Re: [Declude.JunkMail] Kill List not working.....

2004-02-10 Thread R. Scott Perry

I was asked some time ago to add a domail to my kill list.. I added it.  But
the customer is still recieving spam from this domail.  They sent me the
headers (I have them listed below) and I see the domail in the headers.  but
I never see where it failed the KillList.
This is a common problem:

X-Note: SMTP Real From: [EMAIL PROTECTED]
The mail came from [EMAIL PROTECTED], but:

Here is the entry in my killl list file

.ramthehole.com  ID-20040204-pep007
you are blocking E-mail with a return address that contains 
.ramthehole.com, which doesn't appear in the return address.  In this 
case, I would suggest either using just:

@ramthehole.com

or using both:

.ramthehole.com
@ramthehole.com
The first example will work fine in most cases, but the second one will 
cover all possible scenarios.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Kill List not working.....

2004-02-10 Thread Colbeck, Andrew
Bennie, blocking spammers by their domain name only is a losing proposition.
You're already using SBL... I'd suggest that you also implement the SORBS
tests and the MAILPOLICE tests.  

Checking my own spam, we also received mail from this spammer, but we caught
it without having to check for their domain name du jeur.

Andrew.

-Original Message-
From: Bennie [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, February 10, 2004 3:18 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Kill List not working.


Hello all.

I was asked some time ago to add a domail to my kill list.. I added it.  But
the customer is still recieving spam from this domail.  They sent me the
headers (I have them listed below) and I see the domail in the headers.  but
I never see where it failed the KillList.

Headers---

Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net
  (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500
Date: Mon, 09 Feb 2004 23:57:24 -0500
Subject: Exclusive X-Soaked Model Photos
From: Budapest Bukkake [EMAIL PROTECTED]
To:
Return-Path: [EMAIL PROTECTED]
X-Sender: [EMAIL PROTECTED]
X-Mailer: Mailer Software (rev. 01/15/2004)
Message-Id: [EMAIL PROTECTED]
MIME-version: 1.0
Content-type: multipart/alternative; boundary=iqxhhbldriaiwihk
X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50 with
no reverse DNS entry.
X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of 10.
X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12]
X-Note: QueInControl: D6398669f014033a3.SMD (1)
X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10 [12]
X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50]
X-Note: SMTP Real From: [EMAIL PROTECTED]
X-Note: SMTP Real To:
X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]).
X-RBL-Warning: Total spam weight of this E-mail is 12.
X-RCPT-TO:
Status: U
X-UIDL: 374908735

Here is the entry in my killl list file

.ramthehole.com  ID-20040204-pep007

here is the line from my GLOBAL.CFG

KFROMfromfile  e:\imail\declude\fromfile.txt x
15 0
KFrom   WARN

Line from $DEFAULT$.JUNKMAIL

KFROM   WARN X-RBL-Warning: This E-mail failed the KILL File test

Thanks
Bennie



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Kill List not working.....

2004-02-10 Thread Jason
Ah, but the Kill.lst is an envelope rejection.  It saves many more
resources this way.

Jason


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Tuesday, February 10, 2004 2:03 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Kill List not working.


Bennie, blocking spammers by their domain name only is a losing
proposition. You're already using SBL... I'd suggest that you also
implement the SORBS tests and the MAILPOLICE tests.  

Checking my own spam, we also received mail from this spammer, but we
caught it without having to check for their domain name du jeur.

Andrew.

-Original Message-
From: Bennie [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, February 10, 2004 3:18 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Kill List not working.


Hello all.

I was asked some time ago to add a domail to my kill list.. I added it.
But the customer is still recieving spam from this domail.  They sent me
the headers (I have them listed below) and I see the domail in the
headers.  but I never see where it failed the KillList.

Headers---

Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net
  (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500
Date: Mon, 09 Feb 2004 23:57:24 -0500
Subject: Exclusive X-Soaked Model Photos
From: Budapest Bukkake [EMAIL PROTECTED]
To:
Return-Path: [EMAIL PROTECTED]
X-Sender: [EMAIL PROTECTED]
X-Mailer: Mailer Software (rev. 01/15/2004)
Message-Id: [EMAIL PROTECTED]
MIME-version: 1.0
Content-type: multipart/alternative; boundary=iqxhhbldriaiwihk
X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50
with no reverse DNS entry.
X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of
10.
X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
for spam.
X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
[12]
X-Note: QueInControl: D6398669f014033a3.SMD (1)
X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
[12]
X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50]
X-Note: SMTP Real From: [EMAIL PROTECTED]
X-Note: SMTP Real To:
X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]).
X-RBL-Warning: Total spam weight of this E-mail is 12.
X-RCPT-TO:
Status: U
X-UIDL: 374908735

Here is the entry in my killl list file

.ramthehole.com  ID-20040204-pep007

here is the line from my GLOBAL.CFG

KFROMfromfile  e:\imail\declude\fromfile.txt x
15 0
KFrom   WARN

Line from $DEFAULT$.JUNKMAIL

KFROM   WARN X-RBL-Warning: This E-mail failed the KILL File test

Thanks
Bennie



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Kill List not working.....

2004-02-10 Thread Colbeck, Andrew
Ah, perhaps you have more time to spend on your antispam system than I do!

Andrew 8)

-Original Message-
From: Jason [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, February 10, 2004 12:14 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Kill List not working.


Ah, but the Kill.lst is an envelope rejection.  It saves many more
resources this way.

Jason


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Tuesday, February 10, 2004 2:03 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Kill List not working.


Bennie, blocking spammers by their domain name only is a losing
proposition. You're already using SBL... I'd suggest that you also
implement the SORBS tests and the MAILPOLICE tests.  

Checking my own spam, we also received mail from this spammer, but we
caught it without having to check for their domain name du jeur.

Andrew.

-Original Message-
From: Bennie [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, February 10, 2004 3:18 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Kill List not working.


Hello all.

I was asked some time ago to add a domail to my kill list.. I added it.
But the customer is still recieving spam from this domail.  They sent me
the headers (I have them listed below) and I see the domail in the
headers.  but I never see where it failed the KillList.

Headers---

Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net
  (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500
Date: Mon, 09 Feb 2004 23:57:24 -0500
Subject: Exclusive X-Soaked Model Photos
From: Budapest Bukkake [EMAIL PROTECTED]
To:
Return-Path: [EMAIL PROTECTED]
X-Sender: [EMAIL PROTECTED]
X-Mailer: Mailer Software (rev. 01/15/2004)
Message-Id: [EMAIL PROTECTED]
MIME-version: 1.0
Content-type: multipart/alternative; boundary=iqxhhbldriaiwihk
X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50
with no reverse DNS entry.
X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of
10.
X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
for spam.
X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
[12]
X-Note: QueInControl: D6398669f014033a3.SMD (1)
X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
[12]
X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50]
X-Note: SMTP Real From: [EMAIL PROTECTED]
X-Note: SMTP Real To:
X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]).
X-RBL-Warning: Total spam weight of this E-mail is 12.
X-RCPT-TO:
Status: U
X-UIDL: 374908735

Here is the entry in my killl list file

.ramthehole.com  ID-20040204-pep007

here is the line from my GLOBAL.CFG

KFROMfromfile  e:\imail\declude\fromfile.txt x
15 0
KFrom   WARN

Line from $DEFAULT$.JUNKMAIL

KFROM   WARN X-RBL-Warning: This E-mail failed the KILL File test

Thanks
Bennie



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Kill List not working.....

2004-02-10 Thread Bennie
Thanks for the help guys.  Andrew.. I have the sorbs inplace but I see it
did not fail those..  what is the line for mailpolice?

Bennie

- Original Message - 
From: Colbeck, Andrew [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, February 10, 2004 3:34 PM
Subject: RE: [Declude.JunkMail] Kill List not working.


 Ah, perhaps you have more time to spend on your antispam system than I do!

 Andrew 8)

 -Original Message-
 From: Jason [mailto:[EMAIL PROTECTED]
 Sent: Tuesday, February 10, 2004 12:14 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] Kill List not working.


 Ah, but the Kill.lst is an envelope rejection.  It saves many more
 resources this way.

 Jason


 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
 Sent: Tuesday, February 10, 2004 2:03 PM
 To: '[EMAIL PROTECTED]'
 Subject: RE: [Declude.JunkMail] Kill List not working.


 Bennie, blocking spammers by their domain name only is a losing
 proposition. You're already using SBL... I'd suggest that you also
 implement the SORBS tests and the MAILPOLICE tests.

 Checking my own spam, we also received mail from this spammer, but we
 caught it without having to check for their domain name du jeur.

 Andrew.

 -Original Message-
 From: Bennie [mailto:[EMAIL PROTECTED]
 Sent: Tuesday, February 10, 2004 3:18 AM
 To: [EMAIL PROTECTED]
 Subject: [Declude.JunkMail] Kill List not working.


 Hello all.

 I was asked some time ago to add a domail to my kill list.. I added it.
 But the customer is still recieving spam from this domail.  They sent me
 the headers (I have them listed below) and I see the domail in the
 headers.  but I never see where it failed the KillList.

 Headers---

 Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net
   (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500
 Date: Mon, 09 Feb 2004 23:57:24 -0500
 Subject: Exclusive X-Soaked Model Photos
 From: Budapest Bukkake [EMAIL PROTECTED]
 To:
 Return-Path: [EMAIL PROTECTED]
 X-Sender: [EMAIL PROTECTED]
 X-Mailer: Mailer Software (rev. 01/15/2004)
 Message-Id: [EMAIL PROTECTED]
 MIME-version: 1.0
 Content-type: multipart/alternative; boundary=iqxhhbldriaiwihk
 X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919
 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50
 with no reverse DNS entry.
 X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of
 10.
 X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50]
 X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
 for spam.
 X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
 [12]
 X-Note: QueInControl: D6398669f014033a3.SMD (1)
 X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
 [12]
 X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50]
 X-Note: SMTP Real From: [EMAIL PROTECTED]
 X-Note: SMTP Real To:
 X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]).
 X-RBL-Warning: Total spam weight of this E-mail is 12.
 X-RCPT-TO:
 Status: U
 X-UIDL: 374908735

 Here is the entry in my killl list file

 .ramthehole.com  ID-20040204-pep007

 here is the line from my GLOBAL.CFG

 KFROMfromfile  e:\imail\declude\fromfile.txt x
 15 0
 KFrom   WARN

 Line from $DEFAULT$.JUNKMAIL

 KFROM   WARN X-RBL-Warning: This E-mail failed the KILL File test

 Thanks
 Bennie



 ---
 [This E-mail scanned for viruses by Declude Virus]

 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
 unsubscribe Declude.JunkMail.  The archives can be found at
 http://www.mail-archive.com.
 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
 unsubscribe Declude.JunkMail.  The archives can be found at
 http://www.mail-archive.com.

 ---
 [This E-mail was scanned for viruses by Declude Virus
 (http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.
 ---
 [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

 ---
 This E-mail came from the Declude.JunkMail mailing list.  To
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
 type unsubscribe Declude.JunkMail.  The archives can be found
 at http://www.mail-archive.com.
 ---
 [This E-mail scanned for viruses by Declude Virus]




---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude

RE: [Declude.JunkMail] Kill List not working.....

2004-02-10 Thread Colbeck, Andrew
No problem, Bennie.  The MailPolice tests are RHSBL tests, which means that
they test the domain name instead of of the IP address of the sender:

# For information on these tests, see  http://rhs.mailpolice.com/
MAILPOLICE-BULK rhsbl bulk.rhs.mailpolice.com 127.0.0.2 5  0
MAILPOLICE-PORN rhsbl porn.rhs.mailpolice.com 127.0.0.2 10 0

You can set the weights according to your own traffic and your measure of
trust in these lists.  And of course you need a corresponding action like
MAILPOLICE-BULK WARN in your global.cfg or your domain specific
$default$.junkmail

Also, the listing for the sending IP is still in the SORBS test I saw
triggered, so perhaps you're not using all of the SORBS tests:

# For more information on these tests, see http://www.dnsbl.sorbs.net/
# Hosts that send spam and netblocks of providers that support spammers
# sometimes includes abused providers like Sympatico and ATT
SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 4 0

There are something like a dozen SORBS tests, and you may not be interested
in all of them, and you may want to score them differently.  For example, I
use SORBS-SPAM but I give it a low weight, but I also use SORBS-ZOMBIE and
give it a much higher weight.

Andrew 8)

-Original Message-
From: Bennie [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, February 10, 2004 1:33 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Kill List not working.


Thanks for the help guys.  Andrew.. I have the sorbs inplace but I see it
did not fail those..  what is the line for mailpolice?

Bennie

- Original Message - 
From: Colbeck, Andrew [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, February 10, 2004 3:34 PM
Subject: RE: [Declude.JunkMail] Kill List not working.


 Ah, perhaps you have more time to spend on your antispam system than I do!

 Andrew 8)

 -Original Message-
 From: Jason [mailto:[EMAIL PROTECTED]
 Sent: Tuesday, February 10, 2004 12:14 PM
 To: [EMAIL PROTECTED]
 Subject: RE: [Declude.JunkMail] Kill List not working.


 Ah, but the Kill.lst is an envelope rejection.  It saves many more
 resources this way.

 Jason


 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
 Sent: Tuesday, February 10, 2004 2:03 PM
 To: '[EMAIL PROTECTED]'
 Subject: RE: [Declude.JunkMail] Kill List not working.


 Bennie, blocking spammers by their domain name only is a losing
 proposition. You're already using SBL... I'd suggest that you also
 implement the SORBS tests and the MAILPOLICE tests.

 Checking my own spam, we also received mail from this spammer, but we
 caught it without having to check for their domain name du jeur.

 Andrew.

 -Original Message-
 From: Bennie [mailto:[EMAIL PROTECTED]
 Sent: Tuesday, February 10, 2004 3:18 AM
 To: [EMAIL PROTECTED]
 Subject: [Declude.JunkMail] Kill List not working.


 Hello all.

 I was asked some time ago to add a domail to my kill list.. I added it.
 But the customer is still recieving spam from this domail.  They sent me
 the headers (I have them listed below) and I see the domail in the
 headers.  but I never see where it failed the KillList.

 Headers---

 Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net
   (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500
 Date: Mon, 09 Feb 2004 23:57:24 -0500
 Subject: Exclusive X-Soaked Model Photos
 From: Budapest Bukkake [EMAIL PROTECTED]
 To:
 Return-Path: [EMAIL PROTECTED]
 X-Sender: [EMAIL PROTECTED]
 X-Mailer: Mailer Software (rev. 01/15/2004)
 Message-Id: [EMAIL PROTECTED]
 MIME-version: 1.0
 Content-type: multipart/alternative; boundary=iqxhhbldriaiwihk
 X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919
 X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50
 with no reverse DNS entry.
 X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of
 10.
 X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50]
 X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
 for spam.
 X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
 [12]
 X-Note: QueInControl: D6398669f014033a3.SMD (1)
 X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
 [12]
 X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50]
 X-Note: SMTP Real From: [EMAIL PROTECTED]
 X-Note: SMTP Real To:
 X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]).
 X-RBL-Warning: Total spam weight of this E-mail is 12.
 X-RCPT-TO:
 Status: U
 X-UIDL: 374908735

 Here is the entry in my killl list file

 .ramthehole.com  ID-20040204-pep007

 here is the line from my GLOBAL.CFG

 KFROMfromfile  e:\imail\declude\fromfile.txt x
 15 0
 KFrom   WARN

 Line from $DEFAULT$.JUNKMAIL

 KFROM   WARN X-RBL-Warning: This E-mail failed the KILL File test

 Thanks
 Bennie



 ---
 [This E-mail scanned for viruses by Declude Virus

RE: [Declude.JunkMail] Kill List not working.....

2004-02-10 Thread Katie La Salle-Lowery


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Tuesday, February 10, 2004 1:34 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Kill List not working.


Ah, perhaps you have more time to spend on your antispam system than I
do!

Andrew 8)

-Original Message-
From: Jason [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, February 10, 2004 12:14 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Kill List not working.


Ah, but the Kill.lst is an envelope rejection.  It saves many more
resources this way.

Jason


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Tuesday, February 10, 2004 2:03 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] Kill List not working.


Bennie, blocking spammers by their domain name only is a losing
proposition. You're already using SBL... I'd suggest that you also
implement the SORBS tests and the MAILPOLICE tests.  

Checking my own spam, we also received mail from this spammer, but we
caught it without having to check for their domain name du jeur.

Andrew.

-Original Message-
From: Bennie [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, February 10, 2004 3:18 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Kill List not working.


Hello all.

I was asked some time ago to add a domail to my kill list.. I added it.
But the customer is still recieving spam from this domail.  They sent me
the headers (I have them listed below) and I see the domail in the
headers.  but I never see where it failed the KillList.

Headers---

Received: from mail.ramthehole.com [66.110.74.50] by mail.pepperlink.net
  (SMTPD32-8.05) id A398669F0140; Mon, 09 Feb 2004 23:52:40 -0500
Date: Mon, 09 Feb 2004 23:57:24 -0500
Subject: Exclusive X-Soaked Model Photos
From: Budapest Bukkake [EMAIL PROTECTED]
To:
Return-Path: [EMAIL PROTECTED]
X-Sender: [EMAIL PROTECTED]
X-Mailer: Mailer Software (rev. 01/15/2004)
Message-Id: [EMAIL PROTECTED]
MIME-version: 1.0
Content-type: multipart/alternative; boundary=iqxhhbldriaiwihk
X-RBL-Warning: SBL: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12919
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 66.110.74.50
with no reverse DNS entry.
X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of
10.
X-Declude-Sender: [EMAIL PROTECTED] [66.110.74.50]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
for spam.
X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
[12]
X-Note: QueInControl: D6398669f014033a3.SMD (1)
X-Spam-Tests-Failed: SBL, SORBS-SPAM, NOLEGITCONTENT, REVDNS, WEIGHT10
[12]
X-Note: RDNS Real Origin: [No Reverse DNS][66.110.74.50]
X-Note: SMTP Real From: [EMAIL PROTECTED]
X-Note: SMTP Real To:
X-Note: This E-mail was sent from [No Reverse DNS] ([66.110.74.50]).
X-RBL-Warning: Total spam weight of this E-mail is 12.
X-RCPT-TO:
Status: U
X-UIDL: 374908735

Here is the entry in my killl list file

.ramthehole.com  ID-20040204-pep007

here is the line from my GLOBAL.CFG

KFROMfromfile  e:\imail\declude\fromfile.txt x
15 0
KFrom   WARN

Line from $DEFAULT$.JUNKMAIL

KFROM   WARN X-RBL-Warning: This E-mail failed the KILL File test

Thanks
Bennie



---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail scanned for viruses by CENTRIC INTERNET SERVICES]




---
[This E-mail scanned for viruses by CENTRIC INTERNET SERVICES]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe