RE: [Declude.JunkMail] Kill List not working.....
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, February 10, 2004 1:34 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Kill List not working. Ah, perhaps you have more time to spend on your antispam system than I do! Andrew 8) -Original Message- From: Jason [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 10, 2004 12:14 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Kill List not working. Ah, but the Kill.lst is an envelope rejection. It saves many more resources this way. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, February 10, 2004 2:03 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Kill List not working. Bennie, blocking spammers by their domain name only is a losing proposition. You're already using SBL... I'd suggest that you also implement the SORBS tests and the MAILPOLICE tests. Checking my own spam, we also received mail from this spammer, but we caught it without having to check for their domain name du jeur. Andrew. -Original Message- From: Bennie [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 10, 2004 3:18 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Kill List not working. Hello all. I was asked some time ago to add a domail to my kill list.. I added it. But the customer is still recieving spam from this domail. They sent me the headers (I have them listed below) and I see the domail in the headers. but I never see where it failed the KillList. Headers--- Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500 Date: Mon, 09 Feb 2004 23:57:24 -0500 Subject: Exclusive X-Soaked Model Photos From: Budapest Bukkake <[EMAIL PROTECTED]> To: Return-Path: [EMAIL PROTECTED] X-Sender: [EMAIL PROTECTED] X-Mailer: Mailer Software (rev. 01/15/2004) Message-Id: <[EMAIL PROTECTED]> MIME-version: 1.0 Content-type: multipart/alternative; boundary="iqxhhbldriaiwihk" X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50 with no reverse DNS entry. X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12] X-Note: QueInControl: D6398669f014033a3.SMD (1) X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12] X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50] X-Note: SMTP Real From: [EMAIL PROTECTED] X-Note: SMTP Real To: X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]). X-RBL-Warning: Total spam weight of this E-mail is 12. X-RCPT-TO: Status: U X-UIDL: 374908735 Here is the entry in my killl list file .ramthehole.com ID-20040204-pep007 here is the line from my GLOBAL.CFG KFROMfromfile e:\imail\declude\fromfile.txt x 15 0 KFrom WARN Line from $DEFAULT$.JUNKMAIL KFROM WARN X-RBL-Warning: This E-mail failed the KILL File test Thanks Bennie --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by CENTRIC INTERNET SERVICES] --- [This E-mail scanned for viruses by CENTRIC INTERNET SERVICES] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declud
RE: [Declude.JunkMail] Kill List not working.....
No problem, Bennie. The MailPolice tests are RHSBL tests, which means that they test the domain name instead of of the IP address of the sender: # For information on these tests, see http://rhs.mailpolice.com/ MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 5 0 MAILPOLICE-PORN rhsbl porn.rhs.mailpolice.com 127.0.0.2 10 0 You can set the weights according to your own traffic and your measure of trust in these lists. And of course you need a corresponding action like MAILPOLICE-BULK WARN in your global.cfg or your domain specific $default$.junkmail Also, the listing for the sending IP is still in the SORBS test I saw triggered, so perhaps you're not using all of the SORBS tests: # For more information on these tests, see http://www.dnsbl.sorbs.net/ # Hosts that send spam and netblocks of providers that support spammers # sometimes includes abused providers like Sympatico and AT&T SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 4 0 There are something like a dozen SORBS tests, and you may not be interested in all of them, and you may want to score them differently. For example, I use SORBS-SPAM but I give it a low weight, but I also use SORBS-ZOMBIE and give it a much higher weight. Andrew 8) -Original Message- From: Bennie [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 10, 2004 1:33 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Kill List not working. Thanks for the help guys. Andrew.. I have the sorbs inplace but I see it did not fail those.. what is the line for mailpolice? Bennie - Original Message - From: "Colbeck, Andrew" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, February 10, 2004 3:34 PM Subject: RE: [Declude.JunkMail] Kill List not working. > Ah, perhaps you have more time to spend on your antispam system than I do! > > Andrew 8) > > -Original Message- > From: Jason [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 10, 2004 12:14 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Kill List not working. > > > Ah, but the Kill.lst is an envelope rejection. It saves many more > resources this way. > > Jason > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew > Sent: Tuesday, February 10, 2004 2:03 PM > To: '[EMAIL PROTECTED]' > Subject: RE: [Declude.JunkMail] Kill List not working. > > > Bennie, blocking spammers by their domain name only is a losing > proposition. You're already using SBL... I'd suggest that you also > implement the SORBS tests and the MAILPOLICE tests. > > Checking my own spam, we also received mail from this spammer, but we > caught it without having to check for their domain name du jeur. > > Andrew. > > -Original Message- > From: Bennie [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 10, 2004 3:18 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Kill List not working. > > > Hello all. > > I was asked some time ago to add a domail to my kill list.. I added it. > But the customer is still recieving spam from this domail. They sent me > the headers (I have them listed below) and I see the domail in the > headers. but I never see where it failed the KillList. > > Headers--- > > Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net > (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500 > Date: Mon, 09 Feb 2004 23:57:24 -0500 > Subject: Exclusive X-Soaked Model Photos > From: Budapest Bukkake <[EMAIL PROTECTED]> > To: > Return-Path: [EMAIL PROTECTED] > X-Sender: [EMAIL PROTECTED] > X-Mailer: Mailer Software (rev. 01/15/2004) > Message-Id: <[EMAIL PROTECTED]> > MIME-version: 1.0 > Content-type: multipart/alternative; boundary="iqxhhbldriaiwihk" > X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919 > X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50 > with no reverse DNS entry. > X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of > 10. > X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50] > X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) > for spam. > X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 > [12] > X-Note: QueInControl: D6398669f014033a3.SMD (1) > X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 > [12] > X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50] > X-Note: SMTP Real From: [EMAIL PROTECTED] > X-Note: SMTP Real To: > X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]). > X-RBL-Warning: Total spam weight of this E-mail is 12. > X-RCPT-TO: > Status: U > X-UI
Re: [Declude.JunkMail] Kill List not working.....
Thanks for the help guys. Andrew.. I have the sorbs inplace but I see it did not fail those.. what is the line for mailpolice? Bennie - Original Message - From: "Colbeck, Andrew" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, February 10, 2004 3:34 PM Subject: RE: [Declude.JunkMail] Kill List not working. > Ah, perhaps you have more time to spend on your antispam system than I do! > > Andrew 8) > > -Original Message- > From: Jason [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 10, 2004 12:14 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Kill List not working. > > > Ah, but the Kill.lst is an envelope rejection. It saves many more > resources this way. > > Jason > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew > Sent: Tuesday, February 10, 2004 2:03 PM > To: '[EMAIL PROTECTED]' > Subject: RE: [Declude.JunkMail] Kill List not working. > > > Bennie, blocking spammers by their domain name only is a losing > proposition. You're already using SBL... I'd suggest that you also > implement the SORBS tests and the MAILPOLICE tests. > > Checking my own spam, we also received mail from this spammer, but we > caught it without having to check for their domain name du jeur. > > Andrew. > > -Original Message- > From: Bennie [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 10, 2004 3:18 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Kill List not working. > > > Hello all. > > I was asked some time ago to add a domail to my kill list.. I added it. > But the customer is still recieving spam from this domail. They sent me > the headers (I have them listed below) and I see the domail in the > headers. but I never see where it failed the KillList. > > Headers--- > > Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net > (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500 > Date: Mon, 09 Feb 2004 23:57:24 -0500 > Subject: Exclusive X-Soaked Model Photos > From: Budapest Bukkake <[EMAIL PROTECTED]> > To: > Return-Path: [EMAIL PROTECTED] > X-Sender: [EMAIL PROTECTED] > X-Mailer: Mailer Software (rev. 01/15/2004) > Message-Id: <[EMAIL PROTECTED]> > MIME-version: 1.0 > Content-type: multipart/alternative; boundary="iqxhhbldriaiwihk" > X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919 > X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50 > with no reverse DNS entry. > X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of > 10. > X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50] > X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) > for spam. > X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 > [12] > X-Note: QueInControl: D6398669f014033a3.SMD (1) > X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 > [12] > X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50] > X-Note: SMTP Real From: [EMAIL PROTECTED] > X-Note: SMTP Real To: > X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]). > X-RBL-Warning: Total spam weight of this E-mail is 12. > X-RCPT-TO: > Status: U > X-UIDL: 374908735 > > Here is the entry in my killl list file > > .ramthehole.com ID-20040204-pep007 > > here is the line from my GLOBAL.CFG > > KFROMfromfile e:\imail\declude\fromfile.txt x > 15 0 > KFrom WARN > > Line from $DEFAULT$.JUNKMAIL > > KFROM WARN X-RBL-Warning: This E-mail failed the KILL File test > > Thanks > Bennie > > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To &g
RE: [Declude.JunkMail] Kill List not working.....
Ah, perhaps you have more time to spend on your antispam system than I do! Andrew 8) -Original Message- From: Jason [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 10, 2004 12:14 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Kill List not working. Ah, but the Kill.lst is an envelope rejection. It saves many more resources this way. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, February 10, 2004 2:03 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Kill List not working. Bennie, blocking spammers by their domain name only is a losing proposition. You're already using SBL... I'd suggest that you also implement the SORBS tests and the MAILPOLICE tests. Checking my own spam, we also received mail from this spammer, but we caught it without having to check for their domain name du jeur. Andrew. -Original Message- From: Bennie [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 10, 2004 3:18 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Kill List not working. Hello all. I was asked some time ago to add a domail to my kill list.. I added it. But the customer is still recieving spam from this domail. They sent me the headers (I have them listed below) and I see the domail in the headers. but I never see where it failed the KillList. Headers--- Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500 Date: Mon, 09 Feb 2004 23:57:24 -0500 Subject: Exclusive X-Soaked Model Photos From: Budapest Bukkake <[EMAIL PROTECTED]> To: Return-Path: [EMAIL PROTECTED] X-Sender: [EMAIL PROTECTED] X-Mailer: Mailer Software (rev. 01/15/2004) Message-Id: <[EMAIL PROTECTED]> MIME-version: 1.0 Content-type: multipart/alternative; boundary="iqxhhbldriaiwihk" X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50 with no reverse DNS entry. X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12] X-Note: QueInControl: D6398669f014033a3.SMD (1) X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12] X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50] X-Note: SMTP Real From: [EMAIL PROTECTED] X-Note: SMTP Real To: X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]). X-RBL-Warning: Total spam weight of this E-mail is 12. X-RCPT-TO: Status: U X-UIDL: 374908735 Here is the entry in my killl list file .ramthehole.com ID-20040204-pep007 here is the line from my GLOBAL.CFG KFROMfromfile e:\imail\declude\fromfile.txt x 15 0 KFrom WARN Line from $DEFAULT$.JUNKMAIL KFROM WARN X-RBL-Warning: This E-mail failed the KILL File test Thanks Bennie --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Kill List not working.....
Ah, but the Kill.lst is an envelope rejection. It saves many more resources this way. Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, February 10, 2004 2:03 PM To: '[EMAIL PROTECTED]' Subject: RE: [Declude.JunkMail] Kill List not working. Bennie, blocking spammers by their domain name only is a losing proposition. You're already using SBL... I'd suggest that you also implement the SORBS tests and the MAILPOLICE tests. Checking my own spam, we also received mail from this spammer, but we caught it without having to check for their domain name du jeur. Andrew. -Original Message- From: Bennie [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 10, 2004 3:18 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Kill List not working. Hello all. I was asked some time ago to add a domail to my kill list.. I added it. But the customer is still recieving spam from this domail. They sent me the headers (I have them listed below) and I see the domail in the headers. but I never see where it failed the KillList. Headers--- Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500 Date: Mon, 09 Feb 2004 23:57:24 -0500 Subject: Exclusive X-Soaked Model Photos From: Budapest Bukkake <[EMAIL PROTECTED]> To: Return-Path: [EMAIL PROTECTED] X-Sender: [EMAIL PROTECTED] X-Mailer: Mailer Software (rev. 01/15/2004) Message-Id: <[EMAIL PROTECTED]> MIME-version: 1.0 Content-type: multipart/alternative; boundary="iqxhhbldriaiwihk" X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50 with no reverse DNS entry. X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12] X-Note: QueInControl: D6398669f014033a3.SMD (1) X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12] X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50] X-Note: SMTP Real From: [EMAIL PROTECTED] X-Note: SMTP Real To: X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]). X-RBL-Warning: Total spam weight of this E-mail is 12. X-RCPT-TO: Status: U X-UIDL: 374908735 Here is the entry in my killl list file .ramthehole.com ID-20040204-pep007 here is the line from my GLOBAL.CFG KFROMfromfile e:\imail\declude\fromfile.txt x 15 0 KFrom WARN Line from $DEFAULT$.JUNKMAIL KFROM WARN X-RBL-Warning: This E-mail failed the KILL File test Thanks Bennie --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Kill List not working.....
Bennie, blocking spammers by their domain name only is a losing proposition. You're already using SBL... I'd suggest that you also implement the SORBS tests and the MAILPOLICE tests. Checking my own spam, we also received mail from this spammer, but we caught it without having to check for their domain name du jeur. Andrew. -Original Message- From: Bennie [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 10, 2004 3:18 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Kill List not working. Hello all. I was asked some time ago to add a domail to my kill list.. I added it. But the customer is still recieving spam from this domail. They sent me the headers (I have them listed below) and I see the domail in the headers. but I never see where it failed the KillList. Headers--- Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500 Date: Mon, 09 Feb 2004 23:57:24 -0500 Subject: Exclusive X-Soaked Model Photos From: Budapest Bukkake <[EMAIL PROTECTED]> To: Return-Path: [EMAIL PROTECTED] X-Sender: [EMAIL PROTECTED] X-Mailer: Mailer Software (rev. 01/15/2004) Message-Id: <[EMAIL PROTECTED]> MIME-version: 1.0 Content-type: multipart/alternative; boundary="iqxhhbldriaiwihk" X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50 with no reverse DNS entry. X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of 10. X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12] X-Note: QueInControl: D6398669f014033a3.SMD (1) X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12] X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50] X-Note: SMTP Real From: [EMAIL PROTECTED] X-Note: SMTP Real To: X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]). X-RBL-Warning: Total spam weight of this E-mail is 12. X-RCPT-TO: Status: U X-UIDL: 374908735 Here is the entry in my killl list file .ramthehole.com ID-20040204-pep007 here is the line from my GLOBAL.CFG KFROMfromfile e:\imail\declude\fromfile.txt x 15 0 KFrom WARN Line from $DEFAULT$.JUNKMAIL KFROM WARN X-RBL-Warning: This E-mail failed the KILL File test Thanks Bennie --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Kill List not working.....
I was asked some time ago to add a domail to my kill list.. I added it. But the customer is still recieving spam from this domail. They sent me the headers (I have them listed below) and I see the domail in the headers. but I never see where it failed the KillList. This is a common problem: X-Note: SMTP Real From: [EMAIL PROTECTED] The mail came from "[EMAIL PROTECTED]", but: Here is the entry in my killl list file .ramthehole.com ID-20040204-pep007 you are blocking E-mail with a return address that contains ".ramthehole.com", which doesn't appear in the return address. In this case, I would suggest either using just: @ramthehole.com or using both: .ramthehole.com @ramthehole.com The first example will work fine in most cases, but the second one will cover all possible scenarios. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
