Is there anyway that a techno-phobic person can easily forward me the
headers from the spam they get so I can more easily adjust my blacklist? Or
is there a way in outlook 2000 for me to look more deeply into the e-mail
forwards to see the source?
Thanks - Marc
---
[This E-mail scanned for
Below is a second mailing that I received from these people, I posted the
first one to the IMAIL forum. They claim someone is Joe-jobing them, but
I do notice that on their explanation page they are still advertising their
services. That makes me suspicious.I've included the header and the
I have one user who is getting absolutely hammered by spam. Last night I
went through her mailbox and added many of the domains that she was getting
spam from to my blacklist.txt file. The action have configured for that
test is delete. It currently works as I can scan through the log and find
Scott,
After reprinting the Junkmail manual I see why am only having partial
success. I have been using the from domains in the format
@emailoffers.com (occasionally using the format deals-central.com - to catch
10.dealscentral as well as 20.dealscentral). So I suppose since the from
and or
Patrick,
Thanks. I found where that was #XSENDER OFF, took out the pound sign and
changed it to ON. Now if I can get the people who get spam to copy and
forward me the header info...
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Patrick
flailing a deceased equine...
Crap. Running through the Imail log analyzer I found some of the host names
I was looking for preceded by mail1 or some other name. I added these to
the kill list in the hopes that this is actually the MAIL FROM in the SMTP
envelope that is being reported. I also
What am I doing wrong here?
This is the E-mail header:
Message-Id: [EMAIL PROTECTED]
X-RBL-Warning: OSSOFT: http://spamhaus.org/SBL/sbl.lasso?query=SBL5031
X-RBL-Warning: SPAMCOP: Blocked - see
http://spamcop.net/bl.shtml?64.49.243.105
X-RBL-Warning: SPAMHEADERS: This E-mail has headers
Changed it to ipfile - lets see if that does it. I knew I was missing
something
Thanks - Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Tuesday, November 19, 2002 9:11 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail]
c:\imail\blockedmail.txt
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
at
Why was I filtered? I was trying to post a message that was copied and
pasted from an e-mail that I received from a friend who is on optimum
online. It didn't contain any adult words...
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Marc Catuogno
Sent
I have a user that
was getting spamed to death. Thanks to Declude and some help from this
list, I have been monitoring her e-mails and blocking a few more X-declude
sender" and a few IP's everyday. Her account went from getting 80-125
spams a day to about 3-6 spams a day. I had also been
I just thought this might be of interest to the group:
Dear Optimum Online Subscriber,
In just a few days you'll notice something very different about your
Optimum Online Inbox - where's the spam?
That's right. The annoying clutter of unsolicited e-mail will just about
vanish from your inbox,
I've been using the
delete action on a blacklist test for Junkmail. I also have a few ip
ranges blocked. I was thinking that if anyone with any brains figured out
that they were blocked that maybe they would e-mail postmaster or abuse.
Should I have a separate junkmail file for one or both
I just think this is
funny - I increased helobogus, mailfrom and revdns to a weight of 7 and I have a
message subject marked as [SPAM] when it hits a weight of
20...
guess I should lower
two of them Any suggestions? Maybe I'll lower REVDNS by
2.
-RBL-Warning: HELOBOGUS: Domain
Our domain got
hit over several days with different e-mails from addresses like
[EMAIL PROTECTED], or some
variant like [EMAIL PROTECTED]theseaddresses
are from the Xdeclude sender fieldin theheaders. Is there a way (or will there be) a way
to add an address like this to a black list in
12/28/2002 00:58:39
Q3d8f050e00781ce7 Couldn't open software\Ipswitch\IMail\Domains\rand1 [2-2]
I just recently added the domain rand1 to my IMAIL. I just
noticed this entry showing up repeatedly in my delcude log, even though the
domain has no users
I think the dns for RAND1 could
The Domain rand1.com was functioning and able to send and receive mail.
I had one test user set up so deleting it and recreating it was no big
deal. Once I set it up as mail.rand.com and put the host alias
rand1.com the error disappeared. I'm glad it is working but it is
always nice to know why.
I also only have TS access. But I had the host company put the I386
directory on separate partition so I can add and remove components.
Your host company should be able to do that, thereby allowing you to
remove and re-install windows components when needed. Good luck~
Marc
-Original
Let me first say that I'm a big fan of the Declude products and how they
have significantly reduced the amount of spam my end users receive. Let
me also qualify my next statement by saying that I'm not as
knowledgeable as I'd like to be about all the nuances of e-mail, DNS
etc. Sometimes I'm
Scott,
Im feeling a bit ignorant so Im hoping that
you can help. I usually try to keep up on the list and usually upgrade
declude.exe within 24 hours of its release. I see discussion of some of
the new features, the autowhitelist on, the comments test etc. Ive
had declude pro junkmail
Thanks. I'll back track through the list to make sure I am getting able
to set up the features that I'm looking for.
Peace - Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, February 04, 2003 11:59 AM
To: [EMAIL
This is what Im getting in my Declude log:
02/07/2003 02:00:05
Warning: misconfiguration in following line in global.cfg file (ip4r is not an
ACTION)
02/07/2003 02:00:05 DSBL ip4r list.dsbl.org * 6 0
This is the line in my global.cfg file that I copied and
pasted from the latest
Thanks Scott,
In my zeal to get my global file updated I copied that line from the
latest global file. It appears that further down the file the same test
was defined. I missed it because it was grouped with most of the tests
that are commented out with a #.
Thanks again - Marc
-Original
These of e-mails have been flooding my hold folder. Im
running Declude pro. I have a delete weight of 40 and a hold weight of
30. All this spam has been right between. Is there something I can
add to either bump up this weight by about 7 or is there something unique in
here that I can
] On
Behalf Of Marc Catuogno
Sent: Sunday, February 23, 2003
11:26 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Can
someone help me get this blocked?
These of e-mails have been flooding
my hold folder. Im running Declude pro. I have a delete
weight of 40 and a hold weight of 30. All this spam
Scott,
Thanks for the level of support you provide.
I'm part of the way there, it fails the test - but I don't think it is
getting the weight it should. It got the weight of 4 for failing the
filter test and the weight of 3 from the first line in the filter file
but not the weights from the
his in the entry in my GLOBAL.CFG file:
WHITELIST FROM @info.weightwatchers.com
This is a snippet from the e-mail that was held. I have a hold weight of
20.
X-Declude-Sender: [EMAIL PROTECTED] [216.73.90.161]
X-Declude-Spoolname: D51ea12ef00562fee.SMD
X-Note: This E-mail was scanned by Declude
I would like to use Junkmail to add something to the subject of any e-mail
sent to one e-mail address on my domain. Unfortunately I have my own domain
whitelisted so unless I remove that entry there doesn't seem to be a way to
have declude add a something to the subject, the whitelist seems to
Does Whitelist BODY the secret code is 1234 work or does it have to be
anywhere?
TIA - Marc
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.
Crud...
But the WHITELIST only does a complete match, right? so if I had slug as
the whitelist word, the word sluggish in the headers or body wouldn't count.
Right?
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Friday, June 27,
Please forgive my ignorance here ~
I have noticed that when I send e-mail from outlook 2000 that the nat'ed IP
of my T1 provider shows up and it does not have a reverse DNS.
Date: Mon, 30 Jun 2003 16:55:52 -0400
Message-ID:
MIME-Version: 1.0
Content-Type: text/plain;
charset=iso-8859-1
Scott,
Maybe you should e-mail them. This was the version # in the headers:
X-Mailer: Network Associates, Inc. Webshield SMTP, Version 4.5
And when I went to
http://www.networkassociates.com/us/downloads/evals/#McAfee
This looked like the latest version V4.5; McAfee WebShield SMTP MR1A v4.5
Scott-After reading your e-mail recommending that you can hold on bad
headers I tripled the weight. Although I really don't care much that this
was held right now if virus did really come through my server I would like
to get this. Any idea why a Webshield Alert would fail BADHEADERS? (if that
It's a shame because I was catching a great deal more spam, but I may have
to back off on the weight of this test. This looks like a log file that one
guy has e-mailed from a D-link router. Why don't companies have this stuff
compliant. sigh
Received: from DI-604 [65.41.30.4] by
I have this line in my blacklist file
revealsystems.net spammed many
Yet an e-mail with the following headers keeps getting through:
X-RBL-Warning: WEIGHT25: Weight of 27 reaches or exceeds the limit of
25.
X-Declude-Sender: [EMAIL PROTECTED] [207.174.23.4]
X-Declude-Spoolname:
I have a few complaints from users about all the returned messages. Is
there any way to stop particular accounts from receiving all the
rejected messages (undeliverable, user not found, user mailbox full,
etc) that the sobig virus is generating?
---
[This E-mail scanned for viruses by Declude
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Marc Catuogno
Sent: Monday, September 01, 2003 1:38 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] A way to stop the Undeliverables from
sobig?
I have a few complaints from users about
I'm not familiar with this test?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Wednesday, September 10, 2003 10:27 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Strange Subject
Add the following tests and it get's even
I usually only see this when it is caught in my spam folder. Does this
type of warning ever appear in legit mail?
This is a multi-part message in MIME format.
If you are reading this text, you may want to consider changing to a
mail reader or gateway that understands
how to properly handle
After looking up the code, and then looking at the RFC
http://www.faqs.org/rfcs/rfc2822.html (which I hope is the right place)
I can't figure out what is bogus about the following header. What is
wrong with it? Was it inserted by IMAIL after the fact? If it was how
could I tell? I'd like to work
Nevermind... I see that what I assume was its message ID:
X-Streamsendid: 3+1+135073+10+lists.streamsend.com
Is not unique and doesn't follow the RFC recommendation.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
Sent: Wednesday
Just my 2 cents:
Sometimes my word filters in declude junk mail would accidentally
trigger a junk mail test and add weight to an innocent attachment,
depending on how it was encoded.
Also, while I know that PDF's are generally small, is it possible that
the attachment exceeds the size allowed on
I was happy to take it. Maybe this will let us know what configuration
actually works with 8.03 since Ipswitch won't put out a hardware
recommendation. I personally applaud your efforts. Thank you -
Sincerely,
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
I guess I might add more weight to SAL, maybe reduce the negative weight of
IPNOTINMX to start.
I have some of the following in a filter file to add little weight, I don't
know if it is a great idea but it usually helps.
HEADERS 0 CONTAIN Bargains.net
HEADERS 0 CONTAIN Bargain.net
HEADERS 0
Received: from imo-d05.mx.aol.com [205.188.157.37] by
mail.prudentialrand.com with ESMTP
(SMTPD32-7.15) id A3811E61010A; Mon, 06 Oct 2003 14:25:05 -0400
Received: from [EMAIL PROTECTED]
by imo-d05.mx.aol.com (mail_out_v36_r1.1.) id e.48.230ffa47 (30960)
for [EMAIL PROTECTED];
What is up with this? I just sent a test message to myself from AOL and I
got the same thing SPAMCOP BLOCKED, as if I didn't have enough trouble
getting AOL e-mail through, between the noabuse, no postmaster and
occasional BASE64 encoding. IS there a test that can give aol address a
nice
in the global config file:
NOLEGITCONTENT nolegitcontent x x 0 -4
If you're asking me what it does I can only paraphrase Scott. It looks for
things that are uncommon in spam but common in legitimate e-mails so that it
can give it some negative weight.
Marc
-Original
I hate to say this but what about using a bounce message? As the postmaster
you will get all the undeliverable from the spammers using any banned words
and legitimate mailers can contact you if they get an erroneous bounce
because and encoded attachment had a random convergence that resulted in a
I am running IMAIL 7.15 and Declude 1.75. I knew I had a big no-no in
my Global file; whitelist from prudentialrand.com. A spammer has now
been exploiting it. How can I get my users whitelisted so they can
communicate with each other without worrying about being filtered
without letting the
In an effort to catch spammers forging my domain, I've added my own
domain to a spamdomain test. Now all e-mails sent through outlook are
failing the test because the server is seeing them as coming from
whatever IP the user is connected to. Since they are mostly OPTONLINE
customers they are also
PROTECTED] On Behalf Of Sanford
Whiteman
Sent: Wednesday, November 12, 2003 1:12 AM
To: Marc Catuogno
Subject: Re: [Declude.JunkMail] Originating IP -I'm confused, please
don't flame me...
Why wouldn't they be getting the IP of my server once they
authenticate?
Does this happen with other
:18 AM
To: Marc Catuogno
Subject: Re[2]: [Declude.JunkMail] Originating IP -I'm confused, please
don't flame me...
I just assumed that when mail came from my server...
From your server = originating IP is your server's IP. This is not
the case when sending from any MUA other than an app running
Title: Re: [Declude.JunkMail] Strange Anomaly
I'm
just wondering can you have a normal anomaly???
Sorry-
I couldn't help it
-Original Message-From: Keith Johnson
[mailto:[EMAIL PROTECTED]On Behalf Of Keith
JohnsonSent: Monday, November 17, 2003 11:03 PMTo:
[EMAIL
I'm tempted to block this as I'm not sure I like this kinda info in other
people's hands.
I'm updating my address book. Would you please take a moment to review your
contact information? Your updates help to keep me current, as well as other
people like me who already have your email address.
To
Wouldn't Whitelist Auth stop JMPro from testing outgoing mail?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt Robertson
Sent: Thursday, November 20, 2003 10:36 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] @LINKED IPLINKED v1.0.2 - Great
Wow, that one almost looks official and it is even https:\\
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff
(Lists)
Sent: Friday, November 21, 2003 01:54 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Capital One
Here is a nice
Actually I went to capitalone.com and when I hit login it took me to the
same site. Could it be official?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff
(Lists)
Sent: Friday, November 21, 2003 01:54 PM
To: [EMAIL PROTECTED]
Subject:
And I've told all my users not to follow links in e-mails that ask for
information like, SS# creditcard# etc. Also when you go to the site it only
has one cheesy looking graphic that says capitol one and no phone number
on the site that asks you to put in your credit info.
I agree, bad e-mail
X-Declude-Sender: [EMAIL PROTECTED] [64.4.10.85]
X-Declude-Spoolname: D48f900ac00427c71.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
for spam.
X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, NOLEGITCONTENT,
SPAMDOMAINS, FILTER, WEIGHT10, WEIGHT20, WEIGHT15 [21]
64.119.209.70
64.119.210.70
64.119.222.157
64.119.194.100
64.119.210.70
64.119.217.134
64.119.222.156
64.119.222.157
Out of about 40 held messages this morning these IP's were in about 10
of them. I'm going to add the following to a weighted (10) IP file
Isn't that bounceonlyifyoumust? I changed my to bounceifyoumust and the
log showed it as not an action.
BTW, I only bounce from a list of people who insist on sending new
real-estate information to all of our offices after we have repeatedly asked
them to stop. Those and a newsletter from
Recently a big old spammer forged or got access to the Habeas headers. Much
spam got through my system because I had the default setting to whitelist
Habeas. I'd use this with caution until they find this guy and hopefully
sue the crap out of him or hang him by his toenails.
-Original
If your users could handle going to the web interface and adding people they
would like whitelisted to their address book there, all you would need do
then is add AUTOWHITELIST ON to your one global config file. This way
they could whitelist anyone's e-mail address that they wished. Next
You mean H this company is
using zombies
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Kami Razvan
Sent: Tuesday, January 20, 2004
7:19 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail]
Interesting concept..
I guess this qualifies
Just caught this one looking through the helds. I can only imagine how many
people would click through this and open whatever it is they are trying to
give you.
Received: from hvebm [62.194.139.167] by mail.prudentialrand.com
(SMTPD32-7.15) id AEB556A00A2; Mon, 19 Jan 2004 18:56:37 -0500
Received: from ameritech.net [68.72.160.189] by mail.prudentialrand.com
(SMTPD32-7.15) id A4E6AF20096; Sun, 18 Jan 2004 19:29:26 -0500
Received: from adsl-68-72-160-189.dsl.chcgil.ameritech.net
(adsl-68-72-160-189.dsl.chcgil.ameritech.net [68.72.160.189])
by ameritech.net
I am the e-mail admin for a real-estate company. They have access to a
program that allows them to send real-estate info as a link through e-mail.
AOL is now filtering that URL:
554 TRANSACTION FAILED: (HVU:B1) The URL contained in your email to AOL
members has generated a high volume of
Thanks for the discussion. I have my webmaster trying to create an
alternate flyer directly from our website that will not include the URL of
the software that so many agents across the country use. That is the
problem, I have no control over what real-estate agents do with their
mailings from
Hey
I'm from JOISEY... The GHV MLS is just what the board here calls
itself. : )
Maybe
I can just offer all those AOL people who want to get listing info an e-mail
account, for a nominal fee of course...
-Original Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]On
How are people treating this? It looks almost legit and almost like a way
to harvest e-mail address though too
Received: from peter.wominfo.net [207.36.196.99] by mail.prudentialrand.com
with ESMTP
(SMTPD32-7.15) id A7523D900E2; Sun, 01 Feb 2004 05:39:14 -0500
Received: (from [EMAIL
:
WOMC.net
WOMInfo.info
WOMInfo.net
WordOfMouthConnection.com
Word-of-Mouth.org
Andrew.
-Original Message-
From: marc catuogno [mailto:[EMAIL PROTECTED]
Sent: Sunday, February 01, 2004 10:26 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Word of Mouth connetion?
How are people
It's funny but when I do a search for dictionary on their site to see how
to configure black ice to guard against dictionary attacks or how it does I
get no results. Can any user of Black Ice point me in the right direction
here??
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Someone should bitch slap this piece of Sh*t! Selling a list to spam on an
anti-spam list. What a moron. Man this kinda stuff pisses me off.
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Monday, February 16, 2004 6:18 AM
OOPPPSSS!
I'm sorry, I saw the e-mail and thought it was him. I had just got up and
it pissed me off. My apologies, I didn't thoroughly read the e-mail.
My bad- again, sorry.
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
I went to dnsreports and everything seems to be timing out.
Marc
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just
Administration of www.shadowcrew.com online store would like to thank you
for your purchase of Viagra tablets. Couple of words about our products and
services. Viagra is a prescription drug used to treat erection difficulties,
such as erectile dysfunction, which also refers to as an impotence. At
Is there anything that can test for e-mail size? Often I have people
sending those damn pictures through Kodak and so on and they often get
caught by filters (gibberish, spam domains, and so on) these messages are
often over 75kb, so I was wondering if there was a way that I could add a
small
Since upgrading to 8.05 and Declude 1.78i23 my objectionable language filter
is causing a postmaster loop. Because the original message was included
with the word. I'm not even sure why as the postmaster I even got the
notice, it usually just goes to the sender. Has anything been changed?
I've
PROTECTED]
Matt
marc catuogno wrote:
Since upgrading to 8.05 and Declude 1.78i23 my objectionable language
filter
is causing a postmaster loop. Because the original message was included
with the word. I'm not even sure why as the postmaster I even got the
notice, it usually just goes to the sender
Title: Whitelist warning headers?
Something
like this:
XINHEADER X-Spam-Tests-Failed:
%TESTSFAILED% [%WEIGHT%]
Which puts this header in:
X-Spam-Tests-Failed: Whitelisted [0]
This works for me for anything whitelisted
through Declude.
Marc
-Original Message-
PROTECTED]
Subject: RE: [Declude.JunkMail]
Whitelist warning headers?
Where did you put
this? It sounds like it might do the trick.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno
Sent: Tuesday, March 16, 2004 9:10
AM
To: [EMAIL PROTECTED]
Subject: RE
I just got this e-mail and I just feel
like someone is targeting my domain for a spam campaign. When I hit view
source, it only said test. Any suggestions on how to block this??
Im surprised that DUL or DYNA didnt catch this at all, looks like
it came in though a dynamic Comcast IP not one
strict rules.
Adrian
-
ToadShow Pty Ltd
phone: 07 3004 7900
fax: 07 3846 1220
email: [EMAIL PROTECTED]
http://www.toadshow.com.au
-
- Original Message -
From: marc catuogno
To: [EMAIL PROTECTED
-
- Original Message -
From: marc catuogno [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Monday, March 29, 2004 12:47 PM
Subject: RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
This could work for me. I have Whitelist Auth on so my users coming in from
RR and so
fax: 07 3846 1220
email: [EMAIL PROTECTED]
http://www.toadshow.com.au
-
- Original Message -
From: marc catuogno
To: [EMAIL PROTECTED]
Sent: Monday, March 29, 2004 9:32 AM
Subject: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
I
I was just wondering if there is anyway to catch this, maybe declude is
decoding something? Should I leave out the %? I was just surprised not to
see this fail the filter test.
Also, what are the numbers in brackets after the tests now? [2-15-7800]
I have this in my filter file
SUBJECT 25
Thanks again Scott.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Wednesday, March 31, 2004 08:58 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Subject filter failure?
I was just wondering if there is anyway to catch
Forgive my ignorance but how does this
work with security? What do you, or your users, authenticate on?
-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William Baumbach
Sent: Wednesday, March 31, 2004
9:27 PM
To: [EMAIL PROTECTED]
Subject: Re:
Thankfully declude is catching almost all of this, but I have my personal
filter set to add a subject and not DELETE. I'm getting 50-60 messages a
day for prescripts online - all from subscriber networks (most often
charter) and it just started about 3 or 4 days ago. I haven't run stats on
the
Scott,
The site looks good, I like the look.
Marc
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to
Thanks -
It looks as if it was an aberration. I've checked a few different day's
logs and didn't see could not lock file in any other log. Something must
have been up. Maybe I should look through the logs more thouroughly and
more often : )
Anything out there that could alert me to the fact
Running IMAIL 8.05
Declude Virus/JM 1.79 beta
Headers:
Received: from SMTP32-FWD by mail.prudentialrand.com
(SMTP32) id A043C; Wed, 5 May 2004 05:32:02
Received: from gurushy.com [207.226.69.162] by mail.prudentialrand.com
(SMTPD32-8.05) id A121AA0064; Wed, 05 May 2004 05:17:21 -0400
I guess I was too brief-
There were e-mails delivered between 5:15 and 5:33 - This could not lock
message should've just effected just that one e-mail. It shouldn't have
stopped Declude from being called for 15 minutes. Correct?
After a closer look at the logs, this was what I found - what could
No backup software, no on access scanning. I am having some other problems
with the machine - I'm about to nuke it regardless - I just wanted to make
sure that declude was still being called to scan for viruses until I get
this box formatted... ugh
-Original Message-
From: [EMAIL
I am running Declude 1.79 and Imail 8.05, I have autowhitelist on and
whitelist auth. This user (Bernie Cohen) had himself in his address book
and it looks like the spammer had the from e-mail to be bernie's e-mail
address. I thought it was difficult to fake the x-declude sender?
I like the
If you are using LDAP that is completely and horribly hackable and I don't
think there is a patch below 7.
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jose Gosende
Sent: Friday, July 16, 2004 9:57 AM
To: [EMAIL PROTECTED]
Subject:
Or you could use an independent .junkmail file for the account that you are
copying to and not have a delete action for any weight so the action would
be something other than delete. I have an account that the JM file changes
the subject to HOLD WEIGHT and DELETE WEIGHT so I know where I need to
I foolishly was creating a test and called it REVDNS - then realized that it
was a duplicate test - I changed the name. Now the REVDNS test doesn't
work.
REVDNS revdnsexistsx x 10 0
That is the line in my global config
And this is line in an e-mail this morning:
DNS. not that anyone else would make that silly mistake.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno
Sent: Friday, September 17, 2004 8:34 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] REVERSE DNS TEST BROKEN
I foolishly
Or some other name if it is possible -
I'd like to stop e-mails from being whitelisted because my users have their
own name in their address book and someone sends to multiple people as one
of my users. Also I'd like to stop e-mails being delivered to multiple
recipients because one person has
1 - 100 of 189 matches
Mail list logo
