"I doubt it's a setup issue because I'm using the same setup that I've used for a year now. "
This probably goes without saying but you have removed the osirusoft.com tests and replaced them with something appropriate?
I have email accounts that I monitor that get Huge amounts of spam. We were seeing some spam that would pass the DNS based tests and for that reason we added SpamCheck. Now Nothing get through. And we have fewer FPs.
Todd Hunter Progressive Systems
At 10:16 AM 9/2/2003 -0400, you wrote:
Scott, I doubt it's a setup issue because I'm using the same setup that I've used for a year now. Also I am not the only one receiving more spam.. All of my users are as well...
Anyway here is a piece of spam recently received (I've already blacklisted the sender) but it seems as soon as I blacklist a sender a new one is created.
Received: from p.advertisingbymail.com [64.119.218.212] by mail.nfti.com (SMTPD32-6.06) id A91816D01A4; Tue, 02 Sep 2003 08:12:08 -0400 To: [EMAIL PROTECTED] Date: Tue, 2 Sep 2003 04:20:23 -0800 Message-ID: <[EMAIL PROTECTED]> From: Weight Solution <[EMAIL PROTECTED]> Return-Path: <[EMAIL PROTECTED]> Reply-To: <[EMAIL PROTECTED]> Subject: Lose 10lbs in 1 Week X-MimeOLE: Prodigy Compatibility V 4.5c810f26 or later Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Declude-Sender: [EMAIL PROTECTED] [64.119.218.212] X-Declude-Spoolname: D89181a4.SMD X-Note: This E-mail was scanned by NFTISERV's Declude JunkMail for spam. X-Spam-Tests-Failed: None X-Weight: 0 X-Note: This E-mail was sent from p.advertisingbymail.com ([64.119.218.212]). X-RCPT-TO: <[EMAIL PROTECTED]> X-UIDL: 359866453 Status: U
Greg
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, September 02, 2003 9:53 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] More and more email getting past Declude
>Is it just me or have spammers found other ways to get past scanners? I've >been getting slammed lately with more and more spam that is getting past >declude without a single hit.
The two most common reasons for this are [1] A setup issue (a gateway/backup that Declude doesn't know about, bad DNS server, etc.), or [2] "quasi-legitimate E-mail" (for example, E-mail that you get after giving your E-mail address to a company but forgetting to uncheck the box that says "It's OK to give my E-mail address to your affiliates" or whatever).
If you can post the full headers (including Received: headers; no need for the message body), I can probably provide some pointers for how to improve spam detection.
-Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ---------------------------------------------------------------------------- -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com]
------------------------------------------------------------------------------
[This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
