Re: [Declude.JunkMail] No one at Declude?
Looks like tonight we better figure out a new approach. My declude diag file is now reading declude lic as invalid. Anyone else? - Original Message - From: Todd Richards to...@nnepa.com To: Declude.JunkMail@declude.com Sent: Monday, April 15, 2013 9:34 AM Subject: RE: [Declude.JunkMail] No one at Declude? What system is that? Our users are getting hammered with spam. Reminds me of the days, many years ago, before I happened upon Declude... Todd -Original Message- On Sunday, April 14, 2013 10:24 PM, John Doyle wrote: I have reverted to a system that works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blank TO Test?
Hi Rick, FYI, there is also a test in Alligate for this that may nail them earlier in the process. Brian On 9/23/2011 8:40 AM, Rick Davidson wrote: How would one go about triggering on a message with a blank or missing TO field? -- Rick CONFIDENTIALITY NOTICE This e-mail message and any attachments contain confidential and/or privileged information for the sole use of the intended recipient. If you are not the intended recipient, you may not read, disseminate, distribute or copy this e-mail message or any attachments. Please notify the sender immediately by reply e-mail if you received this e-mail message by mistake and delete this e-mail message and any attachments from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The sender, therefore, does not accept liability for any errors or omissions in the contents of this e-mail message or any attachments, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version. -. .- - You have received this e-mail due to a past or current transaction or as a result of our efforts to keep you in touch with current developments affecting your industry. If you wish to unsubscribe from any future general information mailings, please click the 'Reply' button and add the word 'UNSUBSCRIBE' to the subject of your response. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] multiple simultaneous problems
It might help to open task manager and reduce the service priority for the time being to give you a little more breathing room until you get the problem sorted out. Brian David Dodell wrote: -Original Message- From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] Which RBL's are timing out? Is your DNS server having problems? Is your DNS server local to the mail server or is it located somewhere else? It is totally random ... sometimes none of them for several messages, other times, the first several work, and the rest fail ... doesn't seem to be any pattern (3) IMAP4d32.exe services are running 99% of the cpu time ... This will essentially starve out Declude and anything else. I have seen several folks have this issue on the Imail list. What version of Imail are you using? 9.23 since it was released ... been running it for a while. Any thoughts on where to start ... I've rebooted, stopped services, restarted services ... works fine for about 8 hrs then starts up all over again I would start with the IMAP4D issue. Darrell, I agree ... just wish I knew what was affecting it. Another response suggested the file system ... and I noticed the comment from the Sniffer people about NTFS. We have had some bad sectors on our hard drive starting about a few weeks ago ... Ran chkdsk etc and that seemed to have caught them, ran a defrag session today ... I order today a new Barracuda ES2 drive for the server, which will arrive Monday and I'll attempt to clone. Linda @ Declude suggested I might be having a bad network card go bad, which she thinks is attributing to the failed RBL issues, but I don't think that would affect the IMAP usage. Short of installing a new network card / drive ... any other thoughts what to try? David --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] RE: Various Greeting Card messages
This one is a little faster:
(http://\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b)
David Barker wrote:
I have seen these if this is what you referring to the second line is
looking for an IP. You could try this in a filter:
BODYEND NOTCONTAINS SEEING YOUR CARD
BODY20 PCRE
(http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9
]|[01]?[0-9][0-9]?)/)
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kornitz,
David
Sent: Thursday, July 12, 2007 3:35 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] RE: Various Greeting Card messages
Has anyone found (or come up with) an effect filter for all of the
greeting card messages floating around. I have been playing with them,
but in doing so, I end up blocking legitimate cards. Any suggestions
would be greatly appreciated.
Davud
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] RE: Various Greeting Card messages
Yes, technically, it would match 0.0.0.0 through 999.999.999.999 but
with HTTP:// it wouldn't really matter and it is very efficient.
David Barker wrote:
Correct it is however would also match on numbers outside the IP range like
256.256.256.256, but considering you looking for the http:// as well it
should be fine.
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brian
Milburn
Sent: Thursday, July 12, 2007 4:42 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] RE: Various Greeting Card messages
This one is a little faster:
(http://\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b)
David Barker wrote:
I have seen these if this is what you referring to the second line is
looking for an IP. You could try this in a filter:
BODYEND NOTCONTAINS SEEING YOUR CARD
BODY20 PCRE
(http://((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9
]|[01]?[0-9][0-9]?)/)
David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Kornitz,
David
Sent: Thursday, July 12, 2007 3:35 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] RE: Various Greeting Card messages
Has anyone found (or come up with) an effect filter for all of the
greeting card messages floating around. I have been playing with them,
but in doing so, I end up blocking legitimate cards. Any suggestions
would be greatly appreciated.
Davud
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
Re: [Declude.JunkMail] MXRate-Allow
Andy, This address shows 481 reported false positives from actual recipients. It also shows that 5957 individual recipients have added this address to their Alligate whitelists. But, it also shows that it has failed 81 tarpits and 422 greylist tests. So the results are a little ambiguous. Right now the current MXRate recommendation is No recommendation ;) Brian Andy Schmidt wrote: Is it me - or should MXRate-Allow be treated as a spam source list? I don't know how many times I've looked at Spam that made it through and the IP is on their whitelist, such as campaigner. Best Regards */Andy Schmidt/*/ / Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- Received: from mta8br.cmpgnr.com [69.28.223.132] by hm-software.com (SMTPD-9.10) id A0C01D47C; Sat, 18 Nov 2006 11:11:44 -0500 Return-Path: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] Date: Sat, 18 Nov 2006 11:11:48 -0500 (EST) From: Purplus Inc. [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] Reply-To: Purplus Inc. [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] To: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] Subject: Great New Deals From Purplus Software Errors-To: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: multipart/alternative; boundary==_Part_220171_25603728.1163866308151 X-Campaign: 829605.828864.667296.793699032 Bounces-To: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] X-RBL-Warning: Suspected SPAM. Spam Received Recently See: http://www.sorbs.net/lookup.shtml?69.28.223.132; X-Declude-RefID: X-Declude: Version 4.3.14; Code 0xe from mta8br.cmpgnr.com [69.28.223.132] X-Declude: Triggered [4] SENDERDB-ALLOW, SPFPASS, SNIFFER X-Countries: UNITED STATES-destination Return-Path: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] X-RCPT-TO: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] Status: X-UIDL: 463610395 X-IMail-ThreadID: 30c001bc5152 *From:* Purplus Inc. [mailto:[EMAIL PROTECTED] *Sent:* Saturday, November 18, 2006 11:12 AM *To:* [EMAIL PROTECTED] *Subject:* Great New Deals From Purplus Software - SPAM DELETED -- You are subscribed as [EMAIL PROTECTED] To unsubscribe please click here http://cmpgnr.com/r.html?c=829605r=828864t=793699032l=6[EMAIL PROTECTED]la=1o=-40. http://www.campaigner.com/?testdrive_1 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Upgrading Declude Configs - Which Tests are valid?
I spent this afternoon cleaning up my global.cfg file and I still have some tests listed that no longer show up in the latest config file from Declude. I was wondering which of the following, if any are still active tests? DSBL , SENDERDB-BLACK, SENDERDB-SUSPICIOUS, MAILPOLICE-BULK, MAILPOLICE-PORN, FIVETEN-SPAM, FIVETEN-BULK, FIVETEN-MULTISTAGE, FIVETEN-SPAMSUPPORT, FIVETEN-MISC, FIVETEN-SINGLESTAGE, FIVETEN-FREE, AHBL-RELAYS, AHBL-PROXIES, AHBL-SOURCES, AHBL-PROVISIONAL, AHBL-FORMMAIL, AHBL-DUL, NJABL-DYNABLOCK, NJABL-RELAYS, NJABL-DUL, NJABL-SOURCES, NJABL-MULTI, NJABL-FORMMAIL, and NJABL-PROXIES Are any of these tests duplicates, as in basically using the same data or basically the same test? Thanks for the help, Brian T. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Upgrades Concerns
Thanks, I guess that this issue is present, because since upgrading to Imail 8.22 I have had problems with the spool and overflow folders filling up. I just got off the phone with Ipswitch and they concluded that the problem lies with Declude not completing the sending of the messages. We set the smtp server back to Ipswitch and all messages went out with no problem. We switched it back and the spool is filling up again. Anyone know how to get ahold of a sales person at Declude? I tried the phone number and got the sales mailbox but the voicemail is full and you can not leave a message. Any one have any ideas to try and fix the problem. Thanks in advance, Brian T. - Original Message - From: Mike N To: declude.junkmail@declude.com Sent: Friday, October 27, 2006 11:55 AM Subject: Re: [Declude.JunkMail] Upgrades Concerns There is a minor compatability problem with 8.2x and 1.82 in the form of an occasional memory leak - shouldn't be an issue with lower volumes. We ran on this configuration for a while. Declude 4.X works fine with 8.22. - Original Message - From: Brian T. To: declude.junkmail@declude.com Sent: Friday, October 27, 2006 12:40 PM Subject: [Declude.JunkMail] Upgrades Concerns I am getting ready to update Imail to version 8.2x. I presently have declude version 1.82. Are there any concerns, compatabilty issues or other potential problems with running Declude 1.82 and Imail 8.2x? I don't want to have to fix Declude as well as Imail. Thanks in advance, ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Upgrades Concerns
How can I contact someone at Declude as far as a sales person? I really need to get this working. Brian T. - Original Message - From: David Barker To: declude.junkmail@declude.com Sent: Tuesday, October 31, 2006 3:38 PM Subject: RE: [Declude.JunkMail] Upgrades Concerns IMail made changes to their product in 8.22 making Declude 2.x and prior incompatible with IMail this is an IMail issue not Declude. We therefore had to change the way Declude worked in order to accommodate IMail ver 8.2x and above, we have done this with Declude 3.x and 4.x David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brian T.Sent: Tuesday, October 31, 2006 3:27 PMTo: declude.junkmail@declude.comSubject: Re: [Declude.JunkMail] Upgrades Concerns Thanks, I guess that this issue is present, because since upgrading to Imail 8.22 I have had problems with the spool and overflow folders filling up. I just got off the phone with Ipswitch and they concluded that the problem lies with Declude not completing the sending of the messages. We set the smtp server back to Ipswitch and all messages went out with no problem. We switched it back and the spool is filling up again. Anyone know how to get ahold of a sales person at Declude? I tried the phone number and got the sales mailbox but the voicemail is full and you can not leave a message. Any one have any ideas to try and fix the problem. Thanks in advance, Brian T. - Original Message - From: Mike N To: declude.junkmail@declude.com Sent: Friday, October 27, 2006 11:55 AM Subject: Re: [Declude.JunkMail] Upgrades Concerns There is a minor compatability problem with 8.2x and 1.82 in the form of an occasional memory leak - shouldn't be an issue with lower volumes. We ran on this configuration for a while. Declude 4.X works fine with 8.22. - Original Message - From: Brian T. To: declude.junkmail@declude.com Sent: Friday, October 27, 2006 12:40 PM Subject: [Declude.JunkMail] Upgrades Concerns I am getting ready to update Imail to version 8.2x. I presently have declude version 1.82. Are there any concerns, compatabilty issues or other potential problems with running Declude 1.82 and Imail 8.2x? I don't want to have to fix Declude as well as Imail. Thanks in advance, ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Upgrading - which version?
David, Can you possibly have someone from sales call me? Thanks, Brian T. 740-397-4800 - Original Message - From: David Barker [EMAIL PROTECTED] To: declude.junkmail@declude.com Sent: Tuesday, October 31, 2006 5:05 PM Subject: RE: [Declude.JunkMail] Upgrading - which version? Bill, I would suggest 4.x the 3.x is for individual products whereas 4.x is all 3 products PRO version. David -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of AlamoHost Admin Sent: Tuesday, October 31, 2006 4:59 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Upgrading - which version? I'm currently on 2.0.6.16 with Imail 8.22. My SA gives me the choice to upgrade to 3.13 or 4.3.14. I'm not really clear on why there are now two versions. Which one should I be considering? Any open problems big enough to suggest holding off? Thanks, Bill --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Upgrades Concerns
I am getting ready to update Imail to version 8.2x. I presently have declude version 1.82. Are there any concerns, compatabilty issues or other potential problems with running Declude 1.82 and Imail 8.2x? I don't want to have to fix Declude as well as Imail. Thanks in advance, Brian T. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] yahoo.com
I was looking back thru the list to see if this subject was covered earlier and could not find any articles on it. When trying to send to yahoo.com we receive an error 451 mta347.mail.scd.yahoo.com Resources temporarily unavailable. Please try again later [#4.16.5].02:16 10:29 SMTP-(0D4C) SMTP_DELIV_FAILED Does this relate to the domain key issue, or ?? Thanks Brian Baker
Re: [Declude.JunkMail] ANN: SMTP Gateway
Anyone willing to share more info on this? Timetable? Thanks, Brian T. - Original Message - From: John T (Lists) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Wednesday, January 25, 2006 9:33 PM Subject: RE: [Declude.JunkMail] ANN: SMTP Gateway Plans for a gateway version of Declude are still alive. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, January 25, 2006 6:02 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] ANN: SMTP Gateway Judging by the responses, I suppose that it is inappropriate, at least without approaching Barry about promoting this product here. I don't however believe that the intentions were to snipe customers away from Declude, but instead to provide a value-added solution to those of us that require an address-validating gateway or pre-scanner of some sort. His company has of course previously offered a plug-in for Declude, and publishes a blacklist that many around here are making use of as well. I don't believe that they are looking at this product as a big money maker for them, or even a money maker at all. Even programs like Sniffer has some potential of competing with Declude, though both are of course stronger as a result of working together. It would be good for Declude to offer a gateway solution of some sort or find a partner to do so. Matt Sanford Whiteman wrote: I can't believe what is apparently permissible on this list. Has no one realized that this product is a commercial competitor to IMail or SmarterMail, with no relevance to Declude? Don't try that mail is stopped before Declude has to deal with it attempt at association. It is what it is. A separate, commercial anti-spam gateway with no integral link to the now-struggling Declude. At least Len Conrad's free cookbook for IMGate has the exact same features as the one he charges $500 to install. That's always been the redeeming quality of his plugging model. Guess the game has changed. For everyone who's silently letting this go: how'd you feel if Vamsoft started advertising here? Do you think there aren't other people on the list who've kept quiet about similar products and services? --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa d/rel ease/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re lease/ --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ANN: SMTP Gateway
Hi Everyone, A couple of weeks ago I posted a message regarding our SMTP Gateway. Several users responded and have been using the beta version with no major issues. I appreciate the responses. We now have the Alligate SMTP Gateway available for evaluation for anyone that is interested. We could also use another beta tester or two, preferably someone who uses multiple or backup mail servers. We have decided to make a FREE version available as well. It is limited to a single destination server and a maximum of 5 concurrent connections. For simple installations supporting a single mail server and doing less than 10,000 messages per day, the free (Standard) version may be all you need and there is no cost whatsoever. The Alligate SMTP Gateway has numerous features to help with spam prevention that can be applied at the SMTP level before it ever gets to your mail server and Declude. If you use this with MXRate, and employ the tarpitting and/or blocking options, you can reduce spam volume by 60%+ immediately. We now have an informational page andon-line help with screenshots, so we would like to invite you to check it out. The screenshots and help topics will give you a good idea of its' capabilities. We will also be adding more technical details over the next couple of weeks, including information for programmers who may be interested in incorporating third party external anti-spam and virus programs. Main info page: http://www.alligate.com/smtpgateway.htm Help and Screenshots: http://www.alligate.com/help/Default.htm Thanks, Brian Milburn Solid Oak Software
[Declude.JunkMail] Whitelisting email address
I have a customer who wants to receive all emails without having declude check them for spam. My question, is can this be done? And then can it be done so that if a message comes in and it is a message that contains their email address and several other email address on our domain, that it can only be sent to their address prior to the spam checks? I hope this makes sense. Thanks in advance, Brian T. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting email address
Irecall that happening with IMail as well. That is why I was wondering if I did something wrong before. Brian - Original Message - From: Shayne Embry To: Declude.JunkMail@declude.com Sent: Tuesday, January 17, 2006 1:12 PM Subject: Re: [Declude.JunkMail] Whitelisting email address We have found that if one of the addresses is whitelisted, then every recipient's address gets whitelisted. This may be unique to SmarterMail/Declude. I don't remember having the problem with IMail, but we haven't used it in over a year.Shayne Hi Brian, Yes, this can be done with the Pro version. You can have per-user configurations. You can't not have Declude scan the mail, but you can set this individual's configuration to ignore all test results and deliver the mail. As far as I know, this shouldn't have any affect on other recipients of the email. Dean On 1/17/06, Brian [EMAIL PROTECTED] wrote: I have a customer who wants to receive all emails without having decludecheck them for spam.My question, is can this be done? And then can it be done so that if a message comes in and it is a messagethat contains their email address and several other email address on ourdomain, that it can only be sent to their address prior to the spam checks? I hope this makes sense.Thanks in advance,Brian T.---
Re: [Declude.JunkMail] Whitelisting email address
What are you using for a hold weight and delete weight? Brian - Original Message - From: IS - Systems Eng. (Karl Drugge) To: Declude.JunkMail@declude.com Sent: Tuesday, January 17, 2006 3:17 PM Subject: RE: [Declude.JunkMail] Whitelisting email address I can confirm that. If a single email address is white listed, then all of them get white listed. The solution was a line like this : BYPASSWHITELIST bypasswhitelist 45 6 0 0 If an email was over weight 45, AND it also had 6 or more recipients, than it bypassed the white-listing and checked it normally. I never tried to do it with individual config files.. But that might work, if it didnt affect all the recipients. Karl Drugge -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of BrianSent: Tuesday, January 17, 2006 2:16 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Whitelisting email address Irecall that happening with IMail as well. That is why I was wondering if I did something wrong before. Brian - Original Message - From: Shayne Embry To: Declude.JunkMail@declude.com Sent: Tuesday, January 17, 2006 1:12 PM Subject: Re: [Declude.JunkMail] Whitelisting email address We have found that if one of the addresses is whitelisted, then every recipient's address gets whitelisted. This may be unique to SmarterMail/Declude. I don't remember having the problem with IMail, but we haven't used it in over a year.Shayne Hi Brian, Yes, this can be done with the Pro version. You can have per-user configurations. You can't not have Declude scan the mail, but you can set this individual's configuration to ignore all test results and deliver the mail. As far as I know, this shouldn't have any affect on other recipients of the email. Dean On 1/17/06, Brian [EMAIL PROTECTED] wrote: I have a customer who wants to receive all emails without having decludecheck them for spam.My question, is can this be done? And then can it be done so that if a message comes in and it is a messagethat contains their email address and several other email address on ourdomain, that it can only be sent to their address prior to the spam checks? I hope this makes sense.Thanks in advance,Brian T.--- -- PLEASE NOTE : Florida has a very broad public records law. Most written communications to or from City officials regarding City business are public records available to the public and media upon request. Your E-mail communications may be subject to public disclosure. PLEASE NOTE : Florida has a very broad public records law. Most written communications to or from City officials regarding City business are public records available to the public and media upon request. Your E-mail communications may be subject to public disclosure.
RE: [Declude.JunkMail] OT - SMTP Gateway
Hi Sandy, I apologize if this post offended you. I had no intention of posting anything that might be remotely construed as commercial spam. I used Declude for quite awhile, and still use Declude AV. I have monitored this list for years, not to upsell anything to anyone, but because it is one of the best technical resources on the net for guys that are in the trenches fighting spam every day. Declude users are, by and large, come of the most knowledgeable mail administrators around and the discussions are relevant and timely. For what is worth, there are a few Declude users here that know that anti-spam development is more of a personal crusade for me that a profit making venture. We are probably not even close to breaking even on anti-spam technology development, however I am fortunate in that our CYBERsitter product is profitable enough that I am able to indulge in development projects that are not profitable. You are correct that we published a Declude add-in for awhile, however many of the functions we wanted to get into would have simply been duplications of what Declude already did (and does) well. I withdrew the Declude version primarily because one of my goals was to come up with more of a hands off system and this is definitely not what Declude users are interested in. I made the decision to withdraw the Imail specific version because I specifically did not want to appear that we were trying to poach users from the Declude user base or to try and compete with Declude in any way. I posted the message yesterday because I genuinely thought this may be of some interest to Declude users. We have no desire to compete with Declude, rather we have a mutual desire to help administrators deal with the onslaught of garbage they have to deal with on a daily basis. I also think it is worth noting that we have spent many thousands of dollars developing our MXRate blacklist system. While we do use it for our own customers, we also provided a free IP4R system for public use. It gets about 110,000,000 hits a day and the only place we ever announced the availability of this free, public service was here on the Declude list. So, I can only assume that a large amount of the traffic is from Declude users. We have a new $6000 server devoted just to serving the free MXRate service, plus the ongoing bandwidth and maintenance costs. No one ever asked us to do this, and I simply felt that by doing so I could contribute to the Declude community in this way. Since I own the company, these costs basically come out of my pocket. I am disappointed that you feel my contribution is unworthy. Brian -Original Message- Rather than list everything it does here, I put together a little info page at. . . I fail to see this post as anything but spam. But, IMO, having published a Declude add-in for a while, then going off to make money from your own competing products and not participating in the user community, is not an adequate justification for using this list as a marketing list. Just because you'd _like_ the product to have Declude support doesn't mean that it falls legitimately within the Declude user community. I'm sure plenty of us would like our own commercial products to have Declude support, so we could advertise them to another well-known community. But you know what we need much, much more? A stable Declude 3.x that works. A runtime license validation mechanism that doesn't seem suspiciously tied to the uptime of a single remote server. And so on. What we don't need in the short term is another commercial MTA integration. IMail may still have overall price/performance issues as an MTA, but it's a lot more solid than in the past; SmarterMail was more efficient from the get-go, and the Declude/SmarterTools partnership is (we hope) still in force. Brazenly trying to upsell your MTA so that Barry will build in support for it is pretty insensitive to what Declude needs now. If you'd been listening to the list lately, you'd know this. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/do wnload/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2a liases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2alias es/download/release/ --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http
[Declude.JunkMail] OT - SMTP Gateway
Hi Everyone, Some of you folks know me; we published a Declude add-in for awhile and also publish the MXRate IP4R system that many of you currently use. We are looking for a few beta testers for our SMTP Gateway. It does a lot of cool stuff and runs as a Windows service. It has been a part of our Alligate product for over 3 years, but we are going to make the SMTP Gateway available separately as a stand alone product. Rather than list everything it does here, I put together a little info page at: http://www.alligate.com/gwbeta.htm This is not a beta in the traditional sense. The SMTP gateway is in production usage by many ISPs and has been for over 3 years. What we would like to do is uncover any issues that may arise from using it in a standalone mode. One interesting thing is that it was designed specifically for use with an external spam filtering program. We use a file pair system very similar to Imail's Q and D files and they can be initially saved to a directory for third party processing, then moved to our Queue for delivery. I am hoping that if we can generate some interest from the Declude community, we might see some interest by Barry in providing direct Declude support for our gateway. This would make Declude 100% mail server neutral, and it could be used with any mail server on any platform. It also supports routing to multiple mail servers, so it can easily be used in mixed environments. You would no longer be limited to Imail or Smartermail. We are currently finishing the GUI to control the gateway and then it will be ready for release to beta users. The target date is Jan 10, 2006. Please take a look at the info page above and if there is any interest, please feel free to contact me directly. Thanks Brian Milburn Solid Oak Software --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Nigerian Spam
Anyone have a list of keywords that effectively stops the Nigerianspam emails that you would be willing to share? Thanks, Brian
Re: [Declude.JunkMail] Keyword
Given the fact that these types of tests (keyword, subjectetc) take up processor memory, is there a way to run a scan of the logs and get a list of the keywords that actually tripped the keyword filter, so that you can clean up a keyword list and remove the ones that are not doing anything? Thanks, Brian - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Monday, November 28, 2005 8:53 PM Subject: Re: [Declude.JunkMail] Keyword Richard,That is going to be something that only the logs can tell you when you do things this way, and you would need to be running in Debug mode. The best way to tell what failed is to use a weight for the filter and then set the filter action to WARN, that way it will insert in the headers which line was failed.MattRichard Farris wrote: If I have a text file with all my keywords in it and the log file says KEYWORD HOLD (which it should) How do I know which keyword in the list of hundreds held it? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet" - Original Message - From: John T (Lists) To: Declude.JunkMail@declude.com Sent: Monday, November 28, 2005 7:17 PM Subject: RE: [Declude.JunkMail] Keyword Depends upon how it failed. If by keyword you mean a filter test like my KEYSUBJECT then in the log it will tell you which line of the associated filter file that a match was found. John T eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Richard FarrisSent: Monday, November 28, 2005 5:11 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Keyword If you find your are holding mail because of a keyword, how do you find out which keyword it is? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet
[Declude.JunkMail] Question about Some Spam Tests
I recently came across the following tests and was wondering if anybody else was using these tests? What your thoughts are of these tests? And what kind of results you have received from these tests? The test are as follows: AHBL-RELAYS AHBL-PROXIES AHBL-SOURCES AHBL-PROVISIONAL AHBL-FORMMAIL AHBL-DUL FIVETEN-SPAM FIVETEN-BULK FIVETEN-MULTISTAGE FIVETEN-SPAMSUPPORT FIVETEN-MISC NJABL-DYNABLOCK NJABL-RELAYS NJABL-DUL NJABL-SOURCES NJABL-MULTI NJABL-FORMMAIL NJABL-PROXIES Thank you for your time. Brian Thompson Online Services --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] November 2003 Spam Statistics
Actually what Chris was *supposed* to say was that the gateway version of Alligate does a much better job than the Declude version, not Declude itself. The Declude version is now outdated and had not been updated for several months. The Declude version was not dumped however it is not currently available. We won't offer something for sale unless it is the best we can do. We got in a couple of new copies of IMail last week so we can set up new test platforms. We have been unable to test the Declude version because our gateway now handles all incoming mail and there is no spam coming into our mail servers to test. The new test platforms will allow us to move some domains out of the normal loop and we will be able to update the Declude version again (shortly we hope). Brian On 12/04/03 4:34pm you wrote... I *believe* I spoke to Chris. If it wasn't dump it was drop. I didn't interpret this as negative statement, just friendly marketing or another opinion among many. I don't think Chris intended this as a put down. Just an opinion on a competing product. You'd hardly expect the person answering the sales line to say anything else. What I am certain about was that I was told that Alligate would do a better job (albeit as its own Gateway) than Declude at blocking spam. If I've offended or misunderstood anyone, please feel free to correct me. Thanks, Burzin t 03:51 PM 12/4/2003, you wrote: Was the exact phrase Dump Declude used? If so, who did you speak with? Yes, SpamManager is Alligate is NOXMail. (Original name.) They have made a business decision and I hope them all the luck, as they are doing very well. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] November 2003 Spam Statistics
Here are the stats for Tuesday. Wednesday and Thursday we were testing some things the stats were skewed. This was for our main solidoak.com domain mail server (general business, not tech support). Our tech support server lets more spam through, however we can only do limited header type spam checking because of the type of content the message bodies might contain. People are reporting porno web sites all the time to our CYBERsitter support accounts. For Tuesday, there was 1 false positive (Delivery Req) and 4 spams that got through. So with 5139 incoming connection requests, and 4 spams that got through, it was 99.92% effective. At least for that day ;) Some days we don't get any spam, but on bad days as many as 20 may get by. Rarely does any single user get more than 1. But as you might guess, this level is not much to test with. The first set of stats (Alligate Statistics) are from the filtering module that is similar to the Declude version and will (eventually) be identical. The second set of stats (Alligate SMTP Daily Statistics) is an overall summary of delivery. A lot of spam is stopped at the front door by the SMTP servive using the tarpitting and dictionary attack defense mechanisms among others. Alligate Statistics for: Tue, 02 Dec 2003 Report date: Fri, 05 Dec 2003 01:09pm Incoming Msgs:3173 Outgoing Msgs: 152 Total Msgs:3325 Est Legit Mail: 696 %Inc%Fld --- Adult Msgs: 136 4% 5% Spam Msgs:2492 79% 95% Total Failed:2628 83% Repeat Spammers:1300 41% 49% Banned File Att: 20 1% 1% Viruses: 14 0% 1% Total Deleted:2208 70% 84% Total Held: 420 13% 16% Msgs Passed: 160 5% Msgs Ignored: 536 16% Delivery Req: 1 0% Avg Spam Score: 56 Avg Adult Score: 36 Avg Exit Score: 57 Avg Proc Time: 48 milliseconds. Alligate SMTP Daily Statistics for: 12/2/2003 Incoming connections: 5139 Valid Recipients: 4106 Invalid Recipients: 1361 Messages delivered: 701 Spammers tarpitted: 557 Tarpit client disconnects: 64 Connections per minute: 3 Deliveries per minute: 0 Overall delivery rate: 14% Overall rejection rate: 86% On 12/05/03 2:56pm you wrote... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, December 05, 2003 2:18 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] November 2003 Spam Statistics snip our gateway now handles all incoming mail and there is no spam coming into our mail servers to test. The new test platforms will allow us to move some domains /snip So are you saying your product when used as a gateway is 100% effective at removing spam? Nothing slips through Darrell --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Server Gone Wild
This is Brian Thompson with an update: Mail server appears to be back up and running. Thanks for all the help. Still don't know what the problem was, but my declude log shows no entries from 4:23 pm until 11:58 pm. - Original Message - From: Glen Harvy [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, December 03, 2003 1:24 AM Subject: RE: [Declude.JunkMail] Server Gone Wild Give him a ring and tell him to uninstall declude. Only takes a second or two. I'd ring him but it would be a very very expensive call :-) _ Glen Harvy Aquarius Communications for all your Internet Needs. Phone 9977 3788 Fax 9977 3844 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Richard Farris Sent: Wednesday, 3 December 2003 17:06 To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Server Gone Wild A friend of mine at Safe-t.net in Mt. Vernon Ohio just called me and said his spool in Imail is loading up and holding all messages..He thinks the Declude has stopped working...Imail tech support not available.. He has rebooted the server several times with no luck.. Declude log is not showing anything... If anyone on this list has an idea what is going on could you please give Brian Thompson a call at 1.888.895.8648 He can't use email as it just goes to the spool and sits Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude behind a Firewall
Ok, here you go... discounts are only available on multiple server installations. Single server installations are always the same price for everyone. You can download the latest version of Alligate anytime at: http://www.alligate.com/downloads.asp Here are your Alligate activation codes: LICENSE: 98B17332995AA601 KEY: 94B9A54A6BB58CB1 Your license will expire on: 12/5/2003 This product is licensed for use on IP address: 65.123.51.1 Your license type is: Alligate 1 Domain For questions or support, please contact [EMAIL PROTECTED] On 11/05/03 5:14pm you wrote... Hi. My company recently set up a firewall which we put all our servers behind, including our mail server running declude. As soon as we did this, declude stopped working. From what I understood in the log, it looked like declude wasn't able to get out and check spam databases. There were a lot of lines in the log that looked like this: TEST 08 - SPAM COP didn't get a response I assume the firewall is blocking declude. Anybody have an idea of how to allow it access? Is there a certain port I have to open up for declude to get out? Or maybe do I have to set up declude to use a proxy? Thanks, jim --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Alligate
This is correct. We stopped offering the IMail specific (non Declude) version of Alligate a couple of months ago. We have also suspended free trials of the Declude add-in until we can bring it up to date so that the same detection methods are used by both the Declude version and our gateway version. We are currently spending too much time maintaining conditional pattern files mainly for about 8 or 10 registered Declude version users. There is not really that much interest in this as a Declude test it seems... lots of free trials, but very few sales. We have far more invested in free trial tech support than the revenue this has generated. The Declude version of Alligate is now lacking about 50% if the refinements and enhancements that we have incorporated into the gateway version. Until we can bring the code up to date, it just doesn't make sense to continue to offer free trials and provide free tech support until we are working with the same code base for both versions of the product. Brian Milburn Solid Oak Software On 10/10/2003 12:20pm you wrote... FYI -Original Message- From: Brian Milburn [mailto:[EMAIL PROTECTED] Sent: Friday, October 10, 2003 12:05 PM To: [EMAIL PROTECTED] Subject: Re: Alligate Information Request Hi, Thanks for your interest in Alligate for IMail. We have decided we are no longer going to offer an IMail specific version. The Declude Add-in is not currently being offered, however should be available again shortly, probably within a couple of weeks. It is in need of a major update to bring it up to the same level that our gateway product is. I would also invite you to look over the documentation for our gateway version. The gateway version of Alligate requires a dedicated computer, however it is significantly more powerful than any IMail version and greatly reduces the load on your mail server. Additionally, the gateway version has integrated email vulnerability detection which eliminates virtually all viruses and other email based dangers before they ever get to your mail server. The link for the gateway documentation is: http://www.getalligate.com Thanks again, Brian Milburn Solid Oak Software Sincerely, William J. Baumbach II [EMAIL PROTECTED] 9975 Pennsylvania Ave. Manassas, Va. 20110-2028 Ph: 703-367-7900 ext:1708 Fax: 703-691-0946 - [ scanned for spam to: [EMAIL PROTECTED] outgoing http://www.DcMetroNet.com on 10/10/2003 at 12:21:21-0500et. ] This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution of this email is prohibited. If you are not the intended recipient, please contact the sender and destroy all paper and electronic copies of this message. [ scanned for viruses to: [EMAIL PROTECTED] outgoing http://www.DcMetroNet.com on 10/10/2003 at 12:21:25-0500et. ] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Header question: X-Accutrak:
I haven't seen any spam. Walmart uses this for their newsletters, don't know about others. We negative weight this already. Brian On 09/12/03 10:10am you wrote... When ever I see this in the header, it is associated with a legit newsletter. Any one see the same, or see spam with this header? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SMTP Relay Limit
Look at http://www.alligate.com On 09/10/03 3:20pm you wrote... Should have been more specific, I'm looking for something used by larger ISPs that gives me the confidence of volume and stability. Something attached to a name and a phone number I can call when there's a problem. I don't mind paying for it. Top 2 or 3 names? Thanks, Dan On Wednesday, September 10, 2003 13:15, Charles Frolick [EMAIL PROTECTED] wrote: I like Xmail server (http://www.xmailserver.org), it is multi platform and can easily do what you want. Thanks, Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Patnode Sent: Wednesday, September 10, 2003 2:34 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SMTP Relay Limit I'm running Declude as a gateway for various IPs and just hit a limit. Under Addresses specified here are to be considered local addresses for mail gatewaying Adding entries to Access Control under SMTP, the 100th entry produces an error: Maximum table size reached So now, no more clients can be added because I can't relay their mail. Ipswitch says its hard coded across all versions and a fix is months away, if they agree to do it. What I'm thinking is sending all mail to a down stream server that doesn't have this limit that would in turn forward to clients. This leaves two questions: 1) What's the best email server software to do this with, providing both unlimited relay IPs and easy text editing of the delivery list (Linux, Windows, Mac)? 2) What's the best way to deliver from Imail to this server? The obvious is to add this same IP to every domain listed in the hosts file, but would it be better to use Gateway Option, Send all remote mail through gateway Any comments/insights would be appreciated. Thanks! Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: RE: [Declude.JunkMail] OSRELAY question.
Hi, Thanks for your interest in Alligate. We recommend that you first look over the product documentation so that you will have a good understanding of Alligate's capabilities and installation requirements. The documentation can be downloaded at the following address: http://www.alligate.com/downloads.asp Of particular interest to you would probably be the initial sections on setup and operation. There is a considerable amount of detail on customizing, however it will be extremely efficient with no customization whatsoever. Please take a few minutes and peruse the documentation, and if this sounds like it will do the job for you, please lets us know and we will mail temporary license codes to you for evaluation. We will be happy to supply you with a free 30 day license so that you can evaluate the product. In order to generate the license and key codes for you we will need to know the IP address for the computer you will be using to test Alligate. We will also need to know the number of domains you will be processing. These are both used in license key generation. Pricing is determined by the number of domains your are receiving mail for. Licensing costs are available at http://www.alligate.com/pricing.htm Thanks again, Brian Milburn Solid Oak Software --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Alligate vs. Message Sniffer...opinions?
Hi Matt, I guess I'll chime in here... On 08/20/03 10:31pm you wrote... I just joined the list today, but I found your configuration file from back in June and it was very helpful in understanding how to fine tune Alligate. I'm going to study it's logs more closely before I start that phase though, looking for false positives. I've turned that test down to 3/10 of failure and reduced several other tests by 1/10 to 2/10 of failure in order to accommodate it (BADHEADERS for instance). It seems to get most of it's scoring from technical-type stuff instead of the heuristics, and if this is the case, I don't think that a scaled test would be that much more useful to me. If I could score the content and obfuscation, and just those things, I wouldn't be double counting the technicals, and that should reduce some false positives. You are correct that Alligate will accumulate scores on many of the same things as Declude will. This is basically the same engine as we use on the gateway product, but it is 100% stand alone so it must do everything. The technical violations are some of the best spam indicators there are, however, you are racking up double scores. You can rely more on the heuristics by decreasing the values of certain Alligate tests or setting them to 0 (zero). Most of the hard penalty tests support this, as well as most of the heuristic tests where the score is variable depending on the degree of failure. I don't want to knock Alligate, it has some nice functionality, especially when used without Declude (auto whitelisting and digest notification), and it does what it says, but it has a relatively high false positive rate in the default configuration and therefore it can't be scored higher than it is on my scale. If they could get the auto whitelisting and digest notification to work with Declude, that might make me a buyer. I'm still looking for more information on Message Sniffer within this context. The full IMail version does everything and will work in Declude as well. But it costs more. Many Declude version users wanted scaled down, more affordable Declude test only version, so that's we we did. Alligate really depends on training to achieve the best results. This involves automatic whitelisting and users responses to digests. Unfortunately, using it as a test in Declude limits it's full functionality, however properly adjusted, it will still provide several features that don't exist in any other product. You just need to figure out what features are important to your flow, and which aren't and adjust the configuration accordingly. In our gateway version the false positive rate is usually in the area of 1 in 3000 messages after about 30 days of training. In the gateway version this is all done without administrator intervention, but the same results should be possible in the Declude version, except you have to do the training. And, you save lots of money :) You will find this list to be extremely helpful. As I am sure Scott would agree, there are people here that know the products almost better than we do ourselves. They have this down to a fine science, and the advice you can get here will help you get the most for the least. Most Declude users I have worked with are hands on people and know their business. Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blocking attachments
Here's 2... MESSAGE.ZIP YOUR_DETAILS.ZIP Although they are really viruses. On 8/19/2003 12:30pm you wrote... Just double checking, but we do NOT have a way to block specific attachments in Declude JM Pro, correct ? Correct (because we're not yet aware of spammers that are attaching files that should be blocked). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Report System
Me too. Brian T. - Original Message - From: Russ Uhte (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Friday, August 01, 2003 9:45 AM Subject: RE: [Declude.JunkMail] Report System If you would like to try it out let me know and I will make it available.. I'll jump on the bandwagon. I'd love to try that out as well. -Russ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] New spamcop style RBL..
Why don't you guys give it a rest. On 07/27/03 8:53pm you wrote... - Original Message - From: Smart Business Lists [EMAIL PROTECTED] To: Joshua Levitsky [EMAIL PROTECTED] Sent: Sunday, July 27, 2003 8:26 PM Subject: Re: [Declude.JunkMail] New spamcop style RBL.. Sunday, July 27, 2003 you wrote: JL I'm not trying to make this an argument. That's funny. It's snappy remarks like that which make a person not want to even offer any help. I never initiated any personal attacks. Your remark won't make me start doing so on this thread. I honestly wasn't trying to argue anything. I was trying to make points, and others were making points. I felt that some points were not entirely truthful so I made notes. None of my notes were nasty like yours. -Josh --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Postage
Yep, we did too. A couple of them. Can't wait to sign up for this one ;-) On 07/08/03 1:17am you wrote... Anyone else get this?: =Dear Sir/Madam I would like to inquire if you would be interested in incorporating email postage support to your product. It will allow your customers to enforce payment for emails that are not on their white list, or have a certain level of spam ranking. If you are, please contact me and I will be happy to talk to you about our technology and how we can partner to provide you the tools to implement these tested technology. Best regards, = Looks like a payment company looking to branch out Dan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Tar Pitting
Alligate does it :) (The gateway version anyway) On 06/18/03 3:25pm you wrote... It would be less, assuming that IMail can handle it (and that your firewall can do the tarpitting). I'm not aware of any firewalls that can do true SMTP tarpitting (which requires sending short bits of data occasionally to prevent timeouts), but you could simulate it with throttling. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Tar Pitting
I had one customer that told me that he had over 5000 simultaneous open connections with no problems and a large number of these were being tarpitted. I have seen postings in newsgroups that claim to have had 7000 open connections on Win2k Pro. I have not yet been able to determine a hard number for this and don't have enough machines here to create that many connections. We have been able to get up to about 1200 or so. Brian On 06/18/03 3:39pm you wrote... I find the idea intriguing as well but if you start to slow down connections wouldnt that just hold TCP connections open longer possibly making fewer connections available on the server? One of the methods of thwarting file sharing sites is to trickle download many files so that others cannot make connections, would this not have the same affect as tar pitting spammers? Especially since the pro spammers send the same spam run through many different servers. Just thinking outloud. Rick Davidson Buckeye Internet Inc www.buckeyeweb.com 440-953-1900 ext: 222 - Original Message - From: Dan Patnode [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 18, 2003 3:16 PM Subject: Re: [Declude.JunkMail] Tar Pitting I'm intrigued by this idea. During a given minute of time I may get 1000 messages. 1/4 of them are slown down (occupying more SMTP/Declude sessions), but the burdon is spread out. Can this be applied to increase server capacity? If I throttle, at the firewall, the IPs of spammers, will the load on my server be less? Has anyone tried this on a maxed out server? Dan On Sunday, June 15, 2003 16:01, Rifat Levis [EMAIL PROTECTED] wrote: People intersted in tarpitting and Declude firewall integration can read this. I just finished the tarpitting protection for my IMAIL server I am sending logs to the kiwi syslog server and forwarding it to SQL to analyse data When in a 2 min period a single ip send mail to more than 5 unknown account I am blocking the ip address on my netscreen firewall for 1 hour. The next step of this is to integrate Declude to the firewall I have 3 weight weight 10 warn weight 15 warn weight 20 delete Instead of deleting weight 20 i will forward it to an account to send data to SQL analyse it and then block it for 1 hour . NOTE : I am sure that KAMI will be interested :) Best Regards Rifat Levis --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Tar Pitting
Hi Bill, We were testing Alligate at a sustained rate of 8 message per second, relaying to 4 servers, all with different email server software. We ran this test for 4 hours. One was running IMail with Declude, SpamManager, and Declude Virus. Each server was receiving 2 messages per second, or 7200 per hour. The IMail server (as configured) was the second slowest. It was ~3000 messages behind after the first hour, and had to reboot 2 or 3 times as I recall during the test. It about 3 hours to recover after we stopped sending mail for Alligate to deliver the balance to the IMail server. The only one that could handle the load was a Postfix server, and it even fell behind about 200-300 messages. The messages we were sending were made up of 25% ~2k, 25% ~10k, 25% ~25k and 25% had a 100k EXE attachment. Because IMail was the only one running virus checking and secondary spam scanning, it is probably not a fair comparison, however weren't really trying to benchmark the servers, only our product. We were able to deliver all messages successfully to the IMail server despite the reboots and problems, and that was more the point of the test. Brian On 06/18/03 3:37pm you wrote... and send mail only at the speed that IMail can handle I'm curious, what rate did you find Imail capable of handling before it stopped responding? Bill -Original Message- From: [EMAIL PROTECTED] Sent: Wed, 18 Jun 2003 13:36:44 -0700 Subject: Re: [Declude.JunkMail] Tar Pitting Alligate for example, and I am sure most other gateways should level this out for you anyway, and I don't think tarpitting would make a whole lot of difference. When we are forwarding to IMail, we set the forwarding threads fairly conservatively, and send mail only at the speed that IMail can handle it. It is spooled and send at a constant rate. I have seen the queue get backed up during heavy periods, and then clear up when the load lightens. We crashed IMail (sent processor load to 100%) a couple of times during testing by sending it too much mail and it simply stopped responding. Tarpitting is more to discourage spammers from sending to your server (hopefully) and to reduce their output. We have seen a lot of them time out after 30 seconds. Some of these are home made spam blaster programs that are single threaded, do their own MX resolution, and can only send out messages one at a time. It really puts the hurt on them when it takes 5-10 minutes to send one message, so they tend to put timeouts in them and disconnect. Brian On 06/18/03 1:08pm you wrote... Rick, Makes me wonder if spammers cause traffic surges/spikes that slow our servers down and if this would also smooth those spikes down. Suppose a given sending server had 100 copies of a particular message, running only 5 sessions (speculation) at a time, could the sessions be dragged into off peak hours. If the firewall (or Alligator) could be configured to open the flood gates between midnight and 5am, the cues would be empty by the next morning. Dan On Wednesday, June 18, 2003 12:39, Rick Davidson [EMAIL PROTECTED] wrote: I find the idea intriguing as well but if you start to slow down connections wouldnt that just hold TCP connections open longer possibly making fewer connections available on the server? One of the methods of thwarting file sharing sites is to trickle download many files so that others cannot make connections, would this not have the same affect as tar pitting spammers? Especially since the pro spammers send the same spam run through many different servers. Just thinking outloud. Rick Davidson Buckeye Internet Inc www.buckeyeweb.com 440-953-1900 ext: 222 - Original Message - From: Dan Patnode [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 18, 2003 3:16 PM Subject: Re: [Declude.JunkMail] Tar Pitting I'm intrigued by this idea. During a given minute of time I may get 1000 messages. 1/4 of them are slown down (occupying more SMTP/Declude sessions), but the burdon is spread out. Can this be applied to increase server capacity? If I throttle, at the firewall, the IPs of spammers, will the load on my server be less? Has anyone tried this on a maxed out server? Dan On Sunday, June 15, 2003 16:01, Rifat Levis [EMAIL PROTECTED] wrote: People intersted in tarpitting and Declude firewall integration can read this. I just finished the tarpitting protection for my IMAIL server I am sending logs to the kiwi syslog server and forwarding it to SQL to analyse data When in a 2 min period a single ip send mail to more than 5 unknown account I am blocking the ip address on my netscreen firewall for 1 hour. The next step of this is to integrate Declude to the firewall I have 3 weight weight 10 warn weight 15 warn weight 20 delete Instead of deleting weight 20 i will forward it to an account to send data to SQL analyse it and then block it for 1 hour . NOTE : I am sure that KAMI will be interested :) Best Regards Rifat Levis
[Declude.JunkMail] OT - Challenge/Response Systems
Here is something for your weekend list of things to ponder... I heard from a potential customer (small ISP) yesterday that tried a Challenge/Response system for 4 hours. Here is what happened (as best as I can explain it). He implements the Challenge/Response system. A few of his users send emails to others whose ISPs are also using a (presumably different) Challenge/Response system. The remote systems receive the messages his users sent, and send out Challenge messages. His server received the Challenge messages and it sent out Challenge messages of its own back to the address on remote server that sent the Challenge message. No human ever sees any of the messages. This is bad enough, but it also works in reverse, and this is how he found about the problem. Users of some remote system using Challenge/Response send his users messages and his system generates Challenge messages. The remote server receives the Challenge messages and sends new Challenge messages back to his server. His server sends back bounce messages because his Challenge messages were sent from a no-reply account. Then his server receives Challenge messages to the bounce messages and generates bounce messages of it's own. He notices that there are several hundred Challenge and bounce messages going both ways repeatedly after a few hours, and he has to shut it down and kill the reply accounts to stop the loop. Don't know if it actually stopped any spam ;) Brian --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamManager question
Hi Fred, Canned message follows... Thanks for your interest in Alligate for IMail. We recommend that you first look over the product documentation so that you will have a good understanding of Alligate's capabilities and installation options. The documentation can be downloaded at the following address: http://www.alligate.com/imail/downloads.asp We will be happy to supply you with a free 30 day license so that you can evaluate the product. In order to generate the license and key codes for you we will need to know the IP address for the computer you will be using to test Alligate. For the IMail stand alone version, pricing is determined by the number of users your are receiving mail for. For the Declude version, it is a flat fee for unlimited use. Licensing costs are available at http://www.alligate.com/imail/pricing.htm Thanks again, Brian Milburn Solid Oak Software On 06/11/03 5:46pm you wrote... Hi Fred, Sure, I'll be posting a message here, probably tomorrow. Brian On 06/11/03 8:07pm you wrote... Brian let me know when you are ready, I would like to try it. Thanks. Fred [EMAIL PROTECTED] - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 11, 2003 7:25 PM Subject: RE: [Declude.JunkMail] SpamManager question It's going to be a whole lot better here in a day or two. I've incorporated all the new stuff we put into the Alligate Gateway into the version for Declude. There is HTML density testing, compression testing, repeat spammer tracking, foolproof obfuscation detection and removal, and a lot more. There are also better pattern file features such as word proximity checking where words can be check to see if they are within x number if characters of each other. This is useful for stuff like checking to see if the characters XXX are within 20 characters of http://; for instance. It is also useful for giving negative weights to pattern matches that have words like Shipping Tax and Total within say 120 characters of each other indicating it is probably a receipt or invoice for something. Brian On 06/11/03 4:06pm you wrote... Short answer, I love it. I have been using it since it was first out in beta. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Wednesday, June 11, 2003 2:31 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spammanager question We have the sniffer product and it works great, we wanted to also introduce a second content application, i.e. spammanager, but I wanted to see how well it was doing in the field via testimonies. Thanks for the aid. ___ Keith Johnson Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] Good pings come in small packets --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamManager question
It's going to be a whole lot better here in a day or two. I've incorporated all the new stuff we put into the Alligate Gateway into the version for Declude. There is HTML density testing, compression testing, repeat spammer tracking, foolproof obfuscation detection and removal, and a lot more. There are also better pattern file features such as word proximity checking where words can be check to see if they are within x number if characters of each other. This is useful for stuff like checking to see if the characters XXX are within 20 characters of http://; for instance. It is also useful for giving negative weights to pattern matches that have words like Shipping Tax and Total within say 120 characters of each other indicating it is probably a receipt or invoice for something. Brian On 06/11/03 4:06pm you wrote... Short answer, I love it. I have been using it since it was first out in beta. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Wednesday, June 11, 2003 2:31 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spammanager question We have the sniffer product and it works great, we wanted to also introduce a second content application, i.e. spammanager, but I wanted to see how well it was doing in the field via testimonies. Thanks for the aid. ___ Keith Johnson Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] Good pings come in small packets --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SpamManager question
Hi Fred, Sure, I'll be posting a message here, probably tomorrow. Brian On 06/11/03 8:07pm you wrote... Brian let me know when you are ready, I would like to try it. Thanks. Fred [EMAIL PROTECTED] - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, June 11, 2003 7:25 PM Subject: RE: [Declude.JunkMail] SpamManager question It's going to be a whole lot better here in a day or two. I've incorporated all the new stuff we put into the Alligate Gateway into the version for Declude. There is HTML density testing, compression testing, repeat spammer tracking, foolproof obfuscation detection and removal, and a lot more. There are also better pattern file features such as word proximity checking where words can be check to see if they are within x number if characters of each other. This is useful for stuff like checking to see if the characters XXX are within 20 characters of http://; for instance. It is also useful for giving negative weights to pattern matches that have words like Shipping Tax and Total within say 120 characters of each other indicating it is probably a receipt or invoice for something. Brian On 06/11/03 4:06pm you wrote... Short answer, I love it. I have been using it since it was first out in beta. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson Sent: Wednesday, June 11, 2003 2:31 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spammanager question We have the sniffer product and it works great, we wanted to also introduce a second content application, i.e. spammanager, but I wanted to see how well it was doing in the field via testimonies. Thanks for the aid. ___ Keith Johnson Network Engineer Network Advocates, Inc. Tel: 502.412.1050 Fax: 502.412.1058 Email: [EMAIL PROTECTED] Good pings come in small packets --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Recent Message From Declude.JunkMail-owner@declude.com?
Me too. On 06/06/03 11:39am you wrote... I received something weird. It was like the headers only. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Friday, June 06, 2003 11:16 AM To: Declude JunkMail Subject: [Declude.JunkMail] Recent Message From Declude.JunkMail- [EMAIL PROTECTED] Hello, All, A little less than 1/2 hour I received a message in my inbox which purported to be from Declude.com. Here is the full message (the 's are mine)... Received: from declude.com [66.189.124.29] by NexusTechGroup.com with ESMTP (SMTPD32-6.06) id A33F67FC0114; Fri, 06 Jun 2003 13:45:35 -0400 X-Declude-Sender: [EMAIL PROTECTED] [66.189.124.29] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: BADHEADERS [5] == This E-mail is scanned and free from viruses. www.nexustechgroup.com X-RCPT-TO: [EMAIL PROTECTED] Date: Fri, 6 Jun 2003 13:45:42 -0400 X-UIDL: 354754410 Status: U From: [EMAIL PROTECTED] As you can see there's not much to it. Did anyone else receive this message? Was this message actually sent from Declude? Or was it a misfire in an impending attempt to use the good name of Declude.com to slip through people's spam filtering? Just curious. It seemed like a very odd message to me. Thanks, Much! Dan Geiser [EMAIL PROTECTED] == This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] observation to share...
Yep, now that I think about it, I think you did. That was a few days ago, a lot of brain cells must have evaporated since then ;) On 05/27/03 7:59pm you wrote... Scott, does IMail do it's ip4r checking after the whole message is received and the connection terminated or does check on the HELO/EHLO and send an error code back to the remote server? Hey, didn't I already answer this? :) -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hijack Not Working ?
I've made the changes, but did not make the registry change. I'll let you guys know what happens. In regards to the web messaging possible trap, Do I really need to up the limits for hijack? It's always been my understanding that web messaging shouldn't send out as much email as frequently than an email client (Outlook, etc.) Thoughts? Thanks. b -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Thursday, March 27, 2003 10:20 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Hijack Not Working ? Importance: High Wait, the DAISYCHAIN option has a big effect on any one hosting lots of users using Web Mail. Anyone thinking about this needs to consider the following: If you have 1000 users using web mail, it is very likely that just normal usage of those users will trigger the hold values. If you are going to do this, you will have to adjust the values upwards significantly so as not to trap normal usage. Correct, or am I off my rocker? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
I've made the changes below, but the SMTP service on Imail wouldn't start back up. b -Original Message- From: Sanford Whiteman [mailto:[EMAIL PROTECTED] Sent: Thursday, March 27, 2003 2:06 AM To: Brian Cunningham Subject: Re: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ? I made these changes and restarted services. But then I stopped receiving emails. Try implementing the DAISYCHAIN function as follows: (a) COPY SMTP32.EXE to SMTP32.EXB (this step just for backup) (b) RENAME SMTP32.EXE to IPSMTP32.EXE (c) COPY DECLUDE.EXE to SMTP32.EXE (d) Add the DAISYCHAIN directive as described earlier In other words, do *not* make the Registry change, nor rename DECLUDE.EXE. I do not believe these steps were part of the standard procedure (and I was the person who originally suggested DAISYCHAIN, so I do have lots of experience implementing it). -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
Should I be using the SMTP32.exe or the SMTPd32.exe for this process? Thanks. b -Original Message- From: Sanford Whiteman [mailto:[EMAIL PROTECTED] Sent: Thursday, March 27, 2003 2:06 AM To: Brian Cunningham Subject: Re: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ? I made these changes and restarted services. But then I stopped receiving emails. Try implementing the DAISYCHAIN function as follows: (a) COPY SMTP32.EXE to SMTP32.EXB (this step just for backup) (b) RENAME SMTP32.EXE to IPSMTP32.EXE (c) COPY DECLUDE.EXE to SMTP32.EXE (d) Add the DAISYCHAIN directive as described earlier In other words, do *not* make the Registry change, nor rename DECLUDE.EXE. I do not believe these steps were part of the standard procedure (and I was the person who originally suggested DAISYCHAIN, so I do have lots of experience implementing it). -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Year 2020
I had a program that checked a time server every day to keep the time accurate. On more than one occasion I saw the date get changed to the year 2020 and the year 4040. I don't use time server programs any more. On 03/27/03 12:09pm you wrote... I have seen random date changes when the battery that powers the RTC (Real Time Clock) on the MB goes bad.. However, I have only seen this in really old computers. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Karl Hentschel Sent: Thursday, March 27, 2003 11:46 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Year 2020 I don't know if this is the right place for this question, but I'm looking for some feedback. The date has randomly changed to the year 2020 on our mail server. This has happened twice now. Has anybody ever heard of this happening before and what might cause it? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] HiJack Not Working ?
Really dumb questions? Is the syntax of renamed files case sensitive? Does the Daisychain call go within the hijack.cfg file or another config file? Does the Daisychain call need quotes or simply just a call out? Sorry for the dumb questions, but these spammers keep creating new accounts (found another one this morning). We're killing their IP's, but they keep coming in from other systems. I would be awesome if I could get hijack to work with web messaging. Sandy, do you have this config working on your Imail system? If so, what version of Imail are you running? Thanks again. b -Original Message- From: Sanford Whiteman [mailto:[EMAIL PROTECTED] Sent: Thursday, March 27, 2003 2:06 AM To: Brian Cunningham Subject: Re: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ? I made these changes and restarted services. But then I stopped receiving emails. Try implementing the DAISYCHAIN function as follows: (a) COPY SMTP32.EXE to SMTP32.EXB (this step just for backup) (b) RENAME SMTP32.EXE to IPSMTP32.EXE (c) COPY DECLUDE.EXE to SMTP32.EXE (d) Add the DAISYCHAIN directive as described earlier In other words, do *not* make the Registry change, nor rename DECLUDE.EXE. I do not believe these steps were part of the standard procedure (and I was the person who originally suggested DAISYCHAIN, so I do have lots of experience implementing it). -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hijack Not Working ?
I gotcha. That could be a problem. We do have about 5000 + web mail users. Could this explain why when I make the changes email stops being delivered? I've checked the hold(s) and there is nothing being held, but maybe the processing is delaying delivery? b -Original Message- From: John Tolmachoff [mailto:[EMAIL PROTECTED] Sent: Thursday, March 27, 2003 11:23 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Hijack Not Working ? In regards to the web messaging possible trap, Do I really need to up the limits for hijack? It's always been my understanding that web messaging shouldn't send out as much email as frequently than an email client (Outlook, etc.) It depends on how many Web Mail users you have. If you are an ISP with 5000 Web Mail users, it is quite possible for 100 of those to send 1 message each with a 30 minute time period, there by tripping hold 2 and effectively black listing the server IP address. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
SPAMCOP:RE: [Declude.JunkMail] HiJack Not Working ?
Gotcha. I've been using SMTP32.exe (not the daemon). I just wanted to check because every time I make the change it stops delivery (even after I roll the SMTP service within Imail, which does start up successfully). b -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Thu, 27 Mar 2003 12:32:39 -0500 Should I be using the SMTP32.exe or the SMTPd32.exe for this process? It *must* be SMTP32.exe (SMTPd32.exe is the SMTP Daemon, the service which accepts incoming E-mail, as opposed to the process that delivers the E-mail). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] HiJack Not Working ?
I've checked, and the Hijack is registered. The config is set to: RELAYTHRESHOLD1 10 20 RELAYTHRESHOLD2 30 60 And the log files have not held anything today. Everything went through as OK with juat a couple not local users. But I see that [EMAIL PROTECTED] now has about 300 outgoing spam messages in the queue. Help! Thanks. b -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 26, 2003 5:58 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] HiJack Not Working ? We've got a locked down public Imail server where anyone can register for a free email, but all users have to authenticate before relaying mail. We've also got Declude with HiJack in order to stop spammers from using our system But somehow we've got registered users sending hundreds of messages through us and bypassing HiJack. Why isn't the email being trapped by HiJack? The first thing to do is make sure that Declude Hijack is running (you can type \IMail\Declude -diag, *without* making any changes, and you should see a line Declude Hijack Status: Registered). Next, you would want to check your \IMail\Declude\hijack.cfg file to make sure that the settings are reasonable (the default settings are RELAYTHRESHOLD1 10 20 and RELAYTHRESHOLD230 80, which allow up to 80 E-mails to be sent within 30 minutes). Finally, you would check the Declude Hijack log file to see what it says about the E-mails. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
SPAMCOP:RE: [Declude.JunkMail] HiJack Not Working ?
Thanks Scott. I've emailed you the file. We do have a few ALLOWIP's, but I they are for IP's we own. I checked the W log files and it looks like they are coming in through web messaging (god knows how they are sending that much email through web messaging) under several IP's ranging from Nigeria to Israel. I blocked those IP's within Imail Control Access. How can I make Hijack work with webmessaging? b -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 18:10:23 -0500 And the log files have not held anything today. Everything went through as OK with juat a couple not local users. Note that Declude Hijack allows unlimited E-mail to local users, and doesn't count that towards a user's quota. But I see that [EMAIL PROTECTED] now has about 300 outgoing spam messages in the queue. Do you have any ALLOWIP lines in your hijack.cfg file? Is the user sending these E-mails via SMTP, or web messaging (which would not be scanned by default)? Could you E-mail me the log file (off-list to [EMAIL PROTECTED])? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
I've got you up until the DAISYCHAIN ipsmtp.exe point. Do you want me to rename the two files and then add the daisychain line above to the config file of hijack? Thanks. b -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 19:19:28 -0500 I checked the W log files and it looks like they are coming in through web messaging (god knows how they are sending that much email through web messaging) under several IP's ranging from Nigeria to Israel. I blocked those IP's within Imail Control Access. Ah, that explains what is going on. That's the first time I've seen serious spammers try to send E-mail through web messaging. How can I make Hijack work with webmessaging? It is possible to do this, by having the declude.exe file act as the smtp32.exe file, so that Declude can intercept the web messaging E-mail. This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the declude.exe file to smtp32.exe, using a DAISYCHAIN ipsmtp.exe line in the hijack.cfg file. Then, you need to use regedit to change the HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point to smtp32.exe instead of declude.com, and finally stop/restart the IMail SMTP service so that IMail will recognize the change -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
Will renaming declude.exe to smtp32.exe cause problems with junkmail or virus? Do I need to rename or make a copy of declude.exe as renamed? b -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 19:19:28 -0500 I checked the W log files and it looks like they are coming in through web messaging (god knows how they are sending that much email through web messaging) under several IP's ranging from Nigeria to Israel. I blocked those IP's within Imail Control Access. Ah, that explains what is going on. That's the first time I've seen serious spammers try to send E-mail through web messaging. How can I make Hijack work with webmessaging? It is possible to do this, by having the declude.exe file act as the smtp32.exe file, so that Declude can intercept the web messaging E-mail. This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the declude.exe file to smtp32.exe, using a DAISYCHAIN ipsmtp.exe line in the hijack.cfg file. Then, you need to use regedit to change the HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point to smtp32.exe instead of declude.com, and finally stop/restart the IMail SMTP service so that IMail will recognize the change -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
Scott, I made these changes and restarted services. But then I stopped receiving emails. When I reverted back, I'm now receiving emails again. Any thoughts? Thanks. b -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 19:19:28 -0500 I checked the W log files and it looks like they are coming in through web messaging (god knows how they are sending that much email through web messaging) under several IP's ranging from Nigeria to Israel. I blocked those IP's within Imail Control Access. Ah, that explains what is going on. That's the first time I've seen serious spammers try to send E-mail through web messaging. How can I make Hijack work with webmessaging? It is possible to do this, by having the declude.exe file act as the smtp32.exe file, so that Declude can intercept the web messaging E-mail. This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the declude.exe file to smtp32.exe, using a DAISYCHAIN ipsmtp.exe line in the hijack.cfg file. Then, you need to use regedit to change the HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point to smtp32.exe instead of declude.com, and finally stop/restart the IMail SMTP service so that IMail will recognize the change -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: SPAMCOP:Re: [Declude.JunkMail] HiJack Not Working ?
The reverse dns is because of a nat'ing scheme we have behind two firewalls and a load director (posts in the past have already described our config). The freaking SpamCop is because I apparently have Spammers sending an incredible amount of spam through our web messaging (i.e. bypassing hijack and why I'm posting it as an issue). How is that even possible? b -- Original Message -- From: Eje Gustafsson [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 26 Mar 2003 21:27:20 -0600 Not besides that your listed yourself in spamcop and that you need to take a look at the logs to see what's in them and/or show them to us so we can see what is failing. I see a couple of things right of. 1) no reverse DNS for 208.253.112.168 which is your sending ip for you mailserver. 2) your subnet is listed with numerous spam lists. DELINK, SPAMCOP, XBL, HEUR1, REVDNS, SPAMCHK, IPNOTINMX, Reverse-IP - Eje Wednesday, March 26, 2003, 9:15:11 PM, you wrote: BC Scott, BC I made these changes and restarted services. BC But then I stopped receiving emails. BC When I reverted back, I'm now receiving emails again. BC Any thoughts? BC Thanks. BC b BC -- Original Message -- BC From: R. Scott Perry [EMAIL PROTECTED] BC Reply-To: [EMAIL PROTECTED] BC Date: Wed, 26 Mar 2003 19:19:28 -0500 I checked the W log files and it looks like they are coming in through web messaging (god knows how they are sending that much email through web messaging) under several IP's ranging from Nigeria to Israel. I blocked those IP's within Imail Control Access. Ah, that explains what is going on. That's the first time I've seen serious spammers try to send E-mail through web messaging. How can I make Hijack work with webmessaging? It is possible to do this, by having the declude.exe file act as the smtp32.exe file, so that Declude can intercept the web messaging E-mail. This is done by renaming the smtp32.exe file to ipsmtp.exe, renaming the declude.exe file to smtp32.exe, using a DAISYCHAIN ipsmtp.exe line in the hijack.cfg file. Then, you need to use regedit to change the HKEY_LOCAL_MACHINE\Software\Ipswitch\IMail\Global\SendName value to point to smtp32.exe instead of declude.com, and finally stop/restart the IMail SMTP service so that IMail will recognize the change -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] BC --- BC [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] BC --- BC This E-mail came from the Declude.JunkMail mailing list. To BC unsubscribe, just send an E-mail to [EMAIL PROTECTED], and BC type unsubscribe Declude.JunkMail. The archives can be found BC at http://www.mail-archive.com. BC --- BC [This E-mail scanned for viruses by Declude Virus] Best regards, Eje Gustafsson mailto:[EMAIL PROTECTED] --- The Family Entertainment Network http://www.fament.com Phone : 620-231- Fax : 620-231-4066 eBay UserID : macahan - Your Full Time Professionals - --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Habeas headers
Several porn spammers are also using them. They claim that they are using verified opt-in lists, however we have seen several reports from customers that claim they never opted-in for any adult oriented material, however may have for other things. They are apparently buying their opt-in lists from other sources. We have one knowledgable customer that said his wife signed up for some TV shopping network newsletter, and within a week started getting adult messages marked with the Habeas headers. I have had several conversations with the Habeas people. While they claim they will go after violators of the Habeas copyright, I still have not figured out how they will stop spammers that buy what they claim to be legitimate opt-in lists. Here's the biggest problem with Habeas. Once the mark is abused, administrators will stop whitelisting it. They are not going to wait until the legal staff at Habeas is able to stop the use of the mark by a particular spammer. That could take months or longer. This will make Habeas completely ineffective almost overnight. One thing they could do is to add an additional header and force their licensees to use it. It would classify the source as being the original opt-in list owner, or a business partner, meaning someone who bought or rented the list. At least this would help to identify the sender as being the source that you contacted rather then someone who you didn't. Actually, my opinion is that this concept will flame out long before it is ever determined to be useful. On 03/25/03 9:37am you wrote... If anyone is using the Habeas headers whitelist option you should be aware that topica.com is sending their messages with habeas headers. We have them blacklisted but since the whitelisting overrides everything, their messages were getting through. Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ve.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SpamManager/Declude Setup!
It is [EMAIL PROTECTED] I'll check that. It is supposed to be sending this out in the welcome message. On 03/25/03 4:11pm you wrote... John, I subscribed to that list when I bought the product, but I do not see anywhere what email address to send to the list with. Sincerely, Grant Griffith, Vice President EI8HT LEGS Web Management Co., Inc. http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff Sent: Tuesday, March 25, 2003 12:25 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SpamManager/Declude Setup! Did you make any changes to the SpamManager config file or just leave it as default? You want to use the Declude specific configuration options. They are in the pdf. SpamManager also has its own list service. [EMAIL PROTECTED] John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ve.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Interesting test results
Hi Scott and all, We added a test to SpamManager that has produced some really interesting results. What we are doing is to track the 2000 (user configurable) most recent spammer IP addresses. The list is maintained as an MRU style list (sorted with the most recent at the top). If incoming messages reach a user defined score, the IP address of the spammer is added to the list. As part of our testing procedure for our own lists, we validate the results of our spam trap accounts and internal email accounts against most of the public DNS lookup databases and the 3 we subscribe to mostly to determine their weighting. Prior to implementing this test, roughly 40% of spam we received also got hits from one or more of the DNS lookup databases with SpamCop having the best results (false positives ignored). Here is what we found. After about 3 weeks of data collection, only about 1 in 400 incoming spams is identified by a DNS lookup, and NOT on the list of the 2000 most recent spammers. Also, of all the spams we receive on all accounts, about 43% are on the recent spammer list, meaning that almost half of the spams we receive are from senders that have spammed us before. In analyzing this data, we found that spam trap accounts that were set up at the same time, and use the same methods, have a totally different mailing list distribution after a couple of months. This analysis supports our supposition that a locally maintained list of spammers is going to be a lot more accurate than some centrally maintained DNS lookup database. Also we routinely get lots of spam reported to us that we have never seen, also indicating that spam mailing lists evolve into lists that tend to be very unique, and that a few originators are responsible for a majority of spam for each account. I was thinking that it would probably be a relatively simple matter to add such a test in a future version of declude. If an incoming message reached a certain weight, it could be added to a recent spammer list. This list could be checked along with other internal tests _before_ DNS tests are performed, and this could push a weighting up high enough that external DNS lookups could be skipped. The effect of this is that by using a individualized IP address scheme, processing time per message could be greatly reduced resulting in less resource problems, and faster delivery times. Anyway, I thought this would make an interesting topic for discussion. Brian Milburn --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How did this Spammer get through?
I've got several held emails from a spammer trying to use our system for relay. I've got the box locked down to only accept relay from authenticated users, but somehow this guy got through. Luckily, I've got hijack on the box, which has blocked all of his emails. Here's an example of the email he's trying to relay through: Received: from 208.253.112.160 [169.207.38.237] by richmond.com (SMTPD32-7.07) id A450F9200BE; Wed, 12 Mar 2003 18:35:44 -0500 Received: from 0e.ygr0.net ([143.95.123.108]) by 208.253.112.160 with SMTP; Wed, 12 Mar 2003 22:30:43 -0100 Message-ID: [EMAIL PROTECTED] From: Mervin Crow [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: re: Increase Your Gas Mileage by up to 27% ohvs eex Date: Wed, 12 Mar 03 22:30:43 GMT X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: The Bat! (v1.52f) Business MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=15978B3_057.85AE_.850_ This is a multi-part message in MIME format. --15978B3_057.85AE_.850_ Content-Type: text/html Content-Transfer-Encoding: quoted-printable htmlbodyPaul athwartship,a href=3Dhttp://[EMAIL PROTECTED] averpro.com img src=3Dhttp://[EMAIL PROTECTED]/the.jpg width=3D536= height=3D505 /asalute beacon stumpweapon gapbr%RA= NDOM_WORDhum implantation party dish/body/html --15978B3_057.85AE_.850_-- How is he successfully getting through? Also, how can I block him from coming through again? Thanks. Brian -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 12, 2003 6:18 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] HELO contains SOO.. My question is this.. Could I create a wordfilter rule that goes like HELO 10 CONTAINS imail.fament.com or will that shoot myself in the foot for some reason ? That will work fine, just so long as you don't have any other mailservers that identify themselves as imail.fament.com. If your IMail server is the only one that does, the filter will work fine. If it really is the HELO string then I don't see this as a problem since my understanding is that my mail server do NOT connect to itself and should then never send the helo imail.fament.com to itself ?! Correct. There might be odd cases where the IMail server would connect to itself, but if that happens, you've got another problem on your hands (as it would cause a mail loop). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How did this Spammer get through?
Here you go: 03:12 18:35 SMTPD(0F9200BE) [169.207.38.237] HELO 208.253.112.160 03:12 18:35 SMTPD(0F9200BE) [169.207.38.237] MAIL FROM: [EMAIL PROTECTED] 03:12 18:35 SMTPD(0F9200BE) [169.207.38.237] RCPT TO: [EMAIL PROTECTED] 03:12 18:35 SMTPD(0F9200BE) [169.207.38.237] RCPT TO: [EMAIL PROTECTED] 03:12 18:35 SMTPD(0F9200BE) [169.207.38.237] ERR richmond.com invalid user [EMAIL PROTECTED] 03:12 18:35 SMTPD(0F9200BE) [169.207.38.237] RCPT TO: [EMAIL PROTECTED] 03:12 18:35 SMTPD(0F9200BE) [169.207.38.237] ERR richmond.com invalid user [EMAIL PROTECTED] 03:12 18:35 SMTPD(0F9200BE) [169.207.38.237] d:\IMail\spool\Dc4500f9200bec554.SMD 1114 So is he authenticating as a real user? b -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 12 Mar 2003 19:11:04 -0500 Here's an example of the email he's trying to relay through: The key information isn't in the headers in this case -- it's in the IMail SMTP log file. Most importantly are the RCPT TO: lines, which will show who the E-mail was actually addressed to, and whether or not some hack was used to relay the E-mail. If you post the IMail SMTP log file entries, I should be able to let you know what is going on. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How did this Spammer get through?
What's strange is that the only thing consistent around all of the spam emails is the IP address 169.207.38.237, which is listed with SpamCop. Should declude pick that up? I've got spamcop listed as an automatic hold, but somehow he keeps getting through. Thanks. b -- Original Message -- From: R. Scott Perry [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 12 Mar 2003 19:11:04 -0500 Here's an example of the email he's trying to relay through: The key information isn't in the headers in this case -- it's in the IMail SMTP log file. Most importantly are the RCPT TO: lines, which will show who the E-mail was actually addressed to, and whether or not some hack was used to relay the E-mail. If you post the IMail SMTP log file entries, I should be able to let you know what is going on. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for Viruses and Spam by Richmond.com] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: DSN:Re: [Declude.JunkMail] Whitlist Compiler
The address is http://www.spammanager.com It might be a competing product for Declude, but it is not intended to be. It is a different approach however it also supports being used as a Declude test. Imail is not really our intended market, however since we use IMail ourselves, it was a natural place to start. (I hate #%$#%* SPAM!) We use it here in conjunction with Declude products however it will work alone. Our main push is going to be the gateway version which will work with any mail server and numerous mail servers at the same time, and is about 8-10x faster that using it in conjunction with IMail in our tests so far. We are also planning on adding support for Declude Junkmail and Spam in the gateway version as soon as we finish our initial alpha testing. There is a Declude specific version of SpamManager now available that does not have all the bells and whistles and simply returns result codes for Declude JunkMail. It is much less expensive. On 02/28/03 12:24pm you wrote... Hello, Brian, Is there a link on the web somewhere to CYBERsitter SpamManager? I can't seem to find it. Also,would you consider this product a competing product to Declude.JunkMail? Thanks, Dan Geiser [EMAIL PROTECTED] - Original Message - From: Brian Milburn [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, February 08, 2003 12:45 PM Subject: DSN:Re: [Declude.JunkMail] Whitlist Compiler Hmmm... somebody stole my thunder! We added Smart Whitelisting to CYBERsitter SpamManager for the final release. It automatically (optionally) adds the recipients address to the users personal whitelist. $27,000 ?? Jeepers! Somebody's got a lot of VC guys to pay off! On 02/08/03 10:16am you wrote... IronMail compiles whitelists by looking at the recipient addresses of outgoing mail, on the assumption that frequently used addresses are those of people that an enterprise has a partnership with, and who should be allowed to send e-mail into the enterprise. Would be a nice feature in Declude... This is something that we have been thinking about for a long time. It would be a bit awkward to set up, and would use more resources, but could really help minimize false positives. -Scott This E-mail is scanned and free from viruses. www.nexustechgroup.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Solid Oak Software] ware] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: DSN:Re: [Declude.JunkMail] Whitlist Compiler
SpamManager returns negative results for adult and positive results for spam. John has some good test definitions that I am sure he will share. On 02/28/03 7:41pm you wrote... There is a Declude specific version of SpamManager now available that does not have all the bells and whistles and simply returns result codes for Declude JunkMail. Hey Scott/Bryan, For the Declude specific version of SpamManager, will the result codes distinguish the difference between adult content and regular spam? I used SpamManager as an external test during it's beta testing and was quite impressed with it's performance! :-) Thanks, ~Patrick --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Solid Oak Software] ware] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: DSN:Re: Re[2]: [Declude.JunkMail] A Question of Ethics
On 02/27/03 9:32am you wrote... I'll trust you on that, and apologize for the roundhouse classification. Yet in your several dozen cases where divorces were contemplated, employee terminations took place, even people who were sent back to prison and kids who have been grounded examples, clearly your tool was used as spyware. And these are the cases which you brought under discussion. This is only in reference to a business environment. Would you say in this instance that the tools (firewall logging) used would be classified as spyware? I would imagine that any product that logs any activity could be considered spyware in certain circumstances. This includes IMail, Declude, Exchange, MS Proxy, anything that logs activity. There is a huge difference between products that log activity and spyware. For example, there is a product that takes low res screen shots of the computer and allows the parent, employer, or other supervisorial person to playback everything that was done. Several of CYBERsitter's competitors have built in keyboard logging that keeps a record of everything typed. Although I am sure this has cost us sales and review points, we have consistently refused to incorporate similar functions into CYBERsitter. We have been asked thousands of times to provide functions to capture email messages, and capture instant messaging content. Certainly this is possible, but we won't do that either although there are other products have this capability. In my opinion, these are spyware products. Our primary purpose in keeping logs is for support purposes. The user's purpose is probably different, but here again, this is a common function of all tools that manage or distribute content. We also track users who come to our web sites. We know what pages they visit, their browser versions, IP addresses, locale, referrers, and operating systems. We, like tens of thousands of other online retailers, use this information for improving traffic flow, determining user interest, and fine tuning our marketing. So are we spying on our customers? I can use the logs generated by IMail to spy on people as easily as any spyware product. I can see who sent what to who, where and when. Does this make it spyware? I don't think so. You can hold any message that meets certain criteria with Declude and the administrator can read the entire message. It doesn't have to be spam. Does this make Declude spyware too? I think that an overly broad interpretation of what is spyware is foolish, no matter how the data is used. Virtually every Internet related application is designed to manage or regulate the distribution or reception of data in some way. Tools that log activity are absolutely necessary. Tools that are intentionally designed to invade a users privacy are quite another thing entirely. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:Re: Re[2]: [Declude.JunkMail] A Question of Ethics
I seldom comment on this list, but this is something I know a little about. We have published security software since 1990 and our most popular product, CYBERsitter, since 1996. With over 2.5m users, we have seen it all. Because it records all browsing activity, there are many cases where we have been called upon to interpret the activity. I personally know of several dozen cases where divorces were contemplated, employee terminations took place, even people who were sent back to prison for parole violations due directly to our software. Of course that isn't even the tip of the iceberg compared to all the kids who have been grounded for doing nasty things they shouldn't ;) We have had more than our share of controversy. Our policy regarding our responsibility has remained the same throughout and has proven to be the appropriate one I believe. Our software is a tool. The user purchases this tool to perform a specific function. We try to provide as much information as we can about how to use the tool. Once the user installs our software, what they do with the data is up to them. All we can do is to provide the tool by which to gather the data, and to present it in a readable, factual way. It has been my experience, that when a drastic measure is contemplated, a wife divorcing her husband for a porn problem, an employer terminating an employee, or whatever, the software is generally used to confirm and/or validate something they already know. Our policy is to make ourselves available to help people analyze the data we provide, and to give them an honest interpretation of what we feel is taking place. I have personally confirmed peoples suspicions, and also was able to explain suspected activity as accidental or unsolicited. I was contacted one time by a district attorney from Pittsburg. An employee of a company was arrested and in jail for uploading a propriatory customer database to some other location. They faxed me 20 pages of logs, and after analyzing them I discovered that the logs had been altered. It turned out the employer had insured his data for $400,000 and had set the employee up. The employee was released later that day and the employer (our customer) was arrested. Personally, I feel that the ethics question here is whose ethics will we use. Just the fact that this question is being discussed here is proof positive to me that we as a group do care about how the data we provide our users is used. The best we can do is to make it as accurate as possible, and be available to help those who need a professional opinion. Contrast this to companies that provide no rationale whatsoever for their judgements like some RBL providers, or companies that provide spam/porn protection but aren't there to spend the time with you when you have a question. To many companies ethics is spelled ethic$. Hopefully we as a group are not among them. I am willing to bet that the employee in question was not fired solely based on information provided by an anti-spam program. They employer probably had complaints, suspicions, or other reasons that were taken in to account. It is quite possible he just needed the evidence. On 02/26/03 10:14pm you wrote... I'd say if they fired him for just receiving porn then they better be prepared for a lawsuit. If I had something to do with getting rid of some sorry so and so that was doing stuff like that to his employer I'd feel pretty good about it. My thoughts are completely in line with Terry's. There is no question of your complicity in the gentleman's firing if you are comfortable that the employer *knew* the offending messages to *not* be spam, and thus out of your purvue completely. If, however, you feel that, acting as a spam expert, you did not adequately represent the extremely high likelihood that pornographic e-mail is unsolicited, or, even worse, gave the reverse impression (i.e., that your filtering service--impossibly!--only allows through porn that was desired by the end user, deleting everything else on arrival), you should try to remedy this misunderstanding immediately. As an immediate band-aid, you may wish to release an updated end user agreement that highlights this area, without revealing your direct motivation. I would feel horrible knowing I'd inadvertently helped to frame someone, whether due to ignorance or corruption on the part of their boss; in fact, I would ready myself to defend the individual in court, and lose the client. You have to go deeper on this: it's a question of why/whether this has anything to do with you positively or negatively, since you provide anti-spam software--not employee monitoring/spyware, which is in a sense its direct opposite. -Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] --- [This
RE: (4, ):[Declude.JunkMail] Blacklists
Something you might try is setting up a black list file in the GLOBAL.CFG with a weight of 0. ie: SenderBlacklist fromfile C:\IMail\Declude\SenderBlacklist.txt x 0 0 Then you can go in a per-domain or per-user ie: SenderBlacklist DELETE This effectively gives you individual blacklists. Brian Clover -Original Message- From: Rich [mailto:[EMAIL PROTECTED]] Sent: Saturday, February 08, 2003 12:31 AM To: [EMAIL PROTECTED] Subject: (4, ):[Declude.JunkMail] Blacklists Scott and all, We have the ability to develop a whitelist by domain now, how about the ability to create a individual blacklist, say something like this in each junkmail file... WHITELISTFILE C:\maillists\cswanson\whitelist.txt BLACKLISTFILE C:\maillists\cswanson\blacklist.txt What prompted this was a customer who is using the Web Email address book whitelist, and wants to shut down all Hotmail accounts trying to send him mail other then the ones he has in his address book. So if I understand the .JunkMail processing, it's done after the address book is checked. So he'd receive his whitelisted hotmail accounts, and anything else from a hotmail address would be dumped. Kendra Customer Support http://www.kendra.com/support [EMAIL PROTECTED] 425-397-7911 This Email was scanned for viruses Junk Email filtered ISP --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:Re: [Declude.JunkMail] Whitlist Compiler
Hmmm... somebody stole my thunder! We added Smart Whitelisting to CYBERsitter SpamManager for the final release. It automatically (optionally) adds the recipients address to the users personal whitelist. $27,000 ?? Jeepers! Somebody's got a lot of VC guys to pay off! On 02/08/03 10:16am you wrote... IronMail compiles whitelists by looking at the recipient addresses of outgoing mail, on the assumption that frequently used addresses are those of people that an enterprise has a partnership with, and who should be allowed to send e-mail into the enterprise. Would be a nice feature in Declude... This is something that we have been thinking about for a long time. It would be a bit awkward to set up, and would use more resources, but could really help minimize false positives. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Solid Oak Software] ware] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:Re: [Declude.JunkMail] Declude in PCMag
Nah, we've been in there a bunch of times and all you get is calls from people wanting to know if you have a Mac version! Just kidding, congratulations Scott! Brian On 01/24/03 3:52pm you wrote... Congratulations, Scott. Declude is mentioned in PCMag, latest February 25th Issue, page 95. Sniffer is also in the same listing. Suppose we'll see price increases now. big grin -- Roger Heath [EMAIL PROTECTED] www.rleeheath.com -- ActivatorMail(tm) ver.122102 Scanned for all viruses by www.activatormail.com intelligent anti-virus anti-spam service --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ve.com. --- [This E-mail scanned for viruses by Solid Oak Software] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:Re: [Declude.JunkMail] osirusoft down?
That's Santa _Ana_ winds Scott ;-) It has been in the 80's here in So Cal. and the winds have knocked out our electricity twice for a total of about 8 hours, and our backup copper T1 once. Our big fiber line and batteries have kept us up and running. This morning I woke up and when I turned on the lights they were all dim. I checked and we had 60 volts! Things were beeping all over the house. Dang APC UPS's don't have a bell off button. I guess the electricity was off for 3 hours or so, and when the power came back up it was a few volts short. I have never seen anything like this before, especially in January. Brian On 01/07/03 5:56pm you wrote... Is anyone having problems using relays.osirusoft.com and relays.ordb.org? Should I comment these out in the global.cfg file to avoid excessive timeouts? It's a temporary problem due to the Santa Monica Winds in California, which are apparently blowing cars from one lane on highways to another. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ://www.mail-archive.com. ve.com. --- [This E-mail scanned for viruses by Solid Oak Software] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:Re: [Declude.JunkMail] Increase in SPAMCOP listing
Hi John, I have noticed this as well. Yesterday Spamcop failed several legitimate messages from AOL users. Maybe they are not clearing out the false reports as regularly as they normally do because of the holiday week. -Brian On 11/27/02 6:51am you wrote... Has any one else noticed an increase in the number of legit companies listed on SPAMCOP? I have been having to increase my white filter list. Examples: Ebay.com Techrepublic.com winntmag.com John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail]
winmail.dat
[Declude.JunkMail] BlackList Limit ?
Is there a limit on the number of addresses that I can blacklist within a FROMFILE? Thanks. b --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:Re: [Declude.JunkMail] BASE64 test
Not when they are the text portions of the message. If you look at a complex raw email message, there may be several message parts. These can be BASE64 encoded files of any type. All the message parts are essentially contained in the message body. It is up to the client application to separate these parts and reconstruct them into their original formats. I am seeing several hundred spams a day where the sender sends an adult message from an innocuous email address with a subject like Got your message. The message bodies may be extremely explicit, so they are BASE64 encoded so that they get by spam filters or rules like those available in iMail. There would be no good reason at all to encode message text except to get by these filters. On 11/19/02 8:03am you wrote... The BASE64 test will be triggered when E-mail contains a text or HTML MIME segment that is base64 encoded -- there is no reason for such segments to be base64 encoded, but spammers commonly use the base64 encoding to try to bypass filters. Follow-up question: Is there any good or allowed reason to have BASE64 encoding in a message? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DSN:CYBERsitter NoXMail List
I want to thank everyone who requested a beta copy of CYBERsitter NoXMail. There were quite a few requests and we received a lot of positive feedback and a couple of good suggestions. One user requested that we set up a mailing list so that beta users can ask questions, and also so that I can send them announcements of enhancements and 'fixes' as they are posted. We also posted the beta so it can be downloaded. Anyone using the beta is encouraged to subscribe by sending an email to: [EMAIL PROTECTED] and put SUBSCRIBE YOUR NAME in the message body. We will be posting a new version this afternoon that implements some new spam detection tests that help reduce false positives as well as the inclusion of a couple of suggestions we received from users. Thanks again, and thanks to Scott for providing an extensible product with Declude JunkMail! Brian Milburn Solid Oak Software --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:Re: [Declude.JunkMail] Adultery
Hi John, We do not have the docs finished yet, but the program is available if you would care to test it. There is a 'Declude style' configuration file and it is completely commented so it is easy to use without the docs. At this point we are still open to suggestions and comments. We hope to begin the Linux translation by Dec 1, so the feature set and program defaults are not locked down as yet. Let me know and I will send you the files and a license key. Brian On 11/08/02 1:45pm you wrote... Great. Please keep us posted on the progress. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:RE: Re: [Declude.JunkMail] Adultery
Ok, it is being sent to your email address. On 11/12/02 12:44pm you wrote... Brian, I would like to test it as well! Patrick Childers Network Administrator Hussey, Gay, Bell DeYoung Inc. 329 Commercial Drive Savannah, GA 31406 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com]On Behalf Of Brian Milburn Sent: Tuesday, November 12, 2002 12:31 PM To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.JunkMail] Adultery Hi John, We do not have the docs finished yet, but the program is available if you would care to test it. There is a 'Declude style' configuration file and it is completely commented so it is easy to use without the docs. At this point we are still open to suggestions and comments. We hope to begin the Linux translation by Dec 1, so the feature set and program defaults are not locked down as yet. Let me know and I will send you the files and a license key. Brian On 11/08/02 1:45pm you wrote... Great. Please keep us posted on the progress. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail scanned for viruses by Declude/McAfee] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] DSN:Message for Scott
Scott, If you will recall, I contacted you a while back when I was working on CYBERsitter NoXMail and I was having problems with Declude locking the spool file while processing it. You sent me a version that had this fixed. MUCH to my embarrassment, I sent out some beta copies of NoXMail to about 10-15 of your users this morning completely forgetting about the declude.exe problem. Is the fixed version of Declude available to all users? If so, maybe you could post the address here so it won't look like we send out software that doesn't work;-) Thanks, I appreciate it. Brian Milburn Solid Oak Software --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:RE: Re: [Declude.JunkMail] Adultery
No, sorry. We don't do shareware here, although I don't know exactly how it will be distributed yet. Our marketing department is currently doing its evaluations. The 'real' target market is large ISPs, but we use iMail and Declude Junkmail here, so it was an obvious 'must do'. On 11/08/02 11:27am you wrote... I also would be interested. Need to ask. Will this be a shareware or paid add-on? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-owner;declude.com] On Behalf Of Brian Milburn Sent: Friday, November 08, 2002 10:49 AM To: [EMAIL PROTECTED] Subject: DSN:Re: [Declude.JunkMail] Adultery If you are interested in a Declude 'external test' for adult oriented material, we will be releasing a product for Declude/iMail and other MTAs soon (CYBERsitter NoXMail). We adapted the content recognition engine from our product CYBERsitter, and it is extremely accurate and highly configurable. We have about 30,000 of our users currently submitting all their objectionable mail to us and we are in the process of 'fine tuning' the pattern files. It is very fast, processing average messages in ~200ms. We have had very few false positives ( .1%) and it even knows the difference between an 'off-color' joke, and adult spam. Brian Milburn Solid Oak Software, Inc. http://www.cybersitter.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
DSN:RE: RE: Re: [Declude.JunkMail] Adultery
Hi John, I am pretty sure you can be assured of that. We deal with a lot of small ISPs and hosting companies now and always try to keep value high and expense low. On 11/08/02 11:59am you wrote... Hopefully, there will be a tiered pricing structure for smaller companies, such as small hosting companies like us. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Bayesian filtering
Hello all, Has anyone seen anything about this .. Any good or bad ? .. Bayesian filtering .. Check this link http://www.paulgraham.com/filters.html Scott are you thinking along any of these line for the future of Declude? Brian --- [Scanned for viruses with safE-Mail by American Broadband Services] [To scan your Companies email contact ABS [EMAIL PROTECTED]] --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ISP Users and Sample JunkMail config files
Hello all, We would like to see some sample real world config files for ISP's, If others out there are using configs that work for there environments then there is little reason for the rest of us to re-invent the wheel .. Come on folks share! Brian --- [Scanned for viruses with safE-Mail by American Broadband Services] [To scan your Companies email contact ABS [EMAIL PROTECTED]] --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] consensus
Could not agree more! Scott and Declude Make Ipswitch worth putting up with .. Well almost :) Brian R. Watters Senior Director of Information Technologies Totlcom BroadBand Services [EMAIL PROTECTED] Wireless EMail: [EMAIL PROTECTED] http://www.totlcombroadband.com 559-420-0205 559-291-1895 fax Totlcom Broad Band Services LLP This message and any attachments are solely for the use of intended recipients. They may contain privileged and/or confidential information, attorney work product or other information protected from disclosure. If you are not an intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you have received this email in error, please contact the sender and delete the message and any attachment from your system. Thank you for your cooperation. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Aaron Caviglia Sent: Saturday, April 27, 2002 3:22 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] consensus Kevin, I have about 100 users so far and roughly 3000 emails per day. Declude JunkMail catches about 50% of those 1500 e-mails. Rarely do I get a false positive, maybe once every two weeks and then its easy enough to fix. As far as declude goes, its been one of the best companies I have EVER made a purchase from. If every company stood behind their product like declude I would be a very happy man. Part of the reason I stay with IMail and IPSwitch is because of declude. Lets face it IPSwitch is not all that responsive! But Scott and Declude are the best! My 2 cents worth! Aaron Caviglia -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin Crawford Sent: Saturday, April 27, 2002 3:14 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] consensus Hello - I have taken my credit card out of my wallet two or three times now, headed to buy declude junkmail - on the fence so to speak. I know how well declude works for AV - and I am very impressed with Scott as a helpful and courteous individual - and he seems real smart too - lots of knowledge on the workings of mail etc I am trying to drum up support (funds) for it from a few of my business customers. I would like some reviews if possible - what kind of kill rate some of you get without paying some of the db's services out there - just using the free stuff. Cold hard percentages would be good. I am using imgate at the moment, but the ability to just mark spam would be so much better than deleting it - and weighting sounds immensely better that pass or fail on one test, then on to the next. I have gone down to only blocking open relays (since no reason exists to have one - and if you are legit, you shouldn't want one anyway) Also, what kind of performance hits do you take - sorry to break in on such a quiet day - thanks Kevin --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Security Scan Operations Center] BEGIN:VCARD VERSION:2.1 N:Watters;Brian;R. FN:Brian Watters ([EMAIL PROTECTED]) ORG:Totlcom Broad Band Services LLP TITLE:Senior Director of IS TEL;WORK;VOICE:(559) 297-5000 TEL;CELL;VOICE:(559) 351-2603 TEL;WORK;FAX:(559) 454-7634 ADR;WORK:;;5718 East Shields Avenue;Fresno;CA.;93727;USA LABEL;WORK;ENCODING=QUOTED-PRINTABLE:5718 East Shields Avenue=0D=0AFresno, CA. 93727=0D=0AUSA URL;WORK:http://www.totlcombroadband.com EMAIL;PREF;INTERNET:[EMAIL PROTECTED] REV:2006T014223Z END:VCARD
RE: [Declude.JunkMail] ATTACH action and the spamattach.eml file...
Ok .. So where does one learn on how to use the ATTACH action .. I must be looking in all the wrong places .. Also can someone tell us why you would want to use SKIPIFVIRUSNAMEHAS .. Brian -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Thursday, April 25, 2002 9:29 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] ATTACH action and the spamattach.eml file... When viewing Scott's e-mail in Outlook 2002, you do not have the option on that link. You can only click on it. But if you view Scott's e-mail in the web interface, then you can right click on the link and use save target as. Scott, can you place that link on one of your web pages on declude.com? John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, April 25, 2002 8:19 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] ATTACH action and the spamattach.eml file... A number of people have reported issues with the new ATTACH action that are actually an issue with Internet Explorer. Unfortunately, Microsoft thinks that any file ending in .eml is a file in their own unique proprietary format. Normally, when Internet Explorer alters the .eml files, it does so in a way where it is quite obvious that they have been altered (taking out all the headers, for example, leaving just the message body). However, with the spamattach.eml file, it seems that IE can cut the file about halfway through, causing the ATTACH action not to work properly. If you are using the ATTACH action, you should check to make sure that your \IMail\Declude\spamattach.eml file starts with a line beginning with Message-ID: . If not, you should re-download the file (from http://www.declude.com/release/149/spamattach.eml ), but right-click on the link and choose Save target as, which will bypass the problems with IE altering the file. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Security Scan Operations Center] BEGIN:VCARD VERSION:2.1 N:Watters;Brian;Richard FN:Brian Richard Watters ([EMAIL PROTECTED]) ORG:Totlcom Broad Band Services LLP;IS TITLE:Senior Director of IS TEL;WORK;VOICE:559-297-5000 TEL;CELL;VOICE:559-351-2603 TEL;PAGER;VOICE:[EMAIL PROTECTED] TEL;WORK;FAX:559-454-7634 ADR;WORK:;Fresno;5718 East Shields Ave;Fresno;CA;93720;USA LABEL;WORK;ENCODING=QUOTED-PRINTABLE:Fresno=0D=0A5718 East Shields Ave=0D=0AFresno, CA 93720=0D=0AUSA URL;WORK:http://www.totlcombroadband.com EMAIL;PREF;INTERNET:[EMAIL PROTECTED] REV:20011129T222113Z END:VCARD
RE: [Declude.JunkMail] Declude v1.48 (beta) released
Scott, Where can I read about the Attach Action? .. I do not see it in the sample cfg files or the online manual? .. Brian R. Watters Senior Director of Information Technologies Totlcom BroadBand Services [EMAIL PROTECTED] Wireless EMail: [EMAIL PROTECTED] http://www.totlcombroadband.com 559-420-0205 559-291-1895 fax Totlcom Broad Band Services LLP This message and any attachments are solely for the use of intended recipients. They may contain privileged and/or confidential information, attorney work product or other information protected from disclosure. If you are not an intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you have received this email in error, please contact the sender and delete the message and any attachment from your system. Thank you for your cooperation. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, April 23, 2002 10:50 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude v1.48 (beta) released We have just released Declude JunkMail v1.48 ( http://www.declude.com/junkmail/manual.htm ), a beta version. The noticeable changes include: o Fixed the problem with the ATTACH action and message bodies greater than 8K. o .LST files will no longer get scanned. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Security Scan Operations Center] BEGIN:VCARD VERSION:2.1 N:Watters;Brian;R. FN:Brian Watters ([EMAIL PROTECTED]) ORG:Totlcom Broad Band Services LLP TITLE:Senior Director of IS TEL;WORK;VOICE:(559) 297-5000 TEL;CELL;VOICE:(559) 351-2603 TEL;WORK;FAX:(559) 454-7634 ADR;WORK:;;5718 East Shields Avenue;Fresno;CA.;93727;USA LABEL;WORK;ENCODING=QUOTED-PRINTABLE:5718 East Shields Avenue=0D=0AFresno, CA. 93727=0D=0AUSA URL;WORK:http://www.totlcombroadband.com EMAIL;PREF;INTERNET:[EMAIL PROTECTED] REV:2006T014223Z END:VCARD
MISSING_REVERSE_DNS:RE: [Declude.JunkMail] SpamReview Update v1.0.21
Tom, Attempted to dn/load and its asking for a user and pass Brian R. Watters Senior Director of Information Technologies Totlcom BroadBand Services [EMAIL PROTECTED] WireLess EMail: [EMAIL PROTECTED] http://www.totlcombroadband.com 559-420.0205 559-454-7634 fax This message and any attachments are solely for the use of intended recipients. They may contain privileged and/or confidential information, attorney work product or other information protected from disclosure. If you are not an intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you have received this email in error, please contact the sender and delete the message and any attachment from your system. Thank you for your cooperation. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Schwarz Sent: Wednesday, March 20, 2002 9:47 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SpamReview Update v1.0.21 I have added a Beta/Test version of SpamReview to my site. This is version 1.0.21. For this version make sure you scroll down to the BETA Version. It includes a lot of new features (not very well documented on the web site yet but easy to figure out). http://www.slsoft.com/spamreview.htm Thanks to all who have made suggestions. Tom ps. I will be in the office all day after 2pm cst if you have questions or problems. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail scanned for viruses by Security Scan Operations Center] BEGIN:VCARD VERSION:2.1 N:Watters;Brian;Richard FN:Brian Richard Watters ([EMAIL PROTECTED]) ORG:Totlcom Broad Band Services LLP;IS TITLE:Senior Director of IS TEL;WORK;VOICE:559-297-5000 TEL;CELL;VOICE:559-351-2603 TEL;PAGER;VOICE:[EMAIL PROTECTED] TEL;WORK;FAX:559-454-7634 ADR;WORK:;Fresno;5718 East Shields Ave;Fresno;CA;93720;USA LABEL;WORK;ENCODING=QUOTED-PRINTABLE:Fresno=0D=0A5718 East Shields Ave=0D=0AFresno, CA 93720=0D=0AUSA URL;WORK:http://www.totlcombroadband.com EMAIL;PREF;INTERNET:[EMAIL PROTECTED] REV:20011129T222113Z END:VCARD
