Re: [Declude.JunkMail] Whitelisted address getting trapped anyway
The WHITELIST FROM directive uses the sender of the message as specified in the message envelope (MAIL FROM:[EMAIL PROTECTED]), which may or may not correspond to the From: line in the headers of the message itself. In this case, it did not. The filters operate on the message file, not on the envelope. That is why you can have different results like in this case. The X-Declude-Sender: x-header is the sender as specified in the envelope. David Franco-Rocha Declude Technical / Engineering - Original Message - From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Thursday, March 16, 2006 12:00 PM Subject: Re: [Declude.JunkMail] Whitelisted address getting trapped anyway You might need WHITELIST from .xx.com (the smtp sender address looks to be in the fromat [EMAIL PROTECTED]) - Original Message - From: Harry Vanderzand To: Declude.JunkMail@declude.com Sent: Saturday, March 18, 2006 10:17 AM Subject: [Declude.JunkMail] Whitelisted address getting trapped anyway have an addres that I have whitelisted WHITELIST FROM @.com in global.cfg Yet somehow it got marked as spam There was a matchin a filter file How is this possible? Should whitelisting not take precedence? See headers below Received: from mailface.roving.com [63.251.135.75] by intown.net with ESMTP (SMTPD-8.22) id A17A068C; Fri, 17 Mar 2006 14:43:54 -0500Received: from ws06 (unknown [10.200.200.61])by mailface.roving.com (Postfix) with ESMTP id 8224448C003for [EMAIL PROTECTED]; Fri, 17 Mar 2006 14:42:37 -0500 (EST)Message-ID: [EMAIL PROTECTED]Date: Fri, 17 Mar 2006 14:43:53 -0500 (EST)From: Ken Weinberg [EMAIL PROTECTED]Reply-To: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: We Need Your InputMIME-Version: 1.0Content-Type: multipart/alternative; boundary="=_Part_13064663_1921543487.1142624633764"X-Roving-Queued: 20060317 02:43:53.764X-Mailer: Roving Constant Contact 0 (http://www.constantcontact.com)X-Return-Path-Hint: [EMAIL PROTECTED]X-Roving-ID: 1101247029557X-Lumos-SenderID: 1011230829116X-Roving-CampaignId: 1101247029557X-Roving-StreamId: 0X-Declude-Sender: [EMAIL PROTECTED] [63.251.135.75]X-Declude-Spoolname: D11790199df6a.smdX-Note: Total spam weight of this E-mail is 22.X-Note: Spam Tests Failed: FIVETEN-BULK [3], MYFILTER [19], WEIGHT10 [10], WEIGHT11 [11], WEIGHT12 [12], WEIGHT15 [15], WEIGHT19 [19]X-Note: REMOTEIP: 63.251.135.75X-Note: REVDNS: mailface.roving.comX-Note: FROM: [EMAIL PROTECTED]X-Note: TO: X-Spam-Tests-Failed: FIVETEN-BULK, MYFILTER, WEIGHT10, WEIGHT11, WEIGHT12, WEIGHT15, WEIGHT19 [22]X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 428964605X-IMail-ThreadID: 11790199df6a Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] Whitelisted address getting trapped anyway
check your declude logs.. post them here, they would be able to give us more info Luis Arango From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry VanderzandSent: Sábado, 18 de Marzo de 2006 11:18 a.m.To: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Whitelisted address getting trapped anyway have an addres that I have whitelisted WHITELIST FROM @.com in global.cfg Yet somehow it got marked as spam There was a matchin a filter file How is this possible? Should whitelisting not take precedence? See headers below Received: from mailface.roving.com [63.251.135.75] by intown.net with ESMTP (SMTPD-8.22) id A17A068C; Fri, 17 Mar 2006 14:43:54 -0500Received: from ws06 (unknown [10.200.200.61])by mailface.roving.com (Postfix) with ESMTP id 8224448C003for [EMAIL PROTECTED]; Fri, 17 Mar 2006 14:42:37 -0500 (EST)Message-ID: [EMAIL PROTECTED]Date: Fri, 17 Mar 2006 14:43:53 -0500 (EST)From: Ken Weinberg [EMAIL PROTECTED]Reply-To: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: We Need Your InputMIME-Version: 1.0Content-Type: multipart/alternative; boundary="=_Part_13064663_1921543487.1142624633764"X-Roving-Queued: 20060317 02:43:53.764X-Mailer: Roving Constant Contact 0 (http://www.constantcontact.com)X-Return-Path-Hint: [EMAIL PROTECTED]X-Roving-ID: 1101247029557X-Lumos-SenderID: 1011230829116X-Roving-CampaignId: 1101247029557X-Roving-StreamId: 0X-Declude-Sender: [EMAIL PROTECTED] [63.251.135.75]X-Declude-Spoolname: D11790199df6a.smdX-Note: Total spam weight of this E-mail is 22.X-Note: Spam Tests Failed: FIVETEN-BULK [3], MYFILTER [19], WEIGHT10 [10], WEIGHT11 [11], WEIGHT12 [12], WEIGHT15 [15], WEIGHT19 [19]X-Note: REMOTEIP: 63.251.135.75X-Note: REVDNS: mailface.roving.comX-Note: FROM: [EMAIL PROTECTED]X-Note: TO: X-Spam-Tests-Failed: FIVETEN-BULK, MYFILTER, WEIGHT10, WEIGHT11, WEIGHT12, WEIGHT15, WEIGHT19 [22]X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 428964605X-IMail-ThreadID: 11790199df6a Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
RE: [Declude.JunkMail] Whitelisted address getting trapped anyway
Harry, This is the actual sender of the email X-Declude-Sender: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] [63.251.135.75] Not From: Ken Weinberg [EMAIL PROTECTED] David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Vanderzand Sent: Saturday, March 18, 2006 11:18 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Whitelisted address getting trapped anyway have an addres that I have whitelisted WHITELIST FROM @.com in global.cfg Yet somehow it got marked as spam There was a match in a filter file How is this possible? Should whitelisting not take precedence? See headers below Received: from mailface.roving.com [63.251.135.75] by intown.net with ESMTP (SMTPD-8.22) id A17A068C; Fri, 17 Mar 2006 14:43:54 -0500 Received: from ws06 (unknown [10.200.200.61]) by mailface.roving.com (Postfix) with ESMTP id 8224448C003 for [EMAIL PROTECTED]; Fri, 17 Mar 2006 14:42:37 -0500 (EST) Message-ID: [EMAIL PROTECTED] Date: Fri, 17 Mar 2006 14:43:53 -0500 (EST) From: Ken Weinberg [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: We Need Your Input MIME-Version: 1.0 Content-Type: multipart/alternative; boundary==_Part_13064663_1921543487.1142624633764 X-Roving-Queued: 20060317 02:43:53.764 X-Mailer: Roving Constant Contact 0 (http://www.constantcontact.com) X-Return-Path-Hint: [EMAIL PROTECTED] X-Roving-ID: 1101247029557 X-Lumos-SenderID: 1011230829116 X-Roving-CampaignId: 1101247029557 X-Roving-StreamId: 0 X-Declude-Sender: [EMAIL PROTECTED] [63.251.135.75] X-Declude-Spoolname: D11790199df6a.smd X-Note: Total spam weight of this E-mail is 22. X-Note: Spam Tests Failed: FIVETEN-BULK [3], MYFILTER [19], WEIGHT10 [10], WEIGHT11 [11], WEIGHT12 [12], WEIGHT15 [15], WEIGHT19 [19] X-Note: REMOTEIP: 63.251.135.75 X-Note: REVDNS: mailface.roving.com X-Note: FROM: [EMAIL PROTECTED] X-Note: TO: X-Spam-Tests-Failed: FIVETEN-BULK, MYFILTER, WEIGHT10, WEIGHT11, WEIGHT12, WEIGHT15, WEIGHT19 [22] X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 428964605 X-IMail-ThreadID: 11790199df6a Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2 519-741-1222 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted address getting trapped anyway
You might need WHITELIST from .xx.com (the smtp sender address looks to be in the fromat [EMAIL PROTECTED]) - Original Message - From: Harry Vanderzand To: Declude.JunkMail@declude.com Sent: Saturday, March 18, 2006 10:17 AM Subject: [Declude.JunkMail] Whitelisted address getting trapped anyway have an addres that I have whitelisted WHITELIST FROM @.com in global.cfg Yet somehow it got marked as spam There was a matchin a filter file How is this possible? Should whitelisting not take precedence? See headers below Received: from mailface.roving.com [63.251.135.75] by intown.net with ESMTP (SMTPD-8.22) id A17A068C; Fri, 17 Mar 2006 14:43:54 -0500Received: from ws06 (unknown [10.200.200.61])by mailface.roving.com (Postfix) with ESMTP id 8224448C003for [EMAIL PROTECTED]; Fri, 17 Mar 2006 14:42:37 -0500 (EST)Message-ID: [EMAIL PROTECTED]Date: Fri, 17 Mar 2006 14:43:53 -0500 (EST)From: Ken Weinberg [EMAIL PROTECTED]Reply-To: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: We Need Your InputMIME-Version: 1.0Content-Type: multipart/alternative; boundary="=_Part_13064663_1921543487.1142624633764"X-Roving-Queued: 20060317 02:43:53.764X-Mailer: Roving Constant Contact 0 (http://www.constantcontact.com)X-Return-Path-Hint: [EMAIL PROTECTED]X-Roving-ID: 1101247029557X-Lumos-SenderID: 1011230829116X-Roving-CampaignId: 1101247029557X-Roving-StreamId: 0X-Declude-Sender: [EMAIL PROTECTED] [63.251.135.75]X-Declude-Spoolname: D11790199df6a.smdX-Note: Total spam weight of this E-mail is 22.X-Note: Spam Tests Failed: FIVETEN-BULK [3], MYFILTER [19], WEIGHT10 [10], WEIGHT11 [11], WEIGHT12 [12], WEIGHT15 [15], WEIGHT19 [19]X-Note: REMOTEIP: 63.251.135.75X-Note: REVDNS: mailface.roving.comX-Note: FROM: [EMAIL PROTECTED]X-Note: TO: X-Spam-Tests-Failed: FIVETEN-BULK, MYFILTER, WEIGHT10, WEIGHT11, WEIGHT12, WEIGHT15, WEIGHT19 [22]X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 428964605X-IMail-ThreadID: 11790199df6a Harry Vanderzand inTown Internet Computer Services 11 Belmont Ave. W., Kitchener, ON,N2M 1L2519-741-1222
[Declude.JunkMail] whitelisted but not
Here are the headers from a message that was forwarded to my spam email account. It shows that its whitelisted but it was still caught. X-Declude-Sender: [EMAIL PROTECTED] [127.0.0.1] X-Declude-Spoolname: D5E8705DC5A1F.GSC X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [0] at 21:19:04 on 01 Jun 2005 X-Declude-Tests: Whitelisted X-Country-Chain: X-RBL-Warning: MXRATE-BLOCK: http://www.mxrate.com/lookup/refused.asp?ipaddress=32.97.166.48 X-RBL-Warning: MAILFROM: Domain ute-sei.org has no MX or A records [0001]. X-RBL-Warning: SUBJECTCHARS: Subject with at least 50 characters found. X-Declude-Sender: [EMAIL PROTECTED] [32.97.166.48] X-Declude-Spoolname: D5EF114F40118D5BC.SMD X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [18] at 21:20:52 on 01 Jun 2005 X-Declude-Tests: MXRATE-BLOCK, MAILFROM, SUBJECTCHARS, WEIGHT10, WEIGHT14 X-Country-Chain: CANADA-UNITED STATES-destination Susan Duncan Web/Communications Officer / Agent des Communications/web Union of Taxation Employees / Syndicat des employées de l'Impôt Tel: 613-235-6704 ext 240 Fax: 613-234-7290 e-mail: [EMAIL PROTECTED] http://www.ute-sei.org/
RE: [Declude.JunkMail] whitelisted but not
um, there are 2 X-Declude-Tests lines. One of them is proably added by the sender (likely the whitelisted line). Note that there are also 2 X-Declude-Spoolname lines with different spoolnames. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Susan DuncanSent: Monday, June 06, 2005 1:57 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] whitelisted but not Here are the headers from a message that was forwarded to my spam email account. It shows that its whitelisted but it was still caught. X-Declude-Sender: [EMAIL PROTECTED] [127.0.0.1]X-Declude-Spoolname: D5E8705DC5A1F.GSCX-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam.X-Declude-Scan: Score [0] at 21:19:04 on 01 Jun 2005X-Declude-Tests: WhitelistedX-Country-Chain: X-RBL-Warning: MXRATE-BLOCK: "http://www.mxrate.com/lookup/refused.asp?ipaddress=32.97.166.48"X-RBL-Warning: MAILFROM: Domain ute-sei.org has no MX or A records [0001].X-RBL-Warning: SUBJECTCHARS: Subject with at least 50 characters found.X-Declude-Sender: [EMAIL PROTECTED] [32.97.166.48]X-Declude-Spoolname: D5EF114F40118D5BC.SMDX-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam.X-Declude-Scan: Score [18] at 21:20:52 on 01 Jun 2005X-Declude-Tests: MXRATE-BLOCK, MAILFROM, SUBJECTCHARS, WEIGHT10, WEIGHT14X-Country-Chain: CANADA-UNITED STATES-destination Susan Duncan Web/Communications Officer / Agent des Communications/webUnion of Taxation Employees / Syndicat des employées de l'ImpôtTel: 613-235-6704 ext 240Fax: 613-234-7290e-mail: [EMAIL PROTECTED]http://www.ute-sei.org/
RE: [Declude.JunkMail] whitelisted but not
Yes, I notice that afterwards. Im not sure why there are two spoolname lines or two test lines. Looking up info in the logfile got very confusing. Susan Duncan Web/Communications Officer / Agent des Communications/web Union of Taxation Employees / Syndicat des employées de l'Impôt Tel: 613-235-6704 ext 240 Fax: 613-234-7290 e-mail: [EMAIL PROTECTED] http://www.ute-sei.org/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Horne Sent: June 6, 2005 2:44 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] whitelisted but not um, there are 2 X-Declude-Tests lines. One of them is proably added by the sender (likely the whitelisted line). Note that there are also 2 X-Declude-Spoolname lines with different spoolnames. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Susan Duncan Sent: Monday, June 06, 2005 1:57 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] whitelisted but not Here are the headers from a message that was forwarded to my spam email account. It shows that its whitelisted but it was still caught. X-Declude-Sender: [EMAIL PROTECTED] [127.0.0.1] X-Declude-Spoolname: D5E8705DC5A1F.GSC X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [0] at 21:19:04 on 01 Jun 2005 X-Declude-Tests: Whitelisted X-Country-Chain: X-RBL-Warning: MXRATE-BLOCK: http://www.mxrate.com/lookup/refused.asp?ipaddress=32.97.166.48 X-RBL-Warning: MAILFROM: Domain ute-sei.org has no MX or A records [0001]. X-RBL-Warning: SUBJECTCHARS: Subject with at least 50 characters found. X-Declude-Sender: [EMAIL PROTECTED] [32.97.166.48] X-Declude-Spoolname: D5EF114F40118D5BC.SMD X-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [18] at 21:20:52 on 01 Jun 2005 X-Declude-Tests: MXRATE-BLOCK, MAILFROM, SUBJECTCHARS, WEIGHT10, WEIGHT14 X-Country-Chain: CANADA-UNITED STATES-destination Susan Duncan Web/Communications Officer / Agent des Communications/web Union of Taxation Employees / Syndicat des employées de l'Impôt Tel: 613-235-6704 ext 240 Fax: 613-234-7290 e-mail: [EMAIL PROTECTED] http://www.ute-sei.org/
RE: [Declude.JunkMail] whitelisted but not
It likely means that the sender also uses Declude and scans outgoing email. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Susan DuncanSent: Monday, June 06, 2005 3:05 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] whitelisted but not Yes, I notice that afterwards. Im not sure why there are two spoolname lines or two test lines. Looking up info in the logfile got very confusing. Susan Duncan Web/Communications Officer / Agent des Communications/webUnion of Taxation Employees / Syndicat des employées de l'ImpôtTel: 613-235-6704 ext 240Fax: 613-234-7290e-mail: [EMAIL PROTECTED]http://www.ute-sei.org/ -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan HorneSent: June 6, 2005 2:44 PMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] whitelisted but not um, there are 2 X-Declude-Tests lines. One of them is proably added by the sender (likely the whitelisted line). Note that there are also 2 X-Declude-Spoolname lines with different spoolnames. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Susan DuncanSent: Monday, June 06, 2005 1:57 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] whitelisted but not Here are the headers from a message that was forwarded to my spam email account. It shows that its whitelisted but it was still caught. X-Declude-Sender: [EMAIL PROTECTED] [127.0.0.1]X-Declude-Spoolname: D5E8705DC5A1F.GSCX-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam.X-Declude-Scan: Score [0] at 21:19:04 on 01 Jun 2005X-Declude-Tests: WhitelistedX-Country-Chain: X-RBL-Warning: MXRATE-BLOCK: "http://www.mxrate.com/lookup/refused.asp?ipaddress=32.97.166.48"X-RBL-Warning: MAILFROM: Domain ute-sei.org has no MX or A records [0001].X-RBL-Warning: SUBJECTCHARS: Subject with at least 50 characters found.X-Declude-Sender: [EMAIL PROTECTED] [32.97.166.48]X-Declude-Spoolname: D5EF114F40118D5BC.SMDX-Declude-Note: Scanned by Declude 2.0.6 (http://www.declude.com/x-note.htm) for spam.X-Declude-Scan: Score [18] at 21:20:52 on 01 Jun 2005X-Declude-Tests: MXRATE-BLOCK, MAILFROM, SUBJECTCHARS, WEIGHT10, WEIGHT14X-Country-Chain: CANADA-UNITED STATES-destination Susan Duncan Web/Communications Officer / Agent des Communications/webUnion of Taxation Employees / Syndicat des employées de l'ImpôtTel: 613-235-6704 ext 240Fax: 613-234-7290e-mail: [EMAIL PROTECTED]http://www.ute-sei.org/
[Declude.JunkMail] Whitelisted[0]
Hi all, We tag email with the subject tag "SPAM*-" when email gets a score of higher than 10. What happened here. It says that it was whitelisted but it still tagged with "SPAM*-" Message Headers. Reply-To: [EMAIL PROTECTED]From: "Eddie Jacob" [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: RE: *SPAM -FW: National Flame ScheduleDate: Tue, 20 Jul 2004 13:23:43 -0500Message-ID: [EMAIL PROTECTED]MIME-Version: 1.0Content-Type: text/plain;charset="iso-8859-1"Content-Transfer-Encoding: quoted-printableX-Mailer: Microsoft Outlook, Build 10.0.2627Thread-Index: AcRuhvuoW48llqwwRhSwNFVG4SVYDA==X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441In-Reply-To: [EMAIL PROTECTED]X-Declude-Sender:[EMAIL PROTECTED] [208.57.78.89]X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.X-Spam-Tests-Failed: Whitelisted [0]X-RCPT-TO: [EMAIL PROTECTED]X-UIDL: 356763148 Jay Calvert
Re: [Declude.JunkMail] Whitelisted[0]
We tag email with the subject tag SPAM*- when email gets a score of higher than 10. What happened here. It says that it was whitelisted but it still tagged with SPAM*- What happened here is that someone got an E-mail with *SPAM in the subject, and replied to it: Subject: RE: *SPAM -FW: National Flame Schedule Declude JunkMail only adds to the beginning of the subject, but this one starts with RE:. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted[0]
Nevermind! Is it Friday yet? - Original Message - From: Jay Calvert To: [EMAIL PROTECTED] Sent: Tuesday, July 20, 2004 1:17 PM Subject: [Declude.JunkMail] Whitelisted[0] Hi all, We tag email with the subject tag "SPAM*-" when email gets a score of higher than 10. What happened here. It says that it was whitelisted but it still tagged with "SPAM*-" Message Headers. Reply-To: [EMAIL PROTECTED]From: "Eddie Jacob" [EMAIL PROTECTED]To: [EMAIL PROTECTED]Subject: RE: *SPAM -FW: National Flame ScheduleDate: Tue, 20 Jul 2004 13:23:43 -0500Message-ID: [EMAIL PROTECTED]MIME-Version: 1.0Content-Type: text/plain;charset="iso-8859-1"Content-Transfer-Encoding: quoted-printableX-Mailer: Microsoft Outlook, Build 10.0.2627Thread-Index: AcRuhvuoW48llqwwRhSwNFVG4SVYDA==X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441In-Reply-To: [EMAIL PROTECTED]X-Declude-Sender:[EMAIL PROTECTED] [208.57.78.89]X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam.X-Spam-Tests-Failed: Whitelisted [0]X-RCPT-TO: [EMAIL PROTECTED]X-UIDL: 356763148 Jay Calvert
Re: [Declude.JunkMail] Whitelisted- getting thru
Does it matter that I don't have postmaster whitelisted...is this test still valid? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, May 19, 2004 1:44 PM Subject: RE: [Declude.JunkMail] Whitelisted- getting thru Andy, This works because the action on the Postmaster test is ROUTETO back to the postmaster. How it works [1] Lowers the weight of the email by 100 so that the message will not be held or deleted in our system [2] Re-routes the message back to the postmaster only if the postmaster account was an actual recipient of that email. Our policy is that we want to accept any mail destined to the postmaster or abuse account simply because if someone is being blocked by our spam filtering we would like to give them the opportunity to contact us to resolve the issue. However, with just whitelisting the postmaster account you open yourself up to allowing spam to your users if the spammer adds the postmaster account to the email. The solution above mitigates this, because it reroutes the message to the postmaster preventing it from going to the user. The -100 just prevents it from being deleted. So in the end [1] The postmaster gets the mail and the other recipients don't. Darrell Quoting Andy Schmidt [EMAIL PROTECTED]: Darrell: Your technique assigns a weight of -100 to the mail if it contains a certain email address as the recipient? Once the mail has a weight of -100 (adjusted by any failed tests) - how does that PREVENT the email from being delivered to all the OTHER recipients? I'm not clear how the effect is different from a whitelist? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, May 19, 2004 12:51 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelisted- getting thru Richard, This is a common problem especially when dealing with postmaster account. Most people whitelist postmaster and because spammers know this they often include a postmaster address because they know the message (even to the other recipients) will be delivered. I posted awhile back on what I do to get around it. Check out http://www.mail-archive.com/[EMAIL PROTECTED]/msg11041.html Hope this helps! Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Quoting Richard Farris [EMAIL PROTECTED]: I have noticed that some of the spam getting thru is because a I have several in my whitelist and even though it is not addressed to them it sends it on because the whitelisted email is in the CC or BCC... Isn't there any way to whitelist only if it is addressed to that person in the To: box? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. - Check out http://www.invariantsystems.com for utilities for Declude and Imail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted- getting thru
Richard, In my experience it is not a good idea to whitelist the postmaster account for the exact reasons you posted below. If you have the postmaster account whitelisted any incoming spam with multiple recipients listed will end up having the mail delivered. However, the setup of tests below that I outlined [1] allows the mail to be delivered to the postmaster, but [2] prevents it from being delivered to the other recipients. Hope that helps. Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Quoting Richard Farris [EMAIL PROTECTED]: Does it matter that I don't have postmaster whitelisted...is this test still valid? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, May 19, 2004 1:44 PM Subject: RE: [Declude.JunkMail] Whitelisted- getting thru Andy, This works because the action on the Postmaster test is ROUTETO back to the postmaster. How it works [1] Lowers the weight of the email by 100 so that the message will not be held or deleted in our system [2] Re-routes the message back to the postmaster only if the postmaster account was an actual recipient of that email. Our policy is that we want to accept any mail destined to the postmaster or abuse account simply because if someone is being blocked by our spam filtering we would like to give them the opportunity to contact us to resolve the issue. However, with just whitelisting the postmaster account you open yourself up to allowing spam to your users if the spammer adds the postmaster account to the email. The solution above mitigates this, because it reroutes the message to the postmaster preventing it from going to the user. The -100 just prevents it from being deleted. So in the end [1] The postmaster gets the mail and the other recipients don't. Darrell Quoting Andy Schmidt [EMAIL PROTECTED]: Darrell: Your technique assigns a weight of -100 to the mail if it contains a certain email address as the recipient? Once the mail has a weight of -100 (adjusted by any failed tests) - how does that PREVENT the email from being delivered to all the OTHER recipients? I'm not clear how the effect is different from a whitelist? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, May 19, 2004 12:51 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelisted- getting thru Richard, This is a common problem especially when dealing with postmaster account. Most people whitelist postmaster and because spammers know this they often include a postmaster address because they know the message (even to the other recipients) will be delivered. I posted awhile back on what I do to get around it. Check out http://www.mail-archive.com/[EMAIL PROTECTED]/msg11041.html Hope this helps! Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Quoting Richard Farris [EMAIL PROTECTED]: I have noticed that some of the spam getting thru is because a I have several in my whitelist and even though it is not addressed to them it sends it on because the whitelisted email is in the CC or BCC... Isn't there any way to whitelist only if it is addressed to that person in the To: box? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. - Check out http://www.invariantsystems.com for utilities for Declude and Imail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail
RE: [Declude.JunkMail] Whitelisted- getting thru
Actually - I used combinations of BypassWhitelisting with both the total weight and number of recipients. Someone who has a high weight and sends to the postmaster only, can get through. Someone who sends to a few people plus the postmaster, can only have a medium weight. Someone who sends to a whole bunch of people plus the postmaster, better have close to 0 weight. This way, VALID messages to postmaster can get through. The higher the weight, the less tolerant my system is with allowing additional recipients. Every day a TON of messages are NOT whitelisted - because the weight and/or the number of other recipients was too high. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, May 21, 2004 08:40 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelisted- getting thru Richard, In my experience it is not a good idea to whitelist the postmaster account for the exact reasons you posted below. If you have the postmaster account whitelisted any incoming spam with multiple recipients listed will end up having the mail delivered. However, the setup of tests below that I outlined [1] allows the mail to be delivered to the postmaster, but [2] prevents it from being delivered to the other recipients. Hope that helps. Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Quoting Richard Farris [EMAIL PROTECTED]: Does it matter that I don't have postmaster whitelisted...is this test still valid? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, May 19, 2004 1:44 PM Subject: RE: [Declude.JunkMail] Whitelisted- getting thru Andy, This works because the action on the Postmaster test is ROUTETO back to the postmaster. How it works [1] Lowers the weight of the email by 100 so that the message will not be held or deleted in our system [2] Re-routes the message back to the postmaster only if the postmaster account was an actual recipient of that email. Our policy is that we want to accept any mail destined to the postmaster or abuse account simply because if someone is being blocked by our spam filtering we would like to give them the opportunity to contact us to resolve the issue. However, with just whitelisting the postmaster account you open yourself up to allowing spam to your users if the spammer adds the postmaster account to the email. The solution above mitigates this, because it reroutes the message to the postmaster preventing it from going to the user. The -100 just prevents it from being deleted. So in the end [1] The postmaster gets the mail and the other recipients don't. Darrell Quoting Andy Schmidt [EMAIL PROTECTED]: Darrell: Your technique assigns a weight of -100 to the mail if it contains a certain email address as the recipient? Once the mail has a weight of -100 (adjusted by any failed tests) - how does that PREVENT the email from being delivered to all the OTHER recipients? I'm not clear how the effect is different from a whitelist? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, May 19, 2004 12:51 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelisted- getting thru Richard, This is a common problem especially when dealing with postmaster account. Most people whitelist postmaster and because spammers know this they often include a postmaster address because they know the message (even to the other recipients) will be delivered. I posted awhile back on what I do to get around it. Check out http://www.mail-archive.com/[EMAIL PROTECTED]/msg11041. html Hope this helps! Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Quoting Richard Farris [EMAIL PROTECTED]: I have noticed that some of the spam getting thru is because a I have several in my whitelist and even though it is not addressed to them it sends it on because the whitelisted email is in the CC or BCC... Isn't there any way to whitelist only if it is addressed to that person in the To: box
[Declude.JunkMail] Whitelisted- getting thru
I have noticed that some of the spam getting thru is because a I have several in my whitelist and even though it is not addressed to them it sends it on because the whitelisted email is in the CC or BCC... Isn't there any way to whitelist only if it is addressed to that person in the To: box? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support
Re: [Declude.JunkMail] Whitelisted- getting thru
On 19 May 2004 at 9:04, Richard Farris wrote: Kinda - there is a test called BYPASSWHITELIST http://www.mail- archive.com/[EMAIL PROTECTED]/msg17561.html Hope this helps! -Nick Hayer I have noticed that some of the spam getting thru is because a I have several in my whitelist and even though it is not addressed to them it sends it on because the whitelisted email is in the CC or BCC... Isn't there any way to whitelist only if it is addressed to that person in the To: box? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisted- getting thru
Darrell: Your technique assigns a weight of -100 to the mail if it contains a certain email address as the recipient? Once the mail has a weight of -100 (adjusted by any failed tests) - how does that PREVENT the email from being delivered to all the OTHER recipients? I'm not clear how the effect is different from a whitelist? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, May 19, 2004 12:51 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelisted- getting thru Richard, This is a common problem especially when dealing with postmaster account. Most people whitelist postmaster and because spammers know this they often include a postmaster address because they know the message (even to the other recipients) will be delivered. I posted awhile back on what I do to get around it. Check out http://www.mail-archive.com/[EMAIL PROTECTED]/msg11041.html Hope this helps! Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Quoting Richard Farris [EMAIL PROTECTED]: I have noticed that some of the spam getting thru is because a I have several in my whitelist and even though it is not addressed to them it sends it on because the whitelisted email is in the CC or BCC... Isn't there any way to whitelist only if it is addressed to that person in the To: box? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisted- getting thru
Andy, This works because the action on the Postmaster test is ROUTETO back to the postmaster. How it works [1] Lowers the weight of the email by 100 so that the message will not be held or deleted in our system [2] Re-routes the message back to the postmaster only if the postmaster account was an actual recipient of that email. Our policy is that we want to accept any mail destined to the postmaster or abuse account simply because if someone is being blocked by our spam filtering we would like to give them the opportunity to contact us to resolve the issue. However, with just whitelisting the postmaster account you open yourself up to allowing spam to your users if the spammer adds the postmaster account to the email. The solution above mitigates this, because it reroutes the message to the postmaster preventing it from going to the user. The -100 just prevents it from being deleted. So in the end [1] The postmaster gets the mail and the other recipients don't. Darrell Quoting Andy Schmidt [EMAIL PROTECTED]: Darrell: Your technique assigns a weight of -100 to the mail if it contains a certain email address as the recipient? Once the mail has a weight of -100 (adjusted by any failed tests) - how does that PREVENT the email from being delivered to all the OTHER recipients? I'm not clear how the effect is different from a whitelist? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, May 19, 2004 12:51 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelisted- getting thru Richard, This is a common problem especially when dealing with postmaster account. Most people whitelist postmaster and because spammers know this they often include a postmaster address because they know the message (even to the other recipients) will be delivered. I posted awhile back on what I do to get around it. Check out http://www.mail-archive.com/[EMAIL PROTECTED]/msg11041.html Hope this helps! Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Quoting Richard Farris [EMAIL PROTECTED]: I have noticed that some of the spam getting thru is because a I have several in my whitelist and even though it is not addressed to them it sends it on because the whitelisted email is in the CC or BCC... Isn't there any way to whitelist only if it is addressed to that person in the To: box? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. - Check out http://www.invariantsystems.com for utilities for Declude and Imail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelisted- getting thru
Uh - INTERESTING. I need to read up on ROUTETO. I didn't realize it could be used to eliminate extraneous CC/BCC users. Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, May 19, 2004 02:44 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Whitelisted- getting thru Andy, This works because the action on the Postmaster test is ROUTETO back to the postmaster. How it works [1] Lowers the weight of the email by 100 so that the message will not be held or deleted in our system [2] Re-routes the message back to the postmaster only if the postmaster account was an actual recipient of that email. Our policy is that we want to accept any mail destined to the postmaster or abuse account simply because if someone is being blocked by our spam filtering we would like to give them the opportunity to contact us to resolve the issue. However, with just whitelisting the postmaster account you open yourself up to allowing spam to your users if the spammer adds the postmaster account to the email. The solution above mitigates this, because it reroutes the message to the postmaster preventing it from going to the user. The -100 just prevents it from being deleted. So in the end [1] The postmaster gets the mail and the other recipients don't. Darrell Quoting Andy Schmidt [EMAIL PROTECTED]: Darrell: Your technique assigns a weight of -100 to the mail if it contains a certain email address as the recipient? Once the mail has a weight of -100 (adjusted by any failed tests) - how does that PREVENT the email from being delivered to all the OTHER recipients? I'm not clear how the effect is different from a whitelist? Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, May 19, 2004 12:51 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Whitelisted- getting thru Richard, This is a common problem especially when dealing with postmaster account. Most people whitelist postmaster and because spammers know this they often include a postmaster address because they know the message (even to the other recipients) will be delivered. I posted awhile back on what I do to get around it. Check out http://www.mail-archive.com/[EMAIL PROTECTED]/msg11041.html Hope this helps! Darrell - Check out http://www.invariantsystems.com for utilities for Declude and Imail. Quoting Richard Farris [EMAIL PROTECTED]: I have noticed that some of the spam getting thru is because a I have several in my whitelist and even though it is not addressed to them it sends it on because the whitelisted email is in the CC or BCC... Isn't there any way to whitelist only if it is addressed to that person in the To: box? Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. - Check out http://www.invariantsystems.com for utilities for Declude and Imail. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelisted?
I have spam that is getting through. The headers show Whitelisted (0) . From: Terrell Vann [EMAIL PROTECTED] Reply-To: Terrell Vann [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: LOw Cost Som@, X(a)[EMAIL PROTECTED], Valï(u)m, Viagr@ Di3t Pills Many M3ds kyrqbxh Date: Sun, 18 Jan 2004 10:26:02 +0500 X-Mailer: PIPEX NetMail 2.2.0-pre13 X-Declude-Sender: [EMAIL PROTECTED] [67.172.213.160] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-Note: This E-mail was sent from c-67-172-213-160.client.comcast.net ([67.172.213.160]). I only have one Whitelist entry in by Declude config besides the default and I generally do not use whitelists. Since I dont use them I not up on what may be causing this. WHITELISTHABEAS WHITELISTFROM @i360.net Can anyone shed some light? Thanks, Todd Hunter --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted?
That's one of those Habeas header emails. Whitelisting them lately has been a very bad idea. It's nice though that they always seem to mark their spam with a low priority. I just sort by priority and I can select all the offenders and forward them to spamcop. --Joshua Levitsky, MCSE, CISSPSystem EngineerTime Inc. Information Technology[5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1] - Original Message - From: Todd To: [EMAIL PROTECTED] Sent: Sunday, January 18, 2004 5:33 PM Subject: [Declude.JunkMail] Whitelisted? I have spam that is getting through. The headers show Whitelisted (0) . From: "Terrell Vann" [EMAIL PROTECTED] Reply-To: "Terrell Vann" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: LOw Cost Som@, X(a)[EMAIL PROTECTED], Valï(u)m, Viagr@ Di3t Pills Many M3ds kyrqbxh Date: Sun, 18 Jan 2004 10:26:02 +0500 X-Mailer: PIPEX NetMail 2.2.0-pre13 X-Declude-Sender: [EMAIL PROTECTED] [67.172.213.160] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-Note: This E-mail was sent from c-67-172-213-160.client.comcast.net ([67.172.213.160]). I only have one Whitelist entry in by Declude config besides the default and I generally do not use whitelists. Since I dont use them I not up on what may be causing this. WHITELISTHABEASWHITELISTFROM @i360.netCan anyone shed some light?Thanks,Todd Hunter--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] whitelisted
HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Yes; the pharmacourt.biz spammers have infringed on the Habeas intellectual property rights. Habeas is going after them. Until this dies down, you may want to temporarily comment out the WHITELIST HABEAS line in the \IMail\Declude\global.cfg file. You should also report it to them (the spammer was nice enough to include the URL to report it at in the headers!). Reporting is important because although Habeas knows that this has happened, they are collecting as much information as possible. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
These emails are definately spam. Looks like HABEAS has been compromised? More like spammers are forging habeas headers and challenging habeus' ability to prosecute. Larry Craddock --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelisted
Fwiw.. I would never whitelist any email based solely because they warranted it to be spam free... Email headers can and do get forged all the time. I have recently sent them a letter and a lot of porno and spam email for them to review.. ~Rick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andyb Sent: Tuesday, January 13, 2004 12:13 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] whitelisted HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ___ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. ___ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelisted
I received 13 of these today in my personal e-mail. I changed Habeas from whitelist to weight -5 and it seems to have fixed the problem. Don't know yet if non spam is getting blocked but I doubt it. Here is a log entry after change (weight was 36 even with the -5): 01/13/2004 11:09:12 Q26340f0201364351 HABEAS:-5 AHBL:6 CBL:4 DSBL:6 SORBS-SOCKS:5 SORBS-DUHL:4 SPAMCOP:7 SNIFFER2:9 . Total weight = 36. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed HABEAS (). Action=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed AHBL (Open Proxy - http://www.ahbl.org/tools/lookup.php?ip=68.57.145.231;). Action=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed CBL (Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=68.57.145.231;). Action=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed DSBL (http://dsbl.org/listing?ip=68.57.145.231;). Action=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed SORBS-SOCKS (Dynamic IP Address See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=68.57.145.231;). Action=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed SORBS-DUHL (Dynamic IP Address See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=68.57.145.231;). Action=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed SPAMCOP (Blocked - see http://www.spamcop.net/bl.shtml?68.57.145.231;). Action=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed WEIGHT10 (Weight of 36 reaches or exceeds the limit of 10.). Action=HOLD. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed WEIGHT15 (Weight of 36 reaches or exceeds the limit of 15.). ction=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed WEIGHT20 (Weight of 36 reaches or exceeds the limit of 20.). Action=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Msg failed SNIFFER2 (Message failed SNIFFER2: 52.). Action=IGNORE. 01/13/2004 11:09:12 Q26340f0201364351 Subject: Got Pills?Valï(u)m, V|@gra, X(a)[EMAIL PROTECTED], S0ma Di3t Pills Many M3ds brEWTRhNhf 01/13/2004 11:09:12 Q26340f0201364351 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 68.57.145.231 ID: Here is the change in Global.cfg: #WHITELIST HABEAS HABEAS habeas x x -5 0 Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andyb Sent: Tuesday, January 13, 2004 12:13 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] whitelisted HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
I got that this morning as well. I commented out the HABEAS test. - Original Message - From: andyb [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 1:13 PM Subject: [Declude.JunkMail] whitelisted HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] whitelisted
Andy, Habeas has not been compromised. Since Saturday, a spammer has been using the Habeas warrant in the headers to get his junk past configurations like yours. This header text is easy to insert. Note that the X-Mailer: header is also being faked. Each of the spams I've seen like this have come through a zombie on a consumer broadband computer. And is advertising one of three domain names. The general consensus is that you shouldn't WHITELIST on any easily forged text, including the Habeas warrant. Check the archive in the last few days for this list for more discussion and sample configurations that have shared. http://www.mail-archive.com/[EMAIL PROTECTED]/ Andrew 8) -Original Message- From: andyb [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 10:13 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] whitelisted HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
This was whitelisted as it is/was part of the default config file... - Original Message - From: Rick Klinge [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 1:25 PM Subject: RE: [Declude.JunkMail] whitelisted Fwiw.. I would never whitelist any email based solely because they warranted it to be spam free... Email headers can and do get forged all the time. I have recently sent them a letter and a lot of porno and spam email for them to review.. ~Rick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of andyb Sent: Tuesday, January 13, 2004 12:13 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] whitelisted HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. ___ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. ___ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
I have been reporting as they come up. Thanks, Andy - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 1:13 PM Subject: Re: [Declude.JunkMail] whitelisted I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Yes; the pharmacourt.biz spammers have infringed on the Habeas intellectual property rights. Habeas is going after them. Until this dies down, you may want to temporarily comment out the WHITELIST HABEAS line in the \IMail\Declude\global.cfg file. You should also report it to them (the spammer was nice enough to include the URL to report it at in the headers!). Reporting is important because although Habeas knows that this has happened, they are collecting as much information as possible. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
Hi, If people can use Habeas headers to get their spam delivered, then Habeas HAS been compromised. To say otherwise is a symantic difference that I don't care to debate. Bottom line is that Habeus Warrant doesn't mean anything right now. As for a configuration like mine, as I said, this is included in the default config files obtained directly from Declude. Call me ignorant, that's fine. I have to trust the makers of the software to know what they are doing until I find out/learn otherwise. The purpose of the list is to share info. I could have just taken care of this quietly but instead chose to share the issue on the list because if it was happening to me, I'm sure it is happening to others. I'm sorry if my tone sounds a little indignant. I'm not a stupid person, just a busy one with way too much information to process at times. Thanks, Andy - Original Message - From: Colbeck, Andrew [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 1:46 PM Subject: RE: [Declude.JunkMail] whitelisted Andy, Habeas has not been compromised. Since Saturday, a spammer has been using the Habeas warrant in the headers to get his junk past configurations like yours. This header text is easy to insert. Note that the X-Mailer: header is also being faked. Each of the spams I've seen like this have come through a zombie on a consumer broadband computer. And is advertising one of three domain names. The general consensus is that you shouldn't WHITELIST on any easily forged text, including the Habeas warrant. Check the archive in the last few days for this list for more discussion and sample configurations that have shared. http://www.mail-archive.com/[EMAIL PROTECTED]/ Andrew 8) -Original Message- From: andyb [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 10:13 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] whitelisted HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelisted
On their website you can report the spam and they will go after them... in theory... but for now because so many people are bundling the headers in spam you should probably not whitelist Habeas headers. -- Joshua Levitsky, MCSE, CISSP System Engineer Time Inc. Information Technology [5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1] - Original Message - From: andyb [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 1:13 PM Subject: [Declude.JunkMail] whitelisted HI, I'm getting spam, and it is being whitelisted because of HABEAS... Here are the headers. These emails are definately spam. Looks like HABEAS has been compromised? Comments Please. thanks, Andy Received: from cs78191007.pp.htv.fi [62.78.191.7] by thumpernet.com (SMTPD32-6.06) id A0E113013E; Tue, 13 Jan 2004 12:54:41 -0500 Received: from 240.80.76.18 by 81.218.114.4; Tue, 13 Jan 2004 03:42:04 -0200 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. From: Blaine Shaffer [EMAIL PROTECTED] Reply-To: Blaine Shaffer [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: GOT Valï(u)m, Viagr@, X(a)[EMAIL PROTECTED], Som@ Di3t Pills Many M3ds Y5iov Date: Tue, 13 Jan 2004 04:49:04 -0100 X-Mailer: NetJunction (NetJunction 5.0-p1)/MIME MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--891940459175399 X-Priority: 5 X-Declude-Sender: [EMAIL PROTECTED] [62.78.191.7] X-RBL-Warning: Total weight: 0 X-Note: Total spam weight of this E-mail is 0. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-RCPT-TO: [EMAIL PROTECTED] X-UIDL: 370486507 Status: U --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelisted?
Ok I admit I'm pretty weak in the area of tweaking declude but why was this whitelisted? I have three whitelist lines in my global.cfg ... they are WHITELIST HABEAS and 2 WHITELIST[EMAIL PROTECTED] lines ... Date: Mon, 12 Jan 2004 04:44:57 +0400 X-Mailer: PIPEX NetMail 2.2.0-pre13 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=--7204916354633796 X-Priority: 5 X-IMAIL-SPAM-VALFROM: (1580138816) X-Declude-Sender: [EMAIL PROTECTED] [217.83.120.175] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: Whitelisted [0] X-Note: This E-mail was sent from pD95378AF.dip.t-dialin.net ([217.83.120.175]). X-RCPT-TO: [EMAIL PROTECTED] Status: U X-UIDL: 319325114 thanks, Larry Craddock --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted?
Ok I admit I'm pretty weak in the area of tweaking declude but why was this whitelisted? I have three whitelist lines in my global.cfg ... they are WHITELIST HABEAS and 2 WHITELIST[EMAIL PROTECTED] lines ... What does the Declude JunkMail log file say? Is one of those two WHITELIST lines WHITELIST FROM mail.com (which would whitelist this E-mail, since it came frmo [EMAIL PROTECTED])? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted?
Well I'm not sure how I missed this ... but here's the *rest* of the header info: Received: from pd95378af.dip.t-dialin.net [217.83.120.175] by netride.net (SMTPD32-8.05) id A80D5E2F0140; Mon, 12 Jan 2004 06:50:21 -0600 Received: from 0.139.81.238 by 217.83.120.175; Sun, 11 Jan 2004 21:40:57 -0300 Message-ID: [EMAIL PROTECTED] X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. Now what do I do? Larry Craddock - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, January 12, 2004 7:27 AM Subject: Re: [Declude.JunkMail] Whitelisted? Ok I admit I'm pretty weak in the area of tweaking declude but why was this whitelisted? I have three whitelist lines in my global.cfg ... they are WHITELIST HABEAS and 2 WHITELIST[EMAIL PROTECTED] lines ... What does the Declude JunkMail log file say? Is one of those two WHITELIST lines WHITELIST FROM mail.com (which would whitelist this E-mail, since it came frmo [EMAIL PROTECTED])? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted?
Well I'm not sure how I missed this ... but here's the *rest* of the header info: ... X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. Now what do I do? Have you reported it yet? The Habeas headers are a legal means of whitelisting E-mail. In this case, a spam illegally used the Habeas headers -- something that the people that are behind Habeas have been waiting years for. Now is the true test of Habeas -- if they go after the spammer and successfully sue them, it will (hopefully) discourage other spammers from violating the legal rights of the Habeas headers. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted?
Cool ... I'll report it right now. - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, January 12, 2004 8:04 AM Subject: Re: [Declude.JunkMail] Whitelisted? Well I'm not sure how I missed this ... but here's the *rest* of the header info: ... X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to http://www.habeas.com/report/. Now what do I do? Have you reported it yet? The Habeas headers are a legal means of whitelisting E-mail. In this case, a spam illegally used the Habeas headers -- something that the people that are behind Habeas have been waiting years for. Now is the true test of Habeas -- if they go after the spammer and successfully sue them, it will (hopefully) discourage other spammers from violating the legal rights of the Habeas headers. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisted?
At 06:04 AM 1/12/2004, R. Scott Perry wrote: The Habeas headers are a legal means of whitelisting E-mail. In this case, a spam illegally used the Habeas headers -- something that the people that are behind Habeas have been waiting years for. Now is the true test of Habeas -- if they go after the spammer and successfully sue them, it will (hopefully) discourage other spammers from violating the legal rights of the Habeas headers. Coincidentally, I received a similar spam yesterday. The message originated in Queensland from what I can tell from the IP address, was sent through Amsterdam and the body has links to a volume mailer in Phoenix, AZ. It had the Habeas headers so I reported them. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelisted
Hello, One of our clients has been forwarding e-mails that have made it through the cracks and found something interesting. I have our network whitelisted, and have the secdns entry so that it checks the ip of the originating server when it comes through the sec mail server. But today, I noticed something (I don't have the original message or headers; but printed out the message). The IP of our secondary mail server is 67.17.218.70. I received a message that had its IP put in as the hostname. So Declude saw this IP and whitelisted. I'll type a couple lines of the headers: Received: from secmail.crescentdigital.com [67.17.218.70] by mail.crescentdigital.com with ESMTP (SMTPD32-6.06) id ADFD3B007E; Fri, 14 Nov 2003 08:51:57 -0500 Received: from 67.17.218.70 ([211.219.196.240]) by secmail.crescentdigital.com (8.12.8/8.12.5) with SMTP id hAEEpdwo012904; Fri, 14 Nov 2003 09:51:41 -0500 Received: from [135.4.188.96] by 67.17.218.70 SMTP id 1fYH8RwA83HJQ7; Wed, 19 Nov 2003 19:45:46 -0700 X-Mailer: AOL 7.0 for Windows US sub 118 X-Spam-Tests-Failed: Whitelisted I have Declude Standard (one of the latest version, but not the latest). Is there anyway to fix this? The 211.219 IP is a Korean IP and the 135.4 is Lucent (?). Thanks.. Jeff --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelisted - why?
Scott, any chance that the "FROM hm-software.com" whitelist picked up on the Return-Path: 36-809-hm-software.com?[EMAIL PROTECTED] ? Obviously, the intent is to ONLY whitelist things that END with "hm-software.com". WHITELISTANYWHERE [EMAIL PROTECTED]WHITELISTIP63.107.174.WHITELISTIP65.86.89.162WHITELISTFROMhm-software.comWHITELISTFROMger-studioline.net#WHITELISTFROMt-online.deWHITELISTFROMnetworksolutions.comWHITELISTFROMverisign.net#WHITELISTIP128.192.1.101WHITELISTIP130.160.4.249WHITELISTIP199.232.158.102WHITELISTFROMnytimes.comWHITELISTIP148.100.1.2WHITELISTIP64.65.65.2WHITELISTFROMlists.cnn.comWHITELISTFROMtimeinc.comWHITELISTFROMdeepmetrix.comWHITELISTIP67.89.150.4WHITELISTFROMuni.deWHITELISTIP206.242.213.5WHITELISTIP206.64.5.31WHITELISTFROMstellenmarkt.deWHITELISTIP64.119.137. WHITELISTFROMfx-solutions.com 07/23/2002 15:51:14 Qb3ab045201d434d3 SPAMCOP:7 HEUR9:3 WEIGHTFILTER:8 . Total weight = 1807/23/2002 15:51:14 Qb3ab045201d434d3 This E-mail was whitelisted - automatically passing all spam tests -Original Message- Received: from stdout-03.superstorespecials.com [198.64.151.132] by hm-software.com (SMTPD32-7.07) id A3AB45201D4; Tue, 23 Jul 2002 15:51:07 -0400From: ContentAudit [EMAIL PROTECTED]Subject: Advisory: Hidden file dangerTo: [EMAIL PROTECTED]X-Track: 36;GSGOGEBHRLBVGVGNGKGHGEBEEQGNGKCKBVGLGGBEBBGSBCGRCOGVGLGKMIME-Version: 1.0Content-Type: multipart/alternative; boundary="102745310521054"X-vmp-Text: yesDate: Tue, 23 Jul 2002 15:51:07 ESTX-Mailer: 0.35 [Jul 4 2002, 21:14:52]Message-ID: 809$[EMAIL PROTECTED]X-Declude: Version 1.56i; Db3ab045201d434d3.SMD from stdout-03.superstorespecials.com. [198.64.151.132]Return-Path: 36-809-hm-software.com?[EMAIL PROTECTED]X-RCPT-TO: [EMAIL PROTECTED]Status: UX-UIDL: 323387411 From: ContentAudit [mailto:[EMAIL PROTECTED]]Sent: Tuesday, July 23, 2002 04:51 PMTo: [EMAIL PROTECTED]Subject: Advisory: Hidden file danger You are receiving this message because while visiting SuperStoresSpecials' partner site, Mindseti, you opted in to receive special online information and discounts.As a member of SuperStoresSpecials you'll be amongst the first to find out about great shoppingdiscounts and offers from name brand companies.If you do not wish to continue to receive these offers simply click here - Unsubscribe Did you know that your computer AUTOMATICALLY SAVES every PICTURE from every WEBSITE you visit? This function helps your PC access your favorite websites more quickly, but it also allows EXPLICIT adult pictures to be saved to your computer if adult websites have been accidentally or intentionally visited! FREE, confidential online PC check! Safely detect offensive files in just minutes! www.contentwatch.com (Note: Scan will not display images--only file names that may indicate the presence of offensive material.) We strongly oppose the continued sending of unsolicited email and do not want to send email to anyone who does not wish to receive our special mailings. If you would prefer to not receive these messages in the future, please Click Here . We practice responsible mailing by honoring all remove requests and following all U.S. laws. We are in compliance with all state and Federal Laws regarding commercial email solicitations. The e-mail subscription address is: [EMAIL PROTECTED] TM:36;GSGOGEBHRLBVGVGNGKGHGEBEEQGNGKCKBVGLGGBEBBGSBCGRCOGVGLGK
Re: [Declude.JunkMail] Whitelisted - why?
WHITELIST FROM hm-software.com Change it to: WHITELIST FROM @hm-software.com I believe this will do what you need. At least I hope so as this is what I have been doing... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications360-457-9023 Nationwide access with neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
