Re: [Declude.JunkMail] New XBL from Spamhaus
Reply to: Keith Johnson Re: [Declude.JunkMail] New XBL from Spamhaus on Sunday 11:32:26 AM http://www.spamhaus.org/xbl/index.lasso -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - K I read the following on the Register. Does anyone know if we K can include this into Declude? Thanks for the aid: K Clip taken from: K http://www.theregister.co.uk/content/55/34690.html K However, Spamhaus plans to fight back. Yesterday, it released K its Exploits Block List (XBL), a real-time DNS-based database of IP K addresses of illegal 3rd party exploits, including open proxies, K worms/viruses with built-in spam engines, and other types of K trojan-horse exploits utilized by spammers. This list is designed K to sit alongside the Spamhaus Block List (SBL), which blocks K incoming spam from direct spam sources. The combination of SBL and K XBL enables ISPs to safely reject a high volume of incoming spam K outright, Spamhaus says. K Keith --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] X-Declude-Date in Header
We are seeing an intermittent Declude header added to our messages without us using a variable for it, e.g. : X-Declude-Date: 12/26/2003 23:11:23 [106] Is there a reason causing this to appear? This is the interm version.. and I know it warns of 'unusual logging', but we were surprised that this is making an appearance with no variable indicated. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] X-Declude-Date in Header
Reply to: John Tolmachoff (Lists) Re: [Declude.JunkMail] X-Declude-Date in Header on Friday 7:18:53 PM Thanks. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J It is a temporary insertion by Declude for troubling shooting. It will be J taken out in public release versions. This is per a answer by Scott earlier. J John Tolmachoff J Engineer/Consultant/Owner J eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filter Actions - WHITELIST?
Filter actions have so many nice basic functions, IGNORE, WARN, DELETE, HOLD etc. Looking at new filters today and observing logs, it just seems one of these actions naturally should be WHITELIST. Does this make sense? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Filter Actions - WHITELIST?
Reply to: R. Scott Perry Re: [Declude.JunkMail] Filter Actions - WHITELIST? on Tuesday 4:04:36 PM Thanks! This will relieve the limit on the Global file as well... If these filters could be processed first, it might give back a lot of processor if all other actions were performed afterwards, but only if the whitelist filters did not engage... ;) -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Filter actions have so many nice basic functions, IGNORE, WARN, DELETE, HOLD etc. Looking at new filters today and observing logs, it just seems one of these actions naturally should be WHITELIST. Does this make sense? R We are planning on adding a WHITELIST action. :) R -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Null Sender Spam for Valid Accounts
Looking at Scott's response below, I'd like to have the Refuse Null Sender switch off, but we have a situation where spammers are forging valid e-mail addresses. We have thousands of bounces showing up for messages never sent from valid accounts here. For example, [EMAIL PROTECTED] may be a valid account but he is not a spammer. But a spammer uses [EMAIL PROTECTED] forges tens of thousands of messages with this as the 'reply to' account in headers. Since the spammer has many unvalid accounts in his spamming, [EMAIL PROTECTED] is swamped with thousands of bounced mails for mails that he did not even send... This is now happening to hundreds of accounts here because it looks like the spammer's software is randomly selecting them from a spam list. I have re-enabled 'Refuse Null Senders' to relieve this problem, but would like to find a more compliant solution. Does any one know how to attack this issue in another way? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com R Well, the real question is why do you think that you are safer by R rejecting those E-mails? I'm not aware of any safety issues. The R only issue I am aware of is that a small percentage of spammers R send their spam that way. R R The NULLsender has been used for over 20 years for bounce R messages and other automated messages (such as vacation messages, R and those awful spam confirmation E-mails, and Delivery Status R Notifications). R R So the choices are : R R [1] Comply (leave Refuse NULL Senders at the default UNchecked R setting). Pros: Your mailserver will act as expected. Cons: As very R small percentage of spam is sent this way, but it can be detected R using standard spam control. R R [2] Refuse NULL senders. Pros: You'll have that safe feeling. R Cons: You won't receive all your E-mail, because you're blocking R someofit,andbecauseyou'llgetlisted at R http://www.rfc-ignorant.org . R R -Scott -- ActivatorMail(tm) ver.01010031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Null Sender Spam for Valid Accounts
Reply to: John Tolmachoff (Lists) Re: [Declude.JunkMail] Null Sender Spam for Valid Accounts on Thursday 11:15:50 AM This is what I was doing but Spam Review might have 2000-10,000 of bounced mails... too much to do in deleting them... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J You could put in a temporary rule that holds or routes all message with a J blank or as sender, that way the end user will not see them, but you will J still be complying with the requirements. J John Tolmachoff MCSE CSSA J Engineer/Consultant J eServices For You J www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Roger Heath Sent: Thursday, October 16, 2003 1:53 AM To: R. Scott Perry Subject: [Declude.JunkMail] Null Sender Spam for Valid Accounts Looking at Scott's response below, I'd like to have the Refuse Null Sender switch off, but we have a situation where spammers are forging valid e-mail addresses. We have thousands of bounces showing up for messages never sent from valid accounts here. For example, [EMAIL PROTECTED] may be a valid account but he is not a spammer. But a spammer uses [EMAIL PROTECTED] forges tens of thousands of messages with this as the 'reply to' account in headers. Since the spammer has many unvalid accounts in his spamming, [EMAIL PROTECTED] is swamped with thousands of bounced mails for mails that he did not even send... This is now happening to hundreds of accounts here because it looks like the spammer's software is randomly selecting them from a spam list. I have re-enabled 'Refuse Null Senders' to relieve this problem, but would like to find a more compliant solution. Does any one know how to attack this issue in another way? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com R Well, the real question is why do you think that you are safer by R rejecting those E-mails? I'm not aware of any safety issues. The R only issue I am aware of is that a small percentage of spammers R send their spam that way. R R The NULLsender has been used for over 20 years for bounce R messages and other automated messages (such as vacation messages, R and those awful spam confirmation E-mails, and Delivery Status R Notifications). R R So the choices are : R R [1] Comply (leave Refuse NULL Senders at the default UNchecked R setting). Pros: Your mailserver will act as expected. Cons: As very R small percentage of spam is sent this way, but it can be detected R using standard spam control. R R [2] Refuse NULL senders. Pros: You'll have that safe feeling. R Cons: You won't receive all your E-mail, because you're blocking R someofit,andbecauseyou'llgetlisted at R http://www.rfc-ignorant.org . R R -Scott -- ActivatorMail(tm) ver.01010031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus J (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. The archives can be found J at http://www.mail-archive.com. J -- J ActivatorMail(tm) ver.01010031 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.01010031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam assassin .exe as external filter
Reply to: Adrian Hauri Re: [Declude.JunkMail] Spam assassin .exe as external filter on Wednesday 7:46:06 PM I would also like to see how this would work. It is free and looks like it has a big following: http://spamassassin.taint.org/index.html -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - A I was just wondering if anyone A has implemented spamassassin with declude(as external filter) A ? A A There is an easy to use .exe version available A fromhttp://www.drbig.co.uk/modules/mydownloads/ . A At the moment I use SAproxy which filters a lot A with its Bayesian classifier etc. A But I would like to implement it directly on A the server with declude because some filters are really great. A A If someone has done the A implementation already please let me know. A A Cheers A A Adrian -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Foreign Characters and Declude
Reply to: R. Scott Perry Re: [Declude.JunkMail] Foreign Characters and Declude on Friday 7:40:45 PM I want to enable foreign characters but filter on their exact words. It sounds like these character sets are not 'viewed' and filtered in Declude? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Don't know if any one asked this, but we are seeing a flurry of omlauted characters used in Subject fields: RE: üS Döctor appröved RX Prëscríptíon We are ring to filter on these, but Declude doesn't see to recognize them? R That should trigger the NONENGLISH test (if you are using it). R -Scott R --- R Declude JunkMail: The advanced anti-spam solution for IMail mailservers. R Declude Virus: Catches known viruses and is the leader in mailserver R vulnerability detection. R Find out what you've been missing: Ask about our free 30-day evaluation. R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.00922031 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [SPAM-BADHEADERS][Declude.JunkMail] Five Ten List
Reply to: Keith Anderson Re: [SPAM-BADHEADERS][Declude.JunkMail] Five Ten List on Thursday 9:14:19 AM We used to be on Qwest and had the same problem. Outgoing was not a problem, but incoming was. The worst we saw of an RBL blocking whole providers was BLARS which appears to block whole providers except .NL Watch out for this one...too. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - K One of our upstream providers is Qwest, and we have the same problem. K However, everyone seems to be aware of the SPAM-SUPPORT flaw because it has K never prevented us from getting mail to anyone. My server is blocked by five-ten because the author doesn't like Broadwing? I am immediately going to quit using the five-ten lists because I don't know who else this gentleman doesn't like. The response is: IP address 67.99.44.6 is listed here as broadwing.net spam-support. Please note that the following comments apply K --- K [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] K --- K This E-mail came from the Declude.JunkMail mailing list. To K unsubscribe, just send an E-mail to [EMAIL PROTECTED], and K type unsubscribe Declude.JunkMail. The archives can be found K at http://www.mail-archive.com. K -- K ActivatorMail(tm) ver.00922031 Scanned for all viruses by K www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HiJack CIDR?
Searching the archives, I could not find out if Hijack accepts CIDR format for ALLOW IP? Does any one here know if it does? The documentation does not indicate this. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filtering 0.0.0.0 ??
In Deccon I see relay IP 0.0.0.0 from time to time. What is the best way to filter, ban, or configure for this IP showing up? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.00922031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spamdomains list
Reply to: Bill B. Re: [Declude.JunkMail] spamdomains list on Friday 9:20:04 AM Wait a second? When I requested this, was this format put in Declude? earthlink.com earthlink.net earthlink.net earthlink.com email.itwebmessenger.it excite.com excitenetwork.com If so, I did not see this indicated in any messages I have read. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - B Attached is a list of spamdomains and their coresponding aliases that I've compiled thus far. Anybody want to comment or expand upon this? B Bill -- ActivatorMail(tm) ver.0518031 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] IMail v8.0 and Declude Jinkmail??
You are right $6500 is absolutely rediculous. Nothing like paying thousands more for many less features... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - D Scott, D A couple of notes... D 1.) We started with IMail Antivirus and next week it looks like we will D be adding another imail server purchasing Declude AntiVirus for it and D another license for our existing server. My main problem is that to D continue to run Imail AV it costs about $6,500 for a 1 year D subscription(unlimited users). To me that price is ridiculous. Also, D it lacks many features like suppress virus notifications for certain D viruses and the ability to block certain file attachments. -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitlist Compiler
http://www.internetwk.com/breakingNews/showArticle.jhtml?articleID=6512003 IronMail compiles whitelists by looking at the recipient addresses of outgoing mail, on the assumption that frequently used addresses are those of people that an enterprise has a partnership with, and who should be allowed to send e-mail into the enterprise. Would be a nice feature in Declude... This appliance costs $27,000 each.. geesh.. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Does Declude realize it is a store and forward scenario, thus it processes the mail and then places it back in the spool directory for delievery? R Yes, it does. We have quite a few customers who are set up like this. R -Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.122102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Reject Msg based on Size
Reply to: R. Scott Perry Re: [Declude.JunkMail] Reject Msg based on Size on Monday 7:12:40 AM He has a dialup modem and wants to limit per message size.. It would save processor, if a partial message was returned to each the sender and the original message if not delivered might save 1/2 bandwidth.. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Scott, I just had an MIT engineer/user suggest a feature to reject messages based on their size. I found this fascinating personally. You could look at the size and bounce, e.g. SIZE 10MB BOUNCE Might be a server saver also... especially if it bounced a partial response smaller message. R It is an interesting idea. R One problem, though, is that it wouldn't save any bandwidth (as the E-mail R would have to be received before bouncing it). Is this something that R others might find useful? R -Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.122102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Reject Msg based on Size
Reply to: Andy Schmidt Re: [Declude.JunkMail] Reject Msg based on Size on Monday 8:07:22 AM This is not in my earlier version of Imail... Does this do this on an account basis or domain basis? It must be in later versions unless I am missing something. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - A Why not control the message size in Imail - you can set it per domain and, I A believe, per user. A If the message exceeds the max message size, Imail will reject it - and it A will result in a bounce from the SENDING server. A In fact, Imail's ESMTP will announce the max message size to the sending A server so that it can be rejected BEFORE it is transmitted (at EHLO time!) A Best Regards A Andy A --- A [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] A --- A This E-mail came from the Declude.JunkMail mailing list. To A unsubscribe, just send an E-mail to [EMAIL PROTECTED], and A type unsubscribe Declude.JunkMail. The archives can be found A at http://www.mail-archive.com. A -- A ActivatorMail(tm) ver.122102 Scanned for all viruses by A www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Reject Msg based on Size
Scott, I just had an MIT engineer/user suggest a feature to reject messages based on their size. I found this fascinating personally. You could look at the size and bounce, e.g. SIZE 10MB BOUNCE Might be a server saver also... especially if it bounced a partial response smaller message. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude in PCMag
Congratulations, Scott. Declude is mentioned in PCMag, latest February 25th Issue, page 95. Sniffer is also in the same listing. Suppose we'll see price increases now. big grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] OT: Dictionary Attacks
Reply to: Don Schreiner Re: [Declude.JunkMail] OT: Dictionary Attacks on Thursday 11:51:25 AM From an earlier msg: Our servers are very stable with this firewall. It does not autoblock these but you can manually block them. I noticed that they do not show up in the log any more, so it appears to work fine. I know you can set to autoblock select events by editing the blackice.ini can be edited for example: http.urllimit.count=60 http.urllimit.interval=50 will temporarily block too many URL requests, like web site copying... These are the settings to block dictionary attacks. It detects too many errors brought on by many failed logins... [Settings] smtp.error.count=10 ;total errors within smtp.error.interval=120 ;this amount of time(sec)then blocked -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - D Bill, D Also running BI as of few weeks ago and tinkering with firewal.ini. D Would you mind sharing the .ini changes you made. You can e-mail me off D list. Thanks. D Sincerely, D Don Schreiner D CompBiz, Inc. D www.compbiz.net D 407-322-8654 D 800-408-3688 D -Original Message- D From: [EMAIL PROTECTED] D [mailto:[EMAIL PROTECTED]] On Behalf Of Bill B. D Sent: Thursday, January 23, 2003 12:16 PM D To: [EMAIL PROTECTED] D Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks D We started running BlackICE last month and it has been working nice for D us. It requires a few config changes to get it to auto-block IPs that D send you dictionary attacks, but it is definitely a good solution. D Bill D -Original Message- D From: R. Scott Perry D Sent: Thu, 23 Jan 2003 10:58:09 -0500 D Subject: Re: [Declude.JunkMail] OT: Dictionary Attacks It seems this morning that we have several dictionary attacks happening on one of Imail servers. Is there an easy to stop the person doing this? I have looked through the log files and cannot easily spot the person(s) doing this. Is there software that will prevent people from performing Dictionary Attacks in the future? The POP3 and Delcude processes are using like 50-09% of the CPU. Let me know if there is anything I can do... D Are you sure that it is a dictionary attack? If the POP3 process has D higher usage than normal, then E-mails are being sent to your users D (which D would mean that it either isn't a dictionary attack, or a hybrid attack D where they send spam as part of the dictionary attack). D You might want to check the archives of the IMail Forum for ideas on how D to D stop a dictionary attack. Some tricks are using a nobody alias (which D I D believe you are), or using a product like BlackIce Server to stop it. D Unfortunately, Declude can't stop these, because it doesn't have access D to D the TCP/IP connection (which is where it would need to be stopped). D -Scott D --- D [This E-mail was scanned for viruses by Declude Virus D (http://www.declude.com)] D --- D This E-mail came from the Declude.JunkMail mailing list. To D unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type D unsubscribe Declude.JunkMail. The archives can be found at D http://www.mail-archive.com. D --- D [This E-mail was scanned for viruses by Declude Virus D (http://www.declude.com)] D --- D This E-mail came from the Declude.JunkMail mailing list. To D unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type D unsubscribe Declude.JunkMail. The archives can be found at D http://www.mail-archive.com. D -- D Scanned by CompBiz for Viruses http://www.CompBiz.Net. D Save 15 Percent on Virus Software by visiting D http://www.compbiz.net/software_mcafee.cfm for details! D --- D [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] D --- D This E-mail came from the Declude.JunkMail mailing list. To D unsubscribe, just send an E-mail to [EMAIL PROTECTED], and D type unsubscribe Declude.JunkMail. The archives can be found D at http://www.mail-archive.com. D -- D ActivatorMail(tm) ver.122102 Scanned for all viruses by D www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[3]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Monday 8:57:29 PM Scott, do you know when these features might be in beta, including the notification? We cannot use a global setup or most of our users would not get mail. We are anxious to see this work. grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - How would this be implemented on a user or domain basis? R The AUTOWHITELIST option is a global option, and can not be done on a R per-user or per-domain basis. I'm assuming this auto detects the right path regardless of the drive the account resides on? R That is correct. This is a very interesting feature. R I think so too. :) R -Scott -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Tuesday 2:58:10 PM I have many domains and users on my system. Not all want this feature so I need it as a Pro (per domain per user) feature... and as I mentioned earlier, there should be notification to the user of attempted delivery mailfroms... so he or she can add these to their addressbook if desired. This is what I was looking to accomplish so I can tell the CNET editor this feature is working in a viable marketable way... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Scott, do you know when these features might be in beta, including the notification? We cannot use a global setup or most of our users would not get mail. We are anxious to see this work. grin R I'm not sure specifically which feature(s) you are referring to? R The AUTOWHITELIST option is available as an interim release now, and should R be available as a beta within a week or so. R -Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.122102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[6]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: John Tolmachoff Re: [Declude.JunkMail] WhiteList Per User or Domain? on Tuesday 3:40:53 PM Is there a URL for this. Sorry if I don't have it, but I am on many lists and sometimes I delete something that maybe I should not have. g Thanks again, -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - I have many domains and users on my system. Not all want this feature so I need it as a Pro (per domain per user) feature... and as I mentioned earlier, there should be notification to the user of attempted delivery mailfroms... so he or she can add these to their addressbook if desired. This is what I was looking to accomplish so I can tell the CNET editor this feature is working in a viable marketable way... J Rodger, the NoXMail add on to Declude would provide the functions I think J you are looking for. J John Tolmachoff MCSE, CSSA J IT Manager, Network Engineer J RelianceSoft, Inc. J Fullerton, CA 92835 J www.reliancesoft.com J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. The archives can be found J at http://www.mail-archive.com. J -- J ActivatorMail(tm) ver.122102 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Monday 6:46:34 PM Wow, that was fast! Thanks Scott. as usual you are very responsive to these kind of requests... How would this be implemented on a user or domain basis? This is likely in your 'Pro' version documentation, but could you summarize this simply for me. I'm assuming this auto detects the right path regardless of the drive the account resides on? This is a very interesting feature. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - This is something that we are also giving some serious thought to (perhaps an AUTOWHITELIST ON option that if enabled would let Declude JunkMail know to check for address books, and if present, would whitelist any address in them). R This will be in the next beta, and is now available as an interim release ( R http://www.declude.com/release/166i/declude.exe ), for those that want to R test it out immediately. R To use it, you simply add a line AUTOWHITELIST ON in the R \IMail\Declude\global.cfg file. Then, for incoming E-mail, Declude R JunkMail will check to see if the user has an address book set up in web R messaging, and if so, will whitelist any E-mail addresses listed in it. R-Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.122102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: Charles Frolick Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday 9:35:39 AM We already capture most spam and virus using weights in Declude, so the user would only be hit with border line emails. I see this as an ideal scenario for those that would want such a feature. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - C One problem with held or bounced mail that notifies the intended C recipient that it was blocked, is, you did not elimiate the spam, only C change it's contents to hundreds of notifications of unwanted mail. C This will get very old, very fast, and lead to the blacklists you are C trying to avoid. Intelligent spam filters, combined with reasonably C reliable black lists and weighting are much more customizable, and can C be set up to allow customers to choose what to hold, what to delete, and C what to deliver. Several members of this list have created such apps C using various methods. Before I set mine up I would receive between 50 C and 100 spams a day, all where caught by Declude, but had low weights C (as an ISP I have to be somewhat cosevative in my weighting). After C setting up a system that lets the individuals decide, I used very C aggressive setting and now only get 5-10 a day tops, many days I get C none. I never miss any wanted email, I have an allowed senders list and C a blocked senders list, and since it uses Imail rules, I can override C the hold and delete settings for the rare occasion, such as the poorly C built mailer on my statistics program, that always fails BADHEADERS and C SPAMHEADERS, and I cant't allow the sender because that's one of the C broken headers. C Sorry to ramble, just felt I needed to put my two cents in. C Thanks, C Chuck Frolick C ArgoNet, Inc. C -Original Message- C From: [EMAIL PROTECTED] C [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath C Sent: Thursday, January 16, 2003 3:24 PM C To: R. Scott Perry C Subject: Re[2]: [Declude.JunkMail] WhiteList Per User or Domain? C Reply to: R. Scott Perry C Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday C 3:13:03 PM C Thanks. But a catchall is exactly what I don't want. What I want is a C bounce so the sender knows his mail was not accepted... maybe a C catchall if cannot deliver to sender... There are whitelist email C providers showing up and usually the sender gets sent a message that C his mail was not delivered. Usually there is a process to inform the C destination user if he wants to add the sender to his or her C whitelist. Maybe this is not feasible with Declude, but it would be C most certainly nice to have. The lead ZDNet editor David Berlind and I C have a dialog going and he is really down on blacklists and more or C less endorsing the whitelist concept. So I am shooting for a way to C manage this in Declude. I was thinking I could put high weights on all C other emails with a bounce by default but give a white list negative C counter-weights to let those through. Not sure his would work? C -- C Roger Heath C [EMAIL PROTECTED] C www.rleeheath.com C - Copy of Original Message(s): - Is it possible to make a Declude domain or user setting that enables a whitelist of email sender addresses in the Pro version whereby all emails are rejected or bounced accept a whitelist of senders? In other words reject or bounce all senders accept those that the user wishes to communicate with. Could this be done with weights...sending an eml to bounced mails? This way the Global.Cfg would not be used with its limitations. R This isn't currently possible as a designed feature, but you should C be able R to accomplish it with the next release. To do so, you would set up a R per-domain or per-user configuration of CATCHALLMAILS HOLD or C something R similar, and then have a whitelist file for that user with all the R addresses that should be accepted. R-Scott R --- R [This E-mail was scanned for viruses by Declude Virus C (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.122102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service C -- C ActivatorMail(tm) ver.122102 Scanned for all viruses by C www.activatormail.com intelligent anti-virus anti-spam service C --- C [This E-mail was scanned for viruses by Declude Virus C (http://www.declude.com)] C --- C This E-mail came from the Declude.JunkMail mailing list. To C unsubscribe, just send an E-mail to [EMAIL PROTECTED], and C type unsubscribe Declude.JunkMail. The archives can be found C at http://www.mail-archive.com. C --- C [This E-mail was scanned for viruses by Declude
Re[6]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: Charles Frolick Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday 11:05:37 AM That's why I was making the inquiry earlier about using weights. The whole weights model is easier to abide by and set upper and lower parameters or limits for almost everything... This would be a very nice 'Declude Pro' feature when scaled on unique domains and users. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - C That makes sense, a mixture of the two. In that case you would not want C to use CATCHALLMAILS, but use the border line weights to notify, and C let the customer decide to allow. C Thanks, C Chuck Frolick C ArgoNet, Inc. C -Original Message- C From: [EMAIL PROTECTED] C [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath C Sent: Friday, January 17, 2003 10:51 AM C To: Charles Frolick C Subject: Re[4]: [Declude.JunkMail] WhiteList Per User or Domain? C Reply to: Charles Frolick C Re: [Declude.JunkMail] WhiteList Per User or Domain? on Friday C 9:35:39 AM C We already capture most spam and virus using weights in Declude, C so the user would only be hit with border line emails. I see this C as an ideal scenario for those that would want such a feature. C -- C Roger Heath C [EMAIL PROTECTED] C www.rleeheath.com C --- C [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] C --- C This E-mail came from the Declude.JunkMail mailing list. To C unsubscribe, just send an E-mail to [EMAIL PROTECTED], and C type unsubscribe Declude.JunkMail. The archives can be found C at http://www.mail-archive.com. C -- C ActivatorMail(tm) ver.122102 Scanned for all viruses by C www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] WhiteList Per User or Domain?
I know this question must have been asked about Declude, but thought I'd ask again anyway as I do not recall if there is a method possible. Is it possible to make a Declude domain or user setting that enables a whitelist of email sender addresses in the Pro version whereby all emails are rejected or bounced accept a whitelist of senders? In other words reject or bounce all senders accept those that the user wishes to communicate with. Could this be done with weights...sending an eml to bounced mails? This way the Global.Cfg would not be used with its limitations. Thanks, -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday 3:13:03 PM Thanks. But a catchall is exactly what I don't want. What I want is a bounce so the sender knows his mail was not accepted... maybe a catchall if cannot deliver to sender... There are whitelist email providers showing up and usually the sender gets sent a message that his mail was not delivered. Usually there is a process to inform the destination user if he wants to add the sender to his or her whitelist. Maybe this is not feasible with Declude, but it would be most certainly nice to have. The lead ZDNet editor David Berlind and I have a dialog going and he is really down on blacklists and more or less endorsing the whitelist concept. So I am shooting for a way to manage this in Declude. I was thinking I could put high weights on all other emails with a bounce by default but give a white list negative counter-weights to let those through. Not sure his would work? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Is it possible to make a Declude domain or user setting that enables a whitelist of email sender addresses in the Pro version whereby all emails are rejected or bounced accept a whitelist of senders? In other words reject or bounce all senders accept those that the user wishes to communicate with. Could this be done with weights...sending an eml to bounced mails? This way the Global.Cfg would not be used with its limitations. R This isn't currently possible as a designed feature, but you should be able R to accomplish it with the next release. To do so, you would set up a R per-domain or per-user configuration of CATCHALLMAILS HOLD or something R similar, and then have a whitelist file for that user with all the R addresses that should be accepted. R-Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.122102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] WhiteList Per User or Domain?
Reply to: R. Scott Perry Re: [Declude.JunkMail] WhiteList Per User or Domain? on Thursday 5:57:27 PM Scott, the only thing that would concern me is that I use multiple disk drives for my users accounts, for example: activatormail.com d:\actmail techknow.com c:\Imail\techknow wyndows.comc:\Imail\wyndows If you do such a feature I would need to be able to point to an exact path for each domain... I think this would be a great feature for Declude and I hope you do it. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - I think I mentioned this to you earlier, Scott; If you could have the user edit their addressbook in Imail web mail as a whitelist, and Declude used this, then the user could manage their own whitelist. R This is something that we are also giving some serious thought to (perhaps R an AUTOWHITELIST ON option that if enabled would let Declude JunkMail R know to check for address books, and if present, would whitelist any R address in them). R -Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.122102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamReview Black-listing White-listing Possible Feature
Ok, I am now both black-listing and white-listing using a single filter file in Declude. For example if a source is blacklisted this can take the form of the following methods or commands examples: MAILFROM 60 ENDSWITH greatdeal.net HEADERS 60 CONTAINS somebaby.com BODY 60 CONTAINS basherman The weights are so high each mail gets deleted. Now I white-list using 'counter-weights': REVDNS -100 ENDSWITH sportico.com MAILFROM -100 ENDSWITH [EMAIL PROTECTED] HEADERS -100 CONTAINS Yahoo! Alerts SUBJECT -100 CONTAINS ActivatorMail Sign-up To manage the above I have a WEIGHT 35 that DELETES 'black-listed' weights... Now that I know I can edit just one simple file, I am wishing SpamReview could do this for me. I am not sure just how to pursue this but for mailfrom info could be used initially. This means there would be four buttons, for example: Que and White-list Domain = adds MAILFROM -100 ENDSWITH @domain.com Que and White-list Sender = adds MAILFROM -100 ENDSWITH [EMAIL PROTECTED] Delete and Black-List Domain = adds MAILFROM 100 ENDSWITH @domain.com Delete and Black-List Sender = adds MAILFROM 100 ENDSWITH [EMAIL PROTECTED] Maybe Scott can recommend how to do this to be most efficient with Declude testing of emails. Maybe a pull down menu would be good rather than buttons, then many more parameters could exist in addition to above four examples above? For example another method would be: Delete Black-list REVDNS Domain = adds REVDNS 100 ENDSWITH domain.com Delete White-list REBDNS Domain = adds REVDNS -100 ENDSWITH domain.com I would find all this quite useful and I am wondering what others might think. SpamReview could be pointed at a single filter.txt file to edit then edit it... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] 'Counter-weighing' With One File
We recently took the que in earlier discussions here to begin utilizing negative weights in the filter file we had already constructed to make counter-weighing work. We are very pleased with the results. First we have just one file to edit that weighs possible spam by rating MAILFROM, BODY, etc. but then we added to the same file -100 or -60 counter-weights for versions of these that are really legitimate sources. The whole operation is simple as it is based strictly on weight and editing Declude rules to balance against black lists that are trapping legitimate emails.. works super and is very easy to manage. You also do not have the limitations of total whitelisting entries associated with the global.cfg. Spam weights, for example, look like: MAILFROM 13 CONTAINS opt-in MAILFROM 13 CONTAINS optitarget MAILFROM 13 CONTAINS promo Spam 'counterweights' look like: MAILFROM -100 CONTAINS .classmates.com MAILFROM -100 CONTAINS .rnc.org MAILFROM -100 CONTAINS pcclub.com -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - One problem I see (Sandy and others, please jump in) is that whitelisting J is J easy to mess up, and a crack that the law of unintended consequences will J exploit. Two examples: the example in Scott's manual that says whitelisting J mail.com is probably a bad idea, and whitelisting J postmaster@[yourdomainhere.tld] gives a free ride to any spam that sends to J postmaster while cc'ing everybody else at your domain. J I agree. The battle goes on. J John Tolmachoff MCSE, CSSA J IT Manager, Network Engineer J RelianceSoft, Inc. J Fullerton, CA 92835 J www.reliancesoft.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] whitelisting
Reply to: John Tolmachoff Re: [Declude.JunkMail] whitelisting on Thursday 5:02:56 PM I'd like to do this. Will negative weights work for this list? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J One thing I am considering is using a greylist, where known solid domains J that need it will go on a weighted whitelist of say -100 and the weighted J greylist will get say -15, and I would put those domains they needed the J help but not wanting to actually whitelist. J John Tolmachoff MCSE, CSSA J IT Manager, Network Engineer J RelianceSoft, Inc. J Fullerton, CA 92835 J www.reliancesoft.com J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. The archives can be found J at http://www.mail-archive.com. J -- J ActivatorMail(tm) ver.082302 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] More on: %COUNTRYCHAIN%
Reply to: Kami Razvan Re: [Declude.JunkMail] More on: %COUNTRYCHAIN% on Tuesday 9:57:48 AM I have yet to see any countries shown... it is always: [Unknown]-[APNIC Unlisted]-[ARIN Unlisted]-destination -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - K Hi; K I have: K COUNTRYCHAINX-Country-Chain: %COUNTRYCHAIN% K In the Global.cfg. K Am I to expect the country chain in all eMail headers? If yes.. Then I K am not getting it. K I have downloaded the K file:http://www.declude.com/release/162/all_list.dat and put it in the K declude folder. K Missing something? K Regards, K Kami K --- K [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] K --- K This E-mail came from the Declude.JunkMail mailing list. To K unsubscribe, just send an E-mail to [EMAIL PROTECTED], and K type unsubscribe Declude.JunkMail. The archives can be found K at http://www.mail-archive.com. K -- K ActivatorMail(tm) ver.082302 Scanned for all viruses by K www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] question for all...
Reply to: Bill Beach Re: [Declude.JunkMail] question for all... on Friday 8:44:17 AM How do you setup a domain to spool only then forward to another Exchange server? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Has anybody done this? B I just set this up this week for another organization on-site here. I used B to host their e-mail on my IMail server but they are moving to a new B location (none too soon I might add) and want to use Exchange. So currently B their mail comes to my IMail server running Declude AV and JunkMail which B then forwards it to their Exchange box. No problems to report. As far as the B licenses go, my thinking is that if you're only spooling mail and not B hosting any user boxes, you should be able to get by with the mininum user B license. B -B -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[4]: [Declude.JunkMail] question for all...
Reply to: Sanford Whiteman Re: [Declude.JunkMail] question for all... on Saturday 3:54:30 PM Thanks, Sandy. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - How do you setup a domain to spool only then forward to another Exchange server? S Search IMail KB for store and forward. S -Sandy -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] SpamReview Request - Delete All
Reply to: Tom Schwarz Re: [Declude.JunkMail] SpamReview Request - Delete All on Wednesday 5:57:17 AM I would like the buttons actually... I am using the keyboard commands but I'd like to make these one clicks.. Particularly the delete all and exit..then this would delete all displayed entries and all deleted entries in one click. Perahps the other should be delete all then reload any new entries.. No highlighting would be required at all. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - T Roger, T Using standard windows select capibilities you may select multiple entries T with the Shift and Ctrl keys or select all entries using Ctrl-A. T After selecting multiple entries you can use all the normal functions such T as Delete or Move just like you would use them on one selected entry. T Will this take care of your request or would the buttons be better? T Tom T -Original Message- T From: [EMAIL PROTECTED] T [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath T Sent: Tuesday, September 24, 2002 9:19 PM T To: Tom T Subject: [Declude.JunkMail] SpamReview Request - Delete All T Importance: Low T Ok, SpamReview mailFrom is working great for me with the proper T string detect...!!! T Now for another request. two more buttons: T Delete All - Deletes all entries. T Delete All and Exit - Deletes all entries then exits (deleting T deleted if switch is 'on') T This is really want is needed. This way one may inspect select T messages and manage them then delete the rest in one blow. This T will save me even more time from an already great time saving T program. T -- T Roger Heath T [EMAIL PROTECTED] T www.rleeheath.com T -- T ActivatorMail(tm) ver.082302 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service T --- T [This E-mail was scanned for viruses by Declude Virus T (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. The archives can be found T at http://www.mail-archive.com. T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. The archives can be found T at http://www.mail-archive.com. T -- T ActivatorMail(tm) ver.082302 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] SpamReview Request - Delete All
Reply to: Darrell L. Re: [Declude.JunkMail] SpamReview Request - Delete All on Wednesday 7:42:30 AM I know... This is what I do now. One click would still be nicer and faster... been using Windows since version 1. g Thanks, -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Delete All - Deletes all entries. D ctrl+a del Delete All and Exit - Deletes all entries then exits (deleting deleted if switch is 'on') D ctrl+a del alt+f4 D Darrell -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamReview Request - Delete All
Ok, SpamReview mailFrom is working great for me with the proper string detect...!!! Now for another request. two more buttons: Delete All - Deletes all entries. Delete All and Exit - Deletes all entries then exits (deleting deleted if switch is 'on') This is really want is needed. This way one may inspect select messages and manage them then delete the rest in one blow. This will save me even more time from an already great time saving program. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamReview Update and From EMail Discussion
Reply to: Tom Schwarz Re: [Declude.JunkMail] SpamReview Update and From EMail Discussion on Wednesday 3:00:02 PM This feature to add to kill still fails here. In place of X-Declude-Sender: I put X-Note-Real-Mail-From: Wondering what I might be doing wrong? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - T To SpamReview Users, T v1.0.47 is now available. If you are already using v1.0.45 just click on T File/Check for Program Updates to download the new version. T Changes in this version. T SpamReview now extracts the From email address for the list from the Q T file if you have theShow Subject in List option selected in the Settings. T Added a new field in the Settings so you can configure a string to use when T trying to locate the From email address in the settings file. By default T X-Declude-Sender: is used since Declude already includes this in the T message if you have XSENDER ON set in the global.cfg file. T No changes were made to the Add to Kill except to use the new string to T locate the From email address. T -- T I hope this helps resolve some of the problems, questions, and confusion. T -- T A few weeks ago I started to update the web page. You can find help here. T http://www.slsoft.com/spamreviewhelp.htm T You can also find some of the following discussion regarding the From T EMail address in the QA section. Here it is in text form. T Q. Where does SpamReview get the From EMail address from? T A. The From EMail Address can come from a couple of different places T depending on how SpamReview is configured in the Settings. If you have T selected the Show Subject in List option then the From EMail Address T comes from the Q file using the Locate From EMail Address String: value T in the Settings. If the Show Subject in List option is not selected the T From EMail Address comes from the D file. In this case it may not be T right but it's the best we have since we have not read the Q file yet. T The Default Value for Locate From EMail Address String: is T X-Declude-Sender:. You must have XSENDER ON in the global.cfg file for T this to work. If you have setup your own custom method for doing this just T make sure the resulting string has one and only one space between your text T and the start of the email address. ex. MyFromEMailAddress: T [EMAIL PROTECTED] T Important Note: Regardless of the Settings, the From EMail address located T by using the Locate From EMail Address String: is used when adding to the T kill.lst file. There are no exceptions to this. If you have not properly T matched the SpamReview Settings with the Declude JunkMail settings you will T get a blank entry in the kill.lst file. T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. The archives can be found T at http://www.mail-archive.com. T -- T ActivatorMail(tm) ver.082302 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Address Book Only in Declude?
I just got the following request from one of my users: R How do I arrange to receive only emails from members of my address book? In my opinion this could be the biggest feature added to Declude at this time. Here's how I'd like it to work: Declude looks at a text cfg file to see if this feature is turned on for a select domain or e-mail account... for example, if in ADDR.CFG email address or domain wyndows.com or [EMAIL PROTECTED] then Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists then pass the e-mail to this account, else delete...or return e-mail as rejected.. How soon can I get this, Scott? grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Address Book Only in Declude?
Reply to: Kami Razvan Re: [Declude.JunkMail] Address Book Only in Declude? on Thursday 9:48:16 AM Personally we'd like to have this as an add-on and not a standard feature. So we'd like only administrator control over this. It could be easily misunderstood by users as well. The ability to set a whole domain or individual users, like the Pro version of Declude is what we really need. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - K Hi; K The idea is a good one but I think it truly belongs at the IMail level. K This way, using the web manager, every user can decide what level of K mail they want to accept. K It is sort of like what the JunkMail setting is with Hotmail. Strict, K allowing only those in the address book to send, or Loose so anyone can K send. K If Declude adds this then it is up to the Admin to add this for every K user upon request. This is a lot of work! K Just a thought. K Kami K -Original Message- K From: [EMAIL PROTECTED] K [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath K Sent: Thursday, August 29, 2002 10:32 AM K To: R. Scott Perry K Subject: [Declude.JunkMail] Address Book Only in Declude? K I just got the following request from one of my users: R How do I arrange to receive only emails from members of my address R book? K In my opinion this could be the biggest feature added to Declude at K this time. Here's how I'd like it to work: K Declude looks at a text cfg file to see if this feature is turned on for K a select domain or e-mail account... for example, K if in ADDR.CFG email address or domain wyndows.com or K [EMAIL PROTECTED] then K Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists then K pass the e-mail to this account, else delete...or return e-mail as K rejected.. K How soon can I get this, Scott? grin K -- K Roger Heath K [EMAIL PROTECTED] K www.rleeheath.com K --- K [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] K --- K This E-mail came from the Declude.JunkMail mailing list. To K unsubscribe, just send an E-mail to [EMAIL PROTECTED], and K type unsubscribe Declude.JunkMail. The archives can be found K at http://www.mail-archive.com. K -- K ActivatorMail(tm) ver.082302 Scanned for all viruses by K www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Address Book Only in Declude?
Reply to: John Tolmachoff Re: [Declude.JunkMail] Address Book Only in Declude? on Thursday 9:53:27 AM Not to be sarcastic, but how? grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J Not to be sarcastic, but wouldn't that be done in a rules.ima file that J is configurable by the user? J John Tolmachoff J IT Manager, Network Engineer J RelianceSoft, Inc. J Fullerton, CA 92835 J www.reliancesoft.com J -Original Message- J From: [EMAIL PROTECTED] J [mailto:[EMAIL PROTECTED]] On Behalf Of Roger Heath J Sent: Thursday, August 29, 2002 7:32 AM J To: R. Scott Perry J Subject: [Declude.JunkMail] Address Book Only in Declude? J I just got the following request from one of my users: R How do I arrange to receive only emails from members of my address J book? J In my opinion this could be the biggest feature added to Declude J at this time. Here's how I'd like it to work: J Declude looks at a text cfg file to see if this feature is turned J on for a select domain or e-mail account... for example, J if in ADDR.CFG email address or domain wyndows.com or J [EMAIL PROTECTED] then J Look at c:\Imail\Wyndows\users\heath\aliases.txt MAILFROM exists J then pass the e-mail to this account, else delete...or return J e-mail as rejected.. J How soon can I get this, Scott? grin J -- J Roger Heath J [EMAIL PROTECTED] J www.rleeheath.com J -- J ActivatorMail(tm) ver.082302 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service J --- J [This E-mail was scanned for viruses by Declude Virus J (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. The archives can be found J at http://www.mail-archive.com. J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. The archives can be found J at http://www.mail-archive.com. J -- J ActivatorMail(tm) ver.082302 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[3]: [Declude.JunkMail] Address Book Only in Declude?
Reply to: R. Scott Perry Re: [Declude.JunkMail] Address Book Only in Declude? on Thursday 10:19:03 AM The only problem I see with this is whitelisting... perhaps it should even disregard the whitelist too? Looks like a bounce would be preferable on a feature like this. It would be a great feature. If a user wants to receive e-mails from a select source he or she could just log into web mail and enter the address. It would be nice if they could make a 'CONTAINS' rule by say entering an address like [EMAIL PROTECTED], Then if internet.com was in the HEADERS, it would pass the mail.. Others have suggested making whitelists into separate lists so you can per user or per domain them. Perhaps if you do this all these things can be 'matched up'? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - Personally we'd like to have this as an add-on and not a standard feature. So we'd like only administrator control over this. It could be easily misunderstood by users as well. The ability to set a whole domain or individual users, like the Pro version of Declude is what we really need. R If something like this does get added, it would likely best fit into R Declude JunkMail as a test and an action (such as a test NOTINADDRESSBOOK R with an action of BOUNCE or HOLD). That way, it could be applied R per-domain or per-user, and end users wouldn't have any direct control over it. R-Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. The archives can be found R at http://www.mail-archive.com. R -- R ActivatorMail(tm) ver.082302 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.082302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
BLARSBL:Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released
Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released on Tuesday 9:44:55 AM Scott, I am seeing 'whitelisted automatically' ??? How does his work? -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - R We have just released Declude JunkMail v1.57 (beta). Changes include: R o HELOBOGUS will now only be tested on non-local senders. R o HELO detection wasn't using correct hop; fixed. R o An issue STARTSWITH in filter was fixed. R o ROUTETO/COPYTO can now use variables (IE spam@%LOCALHOST%). R o Fixes an issue where starting external programs could fail (0xC142 R error without a .DLL listed). R o Takes care of possible whitelist corruption when certain Received: R headers were processed. R o IS filter type added. R o ENDSWITH filter type added. R o HEADERS filter location added. R o Added REDIRECT option in config files to allow configuration groups. R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. You can E-mail R [EMAIL PROTECTED] for assistance. You can visit our web R site at http://www.declude.com . R -- R ActivatorMail(tm) ver.061902 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re: [Declude.JunkMail] Declude and Sniffer
Reply to: Jeff Kratka Re: [Declude.JunkMail] Declude and Sniffer on Friday 3:08:26 PM You will like Sniffer. Not only is it great at spam detection but it is substantially faster than text based rules. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - J Just curious. How many people are using both Declude Junk Mail and the J sniffer add-on and has it made a difference if yes. I have been completely J pummeled with Spam and am looking for more options. J Thanks. J Jeff J * J TymeWyse Internet J P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 J tel/fax: (541) 839-6027 - [EMAIL PROTECTED] J * J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. You can E-mail J [EMAIL PROTECTED] for assistance. You can visit our web J site at http://www.declude.com . J -- J ActivatorMail(tm) ver.061902 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re: [Declude.JunkMail] problem with spamreview software
Reply to: Eddie Cornejo Re: [Declude.JunkMail] problem with spamreview software on Wednesday 4:05:03 PM We have reported this for several months now and it has never been fixed because it is working for the author. We know the paths are correct as we can load the kill.lst from the menu. It keeps putting carriage returns at the end of the file but no addresses or domains... NT4SP6A. You are not alone. g -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - E Is anyone having a problem with the latest version (1.0.39) of spamreview E not writing to the kill.lst file? E Tried local and mapped drives, file permissions etc. without success. E I have an older version (1.0.12) that does write to the kill.lst file. E I've also emailed the author of the program. E Thanks, E Eddie Cornejo, Sys Admin E Tom Rowe Associates E 956-412-6600 Ext.10 E Toll Free USA 888-866-7693 E Toll Free Canada 877-866-7693 E http://www.tomrowe.com E --- E [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] E --- E This E-mail came from the Declude.JunkMail mailing list. To E unsubscribe, just send an E-mail to [EMAIL PROTECTED], and E type unsubscribe Declude.JunkMail. You can E-mail E [EMAIL PROTECTED] for assistance. You can visit our web E site at http://www.declude.com . E -- E ActivatorMail(tm) ver.061902 Scanned for all viruses by E www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: BLARSBL:Re: [Declude.JunkMail] problem with spamreview software
Reply to: Eddie Cornejo Re: BLARSBL:Re: [Declude.JunkMail] problem with spamreview software on Wednesday 6:01:50 PM I have furnished some files to him to fix this and got fixes the same day. It is an indispensable piece of sofware. Don't know what I would do without it. Hope to see fixes on the kill.lst That is the only problem I am experiencing at this time. -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com - Copy of Original Message(s): - E Roger, E I've come to the conclusion that the spamreview software is choking on my E spool files. E I installed the software on three different machines with the same results E (2k server, 2k pro, and win98). E I am sending the author a sample of my spool files for testing. E If anyone on this list wants to give it a try, please email me directly. E mailto:[EMAIL PROTECTED] E Eddie Cornejo, Sys Admin E Tom Rowe Associates E 956-412-6600 Ext.10 E Toll Free USA 888-866-7693 E Toll Free Canada 877-866-7693 E http://www.tomrowe.com E -Original Message- E From: [EMAIL PROTECTED] E [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath E Sent: Wednesday, July 24, 2002 5:10 PM E To: Eddie Cornejo E Subject: BLARSBL:Re: [Declude.JunkMail] problem with spamreview software E Reply to: Eddie Cornejo E Re: [Declude.JunkMail] problem with spamreview software on Wednesday E 4:05:03 PM E We have reported this for several months now and it has never E been fixed because it is working for the author. We know the E paths are correct as we can load the kill.lst from the menu. It E keeps putting carriage returns at the end of the file but no E addresses or domains... NT4SP6A. You are not alone. g E -- E Roger Heath E [EMAIL PROTECTED] E www.rleeheath.com E - Copy of Original Message(s): - E Is anyone having a problem with the latest version (1.0.39) of spamreview E not writing to the kill.lst file? E Tried local and mapped drives, file permissions etc. without success. E I have an older version (1.0.12) that does write to the kill.lst file. E I've also emailed the author of the program. E Thanks, E Eddie Cornejo, Sys Admin E Tom Rowe Associates E 956-412-6600 Ext.10 E Toll Free USA 888-866-7693 E Toll Free Canada 877-866-7693 E http://www.tomrowe.com E --- E [This E-mail was scanned for viruses by Declude Virus E (http://www.declude.com)] E --- E This E-mail came from the Declude.JunkMail mailing list. To E unsubscribe, just send an E-mail to [EMAIL PROTECTED], and E type unsubscribe Declude.JunkMail. You can E-mail E [EMAIL PROTECTED] for assistance. You can visit our web E site at http://www.declude.com . E -- E ActivatorMail(tm) ver.061902 Scanned for all viruses by E www.activatormail.com intelligent anti-virus anti-spam service E -- E ActivatorMail(tm) ver.061902 Scanned for all viruses by E www.activatormail.com intelligent anti-virus anti-spam service E --- E [This E-mail was scanned for viruses by Declude Virus E (http://www.declude.com)] E --- E This E-mail came from the Declude.JunkMail mailing list. To E unsubscribe, just send an E-mail to [EMAIL PROTECTED], and E type unsubscribe Declude.JunkMail. You can E-mail E [EMAIL PROTECTED] for assistance. You can visit our web E site at http://www.declude.com . E --- E [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] E --- E This E-mail came from the Declude.JunkMail mailing list. To E unsubscribe, just send an E-mail to [EMAIL PROTECTED], and E type unsubscribe Declude.JunkMail. You can E-mail E [EMAIL PROTECTED] for assistance. You can visit our web E site at http://www.declude.com . E -- E ActivatorMail(tm) ver.061902 Scanned for all viruses by E www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] BLARSBL:Declude Keyword Filters
Are key word filters case sensitive? We see some filters not working on subject fields, for example, unless they match exactly the case of the filter... -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re[2]: [Declude.JunkMail] More Spam Addresses
Reply to: Tom Re: [Declude.JunkMail] More Spam Addresses on Saturday 9:09:17 PM Is there documentation on kill.lst and use of the proceeding '.' dot? I could not find this... The Infobase says use @ in each example... Is this for use in Declude blacklist or kill.lst? -- Roger Heath - Copy of Original Message(s): - T Here are a few more spam addresses that were checked. T like always, use them at your own risk. -TJ T .adult-mailer.com T .almus.com T .asseenontw.com T .clubshop.com T .emailfactory.com T .emazing.com T .infogeneratorpro.com T .intimail.com T .masterbatesknows.com T .optinmailing.com T .sandbox.com T .temd.net T .tradersunite.com T .wippit.com T @Yokoz.com T @befree.com T @c-h-o.com T @cadvision.com T @df.lth.se T @discounts.com.ar T @doe.com T @doge.it T @free-inter.net T @gz-5.com T @hanson.com T @informaticien.org T @intenseschool.com T @jyrki.com T @kali.com.cn T @motorcycle.com T @msgserv.com T @optinstar.com T @pediatrician.com T @rapidimpactonline.net T @salliemaemail.com T @sgleb.com.lb T @spermfun.com T @spray.no T @surfacemail.com T @thenetdeals.com T @total.net T @two-river.com T @uptilt.com T @w2knews.com T @xidserv.com T @xynergy.org T @yeah.net T @zbzoom.net T armstrongonewire.com T businessopp2002.com T theadmanager.com T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T -- T ActivatorMail(tm) ver.061902 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
[Declude.JunkMail] BLARSBL:Time Msg Processed : ms ?? (like DEBUG log)
I have seen others ask about this here and I am curious if any such feature was done..??? where %TIMEINOUT% or some variable that is the milliseconds of Declude processing time, normally seen in the DEBUG logging mode. This would be a nice quality control feature for JunkMail if it can be done... so it can be placed in headers even temporarily to view how well mail is being processed. -- Roger Heath -- ActivatorMail(tm) ver.061902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] BLARSBL:DBSL
Reply to: Roger Heath Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 8:49:08 AM Should be DSBL... and it appears to be working here after turning it on.. -- Roger Heath - Copy of Original Message(s): - R http://www.infoworld.com/cgi-bin/fixup.pl?story=http://www.infoworld.com/articles/op/xml/02/05/20/020520opestrat.xmldctag=security R Is DBSL a free blacklist? It seems so in the above article... R If so, do I just uncomment the line in the Global.Cfg to make it R active? R -- R Roger Heath R -- R ActivatorMail(tm) ver.061102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. You can E-mail R [EMAIL PROTECTED] for assistance. You can visit our web R site at http://www.declude.com . R -- R ActivatorMail(tm) ver.061102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] BLARSBL:DBSL
Reply to: Intelliware Administrator Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 9:38:20 AM No, but I will try it. It seems to be working good. Scott had this under subscription based services in his sample global file, so I was a bit confused. Are there others? Does any one here have a complete list of the free ones available? -- Roger Heath - Copy of Original Message(s): - I Did you also uncomment DSBLALL ? I Kevin M. Donovan, MCSE I Network Support Specialist I IntelliWare Systems, Inc. I Phone (817) 277-0800 x228 I - Original Message - I From: Roger Heath [EMAIL PROTECTED] I To: Roger Heath [EMAIL PROTECTED] I Sent: Thursday, June 13, 2002 9:04 AM I Subject: Re: [Declude.JunkMail] BLARSBL:DBSL Reply to: Roger Heath Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 8:49:08 AM Should be DSBL... and it appears to be working here after turning it on.. -- Roger Heath - Copy of Original Message(s): - R I http://www.infoworld.com/cgi-bin/fixup.pl?story=http://www.infoworld.com/art I icles/op/xml/02/05/20/020520opestrat.xmldctag=security R Is DBSL a free blacklist? It seems so in the above article... R If so, do I just uncomment the line in the Global.Cfg to make it R active? R -- R Roger Heath R -- R ActivatorMail(tm) ver.061102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service R --- R [This E-mail was scanned for viruses by Declude Virus I (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. You can E-mail R [EMAIL PROTECTED] for assistance. You can visit our web R site at http://www.declude.com . R -- R ActivatorMail(tm) ver.061102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus I (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . I --- I [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] I --- I This E-mail came from the Declude.JunkMail mailing list. To I unsubscribe, just send an E-mail to [EMAIL PROTECTED], and I type unsubscribe Declude.JunkMail. You can E-mail I [EMAIL PROTECTED] for assistance. You can visit our web I site at http://www.declude.com . I -- I ActivatorMail(tm) ver.061102 Scanned for all viruses by I www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[3]: [Declude.JunkMail] BLARSBL:DBSL
Reply to: R. Scott Perry Re: [Declude.JunkMail] BLARSBL:DBSL on Thursday 10:18:20 AM Thanks. I had to drop this almost as soon as I started it. It seemed to work but then I began getting almost all mail trapped with a weight 10 appearing from nowhere. Even the tests list did not list a weight 10 rule violation. I commented out the DBSL and now am back to normal. -- Roger Heath - Copy of Original Message(s): - No, but I will try it. It seems to be working good. Scott had this under subscription based services in his sample global file, so I was a bit confused. R FYI, that section is for services that require a subscription *or* are not R commonly used. The only ones that require a subscription are the MAPS R tests (RBL, RSS, DUL) and the SNIFFER and POSTFIXGATE tests. Are there others? Does any one here have a complete list of the free ones available? R You can go to http://www.declude.com/junkmail/support/ip4r.htm for a list R of all the known DNS-based spam tests. Except for the ones listed above, R they are all free. R -Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. You can E-mail R [EMAIL PROTECTED] for assistance. You can visit our web R site at http://www.declude.com . R -- R ActivatorMail(tm) ver.061102 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.061102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting
Reply to: Jesus Alvarez Re: [Declude.JunkMail] Blocking Dictionary Attacks and Mail Harvesting on Monday 4:26:37 PM The Server version of NetworkIce Black Ice detects these as 'SMTP- too many errors'. When we see this, we set that IP to be blocked for a day or a week if they are persistent. It essentially shuts off their attack for a set time period... You can purchase this Server Firewall at www.networkice.com -- Roger Heath - Copy of Original Message(s): - J Can Declude Hijack help with dictionary attacks and J other attacks that attempt at mail harvesting ? J We had a case recently where someone tried over 5 J email addresses on a domain before we were able to stop J him. Since we have an Imgate front end, the bounce messages J increased our queues and delivery times quite a bit. His J ISP was notified and their account cancelled but that does J not prevent this from happening again. We currently run J Declude Hijack but it normally catches attempts at J massive outgoing deliveries, not cases like this. J Else, how do other Imail Declude users protect themselves J in these cases ? J Thanks. J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. You can E-mail J [EMAIL PROTECTED] for assistance. You can visit our web J site at http://www.declude.com . J -- J ActivatorMail(tm) ver.041902 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.041902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re[2]: [Declude.JunkMail] 1.49 list problem
Reply to: Jack Taugher Re: [Declude.JunkMail] 1.49 list problem on Friday 1:50:18 PM Using Declude 1.5 and still see this problem. I have a local list of 1800 I send out and it is now over four hours later and it is still delivering this in about 8 LST files. I have exhausted trying to find out why 1800 and all local accounts would take this amount of time or longer. Am I missing a setting somewhere? I have never seen it take so long to deliver local emails. Otherwise regular emails are passing very fast. -- Roger Heath - Copy of Original Message(s): - J I wonder if that was our problem yesterday. J We had a few messages sent to our a list of 800 and a list of 1200. I J didn't recall seeing any .LST files, however it took more than 2 hours to J send out the message -- whereas in the past those two lists seemed to send J everything within 5 minutes. J - Original Message - J From: R. Scott Perry [EMAIL PROTECTED] J To: [EMAIL PROTECTED] J Sent: Friday, April 26, 2002 10:17 AM J Subject: Re: [Declude.JunkMail] 1.49 list problem Does this mean that if I send something to a list it will not go out J right now? That depends on your queue timer settings. However, if you need to send something out immediately, you can go to the IMail Administrator, go to View Queue, find the .LST file(s) and click the Send One button to send them out immediately. -Scott --- [This E-mail was scanned for viruses by Declude Virus J (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. You can E-mail J [EMAIL PROTECTED] for assistance. You can visit our web J site at http://www.declude.com . J -- J ActivatorMail(tm) ver.041902 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.041902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
BLARSBL:Re: [Declude.JunkMail] 1.49 list problem
Reply to: John Shacklett Re: [Declude.JunkMail] 1.49 list problem on Friday 8:38:25 AM We have been witnessing this for a while... as well. It seems like list mail just sits there forever unless is is manually pushed.. This seems to be the only way it gets delivered. -- Roger Heath - Copy of Original Message(s): - J Since downloading the 1.49 beta on Wednesday [was it Wednesday? seems like J it was; everything is a blur lately], my mailserver seems to have developed J a problem with List delivery. The List submissions are accepted, scanned, J and dumped into the spool directory as nice tidy .LST files, and then they J just sit there. Very well done indeed. Seems like we had a problem similar J to this a couple of dozen versions ago? Anyway, I've been pushing these J critters out manually, but I'll let the next one sit and see if it J eventually goes out on its own. Maybe on the next queue run? J -- J John Shacklett J www.continentaloffice.com J [EMAIL PROTECTED] J [EMAIL PROTECTED] J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. You can E-mail J [EMAIL PROTECTED] for assistance. You can visit our web J site at http://www.declude.com . J -- J ActivatorMail(tm) ver.041902 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.041902 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Fwd: Re: [Declude.JunkMail] Question
This is a forwarded message From: R. Scott Perry [EMAIL PROTECTED] To: Roger Heath [EMAIL PROTECTED] Thought others here might find this interesting as I did. -- Roger Heath =Original message text=== My mail server and Declude is really being tested today. I think I got a concerted attack by several people at once to try and crash the server. I have a free email signup system (EZSignUp) and they signup then start sending libraries of email addresses through the server. Since these are from spammers and they violate SpamCop and other blacklists Declude was capturing thousands of emails. What is puzzling to me is that the spammers were sending to their own email address. Actually, they aren't amateurs. They very much want those E-mail that they are getting. These are the guys that go hunting for open relays. They find lots of mail servers and try sending an E-mail through to a free mail account that they have; if it goes through, they know they found an open relay. I figure they must not know what is happening. True -- they probably don't know that their mail is getting caught. It looks like they are amateurs. These are actually the experts (or at least the most dedicated spammers). In SMTP I use 'Relay for Local Users Only'. Note that this will allow spammers to send mail through your server to other servers, if they use a valid return address on one of your domains. Most spammers won't go to that trouble, but they could. Here is an actual emails from the Spam directory: Received: from resystems.com [208.1.108.105] by activatormail.com with ESMTP (SMTPD32-5.05) id AF4421E00DE; Mon, 04 Feb 2002 17:54:44 -0600 This is the open relay that they found. Received: from mx3.yahoo.com (host22.tracersinfo.com [216.242.132.22] (may be forged)) by resystems.com (8.9.3/8.9.3) with SMTP id CAA32528 for [EMAIL PROTECTED]; Tue, 5 Feb 2002 02:25:56 -0500 And the open relay got it from 216.242.132.22, which is on the tracersinfo.com domain. Most likely, the spammer hacked into the server, and isn't connect to it. That's the server they are running their open relay tester software on. From: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] Forged headers. To: [EMAIL PROTECTED] This is the free account on your server. Subject: testmail In most cases, they use a subject with a seemingly innocent header, in case the E-mail gets caught on the open relay and an admin finds it (subjects such as I'll see you Tuesday are common). 0500490540460500520500460490510500460500500581041511605005004611611409709910111411510511010211104609909058055048049058053048058089101115 Here's the proof that it's a spammer. This is their encoded data. If you decode it, you'll see something that includes the IP address of the open relay. To decode it, if you feel like it, take the numbers into groups of three digits (050, 049, 054...), start Notepad, and hold down the ALT key and type the three-digit number, and let go of the ALT key. You'll see 216..., which is the real data the spammer sent. Received: from riceville.k12.ia.us [207.28.21.3] by activatormail.com with ESMTP (SMTPD32-5.05) id AF4110B0084; Mon, 04 Feb 2002 17:54:41 -0600 Here, the nice spammer found an educational mail server he could abuse. -Scott ==End of original message text=== -- ActivatorMail(tm) ver.013102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Update v1.0.7
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Update v1.0.7 on Saturday 10:18:30 AM Seems to me the best way to handle same sender messages is to detect within the program matching senders than ask with a popup 'Delete all instances of this sender?' Yes No. or even have a switch in settings to do this automatically. Then you won't even have to highlight messages to get the same effect faster. Another way to speed review might be for the program to keep a list of previously deleted email addresses then have a switch in settings like 'Delete at boot matched deletes?' Yes No... Then, as the program loads, it would automatically delete previously deleted sender messages. One could purge this list to start over again using this method. You would only be dealing with 'new senders' at that point. I don't know how much time Tom has. g I do appreciate very much the program that exists. -- Roger Heath - Copy of Original Message(s): - T Power is back and life is getting back to normal so I thought I would post T an update. The last update I posted the first person that downloaded it T found a major problem. I hope that is not the case this time. -- ActivatorMail(tm) ver.013102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] header confusion
Reply to: John Shacklett Re: [Declude.JunkMail] header confusion on Thursday 7:20:44 AM I tried several times yesterday to get %testsfailed% working but it seemed to shut off weighing all together. When we dropped this variable everything returned to normal. We never saw tests listed here but had a blank line as well. We are not using this variable now. I was waiting for someone else to say something here. If you remove the %testsfailed% perhaps you will see the blank lines disappear too? -- Roger Heath - Copy of Original Message(s): - J Good morning, all. J I have a sequence of XINHEADER lines defined in my global.cfg, many based on J suggestions from Roger Heath and others. They look something like: J XINHEADER X-Note: Total spam weight of this E-mail is %WEIGHT%. J XINHEADER X-Note: QueInControl: %QUEUENAME% (%NRECIPS%) J XINHEADER X-Note: Tests failed: %testsfailed% J XINHEADER X-Note: RDNS Real Origin: %REVDNS%[%REMOTEIP%] J XINHEADER X-Note: SMTP Real From: %MAILFROM% J XINHEADER X-Note: SMTP Real To: %ALLRECIPS% J In addition, I have several tests defined that use the WARN action and they J have $default$.junkmail lines such as: J SPAMCOP header X-RBL-Warning: SPAMCOP J ADULT header X-RBL-Warning: Possible ADULT Content J What I'm seeing in actual message Dxxx.SMD files is a blank line between J the X-Notes and the X-RBL-Warnings, so that the X-RBL-Warnings are showing J up as visible in the delivered messages. Is this a glitch, or have I done J something incorrect in my setups? J -- J John Shacklett J www.continentaloffice.com J [EMAIL PROTECTED] J [EMAIL PROTECTED] J --- J [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] J --- J This E-mail came from the Declude.JunkMail mailing list. To J unsubscribe, just send an E-mail to [EMAIL PROTECTED], and J type unsubscribe Declude.JunkMail. You can E-mail J [EMAIL PROTECTED] for assistance. You can visit our web J site at http://www.declude.com . J -- J ActivatorMail(tm) ver.013002 Scanned for all viruses by J www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.013002 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Am I blacklisting correctly?
Reply to: R. Scott Perry Re: [Declude.JunkMail] Am I blacklisting correctly? on Thursday 2:52:03 PM This would explain my %testsfailed% experiences. I even tried putting the WARNs 'above' the HOLDs but this made no difference, just so ya know. -- Roger Heath - Copy of Original Message(s): - R Yes. We are currently investigating a problem reported with v1.35a that R may cause the WARN action not to be used when the HOLD action is used. If R you are running 1.35a, that could be why this is happening. R -Scott -- ActivatorMail(tm) ver.013102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Question
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Question on Wednesday 9:38:23 AM Actually, the next most useful feature for me would be to take the real sender and add-to-kill.lst function. Then if you consistently see an abuser, you just add his address to Imails kill file... This also ultimately reduces server load as well, as mail is simply rejected rather than processed... This line gives me the 'real' sender and I'd love to kill.lst some of these if they are clearly doing only spamming...: XINHEADER X-Note: SMTP Real-From: %MAILFROM% I do not see an immediate need to notify senders of bad mail. -- Roger Heath - Copy of Original Message(s): - T On some of the email I review I would like to click a button and send an T email back to the sender, based on a template, letting them know that they T have a problem. It could include all the warnings. Is this a feature that T others would use if it was available? T Tom T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T -- T ActivatorMail(tm) ver.012602 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Declude v1.35 released
Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude v1.35 released on Wednesday 10:41:02 AM WEIGHT10HOLDX-RBL-Warning: %TESTSFAILED%. We've never seen the WEIGHT10 appear in the header, only WEIGHT20, etc. I just realized these are all HOLD, so I guess I need duplicate tests with WARN? It looks like my error in retrospect... -- Roger Heath - Copy of Original Message(s): - I have already observed that this does not appear when used in XINHEADER. I keep getting weights but no testsfailed.. It is blank every time. R I've just tested it here, and it is working. R Could you show me the exact line from your \IMail\Declude\global.cfg file? R -Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. You can E-mail R [EMAIL PROTECTED] for assistance. You can visit our web R site at http://www.declude.com . R -- R ActivatorMail(tm) ver.012602 Scanned for all viruses by R www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[5]: [Declude.JunkMail] Declude v1.35 released
Reply to: R. Scott Perry Re: [Declude.JunkMail] Declude v1.35 released on Wednesday 12:35:49 PM Thanks, I keep forgetting this. -- Roger Heath - Copy of Original Message(s): - R If this is in the $default$.JunkMail file, are you seeing any warning R headers, and if so, what shows up in them? R -Scott -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[4]: [Declude.JunkMail] Spam Review and Kill File
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review and Kill File on Wednesday 6:56:42 PM I always thought you must recycle the SMTP for any change in Imail, rules.ima, kill.lst, etc. I think this may be because some of these settings are held in memory for speed. http://support.ipswitch.com/kb/IM-19990624-DM02.htm shows the requirement for kill.lst -- Roger Heath - Copy of Original Message(s): - T I don't find in the IMail documentation that you have to recycle the SMTP T service. Can you confirm this please? -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Spam Review Program
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Program on Sunday 4:00:21 PM This is super Tom. You are really saving me one heck of a lot of time. It looks nicer all the time. I like the switch from text to html display. Since you are adding features, figured I'd list a few: Keyboard hooks: 1. Delete key for Move to Delete in addition to button. 2. Insert key to Return to Que in addition to button. 3. F5 to Refresh key in addition to button. Still not displaying Weight here. If you tell me what it is looking for, maybe I can change my header to be recognized? -- Roger Heath - Copy of Original Message(s): - T Dan, T v1.0.1 is now available on the web. T v1.0.1 allows you to shut off the delete confirmation (look in settings). T v1.0.1 shows the subject. T Great idea on the Hold button. Will look into this. T I know I need to work on the sort. I would like to let you sort it multiple T ways. T If you resize the form, the message body will resize but resizing all the T windows is more difficult so that will have to wait for a future version. T Great idea though. I will add it to the list. T Keep the great ideas coming. T Thanks, Tom T -Original Message- T From: [EMAIL PROTECTED] T [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Spangenberg T Sent: Sunday, January 27, 2002 11:35 AM T To: [EMAIL PROTECTED] T Subject: RE: [Declude.JunkMail] Spam Review Program T Great program? T Are you ready for some feedback and a few ideas/suggestions? T I would like a way to shut off the delete confirmation. T It would be nice to be able to resize the windows. I like to see the subject T line and it is always down a ways so you have to scroll to see it. T A button to move to a hold directory in addition to the move to que and T delete buttons could be useful. T Also what is the sort order meant to be? Mine doesn't appear to have much T of a sort order. By date might be good. T This is a really a great utility and works very well. T Thanks T Dan T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T -- T ActivatorMail(tm) ver.012602 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012602 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Program
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Program on Saturday 10:28:46 AM I appreciate this. It would prove useful if it works well. I manage my files over a network, all but the drive is ok in that path. I'd like a copy, but I am already wondering if I can change the path. I do not have VB. -- Roger Heath - Copy of Original Message(s): - T This program is written in VB6.0. You give it the path to your IMail spool T folder and it locates the spam email that is in hold by looking in the spam T folder under the spool folder. ex. c:\imail\spool\spam. -- ActivatorMail(tm) ver.012302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Spam Review Software
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Software on Saturday 1:28:47 PM Thanks, Tom. It is working nicely here. It is much faster as once you delete and confirm the focus is on the appropriate button, so once it starts you can just keep hitting Enter until you get to something you want to not delete. I hope I get a lot of spam today. g This is very useful. -- Roger Heath - Copy of Original Message(s): - T Either will work. T \\myserver\imail\spool T or T c:\imail\spool T -Original Message- T From: [EMAIL PROTECTED] T [mailto:[EMAIL PROTECTED]]On Behalf Of Jim Jones, Jr. T Sent: Saturday, January 26, 2002 1:25 PM T To: [EMAIL PROTECTED] T Subject: Re: [Declude.JunkMail] Spam Review Software T can i use a unc to get to the spooled files or does it have to be mapped? T thanks!! T Jim T - Original Message - T From: Tom Schwarz [EMAIL PROTECTED] T To: [EMAIL PROTECTED] T Sent: Saturday, January 26, 2002 12:48 PM T Subject: [Declude.JunkMail] Spam Review Software Exactly 15 hours after I sat down at a computer to write a program to T review spam email I have a first release. I tell you this so you won't yell at T me if you find a bug. Feel free however to report bugs and suggest enhancements. You can locate this software at http://www.slsoft.com/spamreview.htm. Please read the page carefully before downloading. Tom --- [This E-mail was scanned for viruses by Declude Virus T (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . T --- T [This E-mail was scanned for viruses by Declude Virus T (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T -- T ActivatorMail(tm) ver.012302 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re: [Declude.JunkMail] Spam Review Program
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Program on Saturday 10:28:46 AM Tom, I am really enjoying the speed of your app. You web page mentions that you place a weight message in your headers using Declude but does not show how this is done. Can you show this here? I'd like to get this working... Thanks again, -- Roger Heath - Copy of Original Message(s): - T I have received several replies. If it's ok with Declude, I will post the T download address on this list. If someone from Declude would reply to me I T would appreciate it. T This program will be Freeware (I hate spam) and will only be supported to T the extent that I have time to support it (I have a real job). I will be T using it on a daily basis so I will be adding features and fixing bugs when T needed. I will provide the source code to those that want it. Test it T carefully yourself. I will not be responsible for problems that may occur. T Program Notes: T This program is written in VB6.0. You give it the path to your IMail spool T folder and it locates the spam email that is in hold by looking in the spam T folder under the spool folder. ex. c:\imail\spool\spam. T A list of all the files in the spam hold folder come up in a list box. It T includes the name of the file, date, from address, to address. T Selecting an email in the list displays information in three boxes. The T header, the declude warnings, and the body of the message. You can click on T View HTML and view the body in a browser format. T You can click on Move To Deleted and the selected email is moved to a T deleted folder under the spam folder. The selected email is removed from T the spam hold folder. T You can click on Return To Que and the email will be moved back to the T spool folder. The selected email is removed from the spam hold folder. T A Refresh button let's you refresh the list. T Tom T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T -- T ActivatorMail(tm) ver.012302 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] Spam Review Program
Reply to: Tom Schwarz Re: [Declude.JunkMail] Spam Review Program on Saturday 6:43:32 PM We have never seen the default message when a weight of 10 occurs. We have seen it when greater than 20 occurs. I thought perhaps you are using a specific format with perhaps a undocumented variable like %TOTALWEIGHT% or something like that. I do not see anything in the latest manuals or cfg files. -- Roger Heath - Copy of Original Message(s): - T Roger, T If you have upgraded Declude Junkmail recently you can find out how to use T this new feature in their online manual. T If you download their new config files I think, by default, this message T will appear. T Tom T -Original Message- T From: [EMAIL PROTECTED] T [mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath T Sent: Saturday, January 26, 2002 6:17 PM T To: Tom Schwarz T Subject: Re: [Declude.JunkMail] Spam Review Program T Reply to: Tom Schwarz T Re: [Declude.JunkMail] Spam Review Program on Saturday 10:28:46 AM T Tom, I am really enjoying the speed of your app. T You web page mentions that you place a weight message T in your headers using Declude but does not show how this T is done. Can you show this here? I'd like to get this working... T Thanks again, T -- T Roger Heath T - Copy of Original Message(s): - T I have received several replies. If it's ok with Declude, I will post T the T download address on this list. If someone from Declude would reply to me T I T would appreciate it. T This program will be Freeware (I hate spam) and will only be supported to T the extent that I have time to support it (I have a real job). I will be T using it on a daily basis so I will be adding features and fixing bugs T when T needed. I will provide the source code to those that want it. Test it T carefully yourself. I will not be responsible for problems that may T occur. T Program Notes: T This program is written in VB6.0. You give it the path to your IMail T spool T folder and it locates the spam email that is in hold by looking in the T spam T folder under the spool folder. ex. c:\imail\spool\spam. T A list of all the files in the spam hold folder come up in a list box. T It T includes the name of the file, date, from address, to address. T Selecting an email in the list displays information in three boxes. The T header, the declude warnings, and the body of the message. You can click T on T View HTML and view the body in a browser format. T You can click on Move To Deleted and the selected email is moved to a T deleted folder under the spam folder. The selected email is removed from T the spam hold folder. T You can click on Return To Que and the email will be moved back to the T spool folder. The selected email is removed from the spam hold folder. T A Refresh button let's you refresh the list. T Tom T --- T [This E-mail was scanned for viruses by Declude Virus T (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T -- T ActivatorMail(tm) ver.012302 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service T -- T ActivatorMail(tm) ver.012302 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service T --- T [This E-mail was scanned for viruses by Declude Virus T (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T --- T [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] T --- T This E-mail came from the Declude.JunkMail mailing list. To T unsubscribe, just send an E-mail to [EMAIL PROTECTED], and T type unsubscribe Declude.JunkMail. You can E-mail T [EMAIL PROTECTED] for assistance. You can visit our web T site at http://www.declude.com . T -- T ActivatorMail(tm) ver.012302 Scanned for all viruses by T www.activatormail.com intelligent anti-virus anti-spam service -- ActivatorMail(tm) ver.012302 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] mailing lists
Reply to: R. Scott Perry Re: [Declude.JunkMail] mailing lists on Friday 9:01:19 AM Be careful too... mail from @universalstudios.86server.pm0.com is not necessarily mail from Universal Studios... g We see SpamCop as the most reliable, and we just use weighting to 'confirm' SpamCop and we really do not see hardly any legitimate email captured at all. Most of these saver lists are really spamming...under the guise of the user having signed up. Most opt-in is really not opt-in, similar to 'This is not spam' statements. -- Roger Heath - Copy of Original Message(s): - I finding SPAMCOP is catching listserv email that's not spam but lists that people have signed up for like esavers and Universal Studios... R The neat thing about the SPAMCOP test is that the information they supply R (which is included in the warning added to the headers, and the log file) R gives a URL where you can find out why it was listed. You can see what % R of the mail they sent was considered spam by the recipient. R Note that there are many legitimate companies that will not use confirmed R opt-in, which means that people may play games with their friends and R sign them up. In that case, esavers or Universal Studios *would* be R sending out spam. R -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[4]: [Declude.JunkMail] mailing lists
Reply to: andyb@thumpernet Re: [Declude.JunkMail] mailing lists on Friday 10:53:25 AM We do not take this approach. We made everything WARN except WEIGHT10 which is HOLD. Then we give SpamCop a '9' weight. We make other weights to trigger the WEIGHT10 hold if more than SpamCop occurs. If only SpamCop occurs, then the mail is delivered. Basically, we ask other resources to 'confirm' SpamCop... and we have almost no legitimate email being captured at all. I agree that this is working better than ever. There is no easy way to confirm that users signed up for these lists. Lists of millions of email addresses are being sold as already screened through opt-in processes when they have not. The user is simply sent an email saying it is arriving because he or she already opted-in... when no such process ever occurred... If we find a legitimate list we will whitelist it generally. But this is very rare with the above configuration. -- Roger Heath - Copy of Original Message(s): - a Hi, a I checked the headers, it was not pm0.net and I checked with the a customers, they had indeed signed up for these mailing lists. a So, there were 3 false positives this morning out of 40 being held. I a don't even bother to HOLD for SPAMROUTING and a couple of other tests as a there didn't appear to be any false positives, and I have pm0.net in the Imail kill list. a I'm still HOLDing ZONEIN, but I tend to agree with Don's reasoning that a if legitmate email is coming via an open relay, the sys admin for that a email server needs to get with the program and lock it down. a So, SPAMCOP is still suspect to me and I'm getting more false positives a from it than anywhere else... But I'm doing to continue to use it with a HOLD and evaluate what it is catching. a Most customer reaction is very positive and anybody that wants the spam a I just exempt. a I'm happy on the whole with how it all is working, my level of a satisfaction is rising as my understand of how is works rises. A little a lack of ingorance goes a long way. ;-) (did I say that?) a Thanks, a Andy Baldwin a [EMAIL PROTECTED] a http://www.thumpernet.com a 315-282-0020 a Friday, January 04, 2002, 10:21:36 AM, you wrote: RH Reply to: R. Scott Perry RH Re: [Declude.JunkMail] mailing lists on Friday 9:01:19 AM RH Be careful too... mail from @universalstudios.86server.pm0.com RH is not necessarily mail from Universal Studios... g RH We see SpamCop as the most reliable, and we just use weighting RH to 'confirm' SpamCop and we really do not see hardly any RH legitimate email captured at all. Most of these saver lists RH are really spamming...under the guise of the user having signed RH up. Most opt-in is really not opt-in, similar to 'This is not RH spam' statements. RH -- RH Roger Heath RH - Copy of Original Message(s): - I finding SPAMCOP is catching listserv email that's not spam but lists that people have signed up for like esavers and Universal Studios... R The neat thing about the SPAMCOP test is that the information they supply R (which is included in the warning added to the headers, and the log file) R gives a URL where you can find out why it was listed. You can see what % R of the mail they sent was considered spam by the recipient. R Note that there are many legitimate companies that will not use confirmed R opt-in, which means that people may play games with their friends and R sign them up. In that case, esavers or Universal Studios *would* be R sending out spam. R -Scott RH --- RH [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] RH --- RH This E-mail came from the Declude.JunkMail mailing list. To RH unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RH type unsubscribe Declude.JunkMail. You can E-mail RH [EMAIL PROTECTED] for assistance. You can visit our web RH site at http://www.declude.com . a --- a [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] a --- a This E-mail came from the Declude.JunkMail mailing list. To a unsubscribe, just send an E-mail to [EMAIL PROTECTED], and a type unsubscribe Declude.JunkMail. You can E-mail a [EMAIL PROTECTED] for assistance. You can visit our web a site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
Re[2]: [Declude.JunkMail] greylist?
Reply to: R. Scott Perry Re: [Declude.JunkMail] greylist? on Thursday 1:02:15 PM My impression is that you are not following the instructed method. You have: whitelist fromintechpark.com We would have: whitelist from@intechpark.com Our settings work fine adding the '@'. -- Roger Heath - Copy of Original Message(s): - Here's a new problem: I have the following in my global.cfg: whitelist fromintechpark.com I just found a message in my HOLD directory with the following top header: Received: from intechexc01.intechpark.com [216.136.42.245] by mail.continentaloffice.com with ESMTP (SMTPD32-6.05) id AAE52E4F0152; Thu, 03 Jan 2002 12:54:45 -0500 Shouldn't this have gone through? R The FROM type in the whitelist only checks the return address (which in R this case may have been something very different). R You might want to instead use WHITELIST ANYWHERE intechpark.com, which R would whitelist all E-mails that contain intechpark.com anywhere in them. R -Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. You can E-mail R [EMAIL PROTECTED] for assistance. You can visit our web R site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
MISSING_REVERSE_DNS:Re[2]: [Declude.JunkMail] Weight Fix?
Reply to: R. Scott Perry Re: [Declude.JunkMail] Weight Fix? on Thursday 1:16:53 PM We have not seen it error here. It adds 'em up and HOLDs all exceeding the limit just fine. We basically set all switches to WARN except WEIGHT10 and then we can see just how well each combination of tests adds up. I'd say about 80-85% of all spam is caught now with very very few legit mails and the Imail keyword filters are picking up most of the rest.. This feature adds an 'intelligence' to catching spam.. -- Roger Heath [EMAIL PROTECTED] Here's the original how-to from Scott: The second is a weighting system (that was discussed here recently). With it, you can assign each test a weight, and you can have a new test that will only fail if a total weight value is reached. For example, you could have ORDB assigned a weight of 5, SPAMCOP a weight of 8, and SPAMHEADERS a weight of 3, along with a WEIGHT10 test that would get triggered if a weight of 10 was reached. If just ORDB and SPAMHEADERS failed (a total of 8), the WEIGHT10 test would not be triggered. If the SPAMCOP test failed, it would not trigger the WEIGHT10 test. But, if the SPAMCOP test and either the ORDB or SPAMHEADERS tests failed, the WEIGHT10 test would be triggered. Without much experimentation, we were able to set it up so that the weighting system catches about 95% of the spam at our spamtrap. The only false positive we are aware of was a canned response that we got from Network Solutions (to an E-mail that they claimed would receive a personalized reposonse), because they fail the NOPOSTMASTER test, NOWHOIS test, and REVDNS tests (which had a total weight of 13 the way we set it up, and a limit of 10). Given that Network Solutions wants us to pay $10,000 to let people do Whois lookups on our web site, it didn't really bother me at all that it was caught. To use the new weighting system, you should look at the new global.cfg file, which shows how the entries should look. The definition for each test now has 2 extra numbers added to the end (tests that did not already have 4 pieces of information associated with them, such as REVDNS revdns, need to have a placeholder, so they will now look like REVDNS revdns x x 10 0). The first of the two new numbers indicates the weight if a test fails, while the other number indicates the weight if a test does not fail (which is normally 0). You can then add a test using the type weight, such as WEIGHT10 weight x x 20 0, which would get triggered if the total weight was 20 or higher. - Copy of Original Message(s): - I remember several announcements in the past two weeks (since the official 1.30 beta started), that there was going to be a fix in the respective next day or two that would at least re-fix the weight test? R It's actually only been about a week -- the holidays seem to make it seem R longer. The holidays did delay the new release, which should be out later R today or tomorrow. R-Scott R --- R [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] R --- R This E-mail came from the Declude.JunkMail mailing list. To R unsubscribe, just send an E-mail to [EMAIL PROTECTED], and R type unsubscribe Declude.JunkMail. You can E-mail R [EMAIL PROTECTED] for assistance. You can visit our web R site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
