[sniffer] Re: pricing

2007-08-09 Thread Pete McNeil
Hello Daniel, If that's true, we still have the instructions on our site for using the command line version w/ MDaemon. http://kb.armresearch.com/index.php?title=Message_Sniffer.Installation.MDaemon Hope this helps, Thanks, _M Thursday, August 9, 2007, 9:51:06 AM, you wrote: Also

[sniffer] version

2007-08-09 Thread Jason
Pete thanks for your prompt reply I did go to the website you gave me but I'm not quite sure which version should I go for is it version 0.53b? (mdaemon plugin) or the latest 2-3.5?? please advice many thanks Jason

[sniffer] Re: New campaign not caught

2007-08-08 Thread Chris Bunting
What is up with the PDF spams? They are getting thru the filters like crazy for the past few days... Thank You, Chris Bunting Lancaster Networks Direct: 717-278-6639 Office: 888-LANCNET x703 3com IP Telephony Expert Lancaster

[sniffer] working copy

2007-08-08 Thread Jason
Hi all I would like to know where can I download a working copy of message sniffer for evaluation purpose? I'm using Mdaemon 6.8.4 many thanks Jason

[sniffer] Re: working copy

2007-08-08 Thread Pete McNeil
Hello Jason, Wednesday, August 8, 2007, 11:14:54 PM, you wrote: Hi all I would like to know where can I download a working copy of message sniffer for evaluation purpose? I'm using Mdaemon 6.8.4 You can find the current version of MDaemon plugin (0.53) here:

[sniffer] Re: New campaign not caught

2007-08-07 Thread Darin Cox
Just got one a short while ago. Look at these headers: Received: from p4248-ipbfp02matuyama.ehime.ocn.ne.jp [124.96.113.248] by mail.4cweb.com with ESMTP (SMTPD-8.22) id A0D001A0; Tue, 07 Aug 2007 12:41:52 -0400 Received: from [126.147.120.198] by p4248-ipbfp02matuyama.ehime.ocn.ne.jp with

[sniffer] Imail QueueMgr.exe consumes all Paged Pool

2007-08-03 Thread Andy Schmidt
Sorry for cross-posting. I'm not sure whether Declude and/or Sniffer still rely on the Paged Pool - and whether their usage would be reported under the Imail QueueMgr.exe or under some other .exes? So I have 3 possible culprits. The symptom started as a Webmail problem because customers noticed

[sniffer] Re: Imail QueueMgr.exe consumes all Paged Pool

2007-08-03 Thread Pete McNeil
Hello Andy, Friday, August 3, 2007, 5:16:32 PM, you wrote: Sorry for cross-posting. Im not sure whether Declude and/or Sniffer still rely on the Paged Pool and whether their usage would be reported under the Imail QueueMgr.exe or under some other .exes? So I have 3 possible culprits

[sniffer] July 18

2007-07-18 Thread greg
Not sure what is up but I'm seeing lots of messages getting through to my primary folder since yesterday. Lots of .pdf attachments - Just checked and 10/11 were spam messages in my inbox. Thanks, Greg CoffeyNet/AllureTech v 307-473-2323 1546 E. Burlington cell

[sniffer] Re: July 18

2007-07-18 Thread Darin Cox
There have been a lot reported today. It started for us about 8:30am. We use Declude and added a filter to catch messages with subjects starting with Emailing:, ending with .pdf and having a body containing The message is ready to be sent with the following file or link. This combination may

[sniffer] Re: After AutoSNF MessageSniffer stops working

2007-07-08 Thread Alberto Santoni
Thank you a lot ... I will investigate. Regards Alberto -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: 07 July 2007 19:24 To: Message Sniffer Community Subject: [sniffer] Re: After AutoSNF MessageSniffer stops

[sniffer] After AutoSNF MessageSniffer stops working

2007-07-07 Thread Alberto Santoni
Hello twice (two days ago and this night) after an updating with AutoSNF, MessageSniffer stops working, after this accident I have found many files in the working directory with extensions .FIN .XXX Then: I stop iMail SMTP Service I stop MXGUARD Service I stop MessageSniffer Service I wait

[sniffer] Re: After AutoSNF MessageSniffer stops working

2007-07-07 Thread Pete McNeil
Hello Alberto, Since you are stopping the message processing services I don't see this causing any harm - but it does seem like overkill and may simply help you mask another problem. A build up of stale job files usually indicates another more serious problem. Normally, SNF will keep these files

[sniffer] Spam Storm - Watch for high traffic rates - ecard malware new PDF variant

2007-07-03 Thread Pete McNeil
Hello SNF Folks, We've just seen another very high spike (attached image). All rulebases appear to be up to date now to handle this content, however you should be watching for very volumes. Based on telemetry from systems testing the new SNF alpha we are seeing an average of 150% of normal spam

[sniffer] Re: I'm confused

2007-06-30 Thread Pete McNeil
Hello Joey, Simply amazing. I'm sorry we didn't catch that earlier. Yes, the 137999 rule in question was (it is gone now) a core white rule to pass through messages with PDF attachments. We were so focused on making rules that match the spam that nobody saw or thought to look for the white

[sniffer] Spam storm -- Greeting card malware w/ numbered links.

2007-06-29 Thread Pete McNeil
Hello Sniffer Folks, The greeting card malware spam is being pushed right now with amazing bandwidth! This is the first 11000+ / hour spike we've seen in quite a while. Rules are in place for this, but be on the look out in case it hits you before your update is ready. _M -- Pete McNeil

[sniffer] Greeting Malware Spike Graph

2007-06-29 Thread Pete McNeil
Hello Sniffer Folks, Vertical Wall Of Spam -- Pete McNeil Chief Scientist, Arm Research Labs, LLC.attachment: 20070629GreetingMalwareStormInProgress.png# This message is sent to you because you are subscribed to the mailing list

[sniffer] .pdf Attachments

2007-06-28 Thread Greg Coffey
What is with all the .pdf attachments in spam? I haven't noticed this trend previously. Are they infected or what is the scheme? # This message is sent to you because you are subscribed to the mailing list

[sniffer] Re: .pdf Attachments

2007-06-28 Thread Computer House Support
Yes, we're getting tons of these too. Michael Stein Computer House - Original Message - From: Greg Coffey [EMAIL PROTECTED] To: Message Sniffer Community sniffer@sortmonster.com Sent: Thursday, June 28, 2007 10:20 AM Subject: [sniffer] .pdf Attachments What is with all the .pdf

[sniffer] Re: .pdf Attachments

2007-06-28 Thread Pete McNeil
Hello Greg, Thursday, June 28, 2007, 10:20:04 AM, you wrote: What is with all the .pdf attachments in spam? I haven't noticed this trend previously. Are they infected or what is the scheme? Blackhats are now embedding their randomized image-spam images (pump dump, for example) into pdfs

[sniffer] Re: .pdf Attachments

2007-06-28 Thread Chris Bunting
Also getting tons of them in past few days Thank You, Chris Bunting Lancaster Networks Direct: 717-278-6639 Office: 888-LANCNET x703 MS Certified Systems Engineer IP Telephony Expert Lancaster Networks 1085 Manheim Pike Lancaster PA 17601

[sniffer] Re: After Updating MXGUARD

2007-06-28 Thread Alberto Santoni
Pete, after a day the SNF doesn't work yet ... what else can I try? I have checked all that possible With my best regards Alberto Santoni --- ASPita Sprl Grande rue au Bois, 196 - 1030 - Brussels +32(0)2 217 85 28 office +32(0)2 735 78 65 fax

[sniffer] Re: After Updating MXGUARD

2007-06-28 Thread E. H. (Eric) Fletcher
Albert: I remember there was some small trick to this when I did it a year or so ago. If I remember right there was a change to the MxGuard INI file that wasn't obvious. I'll take a look in a bit and see if I can get back to you with something. Eric - Original Message - From:

[sniffer] Re: After Updating MXGUARD

2007-06-28 Thread E. H. (Eric) Fletcher
Alberto: I haven't finished looking but one note I did make was that the syntax in MxGuard.INI had changed slightly to include a comma. [GLOBAL] Our working file under v1.7: SpamFilterType=NATIVE SNIFFER Our working file under v3.1: SpamFilterType=NATIVE, SNIFFER I will continue to look at

[sniffer] Re: Mdaemon Plug-in Update

2007-06-28 Thread Daniel Bayerdorffer
Hi Pete, Thanks for the info. I will keep my eyes peeled for the beta release. Thanks, Daniel -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Wednesday, June 27, 2007 10:05 PM To: Message Sniffer Community Subject:

[sniffer] Re: After Updating MXGUARD

2007-06-28 Thread Alberto Santoni
Thank you Eric I checked my mxguard.ini I have SpamFilterTypes=Native,Sniffer :( May be SNF work now but unfortunately no SPAM is arriving this evening on my server :-) Alberto # This message is sent to you because you are

[sniffer] Re: After Updating MXGUARD

2007-06-28 Thread Greg Coffey
What platform is the server running? I had problems running Win2003 and the latest sniffer, had to back up one ver to make it work. -- Original Message -- From: Alberto Santoni [EMAIL PROTECTED] Reply-To: Message Sniffer Community

[sniffer] Re: After Updating MXGUARD

2007-06-28 Thread Alberto Santoni
Hi I have Win2003 iMail Server 2006.2 MxGuard 3.1 The last version of Message Sniffer Regard Alberto Santoni --- ASPita Sprl Grande rue au Bois, 196 - 1030 - Brussels +32(0)2 217 85 28 office +32(0)2 735 78 65 fax +32(0)476 53 88 34 mobile Skype:

[sniffer] After Updating MXGUARD

2007-06-27 Thread Alberto Santoni
Hello After an update of MxGuard 1.7 - 3.1 the Sniffer doesn't work any more I have the Sniffer in persistent mode and loaded with Srvany I found many files I never seen in the Sniffer dir .SRV .FIN .XXX Which tests can I do to understand the problem ? Best regards Alberto Santoni

[sniffer] Spammers turning to PDF attachments?

2007-06-21 Thread Colbeck, Andrew
See this article at the Internet Storm Center: http://isc.sans.org/diary.html?storyid=3012 Pump and dump scams now in PDF Published: 2007-06-20, Last Updated: 2007-06-20 21:33:39 UTC by Maarten Van Horenbeeck (Version: 1) Apparently the groups behind what we know as pump and dump spam have

[sniffer] Dead Sniffer processes piling up.

2007-06-14 Thread Matt
Pete, I found this morning an instance where suddenly the number of processes on my system shot from around 50 to as many as 300, and after that peak, it settled down and rode the 150 level. All of the hung processes are Sniffer being called by Declude. I also had about 10 errors waiting

[sniffer] Re: Dead Sniffer processes piling up.

2007-06-14 Thread Matt
Pete, I have left all of those processes active for troubleshooting, and they are still there and definitely Sniffer. Process Explorer even shows what command line the executable was run with so I was able to do some digging in the logs for specifics. I found that Declude was recording

[sniffer] Re: Dead Sniffer processes piling up.

2007-06-14 Thread Pete McNeil
Hello Matt, Thursday, June 14, 2007, 1:56:19 PM, you wrote: Pete, I have left all of those processes active for troubleshooting, and they are still there and definitely Sniffer. Process Explorer even shows what command line the executable was run with so I was able to do some digging

[sniffer] Re: Error Messages since WeightGate

2007-06-10 Thread Keith Johnson
Darrell, Did you alter your heap size 3rd entry? If so, did you go to 1024 or other. I found this article by crossing a Declude page, appears to be what I need to go after. http://support.microsoft.com/default.aspx?scid=kb;EN-US;q142676 -Keith _ From: Message Sniffer Community on

[sniffer] Re: Error Messages since WeightGate

2007-06-10 Thread Matt
Keith, When I looked at this several years ago, this is what I came up with: Windows allows a total of 48 MB in the heap, and each service started process uses the third setting in the chain, or 512 KB by default, and there is about 10 MB that gets used for other things. Based on

[sniffer] Re: Error Messages since WeightGate

2007-06-10 Thread Matt
Here's a better page from someone at Microsoft all about the desktop heap. This one suggests that you can change the limit from 48 MB to a value as much as 450 MB. You will probably normally not need more than the total number of processes that Declude can use times the amount of memory

[sniffer] Re: Error Messages since WeightGate

2007-06-10 Thread Keith Johnson
Matt, Excellent research. Very well put together. Thanks for the time and the links. Keith _ From: Message Sniffer Community on behalf of Matt Sent: Sun 6/10/2007 6:29 PM To: Message Sniffer Community Subject: [sniffer] Re: Error Messages since WeightGate Here's a better page from

[sniffer] Re: Error Messages since WeightGate

2007-06-09 Thread Pete McNeil
Hello Keith, If I recall correctly, that error is associated with an undocumented memory heap in the Win OS. When that heap runs out of space this error is thrown. It can hit any application at random, however it seems to pop up more frequently when one program runs another -- For example IMail

[sniffer] Re: Spam

2007-05-30 Thread Darin Cox
Fortunately with Outlook Express we have the Ctrl-W function to initiate the forwarding process. Then we can just type in the first few characters of the address and hit Alt-S to send. Not as quick as a single button, but much quicker than Outlook without this toolbar. Takes me about 4

[sniffer] Re: Spam

2007-05-29 Thread Andy Schmidt
I recommend SpamSource, if you are an Outlook user. It's a little toolbar applet that you can configure any recipient of the forwarded spam and it will include all the original mail headers - just the way Sniffer, Spamcop etc. like it. All you do is press the button on the toolbar and the message

[sniffer] Re: Spam

2007-05-29 Thread Alberto Santoni
It is a wonderful tools! Thanks Andy Nobody pays us for our work of reporting not cached messages. The Sniffer staff should offer for free to our community this tools ;-) Alberto -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Andy

[sniffer] Re: Spam

2007-05-29 Thread David Moore
Well done Andy, cant wait for some spam to try it out on. Regards David Moore [EMAIL PROTECTED] J.P. MCP, MCSE, MCSE + INTERNET, CNE. www.adsldirect.com.au for ADSL and Internet www.romtech.com.au for PC sales Office Phone: (+612) 9453 1990 Fax Phone: (+612) 9453 1880 Mobile Phone: +614 18

[sniffer] ordb.org

2007-05-23 Thread greg
I've noticed quite a few false positives and started some research. Many show hits from ORDB. Apparently ordb.org shut down late in 2006 but it's still in my mxguard config. How can it be coming up with hits when there is no server to check against? What blacklists do you recommend that we

[sniffer] Re: Appriver issue

2007-05-19 Thread John T (lists)
Inserting my 2 cents here since that is all that it is worth. In backing up what Matt said, let me relate a similar example of a problem that occurred a year and a half ago to a major IT security products vendor: At about 6:15 AM PT on a week day in the middle of a normal busy week, their

[sniffer] Re: Downloads are not working....

2007-05-18 Thread Kevin Rogers
I sent a message earlier to this list but I'm not sure if it went through. We've been hit by this Appriver issue and it is still going on as far as I can tell. One of our users, call him [EMAIL PROTECTED] sent a message to about 70 people. And this message has been bounced 20 or 30,000

[sniffer] Re: Appriver issue

2007-05-18 Thread Computer House Support
For those of us in the dark about this, can someone explain who Appriver is, and what is has to do with Message Sniffer? Thank you, Michael Stein Computer House - Original Message - From: Kevin Rogers [EMAIL PROTECTED] To: Message Sniffer Community sniffer@sortmonster.com Sent:

[sniffer] Best renewal price and service on Sniffer?

2007-05-18 Thread Steve Guluk
Hello, I was informed some time back that I needed to renew my subscription to Sniffer soon. I sent an email to [EMAIL PROTECTED] on May 3rd and never got a response back. Today is the last day on my subscription. Does anyone have any suggestions on where to renew, at the best price?

[sniffer] Re: Appriver issue

2007-05-18 Thread Pete McNeil
Hello Computer, Friday, May 18, 2007, 8:34:27 AM, you wrote: For those of us in the dark about this, can someone explain who Appriver is, and what is has to do with Message Sniffer? Message Sniffer started out as an incubator project inside of MicroNeil Research Corporation. When it was time

[sniffer] Re: Best renewal price and service on Sniffer?

2007-05-18 Thread Computer House Support
Dear Steve, I have replied to you off-list regarding our discounted renewal services for Mesage Sniffer. Thank you, Michael Stein Computer House 609 652-5100 [EMAIL PROTECTED] - Original Message - From: Steve Guluk To: Message Sniffer Community Sent: Friday, May 18, 2007

[sniffer] Re: Best renewal price and service on Sniffer?

2007-05-18 Thread Steve Guluk
Thanks for the replies... Got it sorted out. On May 18, 2007, at 7:33 AM, Computer House Support wrote: Dear Steve, I have replied to you off-list regarding our discounted renewal services for Mesage Sniffer. Thank you, Michael Stein Computer House 609 652-5100 [EMAIL PROTECTED]

[sniffer] Re: Appriver issue

2007-05-18 Thread Kevin Rogers
Pete - Thanks for the reply, but I guess I don't understand what you're saying. Some packet loss and rulebase downloads to slow down for a time don't reflect what happened to me yesterday and apparently not what happened to one of the other posters either when he said that Appriver was having

[sniffer] Re: Appriver issue

2007-05-18 Thread Pete McNeil
Hello Kevin, Friday, May 18, 2007, 8:52:47 PM, you wrote: Pete - Thanks for the reply, but I guess I don't understand what you're saying. Some packet loss and rulebase downloads to slow down for a time don't reflect what happened to me yesterday and apparently not what happened to one of

[sniffer] Re: Appriver issue

2007-05-18 Thread Chris Bunting
Maybe I caused the confusion. The problem I had was with my customer using appriver. Not with my customers using message sniffer. How can something that happens with rulebase downloads effect your mail server? It shouldn't. I would expect there's a seperate problem with your mail server

[sniffer] Re: Appriver issue

2007-05-18 Thread David Moore
I think what Peter is try to say is that Sort monster is hosted at Appriver and Appriver had an issue and therefore so did Sort monster. http://www.dnsstuff.com/tools/dnsreport.ch?domain=sortmonster.com Regards David Moore [EMAIL PROTECTED] J.P. MCP, MCSE, MCSE + INTERNET, CNE.

[sniffer] Re: Downloads are not working....

2007-05-17 Thread Pete McNeil
Hello Chuck, Yes. We're working on a networking problem at the moment. I'll keep the list posted as new data becomes available. Thanks, _M Thursday, May 17, 2007, 2:10:40 PM, you wrote: Speeds are really slow and the connection is lost before completionEverything checks out good on our

[sniffer] Re: Downloads are not working....

2007-05-17 Thread Colbeck, Andrew
My last upload averaged a lame 6 KB/s. My last download varied widely in the speed obtained: 0K .. .. .. .. .. 17.85 KB/s 50K .. .. .. .. ..9.58 KB/s 100K .. .. .. ..

[sniffer] Re: Downloads are not working....

2007-05-17 Thread Matt
Appriver, who is somehow involved with Sniffer, is having a ridicolous problem with sending messages over and over again (once every few seconds). They pulled their contact information from their site but didn't take down their servers. I suspect this is putting strain on them and if Sniffer

[sniffer] Re: Downloads are not working....

2007-05-17 Thread Chris Bunting
Matt, I see their contact info there, where are you saying they removed it?? Thank You, Chris Bunting Lancaster Networks Direct: 717-278-6639 Office: 888-LANCNET x703 MS Certified Systems Engineer IP Telephony Expert Lancaster Networks 1085

[sniffer] Re: Downloads are not working....

2007-05-17 Thread Pete McNeil
Hello Chris, Thursday, May 17, 2007, 2:30:13 PM, you wrote: Oh god, that would explain why I put in a support request with appriver and it bounced back. One of our clients exchange servers was down today and they queue mail until it is back up, but I'm trying to get someone to release it

[sniffer] Re: Downloads are not working....

2007-05-17 Thread Chris Bunting
Thanks Pete. I just called them and got someone to tell me the same but no eta. Thank You, Chris Bunting Lancaster Networks 717-278-6639 Sent by my BlackBerry wireless device -Original Message- From: Pete McNeil [EMAIL PROTECTED] Date: Thu, 17 May 2007 14:48:35 To:Message

[sniffer] Re: Downloads are not working....

2007-05-17 Thread Matt
Pete McNeil wrote: I'm not sure what the actual issue is (I will get that data later), however I've just been informed that it should be resolved in the next 20 minutes or so. The issue was that they were redelivering messages over and over again. One customer got one message over 500

[sniffer] Re: Downloads are not working....

2007-05-17 Thread Colbeck, Andrew
Thanks for the update, Pete. Over on the Declude JunkMail support mailing list, it's like déjà vu all over again. Andrew 8) p.s. For the many of us here that don't subscribe to that list... The small number of recently active messages have been re-queued to the list several times.

[sniffer] Re: Downloads are not working....

2007-05-17 Thread Chris Bunting
Today's outage was horrible for one of my customers who was waiting on important emails regarding a property closing today they were buying, it it fouled all sorts of things up. I guess in some ways appriver's hosted solution is nice if YOUR server goes down, but if THEIR servers go down, its

[sniffer] Re: Spam

2007-05-14 Thread Pete McNeil
Hello David, Monday, May 14, 2007, 2:59:16 AM, you wrote: Do not send spam to the sniffer@ list. Submit un-captured spam to [EMAIL PROTECTED], or preferably to a spam collection pop3 box on your system that can be picked up by our bots. Thanks! _M

[sniffer] Re: Spam

2007-05-14 Thread Chuck Schick
Pete: It appears that you guys have it corraled for now. The rate of leakage has dropped again. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Sunday, May 13, 2007 3:51

[sniffer] Re: Spam

2007-05-14 Thread Alberto Santoni
Yes I agree also here we are having a real storm !!! Alberto -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: 14 May 2007 16:46 To: Message Sniffer Community Subject: [sniffer] Re: Spam Pete: It appears that you guys

[sniffer] Re: Spam

2007-05-13 Thread Rick Hogue
We are seeing the same thing. Started about a week and a half ago. Rick Hogue 502-649-3431 Cell Is your association working on the web? http://www.samprogram.com -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: Sunday, May

[sniffer] Re: Spam

2007-05-13 Thread Pete McNeil
Hello Chuck, We are working on a sequence of very aggressive campaigns that started today. They started about 8 hours ago and haven't stopped. We are catching up though. Looks like the blackhats decided to start the week early. _M Sunday, May 13, 2007, 1:05:45 PM, you wrote: We are seeing a

[sniffer] Re: Spam

2007-05-13 Thread Pete McNeil
Hello Rick, About that time they started serveral new campaigns using what appears to be a new version of message obfuscating bot software along with several new sources for stuffing. Volumes and leakage have been up since then. Today's activity is a new, much stronger burst of the same activity

[sniffer] Spam Storm

2007-05-08 Thread Jorge Asch
Has anybody notices any new spam storms out there? Since yesterday, about 10 times the normal spam get's through (normally 2-3 messages a day, now it's like 2-3 messages per hour). Sniffer returns 0 (clean) for all of them, while they don't even get a high enough score with SpamAssasin

[sniffer] Re: Spam Storm

2007-05-08 Thread Pete McNeil
Hello Jorge, Tuesday, May 8, 2007, 1:30:24 PM, you wrote: Has anybody notices any new spam storms out there? Since yesterday, about 10 times the normal spam get's through (normally 2-3 messages a day, now it's like 2-3 messages per hour). Sniffer returns 0 (clean) for all of them,

[sniffer] Re: Spam Storm

2007-05-08 Thread Jorge Asch
I think it's something else. Most message are different in content, and are not 100% spam. I guess your POP bot has been retrieving them from my system (I've reported them all). There is an aggressive new image spam campaign that started about 30 hours ago. This one has a continuously

[sniffer] Lots of Spam getting through last two days

2007-05-05 Thread Greg Coffey
My secondary is catching most but I'm seeing quite a few sliding though Sniffer. # This message is sent to you because you are subscribed to the mailing list sniffer@sortmonster.com. To unsubscribe, E-mail to: [EMAIL PROTECTED] To

[sniffer] Re: Lots of Spam getting through last two days

2007-05-05 Thread Chris Bunting
I've been seeing lots of spam overall for the past few weeks. Filters are definitely not working as they used to. All of my customers are commenting about it also Thank You, Chris Bunting Lancaster Networks Direct: 717-278-6639 Office: 888-LANCNET x703 MS Certified Systems Engineer IP

[sniffer] Timeout

2007-04-21 Thread Kami Razvan
Hi; I am getting the following error quite often recently.. 04/21/2007 18:40:58.911 q91c80097df74.smd Cumulative action(s) on this email = IGNORE LOG WARN [LAST ACTION=WARN] 04/21/2007 18:40:44.849 q91be00d9df71.smd ERROR: External program [SNIFFER] didn't finish quick enough;

[sniffer] QUE Files in Sniffer directory

2007-04-21 Thread Kami Razvan
Sorry the last email was sent early.. I also see a lot of files in the Sniffer directory with .que extension. I have deleted the old ones but there is about 1700 of them still in the directory that are for today.. Kami

[sniffer] Re: Fw: lot's of legit mailservsr in spamdatabases

2007-04-19 Thread Markus Gufler
Hi Bonno tin.it is one of Italians largest ISP's and the (not new) problem is that many blacklists does catch a RELATIVE high number of spam messages COMPARED to the number of legit messages simply because the traps measuring this traffic are located elsewhere then Italy or Europe. There are

[sniffer] Re: Fw: lot's of legit mailservsr in spamdatabases

2007-04-19 Thread Pete McNeil
Hello Bonno, Thursday, April 19, 2007, 7:01:47 AM, you wrote: Hi, I just posted this in the Declude.Junkmail list: snip/ Pete, Is this something the new Sniffer can help us with, identifying legit mailservers? Will hits have a separate exit code we can use to identify

[sniffer] Re: Fw: lot's of legit mailservsr in spamdatabases

2007-04-19 Thread Pete McNeil
Hello Markus, Thursday, April 19, 2007, 7:55:59 AM, you wrote: Hi Bonno tin.it is one of Italians largest ISP's and the (not new) problem is that many blacklists does catch a RELATIVE high number of spam messages COMPARED to the number of legit messages simply because the traps

[sniffer] Anyone else getting hit hard today?

2007-04-15 Thread Chris Bunting
I'm getting a ton of spam today that is getting thru the filter, and a lot that is getting caught... anyone else seeing this? Thank You, Chris Bunting Lancaster Networks Direct: 717-278-6639 Office: 888-LANCNET x703 MS Certified Systems Engineer IP Telephony Expert

[sniffer] Re: Anyone else getting hit hard today?

2007-04-15 Thread Pete McNeil
Hello Chris, We're catching nominal amounts at our spamtrap processors. The primary spamtrap handler is showing 98% capture. Is something broken on your end? Have you forwarded samples to spam@ ? Any errors in your SNF log? Rulebase up to date? _M Sunday, April 15, 2007, 2:33:26 PM,

[sniffer] Re: How to incorporate a white list?

2007-04-04 Thread Pete McNeil
The F001 bot will be disabled until further notice. _M -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. # This message is sent to you because you are subscribed to the mailing list sniffer@sortmonster.com. To

[sniffer] Re: How to incorporate a white list?

2007-04-04 Thread Jonathan Hickman
I do not think that anyone was asking the F001 bot to be disabled. Are you doing this for upgrading purposes or because there appeared to be an error with it? A single false positive as described, in my opinion, is no cause for alarm. Any time something changes, there is a potential for

[sniffer] Re: How to incorporate a white list?

2007-04-04 Thread Pete McNeil
Hello Jonathan, Wednesday, April 4, 2007, 10:41:19 AM, you wrote: I do not think that anyone was asking the F001 bot to be disabled. Are you doing this for upgrading purposes or because there appeared to be an error with it? A single false positive as described, in my opinion, is no

[sniffer] How to incorporate a white list?

2007-04-03 Thread Phillip Cohen
I am getting a large number of false positives and not sure why. Mostly mail from newsletters or lists, such as DMXZone, but I am also still unable to receive some mail from my own internal users. I am filtering on a per mailbox right now and I have been sending spam from my mailbox into its

[sniffer] Re: How to incorporate a white list?

2007-04-03 Thread Andy Schmidt
Hi Phil, Yes, it seems as if some Sniffer rules, e.g., 1367683, is broadly targeting Google's IPs. I've submitted 3 false positive reports since last night, at least two of them were Google users, one located in the U.S. and the other in the Netherlands! Andy -Original Message- From:

[sniffer] Re: How to incorporate a white list?

2007-04-03 Thread Pete McNeil
Hello Andy, Tuesday, April 3, 2007, 9:36:17 AM, you wrote: Hi Phil, Yes, it seems as if some Sniffer rules, e.g., 1367683, is broadly targeting Google's IPs. I've submitted 3 false positive reports since last night, at least two of them were Google users, one located in the U.S. and the

[sniffer] Re: How to incorporate a white list?

2007-04-03 Thread Andy Schmidt
Hi, Unless I'm mistaken, rule 1370762 was targeting the same address range. If I may make a suggestion: Before the spam-trap robots are allowed to block major, well-known and easily recognizable email providers, how about the robot script pulls a WHOIS and a Reverse DNS and runs that data

[sniffer] Re: How to incorporate a white list?

2007-04-03 Thread Matt
Agreed, however reverse DNS is not a universal solution as things like RR accounts will come from the same base domain as RR spam zombies, and you would otherwise have to track down each unique reverse DNS entry. I would test a connection to the SMTP server instead. Most of these servers

[sniffer] Re: How to incorporate a white list?

2007-04-03 Thread Pete McNeil
Hello Andy, Tuesday, April 3, 2007, 5:15:12 PM, you wrote: Hi Jonathan: That's exactly the problem. These particular rules were blocking Google mail servers - NOT specific content. To clarify, it was blocking precisely one IP. The F001 bot only tags a single IP at a time (not ranges, ever),

[sniffer] Re: How to incorporate a white list?

2007-04-03 Thread Andy Schmidt
Hi Pete, Thanks for taking the time to respond. The rule was in place from 20070326. The first reported false positives arrived today Except that reports from end users lingered in my email since Friday. Not your fault - but just to better demonstrate the ultimate effect it had. To be

[sniffer] Re: How to incorporate a white list?

2007-04-03 Thread Matt
Pete, CBL has a proven 99.97% accuracy and on some systems over a 40% hit rate on traffic, yet their methods are rather simple and easy to implement. If an IP hits your spamtrap, and it has either no reverse DNS entry or it has a dynamic reverse DNS entry, it is added, if it doesn't, it

[sniffer] Blank Header Emails still getting Through

2007-03-29 Thread Daniel Bayerdorffer
Hello, I've sent examples of these, every time I get them for several weeks, and they are still getting through. Is there something about them that is difficult? Because the body always has the same message. Something about doing email campaigns for charities. Thanks, Daniel -- Daniel

[sniffer] Re: Blank Header Emails still getting Through

2007-03-29 Thread Chris Bunting
You can set up a rule on your mail server to reject them if they have blank headers Thank You, Chris Bunting Lancaster Networks Direct: 717-278-6639 Office: 888-LANCNET x703 MS Certified Systems Engineer IP Telephony Expert Lancaster

[sniffer] Re: Blank Header Emails still getting Through

2007-03-29 Thread Pete McNeil
Hello Daniel, Thursday, March 29, 2007, 2:41:31 PM, you wrote: Hello, I've sent examples of these, every time I get them for several weeks, and they are still getting through. Is there something about them that is difficult? Because the body always has the same message. Something about

[sniffer] Re: Is this working?

2007-03-28 Thread Shaun Sturby, MCSE Optrics Engineering
Pong Shaun Sturby Technical Services Manager - - - - - - - - - - - - - - - - - - - Optrics Engineering | www.Optrics.com Canada: 6810 - 104 Street, Edmonton, AB, T6H 2L6 TF: 877-463-7638Fax: 780-432-5630 USA: 1740 S 300 West #10, Clearfield, UT, 84015 TF: 877-386-3763Fax:

[sniffer] Re: Is this working?

2007-03-28 Thread Heimir Eidskrem
One good thing about Sniffer is that it works so not much needs to be said :) This list is pretty slow due to few problems. Cordially, Heimir Eidskrem i360, Inc. 11152 Westheimer Suite 147 Houston, TX 77042 Ph: 713-981-4900 [EMAIL PROTECTED] www.i360.net www.i360hosting.com Houston's

[sniffer] Re: Is this working?

2007-03-28 Thread Pete McNeil
Hello Phillip, The list is often quite for long stretches. ;-) _M Wednesday, March 28, 2007, 1:43:22 PM, you wrote: Since installing Mail Sniffer I have not gotten anything on this list. Has it just been slow and there is no traffic or is sniffer eating up this list as SPAM? Phil

[sniffer] Re: Is this working?

2007-03-28 Thread Phillip Cohen
Thanks guys, guess it works. I actually have had clients call up saying that mail is broken and that they only get a few emails a day since installing sniffer. They used all that spam as an indicator that things were working. :) Nice not to have to spend hours going through the mail every

[sniffer] Re: assert! ?

2007-03-21 Thread Pete McNeil
Hello Jay, Wednesday, March 21, 2007, 1:08:35 AM, you wrote: What's the status of Assert!? I see this mentioned in your Wiki in August of 05, but it's coming soon on your web site? Assert! exists and was in production for a while, but we determined that it was not complete enough so we shut

<    4   5   6   7   8   9   10   11   12   13   >