[Declude.JunkMail] Missing delivery headers?
I know that this is one of those bogus eBay messages (see attached log and header snippets), but I'm trying to figure out why some of the delivery headers are missing and where they might be getting removed. The Postfix gateway logs show the message was received from h24-87-16-107.vc.shawcable.net[24.87.16.107], but for some reason the JunkMail logs and the message headers do not show any previous hops prior to the Postfix gateway. What are others seeing that are running gateways in front of their IMail servers? It appears to only be happening with these bogus eBay messages, but I don't know what it is about these particular messages that would cause some of the headers to disappear. Thoughts? Bill MissingHeaders.zip Description: Zip compressed data
[Declude.JunkMail] Re-training needed..
Hi.. I have searched all over the archive and the manual and can't find what exactly it is that we have added to our global statement. I know that it must have made sense when we added it.. COMMENTS comments weight x 5 0 The manual only talks about the test but has no examples.. I know the comments test but how does the above work? It will add the weight if 5 or more comments are found? So if there are 15 comments in the body what would the weight be? May be it is too early and my brain is not functioning yet... :) Regards, Kami
[Declude.JunkMail] Another phishing attempt..
Hi; Just saw this caught.. it seems like it is another phishing attempt.. Regards, Kami == X-Declude-Sender: [EMAIL PROTECTED] [66.202.36.78]X-Declude-Spoolname: Dc3520209011e0efa.SMDX-Note: This E-mail was scanned filtered by Declude [1.76i28] for SPAM virus.X-Weight: 58X-Note: Sent from Reverse DNS: host-66-202-36-78.man.choiceone.netX-Hello: 12.4.218.129 --_E0_02.EC4C_958EContent-Type: text/plain;Content-Transfer-Encoding: quoted-printable htmlThis is James from Swiftpay customer service. I'm e-mailing you to inform =you that user: John94 has sent you $124. Please login to your swiftpay acc=ount and claim your secured funds. To recieve your funds you need to have a valid and up to date swiftpay ac=count.Please a href="" href="http://www.swiftpay.tk">http://www.swiftpay.tk" >LICK HERE/a to sign up if you do not already have an account. Your money will remain in your account pending a claim for 96 hours at whi=ch time it will be held to protect against possible money laundering and f=raud. Have a nice daySincerely,Swiftpay Customer Service[EMAIL PROTECTED]/html uejgkoaaogsusgdbocktemk u fbvevp ydrspc sjth --_E0_02.EC4C_958E--
Re: [Declude.JunkMail] Re-training needed..
Hi Kami, According to my notes . . . COMMENTS comments weight x 10 0 In the above case, the weight of the E-mail will be increased by the number of anti-filtering comments that are found (plus the base weight of the test). So if there are 3 in there, the weight will be increased by 13 (10 for failing the test, and 1 for each anti-filtering comment found). If there are 40 such comments, a total of 50 would be added to the weight of the E-mail. The following is from the global, available from the junkmail manual: COMMENTScommentsx x 7 0 The following is from our global: COMMENTS comments 5 x 10 0 In the above case, the test will only fail those e-mails which contain 5 or more anti-filtering comments. HTH Thanks, Monday, December 1, 2003, 4:46:04 AM, Kami Razvan [EMAIL PROTECTED] wrote: KR Hi.. KR I have searched all over the archive and the manual and can't find what KR exactly it is that we have added to our global statement. I know that it KR must have made sense when we added it.. KR COMMENTS comments weight x 5 0 KR The manual only talks about the test but has no examples.. I know the KR comments test but how does the above work? KR It will add the weight if 5 or more comments are found? KR So if there are 15 comments in the body what would the weight be? KR May be it is too early and my brain is not functioning yet... :) KR Regards, KR Kami Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net PGP Key ID: 04C99A55 (972) 788-2364 Fax: (972) 788-5049 Providing Internet Solutions Worldwide - An eDataWeb Affiliate --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Missing delivery headers?
What are others seeing that are running gateways in front of their IMail servers? It appears to only be happening with these bogus eBay messages, but I don't know what it is about these particular messages that would cause some of the headers to disappear. This is unusual -- either Postfix isn't adding the Received: header, or it is getting stripped somehow while or after IMail receives it. But given the way that IMail works, it's very unlikely that it is being stripped after IMail receives it. That's because IMail saves the D*.SMD file by writing its Received: header, and then adding whatever comes in from the remote mailserver. So when the E-mail is later actually processed (by IMail or Declude), there is already a Received: header before the possibly stripped Received header. I'm not aware of any cases where IMail or Declude will intentionally remove a header. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Refusing message based on nul sender
how paranoid should you be to refuse message based on this only criteria ? 20031127 154038 127.0.0.1 SMTP (07980D3F) 501 5.7.1 MX of sender (mail.cefib.com.) does not accept address as required by RFC 821, 1123, 2505, and 2821 20031127 154038 127.0.0.1 SMTP (07980D3F) ERR undeliverable 501 5.7.1 MX of sender (mail.cefib.com.) does not accept address as required by RFC 821, 1123, 2505, and 2821 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
AW: [Declude.JunkMail] More ATTACH and MAILBOX questions
Title: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions hi scott, since more then 2000 of my users use web messaging the attach action is no real option for me. i use declude virus as well and there i use the emailnotifikation for the recipient when an email is hold because of a vulnerability. in this notification i give the queue file name of the hold email to the recipient and let him decide if he wants the message to be delivered (right now we do this by hand, but we working on an other way). if there would be a notification based an the hold action in jm, i could use it in a similar way (at least for those messages with a weight on the edge between legal and spam). the best thing would be, if i had something like skipifweightishigher in the eml for this! mfg i.a. gez. guhl *** lds nrw dez. 235 tel.: 0211 9449 2578 fax.: 0211 9449 8344 mailto:[EMAIL PROTECTED] *** -Ursprüngliche Nachricht- Von: R. Scott Perry [mailto:[EMAIL PROTECTED]] Gesendet am: Montag, 10. November 2003 21:22 An: [EMAIL PROTECTED] Betreff: Re: [Declude.JunkMail] More ATTACH and MAILBOX questions I'm testing out the ATTACH and MAILBOX options. In web messaging many of the Declude tagged MAILBOX and ATTACH messages do not display the Declude spam hider info. or appear as attachments. Is this are there workarounds for web messaging? I believe that IMail's web messaging doesn't support E-mail attachments (E-mails within a E-mail) that the ATTACH action uses. Unfortunately, I don't know of any workaround. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: AW: [Declude.JunkMail] More ATTACH and MAILBOX questions
since more then 2000 of my users use web messaging the attach action is no real option for me. i use declude virus as well and there i use the emailnotifikation for the recipient when an email is hold because of a vulnerability. in this notification i give the queue file name of the hold email to the recipient and let him decide if he wants the message to be delivered (right now we do this by hand, but we working on an other way). if there would be a notification based an the hold action in jm, i could use it in a similar way (at least for those messages with a weight on the edge between legal and spam). the best thing would be, if i had something like skipifweightishigher in the eml for this! We are actually looking into notifications for Declude JunkMail (where the notifications could be batched, too, such as daily notifications). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT
I have my system setup as listed below. Why would the system ingnore the WEIGHT100 DELETE it is performing WEIGHT40 ROUTETO [EMAIL PROTECTED] (In the top of my Filters) SKIPIFWEIGHT 100 MAXWEIGHT100 $default$.junkmail WEIGHT100 DELETE Global.cfg WEIGHT100 weight x x 100 0 - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, November 29, 2003 5:34 AM Subject: RE: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT Hi Frederick: Here is what we do: # Version= 1.27i28: Skip the test if weight is reached SKIPIFWEIGHT 70 # Version= 1.27i28: Exit the test if weight is reached MAXWEIGHT60 REMOTEIP 0STARTSWITH 157.151.5 REMOTEIP 0STARTSWITH 193.216.245.227 REMOTEIP 0STARTSWITH 194.143.183.53 You have to be using Declude 1.27i27 or 28 (I don't remember) or higher.. Simply add them to the top of your filter files and it will do what they say they do.. Upon start of the filter if the total weight prior to entering the filter is 70 then the filter will not run and if during the run of the filter the weight associated with the filter reaches 60 then the filter exits. So if you have a weight of 50 going into the filter you can exit the filter with no more than 110 as weight. OR If you are running the filter and you are already at a weight of 70 then the filter will never run and you will exit with 70. Recommendation: Make sure you put all your weights that have negative weight prior to the ones with positive weight. That is what we do - all of our negative weights are on top of the global.cfg and we have structured our filters such that the bigger filters are the last to execute so hopefully if the weight is large enough prior to getting to them they will not run. Looking at our log files it is incredible how many of the filters are not even running anymore but they are there just in case... Hope that answers your question.. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Friday, November 28, 2003 11:20 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT Does any one have more information on these SKIPIFWEIGHT and MAXWEIGHT Thanks. Fred --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT
I have my system setup as listed below. Why would the system ingnore the WEIGHT100 DELETE Note that the SKIPIFWEIGHT and MAXWEIGHT options in the latest interim release only apply to the filters that they are listed in. it is performing WEIGHT40 ROUTETO [EMAIL PROTECTED] (In the top of my Filters) SKIPIFWEIGHT 100 MAXWEIGHT100 Here, the maximum weight that this specific filter can add is 100 (and the test will not be run if the weight is calculated at 100 or higher when the test is run). $default$.junkmail WEIGHT100 DELETE Global.cfg WEIGHT100 weight x x 100 0 In this case, if the total weight for the E-mail is 100 or higher, it should be deleted. Note that the WEIGHT100 DELETE would be ignored if there are per-user or per-domain settings (which would override it), or if the E-mail is outgoing (in which case the \IMail\Declude\global.cfg file would be used). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT
Once again I found my own problem. Thanks. - Original Message - From: Frederick Samarelli [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 10:16 AM Subject: Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT I have my system setup as listed below. Why would the system ingnore the WEIGHT100 DELETE it is performing WEIGHT40 ROUTETO [EMAIL PROTECTED] (In the top of my Filters) SKIPIFWEIGHT 100 MAXWEIGHT100 $default$.junkmail WEIGHT100 DELETE Global.cfg WEIGHT100 weight x x 100 0 - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, November 29, 2003 5:34 AM Subject: RE: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT Hi Frederick: Here is what we do: # Version= 1.27i28: Skip the test if weight is reached SKIPIFWEIGHT 70 # Version= 1.27i28: Exit the test if weight is reached MAXWEIGHT60 REMOTEIP 0STARTSWITH 157.151.5 REMOTEIP 0STARTSWITH 193.216.245.227 REMOTEIP 0STARTSWITH 194.143.183.53 You have to be using Declude 1.27i27 or 28 (I don't remember) or higher.. Simply add them to the top of your filter files and it will do what they say they do.. Upon start of the filter if the total weight prior to entering the filter is 70 then the filter will not run and if during the run of the filter the weight associated with the filter reaches 60 then the filter exits. So if you have a weight of 50 going into the filter you can exit the filter with no more than 110 as weight. OR If you are running the filter and you are already at a weight of 70 then the filter will never run and you will exit with 70. Recommendation: Make sure you put all your weights that have negative weight prior to the ones with positive weight. That is what we do - all of our negative weights are on top of the global.cfg and we have structured our filters such that the bigger filters are the last to execute so hopefully if the weight is large enough prior to getting to them they will not run. Looking at our log files it is incredible how many of the filters are not even running anymore but they are there just in case... Hope that answers your question.. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Friday, November 28, 2003 11:20 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT Does any one have more information on these SKIPIFWEIGHT and MAXWEIGHT Thanks. Fred --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT
So if I want to perform an action at 100 should I change these to: SKIPIFWEIGHT 101 MAXWEIGHT101 - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 10:30 AM Subject: Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT I have my system setup as listed below. Why would the system ingnore the WEIGHT100 DELETE Note that the SKIPIFWEIGHT and MAXWEIGHT options in the latest interim release only apply to the filters that they are listed in. it is performing WEIGHT40 ROUTETO [EMAIL PROTECTED] (In the top of my Filters) SKIPIFWEIGHT 100 MAXWEIGHT100 Here, the maximum weight that this specific filter can add is 100 (and the test will not be run if the weight is calculated at 100 or higher when the test is run). $default$.junkmail WEIGHT100 DELETE Global.cfg WEIGHT100 weight x x 100 0 In this case, if the total weight for the E-mail is 100 or higher, it should be deleted. Note that the WEIGHT100 DELETE would be ignored if there are per-user or per-domain settings (which would override it), or if the E-mail is outgoing (in which case the \IMail\Declude\global.cfg file would be used). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SKIPIFWEIGHT and MAXWEIGHT
So if I want to perform an action at 100 should I change these to: SKIPIFWEIGHT 101 MAXWEIGHT101 No. You definitely, positively should not be using SKIPIFWEIGHT or MAXWEIGHT right now unless you understand exactly how they work. I would urge you to wait until the next beta before using those features. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] EASYNET tests going away December 1
Andy, You have all of these tests running? What's the impact on the server for all of these? What's your mail load? I just love having to replace all these tests every month or so, don't we all? LOL! But I want to lessen the impact on our server as much as possible. What of these tests do you recommend the most? Paul Hi, Yesterday's results of my EasyNet replacement candidates: TEST # FAILED Percentage AHBLDOMAINS710.95% AHBLPROXIES...7359.82% AHBLSOURCES...3514.69% (reliable, so far) NJABLDUL..2743.66% (many duplicates with SORBS-DUL) NJABLPROXIES1,085...14.49% NJABLRELAYS...1181.58% NJABLSOURCES..2653.54% (reliable, so far) SORBS-DUL...2,664...35.58% SORBS-HTTP7379.84% (proxies) SORBS-MISC.801.07% (proxies) SORBS-SOCKS...873...11.66% (proxies) SORBS-SMTP..50.07% SORBS-ZOMBIE...300.40% A) Do NOT use SORBS-SPAM. As they point out on their web site, it has been infested with the mail servers of most major providers by the simple fact that virus-infected customer systems have been sending arbitrary emails, implicating the mail sever of the provider. I tested it for two days and kept lowering the weight until I realized that it was not at all helpful in trying to distinguish spam from legitimate mail. B) I have been holding and/or deleting ANYTHING proxy for many weeks now and so far never had any customer complaints about lost emails. Best Regards Andy Schmidt --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] EASYNET tests going away December 1
Paul What program do you use to get those statistics listed ?? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of paul Sent: Monday, December 01, 2003 9:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] EASYNET tests going away December 1 Andy, You have all of these tests running? What's the impact on the server for all of these? What's your mail load? I just love having to replace all these tests every month or so, don't we all? LOL! But I want to lessen the impact on our server as much as possible. What of these tests do you recommend the most? Paul Hi, Yesterday's results of my EasyNet replacement candidates: TEST # FAILED Percentage AHBLDOMAINS710.95% AHBLPROXIES...7359.82% AHBLSOURCES...3514.69% (reliable, so far) NJABLDUL..2743.66% (many duplicates with SORBS-DUL) NJABLPROXIES1,085...14.49% NJABLRELAYS...1181.58% NJABLSOURCES..2653.54% (reliable, so far) SORBS-DUL...2,664...35.58% SORBS-HTTP7379.84% (proxies) SORBS-MISC.801.07% (proxies) SORBS-SOCKS...873...11.66% (proxies) SORBS-SMTP..50.07% SORBS-ZOMBIE...300.40% A) Do NOT use SORBS-SPAM. As they point out on their web site, it has been infested with the mail servers of most major providers by the simple fact that virus-infected customer systems have been sending arbitrary emails, implicating the mail sever of the provider. I tested it for two days and kept lowering the weight until I realized that it was not at all helpful in trying to distinguish spam from legitimate mail. B) I have been holding and/or deleting ANYTHING proxy for many weeks now and so far never had any customer complaints about lost emails. Best Regards Andy Schmidt --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] EASYNET tests going away December 1
Hi Paul: It's hard to measure the actual impact, as this machine serves a few functions. However, my unscientific observation has been, that two other applications on that machine are gobbling up most of its CPU use. Declude's use is noticeable - but minor - and seems to be mostly for Declude Virus launching the virus scanner. Also, keep in mind that in later Declude versions Scott had optimized the DNS queries that are directed against the SAME dnsbl server. My logic is - if it helps holding or deleting 10 or more percent of messages then I would just have to provide whatever hardware resources are necessary to run the additional test to save money at every desktop. If you are trying to ecnomize I would drop AHBL and then NJABL and only keep SORBS. However, I found that the AHBLSOURCES and NJABLSOURCES are pretty reliable, so I give them a high weight - where the SORBS-SOURCES test was eliminated because it's mostly false positives. Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of paul Sent: Monday, December 01, 2003 11:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] EASYNET tests going away December 1 Andy, You have all of these tests running? What's the impact on the server for all of these? What's your mail load? I just love having to replace all these tests every month or so, don't we all? LOL! But I want to lessen the impact on our server as much as possible. What of these tests do you recommend the most? Paul Hi, Yesterday's results of my EasyNet replacement candidates: TEST # FAILED Percentage AHBLDOMAINS710.95% AHBLPROXIES...7359.82% AHBLSOURCES...3514.69% (reliable, so far) NJABLDUL..2743.66% (many duplicates with SORBS-DUL) NJABLPROXIES1,085...14.49% NJABLRELAYS...1181.58% NJABLSOURCES..2653.54% (reliable, so far) SORBS-DUL...2,664...35.58% SORBS-HTTP7379.84% (proxies) SORBS-MISC.801.07% (proxies) SORBS-SOCKS...873...11.66% (proxies) SORBS-SMTP..50.07% SORBS-ZOMBIE...300.40% A) Do NOT use SORBS-SPAM. As they point out on their web site, it has been infested with the mail servers of most major providers by the simple fact that virus-infected customer systems have been sending arbitrary emails, implicating the mail sever of the provider. I tested it for two days and kept lowering the weight until I realized that it was not at all helpful in trying to distinguish spam from legitimate mail. B) I have been holding and/or deleting ANYTHING proxy for many weeks now and so far never had any customer complaints about lost emails. Best Regards Andy Schmidt --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Itemized Summaries by Customer/Domain
What program do you use to get those statistics listed ?? DL Analyzer. I love this tool. I have it set up to send daily/weekly summaries of all emails held or deleted for certain domains to the technical contacts of some larger customers. All they used to know was how much email they get, how much occasional SPAM still slips through and if someone complains about the very occasional false positive. Now that they see itemized how many thousands of emails are being BLOCKED to their users, they are much more willing to reasonably deal with the occasional false-positive. It's a nice way of doing good and talking about it: http://www.dlanalyzer.com I'm trying to get the developers to add the same function for Declude Virus. Then, instead of sending out a notice PER virus (or even suppressing virus notices because of volume), I could have it send daily or weekly summaries to tell them how great a hosting company we are - without flooding customer's mailboxes. Best Regards Andy Schmidt Argos Networks 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-9411 x20 (Business) Fax:+1 201 934-9206 http://www.Argos.net/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] EASYNET tests going away December 1
FWIW, I run many more tests than this -- about 30 total plus the internal Declude tests, External Sniffer, and Declude Virus. Message load is about 150,000 messages per day on a dual 2.8 Ghz. No performance hits noticed. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of paul Sent: Monday, December 01, 2003 11:52 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] EASYNET tests going away December 1 Andy, You have all of these tests running? What's the impact on the server for all of these? What's your mail load? I just love having to replace all these tests every month or so, don't we all? LOL! But I want to lessen the impact on our server as much as possible. What of these tests do you recommend the most? Paul Hi, Yesterday's results of my EasyNet replacement candidates: TEST # FAILED Percentage AHBLDOMAINS710.95% AHBLPROXIES...7359.82% AHBLSOURCES...3514.69% (reliable, so far) NJABLDUL..2743.66% (many duplicates with SORBS-DUL) NJABLPROXIES1,085...14.49% NJABLRELAYS...1181.58% NJABLSOURCES..2653.54% (reliable, so far) SORBS-DUL...2,664...35.58% SORBS-HTTP7379.84% (proxies) SORBS-MISC.801.07% (proxies) SORBS-SOCKS...873...11.66% (proxies) SORBS-SMTP..50.07% SORBS-ZOMBIE...300.40% A) Do NOT use SORBS-SPAM. As they point out on their web site, it has been infested with the mail servers of most major providers by the simple fact that virus-infected customer systems have been sending arbitrary emails, implicating the mail sever of the provider. I tested it for two days and kept lowering the weight until I realized that it was not at all helpful in trying to distinguish spam from legitimate mail. B) I have been holding and/or deleting ANYTHING proxy for many weeks now and so far never had any customer complaints about lost emails. Best Regards Andy Schmidt --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Subject Starts with
Scott, feature request. (Sigh, another one.) Can you add something like this: SUBJECT 0 STARTSWITHSPACE I am seeing a good amount of spam where the subject line starts with a space and then some character and then the subject. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MONKEYFORMMAIL, MONKEYPROXIES
Hi, I noticed this test in my config file, but there are no longer in the Declude default config files... Are they still valid tests? Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] MONKEYFORMMAIL, MONKEYPROXIES
I noticed this test in my config file, but there are no longer in the Declude default config files... Are they still valid tests? They are no longer around. They were killed off by spammers. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Subject Starts with
Scott, feature request. (Sigh, another one.) Can you add something like this: SUBJECT 0 STARTSWITHSPACE I am seeing a good amount of spam where the subject line starts with a space and then some character and then the subject. Ah, good idea -- I'll see if we can add that. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Subject Starts with
Scott, Instead of adding it a command, how about you just create a substitution string for space, i.e. [space]. This way it could be used in this fashion, as well as before some words (as a delimiter in the sense that Bill earlier suggested). SUBJECT 0 BEGINSWITH [space] BODY 0 CONTAINS [space]ass Matt R. Scott Perry wrote: Scott, feature request. (Sigh, another one.) Can you add something like this: SUBJECT 0 STARTSWITHSPACE I am seeing a good amount of spam where the subject line starts with a space and then some character and then the subject. Ah, good idea -- I'll see if we can add that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Per User
On the per user configurations, any problems if the user has a period in the name? John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Best way to forward E-mail from an AOL account
I'm just looking for a recommendation from someone that has set this up since I have no experience with it. I have a client that needs to forward two AOL E-mail addresses over to accounts on our server. Does AOL offer this, or do you have to go through a third party? If you have to go through a third party for forwarding, which one would you use? Thanks, Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Subject Starts with
This way, if it starts a trend, we can not filter on [space] anymore.. Yes, but right now we can't filter on a space :) Scott might also get a little fancy and convert the special character combinations from MIME like =3D to ASCII equivalents before processing the filters. He's already doing some of that by stripping out the comment blocks. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hijack question
If an IP is caught and held by HOLD2, but a sender who is listed by ALLOWADDR sends a e-mail from the IP, will that message be held or passed? ALLOWADDR and ALLOWIP override all other settings, so their mail should be allowed through. Example, IP 10.10.10.1 is held. Joe using [EMAIL PROTECTED] sends a message to someone on the Internet and he is at/behind IP address 10.10.10.1. In the Hijack.cfg file is a line ALLOWADDR [EMAIL PROTECTED]. He should be allowed to send mail in this case. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS
Does any one know if vianet.ca is a valid domain use of simpatico.ca mail servers? X-RBL-Warning: SPAMDOMAINS: Spamdomain 'sympatico.ca' found: Address of [EMAIL PROTECTED] sent from invalid shimmer.vianet.ca. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sniffer
Hi, I highly recommend it. I've been using it for over a year now and it has caught a lot of spam. I am considering Maps too. But it's $1500/yr. Anyone using them? Kevin At 01:36 PM 12/1/2003, you wrote: Is sniffer worth the $300/year? Thinking about trying it. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sniffer
Hi Andy, I think Sniffer is available as a demo. It's worth trying.-- http://www.sortmonster.com/MessageSniffer/Try-It.html -- and I think it has improved in recent months. fwiw: Sniffer catches a lot of stuff that is also caught by other (free) ip4r and RHSBL lists. However, these last few months have shown that maintaining these lists is time consuming and even well run and reliable lists tend to come and go. A paid subscription-- whatever you choose is going to help you weather the storm a bit better. Burzin At 03:36 PM 12/1/2003, you wrote: Is sniffer worth the $300/year? Thinking about trying it. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] -- Burzin Sumariwalla Phone: (314) 994-9411 x291 [EMAIL PROTECTED] Fax: (314) 997-7615 Pager: (314) 407-3345 Networking and Telecommunications Manager Information Technology Services St. Louis County Library District 1640 S. Lindbergh Blvd. St. Louis, MO 63131 --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sniffer
Absolutly worth it's cost... Darrell andyb writes: Is sniffer worth the $300/year? Thinking about trying it. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. Check Out DLAnalyzer a comprehensive reporting tool for Declude Junkmail Logs - http://www.dlanalyzer.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Best way to forward E-mail from an AOL account
I Don't think AOL allows forwarding. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Monday, December 01, 2003 12:34 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Best way to forward E-mail from an AOL account I'm just looking for a recommendation from someone that has set this up since I have no experience with it. I have a client that needs to forward two AOL E-mail addresses over to accounts on our server. Does AOL offer this, or do you have to go through a third party? If you have to go through a third party for forwarding, which one would you use? Thanks, Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Finding reason for white list
Any idea why I am getting this ?? 12/01/2003 16:03:12 Invalid WHITELIST type: AUTH I Just removed the # from the #WHITELIST AUTH line on the default Global config file.. I am running Imail 8.04 WHITELIST AUTH requires Declude JunkMail v1.76 or later. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] sniffer
I subscribed to MAPS for a while - but then found that it was not catching anything that I didn't catch with public tests. But that was probably a year ago that I compared it. Results may be different now. Best Regards Andy Schmidt HM Systems Software, Inc. 600 East Crescent Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Monday, December 01, 2003 04:56 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] sniffer Hi, I highly recommend it. I've been using it for over a year now and it has caught a lot of spam. I am considering Maps too. But it's $1500/yr. Anyone using them? Kevin At 01:36 PM 12/1/2003, you wrote: Is sniffer worth the $300/year? Thinking about trying it. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Finding reason for white list
I've double-checked the logs for something like that; no luck. I'm mystified. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, December 01, 2003 2:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Finding reason for white list Recently we got much spam from one source. When I examined the headers to find out why, all indicated the items had been white listed. I have three methods of white listing: from (full address or domain), to (recipients who want everything) and anywhere (about 20 special text strings). So I began checking each but couldn't find a match between the spam samples and my white lists. I suspected it was one of the white list entries in my global.cfg file because the weight was always zero, but that theory didn't bear fruit either. If this has been asked before I don't remember seeing it: How can I find out exactly what Declude used to white list an email? There should be a log file entry that has the text that was used to whitelist the E-mail (such as E-mail whitelisted - automatically passing all spam tests [EMAIL PROTECTED], where [EMAIL PROTECTED] was the text used to whitelist the E-mail). -Scott --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Finding reason for white list
I've double-checked the logs for something like that; no luck. I'm mystified. What is the exact message in the E-mail headers saying that it was whitelisted? Are you using WHITELIST AUTH or AUTOWHITELIST? -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Subject Starts with
It's not really a reserved word since the suggestion was space enclosed in square brackets - how often have you seen that used in a sentence: wow, I really [space] out sometimes... ;-) Bill - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 1:27 PM Subject: RE: [Declude.JunkMail] Subject Starts with I have to agree with Kami. I would rather not define reserved words. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Monday, December 01, 2003 12:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Starts with Matt.. This is scary .. Now you are suggesting we start defining reserve words.. This way, if it starts a trend, we can not filter on [space] anymore.. Just a thought. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Monday, December 01, 2003 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with Scott, Instead of adding it a command, how about you just create a substitution string for space, i.e. [space]. This way it could be used in this fashion, as well as before some words (as a delimiter in the sense that Bill earlier suggested). SUBJECT 0 BEGINSWITH [space] BODY 0 CONTAINS [space]ass Matt R. Scott Perry wrote: Scott, feature request. (Sigh, another one.) Can you add something like this: SUBJECT 0 STARTSWITHSPACE I am seeing a good amount of spam where the subject line starts with a space and then some character and then the subject. Ah, good idea -- I'll see if we can add that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sniffer
Absolutely! It has been a very nice addition to our spam arsenal. Bill - Original Message - From: andyb [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 1:36 PM Subject: [Declude.JunkMail] sniffer Is sniffer worth the $300/year? Thinking about trying it. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Subject Starts with
That's just it, I am seeing the use of [] in spam subject lines. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, December 01, 2003 2:32 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with It's not really a reserved word since the suggestion was space enclosed in square brackets - how often have you seen that used in a sentence: wow, I really [space] out sometimes... ;-) Bill - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 1:27 PM Subject: RE: [Declude.JunkMail] Subject Starts with I have to agree with Kami. I would rather not define reserved words. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Monday, December 01, 2003 12:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Starts with Matt.. This is scary .. Now you are suggesting we start defining reserve words.. This way, if it starts a trend, we can not filter on [space] anymore.. Just a thought. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Monday, December 01, 2003 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with Scott, Instead of adding it a command, how about you just create a substitution string for space, i.e. [space]. This way it could be used in this fashion, as well as before some words (as a delimiter in the sense that Bill earlier suggested). SUBJECT 0 BEGINSWITH [space] BODY 0 CONTAINS [space]ass Matt R. Scott Perry wrote: Scott, feature request. (Sigh, another one.) Can you add something like this: SUBJECT 0 STARTSWITHSPACE I am seeing a good amount of spam where the subject line starts with a space and then some character and then the subject. Ah, good idea -- I'll see if we can add that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sniffer
I am considering Maps too. But it's $1500/yr. Anyone using them? I have problems at $1500/yr. If it was like $500 I would probably be using it. It was a good list when it was free and I am sure it is still a good list. I just cannot justify the expense for it. For now Sniffer is the only paid add on to Declude (well F-Prot for the anti virus...). Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! Whenever you find yourself on the side of the majority, it's time to pause and reflect. Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Subject Starts with
[Bill] [stranger] [things] [have] [happened] [in] [the] [past]. [space] [may] [not] [be] [used] [but] [starting] [reserve] [words] [can] [start] [a] [precedent] [that] [could] [make] [filtering] [and] [debugging] [a] [nightmare]. [Regards,] [:)] [Kami] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, December 01, 2003 5:32 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with It's not really a reserved word since the suggestion was space enclosed in square brackets - how often have you seen that used in a sentence: wow, I really [space] out sometimes... ;-) Bill - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 1:27 PM Subject: RE: [Declude.JunkMail] Subject Starts with I have to agree with Kami. I would rather not define reserved words. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Monday, December 01, 2003 12:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Starts with Matt.. This is scary .. Now you are suggesting we start defining reserve words.. This way, if it starts a trend, we can not filter on [space] anymore.. Just a thought. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Monday, December 01, 2003 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with Scott, Instead of adding it a command, how about you just create a substitution string for space, i.e. [space]. This way it could be used in this fashion, as well as before some words (as a delimiter in the sense that Bill earlier suggested). SUBJECT 0 BEGINSWITH [space] BODY 0 CONTAINS [space]ass Matt R. Scott Perry wrote: Scott, feature request. (Sigh, another one.) Can you add something like this: SUBJECT 0 STARTSWITHSPACE I am seeing a good amount of spam where the subject line starts with a space and then some character and then the subject. Ah, good idea -- I'll see if we can add that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] HOLD and WARN
Hi, I'm using SPAMCOP as part of the weighting system and as a HOLD action by itself. Because of this, In spamreview it shows a total WEIGHT but SPAMCOP isn't listed, though I know it added to the WEIGHT because of the spamlog. I take it that's just how it is? IS there a way to have it show in SPAMREVIEW as a failed test, but still keep the HOLD action? I believe if I change it to WARN, it will show in Spam Review... Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sniffer
I've got it in and running...seems to be helping already. - Original Message - From: Bill Landry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 5:34 PM Subject: Re: [Declude.JunkMail] sniffer Absolutely! It has been a very nice addition to our spam arsenal. Bill - Original Message - From: andyb [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 1:36 PM Subject: [Declude.JunkMail] sniffer Is sniffer worth the $300/year? Thinking about trying it. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Header question
Any one else seeing this in the headers, good or bad? X-Mailer: Atriks Professional Email Deployment Service John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Finding reason for white list
I could be on the wrong track here but if you use the 'Whitelist To' function on your domain, then if a spammer sends an email to the user that is whitelist to'd, all other users that appear on the TO address line of that email will also receive the 'Whitelist To' behavior. Example: UserB is upset because he feels your anti-spam measures are restrictive and asks you to turn them off for just him. You do this using 'Whitelist To [EMAIL PROTECTED]' in global.cfg. A spammer then sends an email to [EMAIL PROTECTED], [EMAIL PROTECTED] and [EMAIL PROTECTED] Normally, for example's sake, this spam would have been caught with a high weight. However, because of the 'Whitelist To', all three users(a, b, and c) will get the spam, and in the headers, you will see only 'Whitelisted(0)' Just a thought. -Original Message- From: Keith Purtell [mailto:[EMAIL PROTECTED] Sent: Monday, December 01, 2003 2:21 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Finding reason for white list I've double-checked the logs for something like that; no luck. I'm mystified. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, December 01, 2003 2:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Finding reason for white list Recently we got much spam from one source. When I examined the headers to find out why, all indicated the items had been white listed. I have three methods of white listing: from (full address or domain), to (recipients who want everything) and anywhere (about 20 special text strings). So I began checking each but couldn't find a match between the spam samples and my white lists. I suspected it was one of the white list entries in my global.cfg file because the weight was always zero, but that theory didn't bear fruit either. If this has been asked before I don't remember seeing it: How can I find out exactly what Declude used to white list an email? There should be a log file entry that has the text that was used to whitelist the E-mail (such as E-mail whitelisted - automatically passing all spam tests [EMAIL PROTECTED], where [EMAIL PROTECTED] was the text used to whitelist the E-mail). -Scott --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Subject Starts with
So how would that hurt anything if all it provides is a way to delimit a test and tell Declude that this [space] is a space? Bill - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 2:54 PM Subject: RE: [Declude.JunkMail] Subject Starts with That's just it, I am seeing the use of [] in spam subject lines. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, December 01, 2003 2:32 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with It's not really a reserved word since the suggestion was space enclosed in square brackets - how often have you seen that used in a sentence: wow, I really [space] out sometimes... ;-) Bill - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 1:27 PM Subject: RE: [Declude.JunkMail] Subject Starts with I have to agree with Kami. I would rather not define reserved words. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Monday, December 01, 2003 12:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Starts with Matt.. This is scary .. Now you are suggesting we start defining reserve words.. This way, if it starts a trend, we can not filter on [space] anymore.. Just a thought. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Monday, December 01, 2003 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with Scott, Instead of adding it a command, how about you just create a substitution string for space, i.e. [space]. This way it could be used in this fashion, as well as before some words (as a delimiter in the sense that Bill earlier suggested). SUBJECT 0 BEGINSWITH [space] BODY 0 CONTAINS [space]ass Matt R. Scott Perry wrote: Scott, feature request. (Sigh, another one.) Can you add something like this: SUBJECT 0 STARTSWITHSPACE I am seeing a good amount of spam where the subject line starts with a space and then some character and then the subject. Ah, good idea -- I'll see if we can add that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Subject Starts with
Oh, yes, now it get it... [eye rolling out of head onto floor] ;-) Bill - Original Message - From: Kami Razvan [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 2:53 PM Subject: RE: [Declude.JunkMail] Subject Starts with [Bill] [stranger] [things] [have] [happened] [in] [the] [past]. [space] [may] [not] [be] [used] [but] [starting] [reserve] [words] [can] [start] [a] [precedent] [that] [could] [make] [filtering] [and] [debugging] [a] [nightmare]. [Regards,] [:)] [Kami] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, December 01, 2003 5:32 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with It's not really a reserved word since the suggestion was space enclosed in square brackets - how often have you seen that used in a sentence: wow, I really [space] out sometimes... ;-) Bill - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 1:27 PM Subject: RE: [Declude.JunkMail] Subject Starts with I have to agree with Kami. I would rather not define reserved words. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Monday, December 01, 2003 12:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Starts with Matt.. This is scary .. Now you are suggesting we start defining reserve words.. This way, if it starts a trend, we can not filter on [space] anymore.. Just a thought. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Monday, December 01, 2003 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with Scott, Instead of adding it a command, how about you just create a substitution string for space, i.e. [space]. This way it could be used in this fashion, as well as before some words (as a delimiter in the sense that Bill earlier suggested). SUBJECT 0 BEGINSWITH [space] BODY 0 CONTAINS [space]ass Matt R. Scott Perry wrote: Scott, feature request. (Sigh, another one.) Can you add something like this: SUBJECT 0 STARTSWITHSPACE I am seeing a good amount of spam where the subject line starts with a space and then some character and then the subject. Ah, good idea -- I'll see if we can add that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Finding reason for white list
True. However, in the case of the samples I'm looking at, each was addressed to only one user. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dave Marchette Sent: Monday, December 01, 2003 5:07 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Finding reason for white list I could be on the wrong track here but if you use the 'Whitelist To' function on your domain, then if a spammer sends an email to the user that is whitelist to'd, all other users that appear on the TO address line of that email will also receive the 'Whitelist To' behavior. Example: UserB is upset because he feels your anti-spam measures are restrictive and asks you to turn them off for just him. You do this using 'Whitelist To [EMAIL PROTECTED]' in global.cfg. A spammer then sends an email to [EMAIL PROTECTED], [EMAIL PROTECTED] and [EMAIL PROTECTED] Normally, for example's sake, this spam would have been caught with a high weight. However, because of the 'Whitelist To', all three users(a, b, and c) will get the spam, and in the headers, you will see only 'Whitelisted(0)' Just a thought. -Original Message- From: Keith Purtell [mailto:[EMAIL PROTECTED] Sent: Monday, December 01, 2003 2:21 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Finding reason for white list I've double-checked the logs for something like that; no luck. I'm mystified. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, December 01, 2003 2:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Finding reason for white list Recently we got much spam from one source. When I examined the headers to find out why, all indicated the items had been white listed. I have three methods of white listing: from (full address or domain), to (recipients who want everything) and anywhere (about 20 special text strings). So I began checking each but couldn't find a match between the spam samples and my white lists. I suspected it was one of the white list entries in my global.cfg file because the weight was always zero, but that theory didn't bear fruit either. If this has been asked before I don't remember seeing it: How can I find out exactly what Declude used to white list an email? There should be a log file entry that has the text that was used to whitelist the E-mail (such as E-mail whitelisted - automatically passing all spam tests [EMAIL PROTECTED], where [EMAIL PROTECTED] was the text used to whitelist the E-mail). -Scott attachment: winmail.dat
RE: [Declude.JunkMail] HOLD and WARN
Create 2 SPAMCOP tests, the first one action WARN and the second action HOLD. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of andyb Sent: Monday, December 01, 2003 3:06 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] HOLD and WARN Hi, I'm using SPAMCOP as part of the weighting system and as a HOLD action by itself. Because of this, In spamreview it shows a total WEIGHT but SPAMCOP isn't listed, though I know it added to the WEIGHT because of the spamlog. I take it that's just how it is? IS there a way to have it show in SPAMREVIEW as a failed test, but still keep the HOLD action? I believe if I change it to WARN, it will show in Spam Review... Thanks, Andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Finding reason for white list
What is the exact message in the E-mail headers saying that it was whitelisted? X-Tests-Failed: Whitelisted Are you using WHITELIST AUTH or AUTOWHITELIST? No and yes. In the case of the particular user whose incoming mail I extracted the spam from, none of the spammer addresses where in her address book. I also checked her AutoWhite list. This looks like a case for the DEBUG mode. To use the debug mode, you can change the LOGLEVEL LOW line in \IMail\Declude\global.cfg to LOGLEVEL DEBUG. Then, after this problem occurs again, you can then switch back to LOGLEVEL LOW (the debug mode adds huge amounts of information to the log file). You can then E-mail me the \IMail\spool\dec.log file (as an attachment, NOT sent from web messaging), and I can take a look at it to see what is happening. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Finding reason for white list
I wonder how that feature reacts with a BCC? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Keith Purtell Sent: Monday, December 01, 2003 3:24 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Finding reason for white list True. However, in the case of the samples I'm looking at, each was addressed to only one user. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Dave Marchette Sent: Monday, December 01, 2003 5:07 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Finding reason for white list I could be on the wrong track here but if you use the 'Whitelist To' function on your domain, then if a spammer sends an email to the user that is whitelist to'd, all other users that appear on the TO address line of that email will also receive the 'Whitelist To' behavior. Example: UserB is upset because he feels your anti-spam measures are restrictive and asks you to turn them off for just him. You do this using 'Whitelist To [EMAIL PROTECTED]' in global.cfg. A spammer then sends an email to [EMAIL PROTECTED], [EMAIL PROTECTED] and [EMAIL PROTECTED] Normally, for example's sake, this spam would have been caught with a high weight. However, because of the 'Whitelist To', all three users(a, b, and c) will get the spam, and in the headers, you will see only 'Whitelisted(0)' Just a thought. -Original Message- From: Keith Purtell [mailto:[EMAIL PROTECTED] Sent: Monday, December 01, 2003 2:21 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Finding reason for white list I've double-checked the logs for something like that; no luck. I'm mystified. Keith Purtell, Web/Network Administrator VantageMed Operations (Kansas City) CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Monday, December 01, 2003 2:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Finding reason for white list Recently we got much spam from one source. When I examined the headers to find out why, all indicated the items had been white listed. I have three methods of white listing: from (full address or domain), to (recipients who want everything) and anywhere (about 20 special text strings). So I began checking each but couldn't find a match between the spam samples and my white lists. I suspected it was one of the white list entries in my global.cfg file because the weight was always zero, but that theory didn't bear fruit either. If this has been asked before I don't remember seeing it: How can I find out exactly what Declude used to white list an email? There should be a log file entry that has the text that was used to whitelist the E-mail (such as E-mail whitelisted - automatically passing all spam tests [EMAIL PROTECTED], where [EMAIL PROTECTED] was the text used to whitelist the E-mail). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Refusing message based on nul sender
It is a little harsh but allowable. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of serge Sent: Monday, December 01, 2003 5:59 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Refusing message based on nul sender how paranoid should you be to refuse message based on this only criteria ? 20031127 154038 127.0.0.1 SMTP (07980D3F) 501 5.7.1 MX of sender (mail.cefib.com.) does not accept address as required by RFC 821, 1123, 2505, and 2821 20031127 154038 127.0.0.1 SMTP (07980D3F) ERR undeliverable 501 5.7.1 MX of sender (mail.cefib.com.) does not accept address as required by RFC 821, 1123, 2505, and 2821 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Subject Starts with
Oh, and the other thing to remember is, this is not something that Declude would be searching for anywhere in the message, this is only something that is used to define a delimiter to Declude. Just like the delimiter you can define in SpamChk: SpaceChar=# Which allows you to define check-words like: anal#=5 #ass=5 #cock#=3 #sex#=2 By using the # as a delimiter, SpamChk does trigger on any of these words with the # in them, only the word with a space before or after the word as defined the placement of the # sign in the SpamChk.ini file, which tell SpamChk how to trigger a match. This is the same type of delimiter capability being requested for Declude. Hope this helps to clarify... Bill - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 2:54 PM Subject: RE: [Declude.JunkMail] Subject Starts with That's just it, I am seeing the use of [] in spam subject lines. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Monday, December 01, 2003 2:32 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with It's not really a reserved word since the suggestion was space enclosed in square brackets - how often have you seen that used in a sentence: wow, I really [space] out sometimes... ;-) Bill - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 1:27 PM Subject: RE: [Declude.JunkMail] Subject Starts with I have to agree with Kami. I would rather not define reserved words. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Monday, December 01, 2003 12:36 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject Starts with Matt.. This is scary .. Now you are suggesting we start defining reserve words.. This way, if it starts a trend, we can not filter on [space] anymore.. Just a thought. Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Monday, December 01, 2003 3:23 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Subject Starts with Scott, Instead of adding it a command, how about you just create a substitution string for space, i.e. [space]. This way it could be used in this fashion, as well as before some words (as a delimiter in the sense that Bill earlier suggested). SUBJECT 0 BEGINSWITH [space] BODY 0 CONTAINS [space]ass Matt R. Scott Perry wrote: Scott, feature request. (Sigh, another one.) Can you add something like this: SUBJECT 0 STARTSWITHSPACE I am seeing a good amount of spam where the subject line starts with a space and then some character and then the subject. Ah, good idea -- I'll see if we can add that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. .com. --- [This E-mail was scanned for viruses
Re: [Declude.JunkMail] sniffer
Hi Andy- Excellent service, reasonably priced, and it is sometimes the only thing that catches them. Dave Doherty Skywaves, Inc. - Original Message - From: andyb [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 4:36 PM Subject: [Declude.JunkMail] sniffer Is sniffer worth the $300/year? Thinking about trying it. Thanks, andy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] What is this about ??
I've gotten serveral of these the past few minutes. Below are the full headers ..I'm assuming they are trying to relay ??? There was no subject nor message as well as a rcpt to ... Also it seems that declude is claiming that 216.204.154.7 has no MX. DnsStuff.com reports: How I am searching: Asking e.root-servers.net for 7.154.204.216.in-addr.arpa PTR record: e.root-servers.net says to go to indigo.arin.net. (zone: 216.in-addr.arpa.) Asking indigo.arin.net. for 7.154.204.216.in-addr.arpa PTR record: indigo.arin.net says to go to ns2.net-resource.com. (zone: 204.216.in-addr.arpa.) Asking ns2.net-resource.com. for 7.154.204.216.in-addr.arpa PTR record: Reports mx1.maineconnect.net. Answer: 216.204.154.7 PTR record: mx1.maineconnect.net. [TTL 3600s] [A=216.204.154.7] Now for the headers: Received: from maineconnect.net [216.204.154.7] by mail.sslsales.com with ESMTP (SMTPD32-7.14) id A37517B5029E; Mon, 01 Dec 2003 18:49:09 -0500 Received: from 216.204.154.7 [24.241.184.85] by maineconnect.net (SMTPD32-8.01) id A524B75700F8; Mon, 01 Dec 2003 18:56:20 -0500 Received: from 156.201.162.174 X-RBL-Warning: Declude Labeled Spam-SPAMCOP X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8c20]. X-RBL-Warning: HELOBOGUS: Domain 216.204.154.7 has no MX or A records. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 24.241.184.85 with no reverse DNS entry. X-RBL-Warning: Declude Labeled Spam-WEIGHT 15 X-Declude-Sender: [EMAIL PROTECTED] [24.241.184.85] X-Declude-Spoolname: Dd524b75700f8bb13.SMD X-Note: This E-mail was scanned for Spam by Secure Services Inc Organization: Secure Sevices Inc. X-UIDL: 327709429 Thanks !! Dave --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Header question
http://atriks.com/email_deployment.htm Seen quite a few of them. Yet to figure the company out though. Seems like a great place for spammers to hang out ... Dave - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 6:06 PM Subject: [Declude.JunkMail] Header question Any one else seeing this in the headers, good or bad? X-Mailer: Atriks Professional Email Deployment Service John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Best way to forward E-mail from an AOL account
Hi, Matt- I just checked with the horse's, er, mouth... AOL says they do not allow auto forwarding at all. Your customer must log on to her AOL account and forward the messages manually. Dave Doherty Skywaves, Inc. - Original Message - From: Matthew Bramble [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 3:34 PM Subject: [Declude.JunkMail] Best way to forward E-mail from an AOL account I'm just looking for a recommendation from someone that has set this up since I have no experience with it. I have a client that needs to forward two AOL E-mail addresses over to accounts on our server. Does AOL offer this, or do you have to go through a third party? If you have to go through a third party for forwarding, which one would you use? Thanks, Matt --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Header question
Sounds to me like a good phrase to base a rule on. I read the explanation there. Fascinating reading, folks! Is there a test we can use to detect Atriks in the headers, or do we have to create an IMail rule? Dave Doherty Skywaves, Inc. - Original Message - From: David Barrett [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 9:25 PM Subject: Re: [Declude.JunkMail] Header question http://atriks.com/email_deployment.htm Seen quite a few of them. Yet to figure the company out though. Seems like a great place for spammers to hang out ... Dave - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 6:06 PM Subject: [Declude.JunkMail] Header question Any one else seeing this in the headers, good or bad? X-Mailer: Atriks Professional Email Deployment Service John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Header question
The line I posted is what was seen in the headers, and would therefore be a good line to use in a filter file. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Monday, December 01, 2003 8:57 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Header question Sounds to me like a good phrase to base a rule on. I read the explanation there. Fascinating reading, folks! Is there a test we can use to detect Atriks in the headers, or do we have to create an IMail rule? Dave Doherty Skywaves, Inc. - Original Message - From: David Barrett [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 9:25 PM Subject: Re: [Declude.JunkMail] Header question http://atriks.com/email_deployment.htm Seen quite a few of them. Yet to figure the company out though. Seems like a great place for spammers to hang out ... Dave - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 01, 2003 6:06 PM Subject: [Declude.JunkMail] Header question Any one else seeing this in the headers, good or bad? X-Mailer: Atriks Professional Email Deployment Service John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
