RE: [Declude.JunkMail] Bonded senders
The concept behind BONDEDSENDER seems to be the same as HABEAS. But if I understand things correctly, Declude can not treat the two in the same way. To use HABEAS headers you simply enter WHITELIST HABEAS in the global.cfg. And by using this an email could fail every rule you have (but pass the HABEAS) and get through. Lets say you have certain actions that block on rule (not weighting), using the BONDEDSENDER rule you can not whitelist but only reducing the weighting? Scott, is there a way of WHITELISTING a positive BONDEDSENDER? Like you do with HABEAS? Regards, Lyndon. Email checked by UKsubnet anti-virus service To prevent email abuse block spam contact [EMAIL PROTECTED] Tel: +44(0)8712360301 Web: www.uksubnet.net Fax: +44(0)8712360300 Powered by UKsubnet Internet Service Provider Business to Business Internet (ISP) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Bonded senders
Scott, is there a way of WHITELISTING a positive BONDEDSENDER? Like you do with HABEAS? You should be able to do that with the latest beta and a filter, using a line TESTSFAILED WHITELIST CONTAINS BONDEDSENDER in your filter file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bonded senders
Paul, Here's what Cyan said about a month ago... - From: Cyan Callihan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Date: Sun, 18 Jan 2004 13:19:07 -0800 Subject: Re: [Declude.JunkMail] BONDEDSENDER, spam hit on Virtumundo Please send all of your complaints...to [EMAIL PROTECTED] I will investigate. Cyan - Take Care, Dan Geiser [EMAIL PROTECTED] - Original Message - From: Paul Fuhrmeister [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, February 20, 2004 9:19 AM Subject: [Declude.JunkMail] Bonded senders Looking on the bondedsender.com web site, I see no where to report things like this: Received: from adsl-68-78-114-74.dsl.emhril.ameritech.net (adsl-68-78-114-74.dsl.emhril.ameritech.net [68.78.114.74]) Received: from ebay.com (data.ebay.com [66.135.195.180]) From: eBay Service [EMAIL PROTECTED] Subject: Ebay Account Update X-RAV-AntiVirus: This message has been scanned for viruses on adsl-68-78-114-74.dsl.emhril.ameritech.net X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.78.114.74 X-RBL-Warning: SORBS-DUHL: Dynamic IP Address See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=68.78.114.74 X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?68.78.114.74 X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: BONDEDSENDER: IronPort Bonded Sender - http://www.bondedsender.com X-RBL-Warning: SPAM-DOMAINS: Spamdomain '@ebay.com' found: Address of [EMAIL PROTECTED] sent from invalid adsl-68-78-114-74.dsl.emhril.ameritech.net. X-Declude-Sender: [EMAIL PROTECTED] [68.78.114.74] [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bonded senders
I was hoping that someone else would answer this since I've been a bit down on Bonded Sender lately for their practice of allowing some spammers on their system and other things. Regardless, this isn't the fault of Bonded Sender, you are scanning on multiple hops and the spammer forged the headers to trick you into crediting it points. Bonded Sender needs to be named BONDEDSENDER(DUL) in your Global.cfg to prevent it from scanning past the last hop. That will correct the issue. I've mentioned this before and will again since this is the proper context...it would be nice if Declude could add some additional columns to the DSNBL tests so that you could specify how many hops to scan per test, and which hop to start on (two columns). This way we could score things according to how deep they are in the list, noting the fact that zombies are now being used to relay through other servers, and they are also responsible for an occasional FP when the legit sender is using the same computer for sending real E-mail. I have no immediate expectations for this, though I see such a thing as inevitable down the road. The naming trick like I showed above allows you to work around this limitation for now. Credit the trick to Andrew. Matt Paul Fuhrmeister wrote: Looking on the bondedsender.com web site, I see no where to report things like this: Received: from adsl-68-78-114-74.dsl.emhril.ameritech.net (adsl-68-78-114-74.dsl.emhril.ameritech.net [68.78.114.74]) Received: from ebay.com (data.ebay.com [66.135.195.180]) From: eBay Service [EMAIL PROTECTED] Subject: Ebay Account Update X-RAV-AntiVirus: This message has been scanned for viruses on adsl-68-78-114-74.dsl.emhril.ameritech.net X-RBL-Warning: DSBL: http://dsbl.org/listing?ip=68.78.114.74 X-RBL-Warning: SORBS-DUHL: Dynamic IP Address See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=68.78.114.74 X-RBL-Warning: SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?68.78.114.74 X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED] X-RBL-Warning: BONDEDSENDER: IronPort Bonded Sender - http://www.bondedsender.com X-RBL-Warning: SPAM-DOMAINS: Spamdomain '@ebay.com' found: Address of [EMAIL PROTECTED] sent from invalid adsl-68-78-114-74.dsl.emhril.ameritech.net. X-Declude-Sender: [EMAIL PROTECTED] [68.78.114.74] [EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
