RE: [Declude.JunkMail] Comments
> So, if I create say a flyer in Frontpage, then send that as > the body of a message to all of our clients, the multiple > matches will cause a problem, correct? Hi John, I mean't to search for normal but uneccessary repeated html-tags like This can trigger a lot of false positives not only in Frontpage composed html. The target is to remove them completely before search for keywords. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spews is incompetent.
Mark, Amazing. Yea... I complete set it to ignore this week. There is no reason to pay attention to it if they just randomly lump hosts together. I mean, what is the point? Regards, Phillip B. Holmes Media Resolutions Inc. Macromedia Alliance Partner http://www.mediares.com [EMAIL PROTECTED] 1-888-395-4678 972-889-0201 /* Please send support requests to [EMAIL PROTECTED] */ Failure is not falling down but refusing to get up.--- Chinese Proverb -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Mark Smith Sent: Tuesday, February 04, 2003 8:07 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Spews is incompetent. Same thing happened to us... You're preaching to the choir on that one. FWIW, the way we got around it was to work with our ISP and had them grant us a /29 subnet that wasn't listed on SPEWS. We then multinetted that network and placed two SMTP servers on it as gateways/smarthosts. I've lowered OSSRC to a weight of 1. It does have some value but not much IMHO. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of > Phillip B. Holmes > Sent: Tuesday, February 04, 2003 7:34 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Spews is incompetent. > > > Spews Topic: > > Spews.org blacklisted one of our mail servers because of a > domain that the client hosts on another host! He has about 20 > sites on different networks and only one sent 1 round of spam > from one of his OTHER SITES BEFORE he moved a domain to us! > In other words, the domain in question has never been nor > will be our client or even near our network. > > We were grouped with about 10 other ISPs as "supporting > spam." So, we are just guilty by association! > > Luckily, most ISPs don't take spews seriously. Quite frankly, > their webpages sounds like it was written by a 14 year old > kid. It is amazing they have not been sued out of existence. > Mr. Perry would do well to remove the OSSRC listing from his > product completely. > > Regards, > > Phillip B. Holmes > Media Resolutions Inc. > Macromedia Alliance Partner > http://www.mediares.com > [EMAIL PROTECTED] > 1-888-395-4678 > 972-889-0201 > > /* Please send support requests to > [EMAIL PROTECTED] */ > > Failure is not falling down but refusing to get up.--- Chinese Proverb > > > > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of John > Tolmachoff > Sent: Tuesday, February 04, 2003 12:41 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Comments > > > > Spews is a joke and should be taken offline > > Agreed. > > John Tolmachoff MCSE, CSSA > IT Manager, Network Engineer > RelianceSoft, Inc. > Fullerton, CA 92835 > www.reliancesoft.com > > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the > Declude.JunkMail mailing list. To unsubscribe, just send an > E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > > > --- > [This E-mail was scanned > for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by F-Proto Virus Scanner] > > --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. BEGIN:VCARD VERSION:2.1 N:Holmes;Phillip;B. FN:Phillip B. Holmes ([EMAIL PROTECTED]) ORG:Media Resolutions Inc.;IT TITLE:Vice-President TEL;WORK;VOICE:(972) 889-0201 TEL;CELL;VOICE:214-995-6175 ADR;WORK;ENCODING=QUOTED-PRINTABLE:;1-888-395-4678;16415 Addison=0D=0ASuite 610;Addison;TX;75001;United States = of America LABEL;WORK;ENCODING=QUOTED-PRINTABLE:1-888-395-4678=0D=0A16415 Addison=0D=0ASuite 610=0D=0AAddison, TX 75001=0D= =0AUnited States of America URL;WORK:http://www.mediaresolutions.com EMAIL;PREF;INTERNET:[EMAIL PROTECTED] REV:20021128T173226Z END:VCARD
RE: [Declude.JunkMail] Select Email
I do it by using plain old IMAIL Rules... [rules.ima] F~[EMAIL PROTECTED]:main F~[EMAIL PROTECTED]:main F~[EMAIL PROTECTED]:main H!~abc123def123ghi123jkl123:NUL The first 3 lines check the from-address, if there is a match, the message is places in the 'main' mailbox/folder and rules processing completes. The last line says if that long string is NOT found in the headers anywhere, then move to NUL (erase the message). Basically make the last line a "catch all" & delete, so you have to build exceptions above it. -Tom -Original Message- From: Richard Farris [mailto:[EMAIL PROTECTED]] Sent: Tuesday, February 04, 2003 8:39 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Select Email Is there a way to set up an account that receives email from only a select few addresses... Richard Farris Ethixs Online 1.800.548.3877 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Select Email
Is there a way to set up an account that receives email from only a select few addresses... Richard Farris Ethixs Online 1.800.548.3877 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spews is incompetent.
Same thing happened to us... You're preaching to the choir on that one. FWIW, the way we got around it was to work with our ISP and had them grant us a /29 subnet that wasn't listed on SPEWS. We then multinetted that network and placed two SMTP servers on it as gateways/smarthosts. I've lowered OSSRC to a weight of 1. It does have some value but not much IMHO. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of > Phillip B. Holmes > Sent: Tuesday, February 04, 2003 7:34 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Spews is incompetent. > > > Spews Topic: > > Spews.org blacklisted one of our mail servers because of a > domain that the client hosts on another host! He has about 20 > sites on different networks and only one sent 1 round of spam > from one of his OTHER SITES BEFORE he moved a domain to us! > In other words, the domain in question has never been nor > will be our client or even near our network. > > We were grouped with about 10 other ISPs as "supporting > spam." So, we are just guilty by association! > > Luckily, most ISPs don't take spews seriously. Quite frankly, > their webpages sounds like it was written by a 14 year old > kid. It is amazing they have not been sued out of existence. > Mr. Perry would do well to remove the OSSRC listing from his > product completely. > > Regards, > > Phillip B. Holmes > Media Resolutions Inc. > Macromedia Alliance Partner > http://www.mediares.com > [EMAIL PROTECTED] > 1-888-395-4678 > 972-889-0201 > > /* Please send support requests to > [EMAIL PROTECTED] */ > > Failure is not falling down but refusing to get up.--- Chinese Proverb > > > > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of John > Tolmachoff > Sent: Tuesday, February 04, 2003 12:41 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Comments > > > > Spews is a joke and should be taken offline > > Agreed. > > John Tolmachoff MCSE, CSSA > IT Manager, Network Engineer > RelianceSoft, Inc. > Fullerton, CA 92835 > www.reliancesoft.com > > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the > Declude.JunkMail mailing list. To unsubscribe, just send an > E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > > > --- > [This E-mail was scanned > for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by F-Proto Virus Scanner] > > --- [This E-mail scanned for viruses by F-Proto Virus Scanner] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spews is incompetent.
Spews Topic: Spews.org blacklisted one of our mail servers because of a domain that the client hosts on another host! He has about 20 sites on different networks and only one sent 1 round of spam from one of his OTHER SITES BEFORE he moved a domain to us! In other words, the domain in question has never been nor will be our client or even near our network. We were grouped with about 10 other ISPs as "supporting spam." So, we are just guilty by association! Luckily, most ISPs don't take spews seriously. Quite frankly, their webpages sounds like it was written by a 14 year old kid. It is amazing they have not been sued out of existence. Mr. Perry would do well to remove the OSSRC listing from his product completely. Regards, Phillip B. Holmes Media Resolutions Inc. Macromedia Alliance Partner http://www.mediares.com [EMAIL PROTECTED] 1-888-395-4678 972-889-0201 /* Please send support requests to [EMAIL PROTECTED] */ Failure is not falling down but refusing to get up.--- Chinese Proverb -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Tuesday, February 04, 2003 12:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Comments > Spews is a joke and should be taken offline Agreed. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Comments
> I can't imagine anyone who could take spews.org seriously. We don't. We completely ignore them. We used to have a class C on a UUNet T1 and SPEWS had us blacklisted as dial-up IPs. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Comments
Agree as well! SPEWS caused more trouble than it did good. Duane - Original Message - From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, February 04, 2003 12:16 PM Subject: RE: [Declude.JunkMail] Comments > Scott, > > As well it should say that! Anyone that would do anything other than > ignore the spews db is out of their minds. > > In this case they have been irresponsible. The domain that "supposedly" > sent spam is not and has never been hosted here. > > Furthermore, the inability to be removed and statements like this ( Q11 > of their FAQ): > > Q11: I'm a spammer and I'm listed in SPEWS, I want out! Will you do it? > > A11: Sorry, SPEWS is a list of known spammers, spamming operations and > spam supporters, if you fit the criteria there's a good chance you will > be listed and stay listed. If you are a spammer, may we suggest you get > a real job? > > Spews is a joke and should be taken offline. > > > Respectfully, > > Phillip B. Holmes > Media Resolutions Inc. > Macromedia Alliance Partner > http://www.mediares.com > [EMAIL PROTECTED] > 1-888-395-4678 |Ext. 101 > 972-889-0201 |Ext. 101 > > /* Please send support requests to > [EMAIL PROTECTED] */ > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry > Sent: Tuesday, February 04, 2003 12:09 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Comments > > > > >Anyone else out there ever have an issue with spews.org irresponsibly > >reporting servers? > > No. > > But, they will intentionally blacklist IPs that are "near" a spammer. > > >They have blacklisted one of my boxes and for a domain we do not even > >host. There is not a way to get off their list and their site is quite > >flippant. > > > >I can't imagine anyone who could take spews.org seriously. > > > >Advice? Comments? > > If you check, you'll see that they didn't blacklist the IP of your > mailserver. Instead, there is a "nearby" spammer that they have > blacklisted, and they have included your IP in their range. Their > thought > is that you are going to complain to your ISP, who will terminate the > spammer. But it just doesn't work that way in reality. > > This is why we have "Warning: Lists a number of legitimate mailservers > that > happen to have the same Class C address space as spammers." in our > description at http://www.declude.com/junkmail/support/ip4r.htm . > > Anyone who blocks E-mail based on Spews is choosing to block legitimate > E-mail. > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments
> Spews is a joke and should be taken offline Agreed. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Would it be possible to change the format to this? COMMENTS comments 5 x 10 0 COMMENTS comments 5 weight 10 0 Where the number is the minimum needed to fail the test. The second value indicates whether or not the admin wants a cumulative weight. The third and forth values indicate base weights as normal. I'll check to see if we may be able to do that. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments
Scott, As well it should say that! Anyone that would do anything other than ignore the spews db is out of their minds. In this case they have been irresponsible. The domain that "supposedly" sent spam is not and has never been hosted here. Furthermore, the inability to be removed and statements like this ( Q11 of their FAQ): Q11: I'm a spammer and I'm listed in SPEWS, I want out! Will you do it? A11: Sorry, SPEWS is a list of known spammers, spamming operations and spam supporters, if you fit the criteria there's a good chance you will be listed and stay listed. If you are a spammer, may we suggest you get a real job? Spews is a joke and should be taken offline. Respectfully, Phillip B. Holmes Media Resolutions Inc. Macromedia Alliance Partner http://www.mediares.com [EMAIL PROTECTED] 1-888-395-4678 |Ext. 101 972-889-0201 |Ext. 101 /* Please send support requests to [EMAIL PROTECTED] */ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, February 04, 2003 12:09 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Comments >Anyone else out there ever have an issue with spews.org irresponsibly >reporting servers? No. But, they will intentionally blacklist IPs that are "near" a spammer. >They have blacklisted one of my boxes and for a domain we do not even >host. There is not a way to get off their list and their site is quite >flippant. > >I can't imagine anyone who could take spews.org seriously. > >Advice? Comments? If you check, you'll see that they didn't blacklist the IP of your mailserver. Instead, there is a "nearby" spammer that they have blacklisted, and they have included your IP in their range. Their thought is that you are going to complain to your ISP, who will terminate the spammer. But it just doesn't work that way in reality. This is why we have "Warning: Lists a number of legitimate mailservers that happen to have the same Class C address space as spammers." in our description at http://www.declude.com/junkmail/support/ip4r.htm . Anyone who blocks E-mail based on Spews is choosing to block legitimate E-mail. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. BEGIN:VCARD VERSION:2.1 N:Holmes;Phillip;B. FN:Phillip B. Holmes ([EMAIL PROTECTED]) ORG:Media Resolutions Inc.;IT TITLE:Vice-President TEL;WORK;VOICE:(972) 889-0201 TEL;CELL;VOICE:(214) 995-6175 TEL;WORK;FAX:(972) 248-9728 ADR;WORK;ENCODING=QUOTED-PRINTABLE:;1-888-395-4678;16415 Addison=0D=0ASuite 610;Addison;TX;75001;United States = of America LABEL;WORK;ENCODING=QUOTED-PRINTABLE:1-888-395-4678=0D=0A16415 Addison=0D=0ASuite 610=0D=0AAddison, TX 75001=0D= =0AUnited States of America EMAIL;PREF;INTERNET:[EMAIL PROTECTED] REV:20021218T164306Z END:VCARD
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Scott, Would it be possible to change the format to this? COMMENTS comments 5 x 10 0 COMMENTS comments 5 weight 10 0 Where the number is the minimum needed to fail the test. The second value indicates whether or not the admin wants a cumulative weight. The third and forth values indicate base weights as normal. Jerod M. Bennett Director of Media Production Pixelpushers, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, February 04, 2003 7:00 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released > > The test is defined in the global.cfg file as follows: > > > >COMMENTS comments 5 x 10 0 > > > > where the "5" means that 5 such comments have to be encountered (the > > 10 is the weight that will be added for E-mail that fails the test). > > Alternatively, you can use: > > > >COMMENTS comments weight x 10 0 > >OK, I must not be thinking correctly. > >I understand the first example but I'm confused on the second example. >If I wanted to add 5 for every comment line found in a message, and the >weight of the test is 10, wouldn't I put the number 5 where the word >weight is, thereby making the two comment lines identical? The formula for the weight that is added to the E-mail is: b + n, where "b" is the base weight of the test (10 in both examples above), and "b" is either 0 (in the first example) or the number of anti-filtering comments that are found. There isn't an option for a multiplier (so that an E-mail with 20 comments would get a weight of 100 and an E-mail with 40 comments would get a weight of 200). So you can't add 5 for every comment. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments
Anyone else out there ever have an issue with spews.org irresponsibly reporting servers? No. But, they will intentionally blacklist IPs that are "near" a spammer. They have blacklisted one of my boxes and for a domain we do not even host. There is not a way to get off their list and their site is quite flippant. I can't imagine anyone who could take spews.org seriously. Advice? Comments? If you check, you'll see that they didn't blacklist the IP of your mailserver. Instead, there is a "nearby" spammer that they have blacklisted, and they have included your IP in their range. Their thought is that you are going to complain to your ISP, who will terminate the spammer. But it just doesn't work that way in reality. This is why we have "Warning: Lists a number of legitimate mailservers that happen to have the same Class C address space as spammers." in our description at http://www.declude.com/junkmail/support/ip4r.htm . Anyone who blocks E-mail based on Spews is choosing to block legitimate E-mail. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments
Anyone else out there ever have an issue with spews.org irresponsibly reporting servers? They have blacklisted one of my boxes and for a domain we do not even host. There is not a way to get off their list and their site is quite flippant. I can't imagine anyone who could take spews.org seriously. Advice? Comments? Respectfully, Phillip B. Holmes Media Resolutions Inc. Macromedia Alliance Partner http://www.mediares.com [EMAIL PROTECTED] 1-888-395-4678 |Ext. 101 972-889-0201 |Ext. 101 /* Please send support requests to [EMAIL PROTECTED] */ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Keith Johnson Sent: Tuesday, February 04, 2003 11:10 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Comments John, Speaking of lists, whose lists do you use. Keith > -Original Message- > From: John Tolmachoff [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, February 04, 2003 11:31 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Comments > > > On the subject of the new comments test, I am looking forward > to some one coming up with a good list to share. ;) > > John Tolmachoff MCSE, CSSA > IT Manager, Network Engineer > RelianceSoft, Inc. > Fullerton, CA 92835 > www.reliancesoft.com > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. BEGIN:VCARD VERSION:2.1 N:Holmes;Phillip;B. FN:Phillip B. Holmes ([EMAIL PROTECTED]) ORG:Media Resolutions Inc.;IT TITLE:Vice-President TEL;WORK;VOICE:(972) 889-0201 TEL;CELL;VOICE:(214) 995-6175 TEL;WORK;FAX:(972) 248-9728 ADR;WORK;ENCODING=QUOTED-PRINTABLE:;1-888-395-4678;16415 Addison=0D=0ASuite 610;Addison;TX;75001;United States = of America LABEL;WORK;ENCODING=QUOTED-PRINTABLE:1-888-395-4678=0D=0A16415 Addison=0D=0ASuite 610=0D=0AAddison, TX 75001=0D= =0AUnited States of America EMAIL;PREF;INTERNET:[EMAIL PROTECTED] REV:20021218T164306Z END:VCARD
RE: [Declude.JunkMail] Comments
> John, how would you know - since they were DELETED and you have no way to > determine their content after the fact? Manually reviewing the logs and looking at the subject line and sender. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments
Hi, >> not one message deleted by Declude was a false positive << John, how would you know - since they were DELETED and you have no way to determine their content after the fact? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax:+1 201 934-9206 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments
> John, > Speaking of lists, whose lists do you use. > > Keith Currently, I am using mine. However, as time avails, I am going to be working on incorporating Kami's and Tom's. I truly feel and am seeing evidence that a balanced approach is the best. Example, in the last week, not one message deleted by Declude was a false positive. The amount of Spam sent to the users mailbox compared to amount received is less than 10% maybe close to 5%. Right now, I want to reduce the amount held for review with out upsetting either of those statements. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments
John, Speaking of lists, whose lists do you use. Keith > -Original Message- > From: John Tolmachoff [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, February 04, 2003 11:31 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Comments > > > On the subject of the new comments test, I am looking forward > to some one coming up with a good list to share. ;) > > John Tolmachoff MCSE, CSSA > IT Manager, Network Engineer > RelianceSoft, Inc. > Fullerton, CA 92835 > www.reliancesoft.com > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Latest global.cfg and $default$.JunkMail files with upgrade?
Thanks. I'll back track through the list to make sure I am getting able to set up the features that I'm looking for. Peace - Marc -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, February 04, 2003 11:59 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Latest global.cfg and $default$.JunkMail files with upgrade? >I m feeling a bit ignorant so I m hoping that you can help. I usually try >to keep up on the list and usually upgrade declude.exe within 24 hours of >its release. I see discussion of some of the new features, the >autowhitelist on, the comments test etc. I ve had declude pro junkmail >and virus for almost a year and have been very happy. But today I >downloaded new global.cfg and default.junkmail files and saw a few lines >in each that I pasted into my existing files (for example I didn t have >the BASE64 test in my file). Is there anyway I can be sure that I m up to >date? It can be a bit tricky, as you can't simply use the latest config files (if you use them, you will wipe out any changes you have made to your config files). One option is to read this list for new features that are added. Another would be to occasionally check the new config files and see what differences there are between your version and the latest one. >I m interested in using the comments test and the autowhitelist, but I don >t see either of these defined in the files, nor do I see any mention of >how to set up and use them in the manual. That's what happens with beta features -- often, they aren't listed in the config files, and they shouldn't be listed in the manual. For new beta features, you usually need to read the posts here to see what to do to set them up. >Also do I need to add any lines to the virus.cfg file to get the catches >for the latest vulnerabilities? No. As new vulnerabilities are added, they will get detected automatically (unless you turn off the vulnerability detection completely with the "BANCRVIRUSES OFF" setting). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Latest global.cfg and$default$.JunkMail files with upgrade?
I m feeling a bit ignorant so I m hoping that you can help. I usually try to keep up on the list and usually upgrade declude.exe within 24 hours of its release. I see discussion of some of the new features, the autowhitelist on, the comments test etc. I ve had declude pro junkmail and virus for almost a year and have been very happy. But today I downloaded new global.cfg and default.junkmail files and saw a few lines in each that I pasted into my existing files (for example I didn t have the BASE64 test in my file). Is there anyway I can be sure that I m up to date? It can be a bit tricky, as you can't simply use the latest config files (if you use them, you will wipe out any changes you have made to your config files). One option is to read this list for new features that are added. Another would be to occasionally check the new config files and see what differences there are between your version and the latest one. I m interested in using the comments test and the autowhitelist, but I don t see either of these defined in the files, nor do I see any mention of how to set up and use them in the manual. That's what happens with beta features -- often, they aren't listed in the config files, and they shouldn't be listed in the manual. For new beta features, you usually need to read the posts here to see what to do to set them up. Also do I need to add any lines to the virus.cfg file to get the catches for the latest vulnerabilities? No. As new vulnerabilities are added, they will get detected automatically (unless you turn off the vulnerability detection completely with the "BANCRVIRUSES OFF" setting). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Latest global.cfg and $default$.JunkMail files with upgrade?
Scott, I’m feeling a bit ignorant so I’m hoping that you can help. I usually try to keep up on the list and usually upgrade declude.exe within 24 hours of its release. I see discussion of some of the new features, the autowhitelist on, the comments test etc. I’ve had declude pro junkmail and virus for almost a year and have been very happy. But today I downloaded new global.cfg and default.junkmail files and saw a few lines in each that I pasted into my existing files (for example I didn’t have the BASE64 test in my file). Is there anyway I can be sure that I’m up to date? I’m interested in using the comments test and the autowhitelist, but I don’t see either of these defined in the files, nor do I see any mention of how to set up and use them in the manual. Also do I need to add any lines to the virus.cfg file to get the catches for the latest vulnerabilities? I know you are ALWAYS working, but I’m just wondering if those additions will be made to the manual so that I can take advantage of all the features. As always any help is appreciated. Thanks - Marc
RE: [Declude.JunkMail] Comments
On the subject of the new comments test, I am looking forward to some one coming up with a good list to share. ;) John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] New Tests?
CYBERsitter, now known as SpamManager, is being beta tested by a number of us with excellent results. It is coming close to being released. Some information may be found here, www.spammanager.com. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Weight Filter - Sample List
Hi, this list has served me well so far: HELO8 CONTAINS$domain REVDNS 8 ENDSWITH.a83c9d.net REVDNS 8 ENDSWITH.are.net REVDNS 8 ENDSWITH.azogle.com REVDNS 8 ENDSWITH.bestpost.net REVDNS 8 ENDSWITH.bigtimevalues.com REVDNS 20 IS casinoandcash.com REVDNS 8 ENDSWITH.consumerinfo.com REVDNS 8 ENDSWITH.DailyInBox.com REVDNS 8 ENDSWITH.dartmail.net REVDNS 8 ENDSWITH.dealcop.com REVDNS 8 ENDSWITH.deliverenetworks.com REVDNS 6 ENDSWITH.dsl-verizon.net REVDNS 8 ENDSWITH.easymailers.net REVDNS 8 ENDSWITH.email-specials.net REVDNS 8 ENDSWITH.emailcourrier.com REVDNS 8 CONTAINS.emailoffers REVDNS 8 ENDSWITH.emailsvc.net REVDNS 8 ENDSWITH.emipsusa.com REVDNS 8 ENDSWITH.etransmail5.com REVDNS 8 ENDSWITH.evaluemail.com REVDNS 8 ENDSWITH.greatofferstoday.com REVDNS 8 ENDSWITH.hispeedmediaoffers.com REVDNS 8 ENDSWITH.hot-info.net REVDNS 8 ENDSWITH.IConNet.net REVDNS 8 ENDSWITH.ioffersdirect.com REVDNS 8 ENDSWITH.mail-gw.net REVDNS 8 ENDSWITH.mailmalls.net REVDNS 8 IS mediaprint.lt REVDNS 8 ENDSWITH.my-specials.com REVDNS 8 ENDSWITH.obdirectmail.com REVDNS 8 ENDSWITH.offer-exchange.com REVDNS 8 ENDSWITH.offersonthenet.com REVDNS 8 ENDSWITH.oneoffer.net REVDNS 8 ENDSWITH.owe-less.com REVDNS 8 ENDSWITH.primetimedirect.net REVDNS 8 ENDSWITH.ramosglobalmarketing.com REVDNS 8 ENDSWITH.real-net.net REVDNS 8 ENDSWITH.roving.com REVDNS 8 ENDSWITH.specialoffers4you.com REVDNS 8 ENDSWITH.steamyxxxads.com REVDNS 8 ENDSWITH.superstorespecials.com REVDNS 8 ENDSWITH.temd.net REVDNS 8 ENDSWITH.tepmail.com REVDNS 8 ENDSWITH.tiburondeltigre.com REVDNS 8 ENDSWITH.truemail.net REVDNS 8 ENDSWITH.virtual-domain.com REVDNS 8 ENDSWITH.webmailer.de REVDNS 8 ENDSWITH.xpwebnet.com HEADERS 3 CONTAINScharset="euc-kr" HEADERS 3 CONTAINScharset="big5" COUNTRIES 3 CONTAINScn COUNTRIES 3 CONTAINSkr COUNTRIES 2 CONTAINSbr COUNTRIES 2 CONTAINShk COUNTRIES 2 CONTAINSru COUNTRIES 2 CONTAINStw COUNTRIES 2 CONTAINSuy <>
RE: [Declude.JunkMail] Comments
First, I know very little about html formatting, but here is my input; When a message such as a flyer is created in Front Page, each line of text gets its own formatting information: ### New Page 1 This is a test message! This is a test message! This is a test message! So, if I create say a flyer in Frontpage, then send that as the body of a message to all of our clients, the multiple matches will cause a problem, correct? John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How to append footer to a single domainusing Jmail Pro
Scott, Do you have any suggestions on a filter we could use to accomplish the FOOTER on outgoing email (per prior message)? I have a customer who wants this for legal reasons. I have asked that he could place a 'signature' on each of his email clients, however, he doesn't want to give them access to remove it. Thanks for any suggestions. Keith > -Original Message- > From: R. Scott Perry [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, January 29, 2003 4:38 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] How to append footer to a > single domainusing Jmail Pro > > > > >How would I go about setting a footer for a single domain on their > >Outgoing email? I understand I should use the catchallmails > but not sure > >how? Thanks for the aid. > > Unfortunately, there isn't an easy way to do that -- the > CATCHALLMAILS test > can work on a per-domain basis for incoming E-mail, but the > actions are > applied globally for outgoing E-mail. > > It might be possible to figure out a way to do that using a > filter, however > (with Declude JunkMail Pro). > -Scott > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
That's quoted printable stuff. _M | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan | Sent: Tuesday, February 04, 2003 10:14 AM | To: [EMAIL PROTECTED] | Subject: RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released | | | Hi; | This Comments filter is already working great. It is | catching the trick | quite nicely. Great job.. | | Any plan to also add the variation of this trick -- simply: | | =2Ecom=2F | http=3A=2F=2F | | Or the likes? These tricks are now causing our URL filters | not to be as | effective. | | Regards, | Kami | | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of R. | Scott Perry | Sent: Tuesday, February 04, 2003 10:00 AM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released | | | | > > The test is defined in the global.cfg file as follows: | > > | > >COMMENTS comments 5 x 10 0 | > > | > > where the "5" means that 5 such comments have to be | encountered (the | > > 10 is the weight that will be added for E-mail that fails | the test). | > > Alternatively, you can use: | > > | > >COMMENTS comments weight x 10 0 | > | >OK, I must not be thinking correctly. | > | >I understand the first example but I'm confused on the | second example. | >If I wanted to add 5 for every comment line found in a | message, and the | >weight of the test is 10, wouldn't I put the number 5 where the word | >weight is, thereby making the two comment lines identical? | | The formula for the weight that is added to the E-mail is: b | + n, where | "b" is the base weight of the test (10 in both examples | above), and "b" is | either 0 (in the first example) or the number of | anti-filtering comments | that are found. | | There isn't an option for a multiplier (so that an E-mail | with 20 comments | would get a weight of 100 and an E-mail with 40 comments | would get a weight | of 200). So you can't add 5 for every comment. | -Scott | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, | just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe | Declude.JunkMail". The archives can be found at | http://www.mail-archive.com. | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
Hi; This Comments filter is already working great. It is catching the trick quite nicely. Great job.. Any plan to also add the variation of this trick -- simply: =2Ecom=2F http=3A=2F=2F Or the likes? These tricks are now causing our URL filters not to be as effective. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Tuesday, February 04, 2003 10:00 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released > > The test is defined in the global.cfg file as follows: > > > >COMMENTS comments 5 x 10 0 > > > > where the "5" means that 5 such comments have to be encountered (the > > 10 is the weight that will be added for E-mail that fails the test). > > Alternatively, you can use: > > > >COMMENTS comments weight x 10 0 > >OK, I must not be thinking correctly. > >I understand the first example but I'm confused on the second example. >If I wanted to add 5 for every comment line found in a message, and the >weight of the test is 10, wouldn't I put the number 5 where the word >weight is, thereby making the two comment lines identical? The formula for the weight that is added to the E-mail is: b + n, where "b" is the base weight of the test (10 in both examples above), and "b" is either 0 (in the first example) or the number of anti-filtering comments that are found. There isn't an option for a multiplier (so that an E-mail with 20 comments would get a weight of 100 and an E-mail with 40 comments would get a weight of 200). So you can't add 5 for every comment. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
> The test is defined in the global.cfg file as follows: > >COMMENTS comments 5 x 10 0 > > where the "5" means that 5 such comments have to be encountered (the 10 is > the weight that will be added for E-mail that fails the > test). Alternatively, you can use: > >COMMENTS comments weight x 10 0 OK, I must not be thinking correctly. I understand the first example but I'm confused on the second example. If I wanted to add 5 for every comment line found in a message, and the weight of the test is 10, wouldn't I put the number 5 where the word weight is, thereby making the two comment lines identical? The formula for the weight that is added to the E-mail is: b + n, where "b" is the base weight of the test (10 in both examples above), and "b" is either 0 (in the first example) or the number of anti-filtering comments that are found. There isn't an option for a multiplier (so that an E-mail with 20 comments would get a weight of 100 and an E-mail with 40 comments would get a weight of 200). So you can't add 5 for every comment. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] New Tests?
I have been off this list for a while and just noticed two new tests in Scott's spam stats post to the Imail forum. Can anyone tell me where to get more info on the CYBERSITTER and MAILDEFLECTOR tests? I checked Cybersitter's site and couldn't find anything. Is anyone using these tests much? Lots of false positives? Thanks David --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Comments
No, the font command is embedded specifically to cause pattern-matching junk mail scanners to miss the email. I am seeing messages like this: Buy my wonderful product it will do miracles and make you younger while enlarging your proboscis and eliminating wrinkles, while you make a million dollars sitting at home talking to wonderful Russian women just waiting to speak to you. At 08:26 AM 2/4/2003, Bonno Bloksma wrote: > Now that we have the Comments tag, I now find spam with tons of these > peppered throughout: > > Standard HTML stuff I think. > Not really comments, as they are functional, but they're put randomly > throughout the email. Functional, but pointless. Any ideas? The whole idea behind the Comments tag was to flag e-mail that has been made unique by inserting lots of comments which usually are identical in one e-mail but different in between mails. That way they don't get caught by pattern recognizers, however, Declude would catch them by simply counting the number of comments, which *should* not be to high. Let's leave the rest of the stuff alone, in my opion it would only burden Declude with stuff it is not supposed to handle anyway. What would you do with those mail that change the color, delete them, put them on hold? Or.. do you think these color statments are used in the same way the comment tags are being used, with several tags after one another and the last having the correct color? Met vriendelijke groet, Bonno Bloksma --- [This E-mail scanned for viruses by Declude Virus using f-prot] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
on 2/3/03 7:05 PM, R. Scott Perry wrote: > The test is defined in the global.cfg file as follows: > >COMMENTS comments 5 x 10 0 > > where the "5" means that 5 such comments have to be encountered (the 10 is > the weight that will be added for E-mail that fails the > test). Alternatively, you can use: > >COMMENTS comments weight x 10 0 OK, I must not be thinking correctly. I understand the first example but I'm confused on the second example. If I wanted to add 5 for every comment line found in a message, and the weight of the test is 10, wouldn't I put the number 5 where the word weight is, thereby making the two comment lines identical? Thanks, Greg --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments
> What would you do with those mail that change the > color, delete them, put them on hold? Use it in a weighting system. > Or.. do you think > these color statments are used in the same way the comment > tags are being used, with several tags after one another and > the last having the correct color? Multiple font-tags (with the same color or generaly without any changed parameter) does not change the the layout. So they can be used equal to html-comments to split and hide suspicious keywords if the keyword search is made on the raw body. We've also seen that multiple spaces in suspicious phrases like "To beremoved" or "this isnot spam" are used to hide them. The solution is to remove any html-tags and replace multiple spaces by a single one before search for keywords and phrases. Most of them is already implemented in SpamChk which everone can use as an external test for declude. If someone has other suggestions or idea's for content based spam detection we're happy to hear from it. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Comments
Hi Scott! Yes you, no not him, the other one. ;-), If I understood you wrong at first then please read the last line. > Now that we have the Comments tag, I now find spam with tons of these > peppered throughout: > > Standard HTML stuff I think. > Not really comments, as they are functional, but they're put randomly > throughout the email. Functional, but pointless. Any ideas? The whole idea behind the Comments tag was to flag e-mail that has been made unique by inserting lots of comments which usually are identical in one e-mail but different in between mails. That way they don't get caught by pattern recognizers, however, Declude would catch them by simply counting the number of comments, which *should* not be to high. Let's leave the rest of the stuff alone, in my opion it would only burden Declude with stuff it is not supposed to handle anyway. What would you do with those mail that change the color, delete them, put them on hold? Or.. do you think these color statments are used in the same way the comment tags are being used, with several tags after one another and the last having the correct color? Met vriendelijke groet, Bonno Bloksma --- [This E-mail scanned for viruses by Declude Virus using f-prot] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Error Code 32?
I was investigating a spam email as to why it got through declude and found that the header clearly shows that it failed sufficient tests to be held, yet it was not. The declude log shows an error: ERROR: Could not move spam to hold! Code: 32 What is Code: 32? That indicates that Windows reported a "Sharing violation" when Declude JunkMail tried to move the file. That means that some other program was accessing the file. If you have an on-access virus scanner running, that could cause the problem; the other possibility might be backup software. I checked my old logs and can only find that error on 3 seperate occasions. You might want to check the times/dates to see if there is a pattern. Unfortunately, there isn't any easy way to determine *what* program is the one accessing the files. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
> COMMENTS comments 5 x 10 0 > where the "5" means that 5 such comments have to be encountered This means 5 OR MORE comments have to be encountered right? Not exactly 5? That is correct. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Comments
A solution is to distinguish between the entire html-body (raw-data) and a completely html-tag cleaned version. So you can search in the raw data for tipical html strings and in the cleaned part for tipical keywords. Markus > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Scott MacLean > Sent: Tuesday, February 04, 2003 1:54 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Comments > > > > > Now that we have the Comments tag, I now find spam with tons of these > peppered throughout: > > > > Not really comments, as they are functional, but they're put randomly > throughout the email. Functional, but pointless. Any ideas? > ___ > Scott MacLean > [EMAIL PROTECTED] > ICQ: 9184011 > http://www.nerosoft.com > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Comments
Now that we have the Comments tag, I now find spam with tons of these peppered throughout: Not really comments, as they are functional, but they're put randomly throughout the email. Functional, but pointless. Any ideas? ___ Scott MacLean [EMAIL PROTECTED] ICQ: 9184011 http://www.nerosoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released
> COMMENTS comments 5 x 10 0 > where the "5" means that 5 such comments have to be encountered This means 5 OR MORE comments have to be encountered right? Not exactly 5? Bill -Original Message- From: "R. Scott Perry" Sent: Mon, 03 Feb 2003 19:05:41 -0500 Subject: RE: [Declude.JunkMail] Declude JunkMail v1.67 (beta) released >Does the "comments" test require non-whitespace before&after the comments in >order to trigger? >So that most legit messages will not trigger it? Yes. So the most common types of comments, such as: or: alert( "Hello, World" ); will not count. The test is defined in the global.cfg file as follows: COMMENTS comments 5 x 10 0 where the "5" means that 5 such comments have to be encountered (the 10 is the weight that will be added for E-mail that fails the test). Alternatively, you can use: COMMENTS comments weight x 10 0 In this case, the weight of the E-mail will be increased by the number of anti-filtering comments that are found (plus the base weight of the test). So if there are 3 in there, the weight will be increased by 13 (10 for failing the test, and 1 for each anti-filtering comment found). If there are 40 such comments, a total of 50 would be added to the weight of the E-mail. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Error Code 32?
I was investigating a spam email as to why it got through declude and found that the header clearly shows that it failed sufficient tests to be held, yet it was not. The declude log shows an error: ERROR: Could not move spam to hold! Code: 32 What is Code: 32? I checked my old logs and can only find that error on 3 seperate occasions. I checked disk space, folder names/paths etc...all OK. Is there a reference to these codes where we can identify the cause? I resent the message and this time it was caught. Declude version: 1.66i18 Thanks Dan I have included the message headers and log file. Message Header: Received: from geocities.co.jp [80.32.72.82] by mail.signs.com (SMTPD32-7.13) id ACCE433006E; Tue, 04 Feb 2003 01:41:50 -0700 Message-ID: <000600d5ad64$cdc23363$[EMAIL PROTECTED]> From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: hundreds of FREE thumbnailed XXX pictures updated daily!!! 116-3 Date: Tue, 04 Feb 2003 03:23:39 +0500 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" X-Priority: 1 X-Mailer: Microsoft Outlook Express 5.00.2919.6700 Importance: Normal X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?80.32.72.82 X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63. X-Declude-Sender: [EMAIL PROTECTED] [80.32.72.82] X-Declude-Spoolname: D7cce0433006ec083.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SPAMCOP, WEIGHT10, SNIFFER. X-RCPT-TO: <[EMAIL PROTECTED]> Status: R X-UIDL: 334383465 Declude Log: 02/04/2003 01:42:00 Q7cce0433006ec083 SPAMCOP:9 SNIFFER:10 . Total weight = 19 02/04/2003 01:42:00 Q7cce0433006ec083 Msg failed SPAMCOP (Blocked - see http://spamcop.net/bl.shtml?80.32.72.82). Action=WARN. 02/04/2003 01:42:00 Q7cce0433006ec083 Msg failed WEIGHT10 (Weight of 19 reaches or exceeds the limit of 10.). Action=HOLD. 02/04/2003 01:42:00 Q7cce0433006ec083 Msg failed SNIFFER (Message failed SNIFFER: 63.). Action=WARN. 02/04/2003 01:42:00 Q7cce0433006ec083 Subject: hundreds of FREE thumbnailed XXX pictures updated daily!!! 116-3 02/04/2003 01:42:00 Q7cce0433006ec083 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] 02/04/2003 01:42:00 Q7cce0433006ec083 ERROR: Could not move spam to hold! Code: 32 F:\IMAIL\spool\D7cce0433006ec083.SMD F:\IMAIL\spool\spam\D7cce0433006ec083.SMD 02/04/2003 01:42:00 Q7cce0433006ec083 ERROR: Could not move spam to hold (2)! Code: 32 F:\IMAIL\spool\D7cce0433006ec083.SMD F:\IMAIL\spool\spam\D7cce0433006ec083.SMD --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
