[Declude.JunkMail] Spamreview Software Request

[Tom Schwarz]

I have been looking back through my email trying to catch up and have
noticed a few messages related to spamreview.  As the developer I have no
problem with this software being discussed here but would prefer all problem
related issues be directed to [EMAIL PROTECTED]  Not that it bothers me
for others to see the problems but I'm sure Scott would rather not clutter
this group with issues he has no control over.  When I get busy I don't
check these messages every day.  I check [EMAIL PROTECTED] every 5
minutes.

Several have reported problems and new feature possibilities.  I have fixed
most the programs the same or next day or already had a fix and was testing
it when someone else reported it.  The current version is 1.0.45.  Click
File/Check For Program Updates to download this version.  It fixes major
problems with lockups.

Current Issues:

1.  The web site stinks and I need to do a better job keeping it up to date.

2.  Yes, there is an issue with the kill.lst file.  As one pointed out, it's
working for me so it's hard to debug.  Several have provided information but
so far nothing has worked.  I will get it fixed as soon as I can.

3.  There is a problem with the Out Of Office mode where it does not filter
all the messages.  I will fix this as soon as I can.  For now when you come
out of Out Of Office mode Apply Filters before you start to delete email.




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] REMOTEIP feature question

[Bill Landry]

Perfect!

Thanks,

Bill

-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 30, 2002 6:00 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] REMOTEIP feature question



>Scott, I haven't tried this feature yet, but I was wondering if the
REMOTEIP
>feature will follow the IPBYPASS and HOP settings and ignore our mail
>gateway ip addresses?

Yes -- filtering on the REMOTEIP variable will follow the IPBYPASS/HOP 
settings.

 > Hmmm, let me reply to my own question with another question. When using
the
 > REMOTEIP feature, with the "IS" flag, does it just look for an exact
match
 > anywhere in the headers?

No -- it will look for an exact match of the remote IP.  For example, a 
filter file with:

 REMOTEIP  5  IS  127.0.0.1

would only match if the remote IP was 127.0.0.1.  Even if "127.0.0.1" 
appears anywhere else in the headers, it won't matter.  It won't even match 
an E-mail coming from 127.0.0.100.
  -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.JunkMail] REMOTEIP feature question

[R. Scott Perry]

>Scott, I haven't tried this feature yet, but I was wondering if the REMOTEIP
>feature will follow the IPBYPASS and HOP settings and ignore our mail
>gateway ip addresses?

Yes -- filtering on the REMOTEIP variable will follow the IPBYPASS/HOP 
settings.

 > Hmmm, let me reply to my own question with another question. When using the
 > REMOTEIP feature, with the "IS" flag, does it just look for an exact match
 > anywhere in the headers?

No -- it will look for an exact match of the remote IP.  For example, a 
filter file with:

 REMOTEIP  5  IS  127.0.0.1

would only match if the remote IP was 127.0.0.1.  Even if "127.0.0.1" 
appears anywhere else in the headers, it won't matter.  It won't even match 
an E-mail coming from 127.0.0.100.
  -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] REMOTEIP feature question

[Bill Landry]

Hmmm, let me reply to my own question with another question.  When using the
REMOTEIP feature, with the "IS" flag, does it just look for an exact match
anywhere in the headers?

Bill

-Original Message-
From: Bill Landry [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 30, 2002 5:42 PM
To: '[EMAIL PROTECTED]'
Subject: [Declude.JunkMail] REMOTEIP feature question


Scott, I haven't tried this feature yet, but I was wondering if the REMOTEIP
feature will follow the IPBYPASS and HOP settings and ignore our mail
gateway ip addresses?  These new features are really cool and add nice
functionality to the overall filter capabilities.

Thanks,

Bill
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] REMOTEIP feature question

[Bill Landry]

Scott, I haven't tried this feature yet, but I was wondering if the REMOTEIP
feature will follow the IPBYPASS and HOP settings and ignore our mail
gateway ip addresses?  These new features are really cool and add nice
functionality to the overall filter capabilities.

Thanks,

Bill
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.JunkMail] Maps Problem

[R. Scott Perry]

>I found it in the Declude log file.  Please note the IP address
>reported by Declude:
>07/29/2002 08:06:44 Q3dda126 Msg failed RBL (This E-mail came from 
>0.0.0.0, a potential spam source listed in RBL.).

That is very odd.  Which version of Declude are you running?  Do you by 
chance have a copy of the E-mail with complete headers (just the headers, 
without the body, would be fine too)?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Maps Problem

[Don Brown]

Scott,

I got a telephone call from a customer about a particular e-mail which
wasn't making the trip.

I found it in the Declude log file.  Please note the IP address
reported by Declude:
07/29/2002 08:06:44 Q3dda126 Msg failed RBL (This E-mail came from 0.0.0.0, a 
potential spam source listed in RBL.).
07/29/2002 08:06:44 Q3dda126 Subject: test email from PISD  Networking Dept.
07/29/2002 08:06:44 Q3dda126 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 

Here is the snip from the Imail Log:
20020729 080634 127.0.0.1   SMTPD (161F0126) [64.90.57.113] connect 169.151.1.22 
port 2225
20020729 080634 127.0.0.1   SMTPD (161F0126) [169.151.1.22] HELO smtpout.pisd.edu
20020729 080634 127.0.0.1   SMTPD (161F0126) [169.151.1.22] MAIL 
FROM:<[EMAIL PROTECTED]>
20020729 080634 127.0.0.1   SMTPD (161F0126) [169.151.1.22] RCPT 
TO:<[EMAIL PROTECTED]>
20020729 080635 127.0.0.1   SMTPD (161F0126) [169.151.1.22] 
D:\IMail\spool\D3dda126.SMD 787

When I do a lookup for 169.151.1.22 on the MAPS site, it says that the
IP is Not on any of the lists.

There are other RBL entries in the Declude log which are perfectly
fine and show a valid IP address.

Any ideas?

Thanks,



Don Brown - Dallas, Texas USA Internet Concepts, Inc.
[EMAIL PROTECTED] http://www.inetconcepts.net
PGP Key ID: 04C99A55  (972) 788-2364  Fax: (972) 788-5049
Providing Internet Solutions Worldwide - An eDataWeb Affiliate


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.JunkMail] WEIGHT20 Problem

[R. Scott Perry]

>I have a weight setup for WEIGHT20, but it was commented out in my
>default.junkmail file but the logs showed an actual message that failed
>this test even though it was commented out.

That is the correct behavior.  If you do not want to see the WEIGHT20 test 
entries in the log, you would have to comment out (or delete) the test 
definition in the \IMail\Declude\global.cfg file.
  -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] WEIGHT20 Problem

[Tom Baker | Netsmith Inc]

You commented out the ACTION to take for the test, NOT the actual test.

The test is defined in global.cfg, not $default$.junkmail


-Original Message-
From: Darrell L. [mailto:[EMAIL PROTECTED]] 
Sent: Tuesday, July 30, 2002 4:58 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] WEIGHT20 Problem


I have a weight setup for WEIGHT20, but it was commented out in my
default.junkmail file but the logs showed an actual message that failed this
test even though it was commented out.

Using Version 1.57 beta, did not see this happen with 1.55b. 

$default$.junkmail
WEIGHT15HOLD
#WEIGHT20   WARN

LOG
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed ORDB (This mail was handled
by an open relay - please visit
).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed OSRELAY (This entry was
last confirmed open on 5/9/2002). 07/30/2002 17:41:08 Q07e600b80106bb9f Msg
failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?148.81.231.152).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed NOABUSE (Not supporting
abuse@domain). 07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed REVDNS (This
E-mail was sent from a MUA/MTA 148.81.231.152 with no reverse DNS entry.).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed SPAMHEADERS (This E-mail
has headers consistent with spam [4000120f].). 07/30/2002 17:41:08
Q07e600b80106bb9f Msg failed WEIGHT10 (Weight of 34 reaches or exceeds the
limit of 10.). 07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed WEIGHT5
(Weight of 34 reaches or exceeds the limit of 5.). 07/30/2002 17:41:08
Q07e600b80106bb9f Msg failed WEIGHT15 (Weight of 34 reaches or exceeds the
limit of 15.). 07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed WEIGHT20
(Weight of 34 reaches or exceeds the limit of 20.). 07/30/2002 17:41:08
Q07e600b80106bb9f Msg failed DSBL
(http://dsbl.org/listing.php?148.81.231.152).

Darrell LaRock
Information Systems Analyst
Gannett Television
716-849-2272



---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  You can E-mail [EMAIL PROTECTED] for assistance.  You
can visit our web site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] WEIGHT20 Problem

[Darrell L.]

I have a weight setup for WEIGHT20, but it was commented out in my
default.junkmail file but the logs showed an actual message that failed
this test even though it was commented out.

Using Version 1.57 beta, did not see this happen with 1.55b. 

$default$.junkmail
WEIGHT15HOLD
#WEIGHT20   WARN

LOG
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed ORDB (This mail was
handled by an open relay - please visit
).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed OSRELAY (This entry was
last confirmed open on 5/9/2002).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed SPAMCOP (Blocked - see
http://spamcop.net/bl.shtml?148.81.231.152).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed NOABUSE (Not supporting
abuse@domain).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed REVDNS (This E-mail was
sent from a MUA/MTA 148.81.231.152 with no reverse DNS entry.).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed SPAMHEADERS (This
E-mail has headers consistent with spam [4000120f].).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed WEIGHT10 (Weight of 34
reaches or exceeds the limit of 10.).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed WEIGHT5 (Weight of 34
reaches or exceeds the limit of 5.).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed WEIGHT15 (Weight of 34
reaches or exceeds the limit of 15.).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed WEIGHT20 (Weight of 34
reaches or exceeds the limit of 20.).
07/30/2002 17:41:08 Q07e600b80106bb9f Msg failed DSBL
(http://dsbl.org/listing.php?148.81.231.152).

Darrell LaRock
Information Systems Analyst
Gannett Television
716-849-2272



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] How do we Determine the Spam address "." or "@"

[Tom]

> How do you determine when to use an entry like
> .ac-mail.net
> versus an entry like
> @123jumo.com

This depends on the address the spammer used, I always try to use
.abc.com if and when possible, however, some spammers send mail
using the root address.

If the spammer uses [EMAIL PROTECTED] I would then use .domain.com
since most spam addresses will show the following:

@mail1.domain1.com
@mail2.domain1.com
@mail3.domain1.com

We would use .domain1.com.  You need the dot where the name is too short
otherwise you may catch other domain names ending with domain1.com.  You
may also want to use @domain.com to be safe.  This is why I requested an
OR command for the Kill List, so it can trigger on "." OR "@" symbols.

If the spammer uses [EMAIL PROTECTED] then we just remove the spammers name
since that usually changes anyway.  The end result would be @domain2.com

So in-conclusion the best remedy would be:

@domain.com
.domain.com

to catch both types of addresses.

Just keep in mind, each web site should be checked first otherwise you
might lock out a valid ISP.  Another thing you may want to consider is
where the e-mail address is coming from, if you get e-mail from HOTMAIL
you might not want to block it.  These addresses are infamous with SPAM,
but they come from an E-MAIL Service Provider and using these addresses
would overwhelm your kill list, not to mention CPU cycles.  Plus they
don't typically use the same address over and over.

Best Regards,
Tom
Image`fx





---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.JunkMail] Todays entries for the Kill List

[R. Scott Perry]

>How do you determine when to use an entry like
>
>.ac-mail.net
>
>versus an entry like
>
>@123jumo.com

In general, the ".ac-mail.net" entry would match "@hostname.ac-mail.net" 
but not "@ac-mail.net".  "@123juno.com" would match "@123juno.com", but not 
"@hostname.123juno.com".
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

OSSRC:RE: [Declude.JunkMail] Todays entries for the Kill List

[Robert Hopkins]

Tom,

How do you determine when to use an entry like

.ac-mail.net

versus an entry like

@123jumo.com

Thanks!

Rob
Hopkins Mailing Services, Inc.


> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Tom
> Sent: Tuesday, July 30, 2002 3:05 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Todays entries for the Kill List
> 
> 
> 
> Here is an update for the kill list for
> 07/30/02 - Even though each address is 
> checked, we strongly suggest you use it
> at your own risk.  The entire list can
> be downloaded from the following URL:
> 
> http://www.imagefxonline.net/apps/delog/fromfile.txt
> 
> Regards,
> Tom
> Image`fx
> 
> 
> ---
> @global10.j.pl07302002-000
> @mindarrow.net07302002-001
> @europe.com   07302002-002
> @winanewcar.com   07302002-003
> @t-shirt.net.cn   07302002-004
> @123jump.com  07302002-005
> @21cn.com 07302002-006
> @anglcorp.com 07302002-007
> @bnb1.com 07302002-008
> @e-mailprovider.net   07302002-009
> @lightspeed-mail.com  07302002-010
> @sinetechold.com  07302002-011
> @univdp.com   07302002-012
> @w2knews.com  07302002-013
> @sandra.meteo.bas.bg  07302002-014
> .bizrate.com  07302002-015
> .cooking.com  07302002-016
> .definet.fi   07302002-017
> .EBGAMES.COM  07302002-018
> .emailconfirmation.net07302002-019
> .exactis.com  07302002-020
> .FAMILYTIME.COM   07302002-021
> .fast.net 07302002-022
> .infomailer.net   07302002-023
> .menuts.net   07302002-024
> .netservers.net   07302002-025
> .opinionsurveys.com   07302002-026
> .topshelfdeals.com07302002-027
> .transcentives.net07302002-028
> .wnysurf.net  07302002-029
> ---
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .
---
[This E-mail scanned for viruses by Declude Virus]


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.JunkMail] Can this ever be valid?

[R. Scott Perry]

>Does the HEADER filter look at the header before DECLUDE adds all its 
>headers? or we can't say which is first?

It looks at the header before the Declude headers are added.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Can this ever be valid?

[Kami Razvan]

Title: Message



Hi;
Has anyone seen a 
valid or a legitimate e-Mail that is addressed as follows:
 
To: #recipient#@Domain.com
 
a number of SPAMS 
received have that as the address in the TO field.  With the new HEADER 
option in 1.57 beta we can filter this from the HEADER section so I am wondering 
if such an address can be legitimate?
 
Also--
 
Does the HEADER 
filter look at the header before DECLUDE adds all its headers? or we can't say 
which is first?
 
Regards,
Kami

RE: [Declude.JunkMail] Todays entries for the Kill List

[Tom]

Here is an update for the kill list for
07/30/02 - Even though each address is 
checked, we strongly suggest you use it
at your own risk.  The entire list can
be downloaded from the following URL:

http://www.imagefxonline.net/apps/delog/fromfile.txt

Regards,
Tom
Image`fx


---
@global10.j.pl  07302002-000
@mindarrow.net  07302002-001
@europe.com 07302002-002
@winanewcar.com 07302002-003
@t-shirt.net.cn 07302002-004
@123jump.com07302002-005
@21cn.com   07302002-006
@anglcorp.com   07302002-007
@bnb1.com   07302002-008
@e-mailprovider.net 07302002-009
@lightspeed-mail.com07302002-010
@sinetechold.com07302002-011
@univdp.com 07302002-012
@w2knews.com07302002-013
@sandra.meteo.bas.bg07302002-014
.bizrate.com07302002-015
.cooking.com07302002-016
.definet.fi 07302002-017
.EBGAMES.COM07302002-018
.emailconfirmation.net  07302002-019
.exactis.com07302002-020
.FAMILYTIME.COM 07302002-021
.fast.net   07302002-022
.infomailer.net 07302002-023
.menuts.net 07302002-024
.netservers.net 07302002-025
.opinionsurveys.com 07302002-026
.topshelfdeals.com  07302002-027
.transcentives.net  07302002-028
.wnysurf.net07302002-029
---


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[Bill Landry]

Hey, thanks Scott, as always, you're awesome!

Bill

-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 30, 2002 10:15 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released



>Wishlist items:
>1. send out rhsbl tests simultaneously with ip4r tests, rather than after
>all ip4r test results come back
>2. don't run rhsbl tests against WHITELISTed and IP BYPASS addresses.  In
my
>GLOBAL.CFG file:

These are already on the suggestion database.  :)

>3. filter list quoting for flagging exact matches only

The "IS" type will handle exact matches.  As for matches with whitespace at 
the beginning/end, we are working on that.

>Scott, is there someplace where we can see samples of how to implement some
>of the new features added to v1.57?

Yes, here.  :)

I believe the only new feature in 1.57 that hasn't been brought up yet is 
the REDIRECT option that allows for grouping users together to use the same 
config files.

The syntax is simply "REDIRECT [EMAIL PROTECTED] 
C:\IMail\Declude\configfilename.cfg".  This line goes in the 
\IMail\Declude\$default$.JunkMail file (or any of the per-domain/per-user 
files), and will tell Declude to go to the 
C:\IMail\Declude\configfilename.cfg file instead.

For example, you could have a file "c:\IMail\Declude\lenient.cfg" with 
lenient spam settings (perhaps using the WARN action for all tests except 
WEIGHT20, which would get held).  You could also have a file 
"c:\IMail\Declude\strongsettings.cfg" with stronger settings (perhaps 
deleting mail with a weight of 10 or higher).

Then, in your \IMail\Declude\$default$.JunkMail file, you could have the 
following lines on the top:

 REDIRECT [EMAIL PROTECTED] C:\IMail\Declude\lenient.cfg"
 REDIRECT [EMAIL PROTECTED] C:\IMail\Declude\strongsettings.cfg"

 [followed by the default settings]

That way, [EMAIL PROTECTED] will use the settings in the 
C:\IMail\Declude\lenient.cfg file, [EMAIL PROTECTED] will use the settings 
in the C:\IMail\Declude\strongsettings.cfg file, and everyone else will use 
the settings that follow in the \IMail\Declude\$default$.JunkMail file.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] REDIRECT

[R. Scott Perry]

>But - since this is essentially "per user" configuration - will that feature
>demand "Pro" level or is the "Standard+" level sufficient?

The per-user ability will still require the Pro version.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] REDIRECT

[Andy Schmidt]

Hi Scott:

>> REDIRECT [EMAIL PROTECTED] C:\IMail\Declude\lenient.cfg <<

hhh that would be a cool feature.

Instead of "whitelisting" Postmaster@  I could now decide to simply test
those differently.

But - since this is essentially "per user" configuration - will that feature
demand "Pro" level or is the "Standard+" level sufficient?

Best Regards
Andy

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[R. Scott Perry]

>Wishlist items:
>1. send out rhsbl tests simultaneously with ip4r tests, rather than after
>all ip4r test results come back
>2. don't run rhsbl tests against WHITELISTed and IP BYPASS addresses.  In my
>GLOBAL.CFG file:

These are already on the suggestion database.  :)

>3. filter list quoting for flagging exact matches only

The "IS" type will handle exact matches.  As for matches with whitespace at 
the beginning/end, we are working on that.

>Scott, is there someplace where we can see samples of how to implement some
>of the new features added to v1.57?

Yes, here.  :)

I believe the only new feature in 1.57 that hasn't been brought up yet is 
the REDIRECT option that allows for grouping users together to use the same 
config files.

The syntax is simply "REDIRECT [EMAIL PROTECTED] 
C:\IMail\Declude\configfilename.cfg".  This line goes in the 
\IMail\Declude\$default$.JunkMail file (or any of the per-domain/per-user 
files), and will tell Declude to go to the 
C:\IMail\Declude\configfilename.cfg file instead.

For example, you could have a file "c:\IMail\Declude\lenient.cfg" with 
lenient spam settings (perhaps using the WARN action for all tests except 
WEIGHT20, which would get held).  You could also have a file 
"c:\IMail\Declude\strongsettings.cfg" with stronger settings (perhaps 
deleting mail with a weight of 10 or higher).

Then, in your \IMail\Declude\$default$.JunkMail file, you could have the 
following lines on the top:

 REDIRECT [EMAIL PROTECTED] C:\IMail\Declude\lenient.cfg"
 REDIRECT [EMAIL PROTECTED] C:\IMail\Declude\strongsettings.cfg"

 [followed by the default settings]

That way, [EMAIL PROTECTED] will use the settings in the 
C:\IMail\Declude\lenient.cfg file, [EMAIL PROTECTED] will use the settings 
in the C:\IMail\Declude\strongsettings.cfg file, and everyone else will use 
the settings that follow in the \IMail\Declude\$default$.JunkMail file.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[Bill Landry]

Thanks Scott, the HELO detection is working great!

Wishlist items:
1. send out rhsbl tests simultaneously with ip4r tests, rather than after
all ip4r test results come back
2. don't run rhsbl tests against WHITELISTed and IP BYPASS addresses.  In my
GLOBAL.CFG file:

  WHITELIST IP 206.114.137.0/23  <--- my data center address space
  IPBYPASS 206.114.137.48  <--- lab results server, forwards to IMail for
delivery

however, I still see the rhsbl test run against this server (but not the
ip4r tests):

=
Jul 30 08:09:24.884 queries: info: client 206.114.137.48#2734: query:
pointshare.net.in.dnsbl.org IN A
Jul 30 08:09:24.933 queries: info: client 206.114.137.48#2735: query:
pointshare.net.dsn.rfc-ignorant.org IN A
Jul 30 08:09:24.995 queries: info: client 206.114.137.48#2736: query:
pointshare.net.abuse.rfc-ignorant.org IN A
Jul 30 08:09:25.058 queries: info: client 206.114.137.48#2737: query:
pointshare.net.postmaster.rfc-ignorant.org IN A
Jul 30 08:09:25.120 queries: info: client 206.114.137.48#2738: query:
pointshare.net.bandwidth-pigs.monkeys.com IN A
Jul 30 08:09:25.226 queries: info: client 206.114.137.48#2739: query:
pointshare.net IN MX
=

3. filter list quoting for flagging exact matches only

Scott, is there someplace where we can see samples of how to implement some
of the new features added to v1.57?

Thanks again for a great product and for being so responsive to our ongoing
feature requests!

Best regards,

Bill

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Feature Suggestion

[R. Scott Perry]

>Declude would examine the TLD of the sender and then looks for an REVDNS.DE
>alert message.  If none is found, it uses for the "default" REVDNS bounce
>message.

That's an interesting idea -- it has been added to the suggestion database.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] WhiteList log entries

[R. Scott Perry]

>I made a pointing of defining LOG_OK = none - so I never expected to see
>those whitelist entries in my log either.

The problem is that the "failed" log messages and the "whitelisted" 
logically go together, since the whitelist entry cancels out the "failed" 
entries.  If there was a way that we could remove the "failed" messages as 
well for whitelisted E-mail, that could be an option.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[Bill Landry]

Hey, that's great, no more searching for why a message did not get caught by
any spam tests!

Bill

-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, July 30, 2002 8:18 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released



>Scott,  I  am seeing 'whitelisted automatically' ??? How does his work?

Do you mean that you are seeing a log file entry "This E-mail was 
whitelisted - automatically passing all spam tests"?

We added that log file entry because SO many people have complained about 
E-mail not getting caught, only to find out that it had been whitelisted.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This e-mail was scanned for viruses by Pointshare's Virus Scanning Service]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] WhiteList log entries

[Andy Schmidt]

>> but  I  don't  want  to  have  tons of automatic white list entries. <<

I agree:

I made a pointing of defining LOG_OK = none - so I never expected to see
those whitelist entries in my log either.

LOGFILE D:\imail\spool\dec.log
LOGLEVELMID
LOG_OK  NONE

HOP 0

XINHEADER   X-Declude: Version %VERSION%; %QUEUENAME% from %REVDNS%
[%REMOTEIP%]
XINHEADER   X-Declude: Failed %TESTSFAILED% [%WEIGHT%]
XINHEADER   Return-Path: <%MAILFROM%>

Best Regards
Andy Schmidt

H&M Systems Software, Inc.
600 East Crescent Avenue
Suite 203
Upper Saddle River, NJ 07458-1846

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

http://www.hm-software.com/


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Roger Heath
Sent: Tuesday, July 30, 2002 11:26 AM
To: R. Scott Perry
Subject: BLARSBL:Re[2]: [Declude.JunkMail] Declude JunkMail v1.57 (beta)
released


Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released on
Tuesday 10:17:30 AM

Yes. I thought it might be adding whitelist entries automatically
if  emails  passed all spam tests. If it is just a log entry.. no
pbm,  but  I  don't  want  to  have  tons of automatic white list
entries. 

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Scott,  I  am seeing 'whitelisted automatically' ??? How does his work?

R> Do you mean that you are seeing a log file entry "This E-mail was
R> whitelisted - automatically passing all spam tests"?

R> We added that log file entry because SO many people have complained about
R> E-mail not getting caught, only to find out that it had been whitelisted.
R>  -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

R> ---

R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  You can E-mail
R> [EMAIL PROTECTED] for assistance.  You can visit our web
R> site at http://www.declude.com .
R> --
R> ActivatorMail(tm) ver.061902 Scanned for all viruses by
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

BLARSBL:Re[2]: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[Roger Heath]

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released on Tuesday 
10:17:30 AM

Yes. I thought it might be adding whitelist entries automatically
if  emails  passed all spam tests. If it is just a log entry.. no
pbm,  but  I  don't  want  to  have  tons of automatic white list
entries. 

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -


>>Scott,  I  am seeing 'whitelisted automatically' ??? How does his work?

R> Do you mean that you are seeing a log file entry "This E-mail was 
R> whitelisted - automatically passing all spam tests"?

R> We added that log file entry because SO many people have complained about 
R> E-mail not getting caught, only to find out that it had been whitelisted.
R>  -Scott

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---

R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  You can E-mail
R> [EMAIL PROTECTED] for assistance.  You can visit our web
R> site at http://www.declude.com .
R> --
R> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[R. Scott Perry]

>Scott,  I  am seeing 'whitelisted automatically' ??? How does his work?

Do you mean that you are seeing a log file entry "This E-mail was 
whitelisted - automatically passing all spam tests"?

We added that log file entry because SO many people have complained about 
E-mail not getting caught, only to find out that it had been whitelisted.
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[R. Scott Perry]

>Would this be proper syntax of the new features?
>
>REMOTEIP8   IS  218.17.92.184
>REVDNS  8   ENDSWITH.are.net

...

Yes, that is the correct syntax.  "IS" looks for an exact match (so 
"REMOTEIP 8 IS 218.17.92." would never catch anything, since an IP address 
will never be just "218.17.92.").  "ENDSWITH" looks for a match at the end 
of a string, so "REVDNS 8 ENDSWITH .are.net" would match "spamhost.are.net" 
but not "we.are.net.citizens.that.do.not.spam".
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Feature Suggestion

[Andy Schmidt]

Hi:

It would be very helpful to have language dependent MSG files for
BOUNCE/ALERT messages.

Declude would examine the TLD of the sender and then looks for an REVDNS.DE
alert message.  If none is found, it uses for the "default" REVDNS bounce
message.

We currently have the problem that our English speaking customers have NO
problem with our very informative REVDNS warning - but we do host foreign
language domains - and it would be nice to provide THEM with a localized
text.

Best Regards
Andy Schmidt

H&M Systems Software, Inc.
600 East Crescent Avenue
Suite 203
Upper Saddle River, NJ 07458-1846

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

http://www.hm-software.com/

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

BLARSBL:Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[Roger Heath]

Reply to: R. Scott Perry
  Re: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released on Tuesday 9:44:55 
AM

Scott,  I  am seeing 'whitelisted automatically' ??? How does his
work?

--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com


- Copy of Original Message(s): -

R> We have just released Declude JunkMail v1.57 (beta).  Changes include:

R> o HELOBOGUS will now only be tested on non-local senders.
R> o HELO detection wasn't using correct hop; fixed.
R> o An issue STARTSWITH in filter was fixed.
R> o ROUTETO/COPYTO can now use variables (IE "spam@%LOCALHOST%").
R> o Fixes an issue where starting external programs could fail (0xC142 
R> error without a .DLL listed).
R> o Takes care of possible whitelist corruption when certain Received: 
R> headers were processed.
R> o IS filter type added.
R> o ENDSWITH filter type added.
R> o HEADERS filter location added.
R> o Added REDIRECT option in config files to allow configuration "groups".

R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

R> ---

R> This E-mail came from the Declude.JunkMail mailing list.  To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail".  You can E-mail
R> [EMAIL PROTECTED] for assistance.  You can visit our web
R> site at http://www.declude.com .
R> --
R> ActivatorMail(tm) ver.061902 Scanned for all viruses by 
R> www.activatormail.com intelligent anti-virus anti-spam service

--
ActivatorMail(tm) ver.061902 Scanned for all viruses by 
www.activatormail.com intelligent anti-virus anti-spam service

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[Andy Schmidt]

Scott:

Would this be proper syntax of the new features?

HELO8   CONTAINS$domain

REMOTEIP8   IS  218.17.92.184

REVDNS  8   ENDSWITH.are.net
REVDNS  8   ENDSWITH.DailyInBox.com
REVDNS  8   ENDSWITH.emailsvc.net
REVDNS  8   ENDSWITH.hispeedmediaoffers.com
REVDNS  8   ENDSWITH.hot-info.net
REVDNS  8   ENDSWITH.IConNet.net
REVDNS  8   ENDSWITH.mail-gw.net
REVDNS  8   ENDSWITH.real-net.net
REVDNS  8   ENDSWITH.superstorespecials.com
REVDNS  8   ENDSWITH.truemail.net

SUBJECT 5   CONTAINSviagra

BODY3   CONTAINSAs seen on
BODY3   CONTAINSNigeria
BODY5   CONTAINSopt-in

HEADER  5   CONTAINS@legacydomain.name


Best Regards
Andy Schmidt

H&M Systems Software, Inc.
600 East Crescent Avenue
Suite 203
Upper Saddle River, NJ 07458-1846

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

http://www.hm-software.com/

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Declude JunkMail v1.57 (beta) released

[R. Scott Perry]

We have just released Declude JunkMail v1.57 (beta).  Changes include:

o HELOBOGUS will now only be tested on non-local senders.
o HELO detection wasn't using correct hop; fixed.
o An issue STARTSWITH in filter was fixed.
o ROUTETO/COPYTO can now use variables (IE "spam@%LOCALHOST%").
o Fixes an issue where starting external programs could fail (0xC142 
error without a .DLL listed).
o Takes care of possible whitelist corruption when certain Received: 
headers were processed.
o IS filter type added.
o ENDSWITH filter type added.
o HEADERS filter location added.
o Added REDIRECT option in config files to allow configuration "groups".

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Adding Weigh to TO:?

[Andy Schmidt]

>> Now the question:  Can we add a weigh to the address used in the To List?
<<

SP> I don't think that is currently possible.  Why would you want to do
that,
though? <

Scott,

actually, I had wished for this myself for a while.  We DO have a few
"legacy" domain names where 99% of the incoming messages are just SPAM -
with the few occasional people still using the old domain names from old
flyers or search engine results.

If would be very nice, if I could assign a weight to those legacy domain
names.

Best Regards
Andy

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Adding Weigh to TO:?

[R. Scott Perry]

>"Right now, the only way to do that would be to set up a filter on the
>headers, using the latest beta version."
>
>--- You mean 1.56?  Or is 1.7 out?  On the site there is 1.56.

You can always go to http://www.declude.com/junkmail/manual.htm to find out 
what the latest version is.  Right now, the latest beta is 1.56.  1.57 is 
due out shortly.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Adding Weigh to TO:?

[Kami Razvan]

"Right now, the only way to do that would be to set up a filter on the 
headers, using the latest beta version."

--- You mean 1.56?  Or is 1.7 out?  On the site there is 1.56.

"One problem with this idea, though, is that mailing lists will usually
have 
the mailing list address in the "To:" header (or "Undisclosed 
Recipients").  The IMail Forum, for example, does this."

--- Yes I agree- including this list since the To shows up as
Declude.Junkmail.  But a weight would only add to it and legitimate
lists would not score anything more than what is assigned to this single
test.  But bad postings will be elevated and hopefully exceed the limit
we have set.

Regards,
Kami

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, July 30, 2002 9:09 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Adding Weigh to TO:?



>Sorry to have sent the entire header but I think I did not relay the 
>issue clearly.  Look at the header and see who it is sent to.  We have 
>no business receiving an email that is addressed to:
>
>[EMAIL PROTECTED] since this is our backup mail server.

So you're talking about filtering on the apparent To: address(es) from
the 
headers, not the actual recipients.  That makes sense.

Right now, the only way to do that would be to set up a filter on the 
headers, using the latest beta version.

>May be (just an idea) - that a list of domains can exist that we can 
>allow the recipient address have.  Anything other than the listed 
>domains can have a weight added to it.

One problem with this idea, though, is that mailing lists will usually
have 
the mailing list address in the "To:" header (or "Undisclosed 
Recipients").  The IMail Forum, for example, does this.

>On another note (Aside from this one): We are receiving SPAM from 
>Japanese sources with purely Japanese writings.  We don't even know 
>what we are seeing so we can block it or filter it.  Any ideas as to 
>how to combat this new trend?  This also holds true with Turkish 
>language SPAM.

We're looking at some ways to automatically detect different languages
in 
spam, which could help out in situations such as this.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  You can E-mail [EMAIL PROTECTED] for
assistance.  You can visit our web site at http://www.declude.com .


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Adding Weigh to TO:?

[R. Scott Perry]

>Sorry to have sent the entire header but I think I did not relay the
>issue clearly.  Look at the header and see who it is sent to.  We have
>no business receiving an email that is addressed to:
>
>[EMAIL PROTECTED] since this is our backup mail server.

So you're talking about filtering on the apparent To: address(es) from the 
headers, not the actual recipients.  That makes sense.

Right now, the only way to do that would be to set up a filter on the 
headers, using the latest beta version.

>May be (just an idea) - that a list of domains can exist that we can
>allow the recipient address have.  Anything other than the listed
>domains can have a weight added to it.

One problem with this idea, though, is that mailing lists will usually have 
the mailing list address in the "To:" header (or "Undisclosed 
Recipients").  The IMail Forum, for example, does this.

>On another note (Aside from this one): We are receiving SPAM from
>Japanese sources with purely Japanese writings.  We don't even know what
>we are seeing so we can block it or filter it.  Any ideas as to how to
>combat this new trend?  This also holds true with Turkish language SPAM.

We're looking at some ways to automatically detect different languages in 
spam, which could help out in situations such as this.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Adding Weigh to TO:?

[Kami Razvan]

Hi Again:
Just to complement the previous posting:  Look at the following SPAM

=
Received: from njohhd ([65.138.136.163])
  by mail.americana.com.do (Lotus Domino Release 5.0.9a)
  with SMTP id 2002073008494562:2754 ;
  Tue, 30 Jul 2002 08:49:45 -0400 
From: Julia Barranger <[EMAIL PROTECTED]>
Subject: [SPAM]Breakthrough: Herpes
To: 6260=206.136.175.1=65.151.224.107=@[65.151.224.107]
Cc: <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>
X-Mailer: Microsoft Outlook Express 5.00.2615.200
X-MIMETrack: Itemize by SMTP Server on kennedy_notes/Americana(Release
5.0.9a |January 7, 2002) at
 07/30/2002 08:49:47 AM,
Serialize by Router on kennedy_notes/Americana(Release 5.0.9a
|January 7, 2002) at
 07/30/2002 08:50:57 AM,
Serialize complete at 07/30/2002 08:50:57 AM
Date: Tue, 30 Jul 2002 08:49:47 -0400
==

The TO field is truly bogus.  This could have been trapped since there
is no reason to receive an e-Mail with that type of address as the
recipient.  Or is there?  

Regards,
Kami

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, July 30, 2002 8:19 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Adding Weigh to TO:?



>Recently we are noticing a higher incidents of mail coming to us from 
>the
>backup mail server.  This is hosted elsewhere but somehow the SPAM'ers
are 
>sending e-Mail to that server to come to us.  I think they probably
think 
>that we have that server in a WhiteList, therefore it will come
through.

That is becoming a more common trick of spammers.  For those that don't 
know, you can get around this in Declude JunkMail by adding a line in
the 
format "IPBYPASS 192.168.112.1" in the \IMail\Declude\global.cfg file, 
which will scan the mail as if Declude JunkMail was running on the
backup 
mailserver.

>Now the question:  Can we add a weigh to the address used in the To 
>List?

I don't think that is currently possible.  Why would you want to do
that, 
though?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  You can E-mail [EMAIL PROTECTED] for
assistance.  You can visit our web site at http://www.declude.com .


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

RE: [Declude.JunkMail] Adding Weigh to TO:?

[Kami Razvan]

Hi Scott:

Sorry to have sent the entire header but I think I did not relay the
issue clearly.  Look at the header and see who it is sent to.  We have
no business receiving an email that is addressed to:

[EMAIL PROTECTED] since this is our backup mail server.

When they send it to that address they are basically SPAM'ing a large
number of people.  We truly should never receive e-Mail when it is sent
to that anyone at that address.  So if I can see who this is addressed
to we can add weight to it.

May be (just an idea) - that a list of domains can exist that we can
allow the recipient address have.  Anything other than the listed
domains can have a weight added to it.  This way we can indicate that
recipient can have @Durability.com.  If anything other than @Durability
add 2 to its weight.  Just an idea.

On another note (Aside from this one): We are receiving SPAM from
Japanese sources with purely Japanese writings.  We don't even know what
we are seeing so we can block it or filter it.  Any ideas as to how to
combat this new trend?  This also holds true with Turkish language SPAM.
I am sure we have to learn to live with this one but just in case there
are ideas out there..

===
Received: from rainer.bnt.com [12.4.218.18] by mail.durability.com with
ESMTP
  (SMTPD32-7.11) id AB3525200EC; Tue, 30 Jul 2002 03:07:33 -0400
Received: from oscar.bnt.com (oscar.bnt.com [12.4.218.17])
by rainer.bnt.com (8.12.3/8.12.3) with ESMTP id g6U778SO060862
for <[EMAIL PROTECTED]>; Tue, 30 Jul 2002 03:07:08 -0400 (EDT)
(envelope-from [EMAIL PROTECTED])
Received: from 206.112.72.3 ([202.130.255.21])
by oscar.bnt.com (8.12.3/8.12.3) with SMTP id g6U76nI7047365
for <[EMAIL PROTECTED]>; Tue, 30 Jul 2002 03:07:01 -0400 (EDT)
(envelope-from [EMAIL PROTECTED])
Message-Id: <[EMAIL PROTECTED]>
X-Authentication-Warning: oscar.bnt.com: Host [202.130.255.21] claimed
to be 206.112.72.3
Received: from 36.185.61.158 ([36.185.61.158]) by f64.law4.hotmail.com
with QMQP; Jul, 30 2002 4:05:03 AM -0100
Received: from [198.250.227.71] by m10.grp.snv.yahoo.com with QMQP; Jul,
30 2002 2:57:01 AM -
Received: from unknown (HELO mail.gmx.net) (78.165.116.169) by
smtp4.cyberec.com with smtp; Jul, 30 2002 1:59:44 AM +0400
Received: from rly-xw01.mx.aol.com ([153.196.56.114]) by
da001d2020.lax-ca.osd.concentric.net with SMTP; Jul, 30 2002 12:51:47 AM
-0700
From: Carl Miller <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Cc: 
Subject: Win Slot Jackpots aipll
Sender: Carl Miller <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Date: Tue, 30 Jul 2002 04:08:14 -0700
X-Mailer: Microsoft Outlook Express 6.00.2462.
X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner
consistent with spam [6000410f].
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
[6000410f].
X-RBL-Warning: WORDFILTER: Message failed WORDFILTER test (21)
X-RBL-Warning: WEIGHT10: Weight of 12 reaches or exceeds the limit of
10.
X-Declude-Sender: [EMAIL PROTECTED] [12.4.218.17]
X-Declude-Spoolname: D3b35025200ec0bec.SMD
X-Note: This E-mail was scanned by Declude (www.declude.com) for spam &
virus.
X-Note: This E-mail was filtered for SPAM keywords.
X-Spam-Tests-Failed: ROUTING, SPAMHEADERS, WORDFILTER, WEIGHT10
X-Weight: 12
X-Note: This E-mail was sent from oscar.bnt.com. ([12.4.218.17]).
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 326076559
=

Regards,
Kami

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, July 30, 2002 8:19 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Adding Weigh to TO:?



>Recently we are noticing a higher incidents of mail coming to us from 
>the
>backup mail server.  This is hosted elsewhere but somehow the SPAM'ers
are 
>sending e-Mail to that server to come to us.  I think they probably
think 
>that we have that server in a WhiteList, therefore it will come
through.

That is becoming a more common trick of spammers.  For those that don't 
know, you can get around this in Declude JunkMail by adding a line in
the 
format "IPBYPASS 192.168.112.1" in the \IMail\Declude\global.cfg file, 
which will scan the mail as if Declude JunkMail was running on the
backup 
mailserver.

>Now the question:  Can we add a weigh to the address used in the To 
>List?

I don't think that is currently possible.  Why would you want to do
that, 
though?
 -Scott


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://ww

Re: [Declude.JunkMail] Adding Weigh to TO:?

[R. Scott Perry]

>Recently we are noticing a higher incidents of mail coming to us from the 
>backup mail server.  This is hosted elsewhere but somehow the SPAM'ers are 
>sending e-Mail to that server to come to us.  I think they probably think 
>that we have that server in a WhiteList, therefore it will come through.

That is becoming a more common trick of spammers.  For those that don't 
know, you can get around this in Declude JunkMail by adding a line in the 
format "IPBYPASS 192.168.112.1" in the \IMail\Declude\global.cfg file, 
which will scan the mail as if Declude JunkMail was running on the backup 
mailserver.

>Now the question:  Can we add a weigh to the address used in the To List?

I don't think that is currently possible.  Why would you want to do that, 
though?
 -Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---

This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  You can E-mail
[EMAIL PROTECTED] for assistance.  You can visit our web
site at http://www.declude.com .

[Declude.JunkMail] Adding Weigh to TO:?

[Kami Razvan]

Title: Message



Hi;
Recently we are 
noticing a higher incidents of mail coming to us from the backup mail 
server.  This is hosted elsewhere but somehow the SPAM'ers are sending 
e-Mail to that server to come to us.  I think they probably think that we 
have that server in a WhiteList, therefore it will come 
through.
 
Now the 
question:  Can we add a weigh to the address used in the To List?  

 
Regards,Kami