Scott should back me up or correct me on this. I think that you can
configure multiple test lines using Message Sniffer where each line looks
for a specific return value instead of nonzero. Something like the
following...
SNIFFERSPAM external 63
SNIFFERSCUM external 62
Note the 63 and 6
How can we catch symbol 62 differently? V2 is configured as 'nonzero',
meaning that all return codes other than zero are logged and treated alike
by Declude.
- Original Message -
From: "Madscientist" <[EMAIL PROTECTED]>
Subject: RE: [Declude.JunkMail] Filtering E-Greetings
> Sniffer ver
Message Sniffer Version 2 has been officially released.
_M
| -Original Message-
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED]] On Behalf Of
| Sheldon Koehler
| Sent: Wednesday, December 04, 2002 7:01 PM
| To: [EMAIL PROTECTED]
| Subject: Re: [Declude.JunkMail] Filtering E-Greeti
> Sniffer version 2 is out now. Scumware rules have a special symbol 62.
> You could look for that specific result code and treat it specially.
> Currently all other spam rules are coded to the "generic" group with a
> symbol of 63.
Is this still in beta? I will have to take a closer look at it to
Sniffer version 2 is out now. Scumware rules have a special symbol 62.
You could look for that specific result code and treat it specially.
Currently all other spam rules are coded to the "generic" group with a
symbol of 63.
That should make it simpler.
Hope this helps,
_M
| -Original Messa
> An excellent article for mail admins...
>
> http://rr.sans.org/email/spam_battle.php
Thanks!!!
I now have a new tagline signiture...
Sheldon
Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com
Ten Forward Communications 360-457-9023
Nationwide access, neighborhood supp
Since we have to use Sniffer as a weighted test and these are only failing
the Sniffer test, how can I safely block these greetings?
We have too high of a volume to hold email as it would take a full time
staff person to just search the rejects, so we are forced to delete.
Sheldon
Sheldon Koeh
Good question, I was seeing the same thing, but I don't believe wildcards
work here. Hope I'm wrong. Scott?
No, it isn't possible to use wildcards. However, given how many people
have been requesting more comprehensive filtering abilities, it's something
that we may work on.
Title: Black list domain
Good question, I was seeing the same
thing, but I don't believe wildcards work here. Hope I'm wrong.
Scott?
Paul
- Original Message -
From:
Harry Vanderzand
To: [EMAIL PROTECTED]
Sent: Wednesday, December 04, 2002 5:11
PM
Subject
An excellent article for mail admins...
http://rr.sans.org/email/spam_battle.php
---
[This E-mail scanned for viruses by Declude/McAfee]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscri
Title: Black list domain
Hi
I am getting a lot of Spam from domains like: @listsend4586.com The spammers tend to use a lot of variation of the same domain by varying the numbers.
I know I can blacklist .domain.com
Can I blacklist @listsend*.com where * can be anything?
Hope I made se
> Since I have been using the ROUTETO command, can I somehow forward
> the message to the intended recipient...
Yes, The Bat! does this readily.
> ...without the user realizing I monitored it?
Not in a commercial MUA that I'm aware of, since they add headers that
traced the message route.
The
> Is there a way to change the location of HOLD messages from the
> default?
You can use an NTFS mount point to put it on another physical
partition, though it's still just one folder.
-Sandy
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
T
Can you recommend an e-mail client to read mail and redirect it to the
proper recipient?
I'll look into the Imail Client.
Ron
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Wednesday, December 04, 2002 12:59 PM
To: [EMAIL
I use the ROUTETO command and I view them through web messaging. Should I
view them another way?
That's up to you -- using the ROUTETO action, they are treated as regular
E-mail, and the methods of handling them are based solely on the type of
mail client you are using.
Since I have been us
I use the ROUTETO command and I view them through web messaging. Should I
view them another way?
Since I have been using the ROUTETO command, can I somehow forward the
message to the intended recipient without the user realizing I monitored it?
If I were to start using the HOLD command, how woul
Perhaps someone can shed some light on this. I've got junkMail running using
a weight system. If an email gets a weight of less that 18 it is passed on
to the receipient. Today however, I'm getting legit emails from a particular
client that is being caught and forwarded to my catchall account as
Hello All,
Perhaps someone can shed some light on this. I've got junkMail running using
a weight system. If an email gets a weight of less that 18 it is passed on
to the receipient. Today however, I'm getting legit emails from a particular
client that is being caught and forwarded to my catchall a
So here is the deal: we have an IP address that is list/or reported (who
knows)
with OSRELAY (http://relays.osirusoft.com/) as an open relay. Me and another
engineer have been on site trying to figure out how to de-list this IP
address.
You can de-list it by making sure that it is no longer an
That is a bummer, I'm using xcopy to backup files from one computer to
another, and the hold directly can have as many as 3000 messages over the
weekend (which is big plug for the effectiveness of declude)
thanks, andy
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[
Is there a way to change the location of HOLD messages from the default?
No, there isn't, but that is something we are planning to change.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail m
Is there a way to change the location of HOLD messages from the default?
Thanks, andrew
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
Good morning all,
In advance I would like to apologize for posting this email but my purpose
of
this email are accomplishing two things:
1. Us internet technologist to be motivated to communicate in human language
2. Ask the experts or troopers who dealt with this issue and share their
inputs
So
Scott,
In the headers. No whitelists, no weight changes. I've included the headers
below. Also, attached is the global.cfg file
Thanks for your help, Steve
Received: from bellsouth.net [200.168.14.67] by mail.tmlp.com
(SMTPD32-7.06) id ACE418F100DA; Wed, 04 Dec 2002 05:45:56 -0500
Received: f
In the headers. No whitelists, no weight changes. I've included the headers
below. Also, attached is the global.cfg file
The problem here is that the weight of the E-mail isn't greater than
10. The line:
IPNOTINMX ipnotinmx x x 0 -4
will give an E-mail
I'm a relatively new user of JunkMail. I've recently seem several emails
fail the following combinations of tests yet not trip the Weight10 test:
NOPOSTMASTER, BASE64 and ROUTING
HELOBOGUS, REVDNS
BADHEADERS, SPAMHEADERS
Anyone else have similar experiences...what could I do (if anything) t
Folks,
I'm a relatively new user of JunkMail. I've recently seem several emails
fail the following combinations of tests yet not trip the Weight10 test:
NOPOSTMASTER, BASE64 and ROUTING
HELOBOGUS, REVDNS
BADHEADERS, SPAMHEADERS
Anyone else have similar experiences...what could I do (if anyth
My latest incident with spamcop -
A client has an Order Confirmation auto-responder.
To get the message you have to send an e-mail to the auto-responder.
The auto-responder is not on our server - only the web site.
The auto-responder message was reported to spamcop.
We think it was
Hi;
You are right... This actually is the first time this has happened. Our
weighing system is such that a score of 100+ is assigned to our Spam
trap accounts. In almost 1 year this is the first time I am faced with
this... Never thought a legitimate eMail could trigger so many traps.
Of course
29 matches
Mail list logo
