> Two words: pink contracts

9 syllables: what the heck are you talking about?

I've had nightmares setting up PacBell/SBC DSL that would fill a book,
but that was incompetent tech installation and support.  Once the
service is up its always been just great; for years running.

And besides, here in central California you either work with SBC or you
work with someone who is leasing from them.

Wazzup?

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] SORBS-SPAM

2003-09-02 Thread Matt Robertson
Keith wrote:
>Would you post your configuration that works for you?  and anyone else
>that's willing to do so?  I'd like to see some examples of successful
>configurations to learn from.

Here's mine.  Weights 0-12 are OK, weights 13-19 get bounced and 20+
gets deleted.  Neither bounces nor deletes should be done without
understanding *exactly* what the consequences are.

While I get awfully close to zero false positives, I also wind up
bouncing about 20% of the stuff declude bags.  That works out to about
11000 bounce messages last month.  Maybe a dozen actully reached a
person.  However those dozen would be angry customers wondering why
their mail got deleted.  Instead the bounce becomes a positive customer
service.  I need to experiment and see how many items hit weight 18, 17,
16 etc. to see if I can cut down on the bounces safely.  I'll bet I can.

You can see my latest stats here:
http://mysecretbase.com/mailsystem.html.  I also wrote up how the system
works for customer information.  What I'm describing is Declude Virus,
Declude Junkmail and Imail 8 anti-spam working together.

Hope this helps,

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com



BLITZEDALL  ip4ropm.blitzed.org *
2   0
CBL ip4rcbl.abuseat.org 127.0.0.2
3   0
COMPU   ip4rblackhole.compu.net 127.0.0.4
3   0
DORKS   ip4rorbs.dorkslayers.com127.0.0.2
5
DSBLip4rlist.dsbl.org   *
5   0
EASYNET-DNSBL   ip4rblackholes.easynet.nl   127.0.0.2
5   0
EASYNET-PROXIES ip4rproxies.blackholes.easynet.nl   *
2   0
FABEL   ip4rspamsources.fabel.dk*
2   0
FIVETEN-SRC ip4rblackholes.five-ten-sg.com  127.0.0.2
2   0
FIVETEN-SPAMSUP ip4rblackholes.five-ten-sg.com  127.0.0.7
2   0
FIVETEN-MISCip4rblackholes.five-ten-sg.com  127.0.0.9
2   0
FIVETEN-FREEip4rblackholes.five-ten-sg.com  127.0.0.12
2   0
INTERSILip4rblackholes.intersil.net 127.0.0.2
5   0
IPWHOIS ip4ripwhois.rfc-ignorant.org127.0.0.6
3   0
LNSGSRC ip4rspamguard.leadmon.net   127.0.0.3
3   0
LNSGBULKip4rspamguard.leadmon.net   127.0.0.4
3   0
LNSGOR  ip4rspamguard.leadmon.net   127.0.0.5
3   0
LNSGMULTI   ip4rspamguard.leadmon.net   127.0.0.6
3   0
LNSGBLOCK   ip4rspamguard.leadmon.net   127.0.0.7
3   0
MONKEYFORMMAIL  ip4rformmail.relays.monkeys.com *
3   0
MONKEYPROXIES   ip4rproxies.relays.monkeys.com  *
3   0
NJABL   ip4rdnsbl.njabl.org 127.0.0.2
10  0
NJABLDULip4rdnsbl.njabl.org 127.0.0.3
50  0
ORDBip4rrelays.ordb.org *
5   0
SBL ip4rsbl.spamhaus.org127.0.0.2
10  0
SORBS-HTTP  ip4rdnsbl.sorbs.net 127.0.0.2
5   0
SORBS-SOCKS ip4rdnsbl.sorbs.net 127.0.0.3
5   0
SORBS-MISC  ip4rdnsbl.sorbs.net 127.0.0.4
5   0
SORBS-SMTP  ip4rdnsbl.sorbs.net 127.0.0.5
5   0
SORBS-SPAM  ip4rdnsbl.sorbs.net 127.0.0.6
5   0
SORBS-WEB   ip4rdnsbl.sorbs.net 127.0.0.7
5   0
SORBS-BLOCK ip4rdnsbl.sorbs.net 127.0.0.8
5   0
SORBS-ZOMBIEip4rdnsbl.sorbs.net 127.0.0.9
10  0
SORBS-BADCONF   ip4rdnsbl.sorbs.net 127.0.0.11
3   0
SORBS-NOMAILip4rdnsbl.sorbs.net 127.0.0.12
3   0
SPAMBAG ip4rblacklist.spambag.org   *
10  0
SPAMCOP ip4rbl.spamcop.net  127.0.0.2
10  0
UCEBip4rblackholes.uceb.org *
10  0
VOX ip4rvox.schpider.com127.0.0.2
3   0
WIREHUB-DNSBL   ip4rblackholes.wirehub.net  127.0.0.2
5   0
YBL ip4rybl.megacity.org127.0.0.2
5   0

DSN rhsbl   dsn.rfc-ignorant.org127.0.0.2
5   0
NOABUSE rhsbl   abuse.rfc-ignorant.org  127.0.0.4
3   0
NOPOSTMASTERrhsbl   postmaster.rfc-ignorant.org 127.0.0.3
3   0
SECURITYSAGErhsbl   blackhole.securitysage.com  *
5   0
MAILPOLICE-BULK rhsbl   bulk.rhs.mailpolice.com 127.0.0.2
5   0
MAILPOLICE-PORN rhsbl   porn.rhs.mailpolice.com 127.0.0.2
5   0

BADHEADERS  badheaders  x   x
8   0
HELOBOGUS   helovalid   x   x
5   0
HEUR10  heuristi

RE: [Declude.JunkMail] OT: Declude notification and SoBig assault.

2003-08-22 Thread Matt Robertson
The notifications serve a valuable purpose primarily to notify my
customers that they have virus-protected email.   For forging viruses a
responsible admin has to use skipifvirusnamehas to shut them off.  I do
not send notices to the sender... Not my problem, imho.


 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick
Sent: Friday, August 22, 2003 7:53 AM
To: Declude. JunkMail (E-mail)
Subject: [Declude.JunkMail] OT: Declude notification and SoBig assault.


I have been swamped with notifications to postmaster that one of our
mail
server sent SoBig/F to their mail server.  Since Sobig/F seems to forge
the
from address and use its own SMTP process - it definetely does not come
from
our servers.  I am finding these notification annoying, waste of time,
and
sometimes insulting.  Here is a snip from one of the canned
notifications
from someone who uses declude AV.

"If your mail server had better virus protection, it would have caused
less
work for our server and could have prevented one of your  users from
getting
a virus."

Getting one or two of these a week does not bother me - getting over a
thousand in two days is overload.  What opinion do others have about
these
notifications?  So many of these viruses forge the from address, I do
not
even pay attention to most of these notifications.

Chuck Schick
Warp 8, Inc.
303-421-5140
www.warp8.com



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Sobig Assault

2003-08-21 Thread Matt Robertson
Greg wrote
>I've found that they really don't want to see them at all. 

I get that a lot myself.  However the notices also tell them my
value-added service is diligently doing its job.  If I don't remind them
why they're paying me, they might forget :D

With that said, enough is enough.  Skipifvirusnamehas went in for sobig
midday yesterday.

--------
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Greg Foulks
Sent: Thursday, August 21, 2003 10:24 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Sobig Assault


I've removed my notice .eml template to users... 

Greg

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Malcolm Kynoch
Sent: Thursday, August 21, 2003 1:12 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Sobig Assault


Hi,

Many of our users are getting plowed by Sobig, Declude and Fprot do
there job well, but the users mailbox is getting clogged with the
notices of detection.  Is there a way to turn off notices for a
particular virus?  For now I've removed the mail templates.

Any ideas?


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Declude Virus Pro and Fprot (DOS)

2003-08-14 Thread Matt Robertson
Interesting.  I've been using email since FidoNet but never messed with
that.  Ignorance truly is bliss :D

So, since I can't find this setting in Outlook XP I'm going to assume
its due to an old copy of Outlook 97 or somesuch.  Or am I wrong about
that?

--Matt--

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Declude Virus Pro and Fprot (DOS)

2003-08-14 Thread Matt Robertson
I've always wondered about this.  So how do you desensitize Outlook?
i.e. tell it not to break apart attachments as John posted?

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Interesting spam...

2003-08-14 Thread Matt Robertson
Yes, I got one of those personally.  Incredibly cheeky, but no doubt there are people 
dumb enough to fall for it.  If there weren't, we wouldn't still be getting those 
Nigerian scams.  Got one of those yesterday, too.

Visited their web site (which offers English and Russian language versions) and they 
have a not-too-convincing disclaimer saying they had nothing to do with the spam.

--
-------
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---

--
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] New spamcop style RBL..

2003-07-28 Thread Matt Robertson
I do a ROUTETO with no problems.

At their request I sent them instructions for config'ing Imail 8 and
Declude.  So if they get put up and they're wrong its probably my fault
:D

Here's what I sent them:

Here is the Imail 8 mail server configuration info:
---
1. Choose the AntiSpam folder for the domain that you want 
   to bounce spam to Trustic
2. Click the Content Filtering tab.
3. For Statistical and Phrase Filtering (assuming they are 
   enabled) set the Action to Forward To and the action address 
   as your Trustic account bounce address.
4. Click Apply.
5. Click the Content Filtering (HTML) tab.
6. For Feature Filtering and URL Domain Black List (assuming
   they are enabled) set the Action to Forward To and the 
   action address as your Trustic account bounce address.
7. Click Apply.
8. Stop and restart your Imail smtp service.  You may need to 
   do this from the Windows control panel Services applet after 
   closing Imail Administrator for the changes to take 
   immediate effect.

Here is the Declude configuration info 
(Declude is a very common Imail anti-spam add-in).
--
1. In the Declude Global.cfg file, create a new ip4r test.  
   For example:
  TRUSTIC ip4r XXX-X.query.trustic.com * 0 0
   Replace the 'X'  values with your Trustic account number.  
   This will set up Trustic with a tentative weight of zero.
   After reviewing the results to ensure they are satisfactory 
   change the first zero to the weight of your choice.

2. To send Trustic your (confirmed!) spam (typically only that 
   which has received very heavy weighting and you are certain 
   contains no false positives) Use the ROUTETO command in your 
   $default$.junkmail file.  For example, if ordinarily you 
   have a WEIGHT30 test that deletes the message, i.e.
  WEIGHT30 DELETE
   Change it to
  WEIGHT30 ROUTETO [EMAIL PROTECTED]
   Where again you replace the 'X' values with your Trustic account
   number

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jason Newland
Sent: Monday, July 28, 2003 9:05 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] New spamcop style RBL..


has anyone been able to "auto-send" them your held spam?  I have tried
using
the ROUTETO command, but I get an error when I use the forward address,
and
an error when I use the bounce address.

Can anyone shed some light on the proper way to send them the held
e-mails
for submission?


Thanks


Jason


- Original Message -
From: "Matt Robertson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, July 28, 2003 10:42 AM
Subject: RE: [Declude.JunkMail] New spamcop style RBL..


> As a followup on this, I've been told by Trustic that they are
> considering discontinuing the use of the positive ip4r test.
>
> After about 12 hours of using the proper ip4r test I'm seeing only
> negative entries, which is what I should be seeing.  At the moment I'm
> sending them all of my super-heavyweight Declude spam that I know
isn't
> a false positive, plus my Imail spam stuff where, again, I know I've
got
> as close to a perfect track record as I can get.  Haven't had the
chance
> to look at the logs yet to see what their test is picking up.
>
> 
>  Matt Robertson   [EMAIL PROTECTED]
>  MSB Designs, Inc.  http://mysecretbase.com
> 
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] New spamcop style RBL..

2003-07-28 Thread Matt Robertson
As a followup on this, I've been told by Trustic that they are
considering discontinuing the use of the positive ip4r test.

After about 12 hours of using the proper ip4r test I'm seeing only
negative entries, which is what I should be seeing.  At the moment I'm
sending them all of my super-heavyweight Declude spam that I know isn't
a false positive, plus my Imail spam stuff where, again, I know I've got
as close to a perfect track record as I can get.  Haven't had the chance
to look at the logs yet to see what their test is picking up.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] New spamcop style RBL..

2003-07-28 Thread Matt Robertson
Jason,

The mechanism is perhaps there since user-specific ip4r lookups are in
place, but this may be a one-way identifier.  The implication is they do
not, imho, based on their site's overview text.

The only way to tell is to individually evaluate email messages, or ask
them directly :(
----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] New spamcop style RBL..

2003-07-27 Thread Matt Robertson
http://www.trustic.com/ip?ip=63.149.203.45+
>You were one of the positives and you didn't bother to submit spam to
make
>it not trusted.

Wrong repeatedly.  I sent spam to them as I've already said.  All of it
at one point.

As you later note this is becoming a pi$$ing match and that doesn't
belong here.  This is a technical discussion and lets keep it that way.

Part of what is now clearly confusion here stemmed from the (your?)
original recommendation to use the pos ip4r test.  A careful reading of
the Trustic DNS Query information shows this to be the opposite of what
you're supposed to do.  My fault for not reading the docs carefully and
pulling code out of a list message.  If you follow the path of the mail
when using that test coupled to a mail filter program like Declude
you'll see that mail gets counted twice, assuming you use ROUTETO to
send spam back to Trustic.

Perhaps when using the proper ip4r test the system isn't so screwed up.
Was it you who recommended the pos ip4r test for use with Declude?

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] New spamcop style RBL..

2003-07-27 Thread Matt Robertson
I can understand how you'd be defensive since you recommended them to
the list, but this has nothing to do with sentiment and everything to do
with empirical observation of specific results.  I'm sorry you feel the
way you do, but don't bandy about words like 'slander' when clearly they
don't belong in the conversation.

The following servers are trusted by Trustic.  I only used tested this
service for about 1 1/2 hours so I have a pretty short list (90 entries,
47 of which were slammed in via their automated positive procedure).  If
I had the time to waste I'd go thru the whole list and I'm sure I'd find
more jewels.  I pulled these out of just the first two screens:

63.149.203.45 
 5 automated positive recommendations and a trusted server.  
 But here they're listed on THIRTEEN separate lines
 http://www.dnsstuff.com/tools/ip4r.ch?ip=63.149.203.45 

pd9eb978c.dip.t-dialin.net (217.235.151.140) 
 http://www.dnsstuff.com/tools/ip4r.ch?ip=217.235.151.140
 Dial-in, huh?  Quite a list on the other spam services.  
 Trustic lists them as trusted.

user-0can757.cable.mindspring.com (24.171.156.167) 
 another home cable modem listed like crazy but trusted at trustic
 http://www.dnsstuff.com/tools/ip4r.ch?ip=24.171.156.167

61.99.1.113
 same story here
 http://www.dnsstuff.com/tools/ip4r.ch?ip=61.99.1.113

pcp03063004pcs.newlaf01.mi.comcast.net ( 68.41.175.131 )
 home dsl cable IP

pcp515079pcs.nash01.tn.comcast.net ( 68.53.145.237 )
 home dsl cable IP

d.hm02.com ( 207.158.1.214 ) 
 4 positive *automated* entries, but listed in SpamCop and sent me
spam

mm12.metamailoffers.com ( 207.134.3.243 ) 
 read the domain name.  Wonder what they do.  
 They also have two automated favorable positives 

user-0can757.cable.mindspring.com ( 24.171.156.167 )
 another home dsl service with an automated positive and trusted
status.

mtiwmhc14.worldnet.att.net ( 204.127.131.114 ) 
 This one sent me 3 spams directly today.  Then a 4th came thru
relayed by 
 another server thru this one.  Trustic's system gives only the last
IP a 
 minus rating and all previous ones a positive, so *I* gave it an
automatic 
 positive the fourth time it spammed me.

What does it all mean?  First of all I don't care how smart the guy is
who founded this system.  Trustic as it presently performs doesn't
belong in my production environment, which the Trustic people are up
front about, at least (betas after all should be used only in
development and staging environments).  From what I can see the system
should be labeled more of a public alpha, rather than a beta.  It has
holes which you can drive a mail truck through.


 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] New spamcop style RBL..

2003-07-27 Thread Matt Robertson
Omar K. wrote:
>Indeed, I think you should forward your legit concerns to them if you
truly
>want to make a positive difference.

It was precisely the desire to make a positive difference that motivated
me to describe my experience to the list.  

For my part I appreciate it if an early adopter subs his/her toe and
warns me about it before I go off and waste my own time making the same
mistake.

I know what you meant was for me to provide feedback to the trustic
people, and I've done that as well.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Omar K.
Sent: Sunday, July 27, 2003 2:56 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] New spamcop style RBL..



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky
Sent: Sunday, July 27, 2003 10:32 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] New spamcop style RBL..


- Original Message ----- 
From: "Matt Robertson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, July 27, 2003 4:08 PM
Subject: RE: [Declude.JunkMail] New spamcop style RBL..


> Could that have been the idea in the first place?  Who knows anything
> about these guys?

While I can only speak of how I have interacted with them. (I have had a
positive experience.) I have to say that your last sentence is just
meant to
slander them through the implication that they aren't legit.

If you look at http://www.trustic.com/about/management you will see they
have a real brain on their management team. Mark Fletcher is a smart
guy,
and a legitimate guy. You shouldn't say something like that last
sentence to
back up your argument that the service is Beta. It just weakens every
point
you put in your emails prior to that.

-Josh


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] New spamcop style RBL..

2003-07-27 Thread Matt Robertson
*I* manually marked them as negatives, and my one manual entry showed up
as such correctly But that IP had four more entries showing the
automated 'default positive' entries, and apparently that was enough to
get this dialup IP listed as 'trusted' within the system... And as I
noted its not alone.

Yes, I know the address submission is *supposed* to give only negatives,
but I got something like 8 positives in before I shut it off (They got
plus signs).  I keep my Declude entries set to Verbose so I can follow
what gets sent out and see what it wound up being when it arrives at
Trustic.  Mail volume is low today so I can follow along pretty closely.

I'd leave this service alone for awhile so they can get their act
together.  They may call this a beta but it looks like it should still
be an alpha.  That method of auto-whitelisting is clearly something that
wasn't thought through.  All you have to do is look at a Trustic log and
check out all the 'trusted' dialup and broadband IPs to see that.  

Sorry to sound so negative, but its just really a frustrating lesson in
what happens when I don't think stuff through.  The 'positive' list
method of theirs is so deeply flawed its hard to see how anyone could
put something like that out on the market... Automatically giving
positive entries just because something isn't in a blacklist yet.  How
ridiculous.  Most of the anti-spam battle is about discovering new IPs
every day, and those IPs will change tomorrow.  All their system will do
is get server admins to let spam through.

Could that have been the idea in the first place?  Who knows anything
about these guys?


 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky
Sent: Sunday, July 27, 2003 12:32 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] New spamcop style RBL..



- Original Message - 
From: "Matt Robertson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, July 27, 2003 2:44 PM
Subject: RE: [Declude.JunkMail] New spamcop style RBL..


> I just verified a piece of spam that originated from a dialup IP.  Now
> its in my list and I see Trustic has listed that IP as a "trusted"
> server... Its loaded with automatic recommendations from that stupid
> auto-positive list.  In fact the last four spams come from servers
> marked as 'Trusted'.
>
> Looks like the people using automatic whitelisting are overwhelming
the
> blacklisters who actually send mail... A losing battle.  ESPECIALLY
> since I had Declude ROUTETO my high-weight spam to my Trustic bounce
> address... Where it promptly gave them all positive recommendations
> until I got it shut off.

It's marked trusted but is it trusted and there is a negative on the
left or
is it trusted and there is a positive on the left? (In the first column
there are plus signs and minus signs.)

Also the email address submission only gives negatives... no
positives
not sure how you could ROUTETO and have positives as a result.

-Josh


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] New spamcop style RBL..

2003-07-27 Thread Matt Robertson
I just verified a piece of spam that originated from a dialup IP.  Now
its in my list and I see Trustic has listed that IP as a "trusted"
server... Its loaded with automatic recommendations from that stupid
auto-positive list.  In fact the last four spams come from servers
marked as 'Trusted'.

Looks like the people using automatic whitelisting are overwhelming the
blacklisters who actually send mail... A losing battle.  ESPECIALLY
since I had Declude ROUTETO my high-weight spam to my Trustic bounce
address... Where it promptly gave them all positive recommendations
until I got it shut off.

Beta indeed.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Joshua Levitsky
Sent: Sunday, July 27, 2003 10:54 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] New spamcop style RBL..



- Original Message - 
From: "Matt Robertson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, July 27, 2003 1:35 PM
Subject: RE: [Declude.JunkMail] New spamcop style RBL..


> One thing I was REALLY not happy about was their method of adding
> default positives (i.e. the originally posted test).  Basically if no
> one has said anything bad about a server it gets an automatic
positive.
> I plugged this into Declude and gave a blast of positives -- all to
spam
> that apparently hadn't made it into their system yet.  By the time I
got
> it shut off I'd given out 47 'false' positives.  That's not very smart
> logic and a great way to loosen up your spam rules.  Much smarter to
> control the trusted entries yourself via other means (i.e. Declude
> whitelist or make your own trusted whitelist in Declude with a
negative
> weight).

You can use the DNS entry that doesn't have "POS-" on the front and you
won't give positives for mail servers that haven't been seen by Trustic
before. I am going to suggest to them that there be a neutral setting. I
understand they want to build a very complete list of mail servers so
admins
can take responsibility for their servers. If new servers were added as
neutral then they would get a good list of lots of servers and weighting
wouldn't be affected.  Would also be nice if they gave one result for
bad
(which they do 127.0.0.2) and another result for positive and yet
another
for trusted positive. Then I could give positive weights for trusted
positives and take away spam points from servers I say are good.

-Josh


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] New spamcop style RBL..

2003-07-27 Thread Matt Robertson
I've just started forwarding spam to them, but only the stuff that comes
in from Imail's content filtering, which is basically just sweeping up
after Declude (and it STILL bags about 10% of the survivors!).  

One thing I was REALLY not happy about was their method of adding
default positives (i.e. the originally posted test).  Basically if no
one has said anything bad about a server it gets an automatic positive.
I plugged this into Declude and gave a blast of positives -- all to spam
that apparently hadn't made it into their system yet.  By the time I got
it shut off I'd given out 47 'false' positives.  That's not very smart
logic and a great way to loosen up your spam rules.  Much smarter to
control the trusted entries yourself via other means (i.e. Declude
whitelist or make your own trusted whitelist in Declude with a negative
weight).

It seems to me that, with this system at least, what you want to do is 

1. Stay MILES away from that auto-positive list to prevent weighting
spammer IPs as valid.
2. Forward spam to your account's Trustic bounce address.  Put up with
the validation messages for a day or so and then let the thing run on
its own.
3. Att a test into Declude for the Trustic NEG list.  Weight it zero or
light until it proves itself.
4. Stay MILES away from that auto-positive list to prevent weighting
spammer IPs as valid.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] OT: Imail v6 and Windows Update

2003-07-17 Thread Matt Robertson
Jeff Maze wrote:
>Version 6 works just fine for what we use it for and don't
>need to spend the $1500

Who told you US$1500?  That's the full price.  Ipswitch charges US$495
for the upgrade if you buy it directly from them.  I went to CDW and got
mine for US$349.

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] OT: National Do Not Call Registry

2003-06-27 Thread Matt Robertson
Their web site has been *swamped* all day, but recently I got in and registered my 
home, cell and Mom's phone.  Waiting for the email confs now.

---
 Matt Robertson, [EMAIL PROTECTED]
 MSB Designs, Inc. http://mysecretbase.com
---


-- Original Message --
From: "Dan Geiser" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date: Fri, 27 Jun 2003 17:05:42 -0400

>There is some helpful info here as well...
>
>http://www.ftc.gov/bcp/conline/edcams/donotcall/index.html
>
>- Original Message -
>From: "Dan Patnode" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Friday, June 27, 2003 3:49 PM
>Subject: [Declude.JunkMail] OT: National Do Not Call Registry
>
>
>Stops the telemarketers (with some exceptions), debuted this morning:
>
>http://donotcall.gov/
>
>
>
>More junk stopping info:
>
>http://www.obviously.com/junkmail/
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>===
>This E-mail is scanned and free from viruses. www.nexustechgroup.com
>
>
>
>This E-mail is scanned and free from viruses. www.nexustechgroup.com
>
>
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
 
 
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] best Practices and "Per Domain" Whitelisting

2003-06-11 Thread Matt Robertson
I've often thought about building a 'blacklist' file, but then
assigning, say, a -50 weight to it.  Wouldn't that effectively produce a
per domain whitelist assuming I altered the domain-specific cfg stuff
accordingly?

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Wednesday, June 11, 2003 7:52 AM
To: Declude JunkMail
Subject: [Declude.JunkMail] best Practices and "Per Domain" Whitelisting


Hello, All,
We are using Declude JunkMail Pro and are filtering spam "per domain".
We
would like to drop the hold weight for one of our client's domains down
to
10 but this client receives e-mail from an important address that
sometimes
comes through with a weight of 10.  We would like to make sure that this
particular message makes it through.

Is there a best practices way of making sure that specific e-mail
addresses
make it through?

I thought about creating a "per domain" whitelist for that e-mail
address.
I've seen some mention of "per domain" whitelisting on here.  Can
someone
tell me how I can find out the details about how to whitelist "per
domain"
and also if there's a specific version number of Declude JunkMail that I
have to be running to take advantage of that?

Is "per domain" whitelisting the best way to go or are their other
suggestions that the readers of this list might have?

Thanks, Much!
Dan Geiser <[EMAIL PROTECTED]>


This E-mail is scanned and free from viruses. www.nexustechgroup.com

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] My February Spam Stats So Far

2003-02-24 Thread Matt Robertson
Sawmill processes logs... Get it?  Logs... Hey, I didn't make that up,
their marketing guys did.

http://sawmill.net.  I use it to process my Imail, Declude, web and
ColdFusion logs.

Cheers,

----
 Matt Robertson   [EMAIL PROTECTED] 
 MSB Designs, Inc.  http://mysecretbase.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Monday, February 24, 2003 2:53 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] My February Spam Stats So Far


Hi, Matt,
What is Sawmill?

Thanks,
Dan Geiser <[EMAIL PROTECTED]>

- Original Message -----
From: "Matt Robertson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, February 24, 2003 5:47 PM
Subject: [Declude.JunkMail] My February Spam Stats So Far


> Just in case anyone is interested, I pulled my Top Tests report for
the
> month so far and got this.
>
> FYI
> 1. I use Sawmill to get the info.
> 2. Weight13 is my trigger weight test
> 3. delogfile and delogdaily are the blacklists made available from the
> delog guy.  A wonderful and appreciated resource.
>
> 
>  Matt Robertson   [EMAIL PROTECTED]
>  MSB Designs, Inc.  http://mysecretbase.com
> 
>
> Rank  Name   Bagged
> ---
> 1 WEIGHT13   52,316
> 2 WIREHUB-DNSBL  37,318
> 3 SPAMCOP34,308
> 4 DELOGFILE  25,171
> 5 NOPOSTMASTER   19,349
> 6 REVDNS 18,850
> 7 SBL17,705
> 8 OSSRC  17,540
> 9 BADHEADERS 17,422
> 10OSSOFT 17,059
> 11DSBL   14,983
> 12NOABUSE13,680
> 13INTERSIL   13,610
> 14HELOBOGUS  12,716
> 15SORBS-HTTP  9,742
> 16SPAMHEADERS 6,614
> 17ROUTING 5,345
> 18OSPROXY 4,935
> 19SORBS-SOCKS 4,581
> 20DSN 4,542
> 21NJABL   3,892
> 22OSRELAY 2,528
> 23COMPU   2,147
> 24ORDB1,907
> 25MAILFROM1,471
> 26DORKS 861
> 27DELOGDAILY841
> 28NJABLDUL  805
> 29OSDIPS507
> 30SORBS-SPAM437
> 31SORBS-MISC268
> 32OSLIST 28
> 33SORBS-SMTP  5
>
>Total 363,483
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> This E-mail is scanned and free from viruses. www.nexustechgroup.com
>
>


This E-mail is scanned and free from viruses. www.nexustechgroup.com

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  1   2   >