Re: [Declude.JunkMail] DNSSTUFF

[Matt]

Cancel that, no clue what brought down my server, it doesn't seem
related to E-mail.  I am however having trouble reaching two other
sites though, but that's probably a coincidence.

The DNSStuff Canadian mirror isn't responding, but the backup site
still is:

    http://backup.dnsstuff.com/

Matt


Matt wrote:

  
  
I seem to be finding a lot of things that are down currently, and my
own server was knocked off-line earlier tonight by what appears to have
been a huge surge of viruses (more research necessary).  Maybe just a
coincidence of course.
  
Matt
  
  
  
Goran Jovanovic wrote:
  
Hmmm me too. I had problems earlier this week and then it came back.


 
 Goran Jovanovic
 The LAN Shoppe

 

  

  -Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED]] On Behalf Of Rick Hogue
Sent: Wednesday, May 12, 2004 11:01 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] DNSSTUFF

 What happened to this valuable site? I get a server not found?


Rick Hogue
www.intent.net Web Hosting 1-800-866-2983
www.prosperity.com Featured web site


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  
  
  
  -- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] DNSSTUFF

[Matt]

I seem to be finding a lot of things that are down currently, and my
own server was knocked off-line earlier tonight by what appears to have
been a huge surge of viruses (more research necessary).  Maybe just a
coincidence of course.

Matt



Goran Jovanovic wrote:

  Hmmm me too. I had problems earlier this week and then it came back.


 
 Goran Jovanovic
 The LAN Shoppe

 

  
  
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED]] On Behalf Of Rick Hogue
Sent: Wednesday, May 12, 2004 11:01 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] DNSSTUFF

 What happened to this valuable site? I get a server not found?


Rick Hogue
www.intent.net Web Hosting 1-800-866-2983
www.prosperity.com Featured web site


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]

  
  

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

RE: [Declude.JunkMail] DNSSTUFF

[Goran Jovanovic]

Hmmm me too. I had problems earlier this week and then it came back.


 
 Goran Jovanovic
 The LAN Shoppe

 

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Rick Hogue
> Sent: Wednesday, May 12, 2004 11:01 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] DNSSTUFF
> 
>  What happened to this valuable site? I get a server not found?
> 
> 
> Rick Hogue
> www.intent.net Web Hosting 1-800-866-2983
> www.prosperity.com Featured web site
> 
> 
> ---
> [This E-mail scanned for viruses by Declude Virus]
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] DNSSTUFF

[Rick Hogue]

 What happened to this valuable site? I get a server not found?


Rick Hogue
www.intent.net Web Hosting 1-800-866-2983
www.prosperity.com Featured web site


---
[This E-mail scanned for viruses by Declude Virus]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Outlook HTML Question

[Fritz Squib]

Try http://www.xintercept.com/pkpeek.htm, great little add-in for MS Lookout
- er Outlook.

"PocketKnife Peek is an Outlook add-in for screening your e-mail as plain
text before opening it in Outlook. The add-in can be used to view all
Outlook message formats, but is aimed particularly at averting the threats
lurking in HTML mail."

"A convenient tabbed view lets you easily examine the:
Message in plain text, 
HTML source (if any),  
Internet header, and 
Attachments."  
 
"Key Features:
Screen incoming messages without opening them in Outlook 
Converts HTML messages to plain text 
Review HTML source without using Notepad or opening the message 
Examine Internet header with one click 
See destinations of links in HTML messages 
View list of attachments (including the contents of ZIP files)  
Reply to and forward HTML mail in plain text  
Reply to Some feature gives greater control over who replies are addressed
to 
Circumvents security message introduced with Outlook 2002 SP3"

And it's free 


Fritz

Frederick P. Squib, Jr.
Network Operations/Mail Administrator
Citizens Telephone Company of Kecksburg
http://www.wpa.net

()  ascii ribbon campaign - against html mail 
/\- against microsoft attachments



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic
Sent: Wednesday, May 12, 2004 7:57 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] OT: Outlook HTML Question


Hi,

Does anyone know how to do this? If an HTML mail arrives in Outlook how can
you look to see what the HTML source is? I have looked and do not see any
View Source and the Save as options did not work.

Thanx


 
 Goran Jovanovic
 The LAN Shoppe

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]


---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Poweredge 2650 Crashing..

[Scott Hahn]

Just a follow up to those who helped with
my Poweredge crashing.

Finally after having Dell escalate the
case I got a tech who was willing to replace the Cpu’s, and not a single
problem since.

 

Thanks all. 

 

 



Scott Hahn

RE: [Declude.JunkMail] OT: Outlook HTML Question

[Goran Jovanovic]

Thanx Kevin,

Got to love the hoops we sometimes have to go through


 
 Goran Jovanovic
 The LAN Shoppe

 

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Kevin Bilbee
> Sent: Wednesday, May 12, 2004 8:19 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] OT: Outlook HTML Question
> 
> This will show you the decoded HTML source. So if the body is encoded
you
> will not see the encoding. This is a problem if you are trying to
setup
> filters. what I do if I want to see the real source is froward it as
an
> attachment to and account I service with outlook express.
> 
> 
> Kevin Bilbee
> 
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] Behalf Of Goran
Jovanovic
> > Sent: Wednesday, May 12, 2004 5:06 PM
> > To: [EMAIL PROTECTED]
> > Subject: RE: [Declude.JunkMail] OT: Outlook HTML Question
> >
> >
> > Duh ... looked everywhere but there.
> >
> > Thanx
> >
> >
> >  Goran Jovanovic
> >  The LAN Shoppe
> >
> >
> >
> > > -Original Message-
> > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > > [EMAIL PROTECTED] On Behalf Of Erik
> > > Sent: Wednesday, May 12, 2004 8:03 PM
> > > To: [EMAIL PROTECTED]
> > > Subject: RE: [Declude.JunkMail] OT: Outlook HTML Question
> > >
> > > Right-click in the body of the HTML message and choose, "View
Source"
> > >
> > >
> > > -Original Message-
> > > From: [EMAIL PROTECTED]
> > > [mailto:[EMAIL PROTECTED] On Behalf Of Goran
> > Jovanovic
> > > Sent: Wednesday, May 12, 2004 5:57 PM
> > > To: [EMAIL PROTECTED]
> > > Subject: [Declude.JunkMail] OT: Outlook HTML Question
> > >
> > >
> > > Hi,
> > >
> > > Does anyone know how to do this? If an HTML mail arrives in
Outlook
> > how
> > > can
> > > you look to see what the HTML source is? I have looked and do not
see
> > any
> > > View Source and the Save as options did not work.
> > >
> > > Thanx
> > >
> > >
> > >
> > >  Goran Jovanovic
> > >  The LAN Shoppe
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> > > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe,
> > > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> > > Declude.JunkMail".  The archives can be found at
> > > http://www.mail-archive.com.
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> > > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > > type "unsubscribe Declude.JunkMail".  The archives can be found
> > > at http://www.mail-archive.com.
> > > ---
> > > [This E-mail scanned for viruses by Declude Virus]
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Outlook HTML Question

[Kevin Bilbee]

This will show you the decoded HTML source. So if the body is encoded you
will not see the encoding. This is a problem if you are trying to setup
filters. what I do if I want to see the real source is froward it as an
attachment to and account I service with outlook express.


Kevin Bilbee

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Goran Jovanovic
> Sent: Wednesday, May 12, 2004 5:06 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] OT: Outlook HTML Question
>
>
> Duh ... looked everywhere but there.
>
> Thanx
>
>
>  Goran Jovanovic
>  The LAN Shoppe
>
>
>
> > -Original Message-
> > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> > [EMAIL PROTECTED] On Behalf Of Erik
> > Sent: Wednesday, May 12, 2004 8:03 PM
> > To: [EMAIL PROTECTED]
> > Subject: RE: [Declude.JunkMail] OT: Outlook HTML Question
> >
> > Right-click in the body of the HTML message and choose, "View Source"
> >
> >
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] On Behalf Of Goran
> Jovanovic
> > Sent: Wednesday, May 12, 2004 5:57 PM
> > To: [EMAIL PROTECTED]
> > Subject: [Declude.JunkMail] OT: Outlook HTML Question
> >
> >
> > Hi,
> >
> > Does anyone know how to do this? If an HTML mail arrives in Outlook
> how
> > can
> > you look to see what the HTML source is? I have looked and do not see
> any
> > View Source and the Save as options did not work.
> >
> > Thanx
> >
> >
> >
> >  Goran Jovanovic
> >  The LAN Shoppe
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe,
> > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> > Declude.JunkMail".  The archives can be found at
> > http://www.mail-archive.com.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > ---
> > [This E-mail scanned for viruses by Declude Virus]
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Outlook HTML Question

[Goran Jovanovic]

Duh ... looked everywhere but there.

Thanx


 Goran Jovanovic
 The LAN Shoppe

 

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Erik
> Sent: Wednesday, May 12, 2004 8:03 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] OT: Outlook HTML Question
> 
> Right-click in the body of the HTML message and choose, "View Source"
> 
> 
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Goran
Jovanovic
> Sent: Wednesday, May 12, 2004 5:57 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] OT: Outlook HTML Question
> 
> 
> Hi,
> 
> Does anyone know how to do this? If an HTML mail arrives in Outlook
how
> can
> you look to see what the HTML source is? I have looked and do not see
any
> View Source and the Save as options did not work.
> 
> Thanx
> 
> 
> 
>  Goran Jovanovic
>  The LAN Shoppe
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> [This E-mail scanned for viruses by Declude Virus]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Outlook HTML Question

[Erik]

Right-click in the body of the HTML message and choose, "View Source"


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic
Sent: Wednesday, May 12, 2004 5:57 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] OT: Outlook HTML Question


Hi,

Does anyone know how to do this? If an HTML mail arrives in Outlook how can
you look to see what the HTML source is? I have looked and do not see any
View Source and the Save as options did not work.

Thanx


 
 Goran Jovanovic
 The LAN Shoppe

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT: Outlook HTML Question

[Goran Jovanovic]

Hi,

Does anyone know how to do this? If an HTML mail arrives in Outlook how
can you look to see what the HTML source is? I have looked and do not
see any View Source and the Save as options did not work.

Thanx


 
 Goran Jovanovic
 The LAN Shoppe

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Universities spamming..

[Kevin Bilbee]

I have 
had great luck contacting th universitys letting them know the offending IP 
addresses. they are normally very grateful. And the virus spam generally stops 
within a day or two.
 
 
 
Kevin 
Bilbee

  -Original Message-From: 
  [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]On Behalf Of Kami 
  RazvanSent: Wednesday, May 12, 2004 2:11 PMTo: 
  [EMAIL PROTECTED]Subject: [Declude.JunkMail] 
  Universities spamming..
  Hi;
   
  today we have 
  received a ton of spam from probably infected computers in 
  Universities..
   
  The most notable 
  was a lot of Viagra spam from Harvard University.  Considering we receive 
  a lot of emails from them their reverse dns WAS whitelisted- not 
  anymore..
   
  just thought to 
  share the pain..
   
  Kami

Re: [Declude.JunkMail] Whitelisting a test?

[R. Scott Perry]

Is there anyway we can whitelist a test?

With Declude we can have combination tests and tests that give weight 
based on a combination of test names.. now I wonder if we can whitelist a 
test name:

Whitelist  Testsfailedspamcop :)

If we can do this it can help us with whitelisting based on a combination 
of parameters rather than a single parameter.
No, but it can be added to the suggestion database.  :)

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Whitelisting a test?

[Kami Razvan]

Scott:
 
Is there anyway we 
can whitelist a test?
 
With Declude we 
can have combination tests and tests that give weight based on a combination of 
test names.. now I wonder if we can whitelist a test name:
 
Whitelist  
Testsfailed    spamcop :)
 
If we can do this 
it can help us with whitelisting based on a combination of parameters rather 
than a single parameter.
 
Regards,
-Kami

[Declude.JunkMail] Universities spamming..

[Kami Razvan]

Hi;
 
today we have 
received a ton of spam from probably infected computers in 
Universities..
 
The most notable 
was a lot of Viagra spam from Harvard University.  Considering we receive a 
lot of emails from them their reverse dns WAS whitelisted- not 
anymore..
 
just thought to 
share the pain..
 
Kami

RE: [Declude.JunkMail] PDF counter balance

[Markus Gufler]

> Can anybody point out reasons why it would be a bad idea for 
> me to use this line to stop filtering messages with file 
> attachments? This is mainly for PDF files which seem to get 
> caught for strange reasons.
> 

One reason could be that the enemy (spammer) is listening, and now he can
see exactly what he has to put somewhere in the mail body.

As many other counter balances and legit indicators it's not a good idea to
publish the exact string or solution. 

I consider to set up a separate test (for example named WHTLST-PDF) and
assign the lowest negative weight you can (or also zero)
Now let run this test for 24 hours (or at least some thousands of messages)
and search trough the logfile for correct and wrong results.

Markus




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

[R. Scott Perry]

Not to start a huge long thread about interims and such, but if you can 
get this interim released, do you know if that little problem with the zip 
files (zipped but didn't abide by the zipped rules) getting caught by 
banext ezip will be fixed as well...
Yes (whenever we say that something "has been fixed" or "will be fixed for 
the next release", it will be in the next interim, and any 
interim/beta/release that comes out after that).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

[Russ Uhte \(Lists\)]

At 02:31 PM 5/12/2004, R. Scott Perry wrote:

Are you using an interim version of Declude?  I just recently had this 
problem, and contact [EMAIL PROTECTED]  They told me there was a bug with the 
ALLRECIPS in the current interim, and that it would be resolved in a 
future interim.  For now, I've had to return back to the latest beta.

If you hear something different, please let me know.
Ah, I like it when customers are able to take care of things that I forget 
about.  :)

You are correct -- I'll see if I can get a new interim release online 
which will take care of this.
Not to start a huge long thread about interims and such, but if you can get 
this interim released, do you know if that little problem with the zip 
files (zipped but didn't abide by the zipped rules) getting caught by 
banext ezip will be fixed as well...

Thanks,
Russ
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

[R. Scott Perry]

Are you using an interim version of Declude?  I just recently had this 
problem, and contact [EMAIL PROTECTED]  They told me there was a bug with the 
ALLRECIPS in the current interim, and that it would be resolved in a 
future interim.  For now, I've had to return back to the latest beta.

If you hear something different, please let me know.
Ah, I like it when customers are able to take care of things that I forget 
about.  :)

You are correct -- I'll see if I can get a new interim release online which 
will take care of this.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

[R. Scott Perry]

I have a filter called FOREIGN that I have been defeating with END 
statements for certain domains with international traffic like so

- Foreign.txt -
ALLRECIPSENDCONTAINS@clientdomain.com
I just noticed an E-mail that was held which failed this filter for this 
client.  Note that they are gatewayed, so aliasing is not affecting 
this.  The headers are below.  Any ideas about what might be wrong 
here?  I don't know if this isn't working in general yet, and the only 
thing of note from this E-mail is that the address is in all caps 
(modified for public display).
From the list of recipients:

X-MailPure: RECIPIENTS: <[EMAIL PROTECTED]>
I would think that it should work unless there was a typo somewhere (or 
related issue, such as a space at the end of the filter line, or no 
carriage return at the end of the line).  I would suggest using the debug 
mode to get debug log file entries, which we can look at to see why it is 
happening.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

[Russ Uhte \(Lists\)]

At 02:09 PM 5/12/2004, Matt wrote:
Scott,

I have a filter called FOREIGN that I have been defeating with END 
statements for certain domains with international traffic like so

- Foreign.txt -
ALLRECIPSENDCONTAINS@clientdomain.com
Matt,

Are you using an interim version of Declude?  I just recently had this 
problem, and contact [EMAIL PROTECTED]  They told me there was a bug with the 
ALLRECIPS in the current interim, and that it would be resolved in a future 
interim.  For now, I've had to return back to the latest beta.

If you hear something different, please let me know.

Thanks,
Russ 

---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Injunction against SpamCop

[Matt]

Spammers have been suing for a long time now, and courts have
consistantly ruled in the favor of the RBL in question.  The only thing
about this that is troublesome so far is the injunction.  Keep in mind
that OptInRealBig is being sued by both Microsoft and New York State,
and if we can't block a top 5 spammer at the request of our customers
or identify them as a free public service, we might as well throw in
the towel.  I'm not worried though.

The shame is that Congress gave an ounce of legidimacy to companies
like this one, and that was enough to appearantly confuse the courts. 
Take note that IronPort owns SpamCop, and I would imagine that the
community will come to their aid for fear of this becoming precident
setting, which is still highly unlikely.  There is a very similar case
that Spamhaus recently won in Florida that didn't even make it past the
SLAPP laws.  You can read about it on their site.

Matt



Todd Holt wrote:

  This could have serious implications everywhere on the internet...

- When I go to Google and see a person's poor review of a product, then
I don't buy that product, is very similar.  Google is a third party, the
reviewer is a disgruntled user, I'm deciding not to purchase (or use)
the product because of this review, and the producer of the product is
not allowed to correct the problem before the posting.  Shame on you
Google!

- When I go to Pricescan and see a list of vendors selling a product,
but one vendor has a poor Vendor Rating and I don't buy from that
vendor.  Pricescan is a third party, I choose not to buy from the poorly
rated vendor, and I don't see any ability for the vendor to review the
source of the poor rating before it's published.  Shame on you
Pricescan!

The only real difference with SpamCop (and similar services) is:
1. The amount of money the spammers will spend on fighting the issue.
2. The amount of money that SpamCop has to defend itself.
3. The speed in which the filtering mechanism occurs (vs. Google,
Pricescan)
4. The volume of complaints that can be processed in a short period of
time.
5. The lawmaker's lack of understanding of email technology (and its
costs).
6. How pervasive the public feels the problem is.

IMHO:
The only thing that will stop spam is when enough lawmakers have enough
spam sent to them to cause enough frustration!  Then they will
understand the problem.

Todd Holt
Xidix Technologies, Inc
Las Vegas, NV USA
702.319.4349
www.xidix.com
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Andy Schmidt
Sent: Wednesday, May 12, 2004 10:38 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Injunction against SpamCop

Well, there is SOME truth behind their allegation - it's just too bad,
that
in this case, a spammer can use the truth for their purposes.

But, for anyone maintaining a VALID, subscription based mailing list,
SpamCops approach is troublesome, counterproductive at best, damaging at
worst (even if their intentions are good).  It frequently happens that a
prior customer is no longer interested in future mailings.  But, instead
of
following directions to "unsubscribe" - they simply forward the email to
a
spam-reporting service.

If that spam-reporting service doesn't provide me with the full
unsubscribe
request, then everyone will be unhappy:

	a) the ex-customer will continue to receive mailings and be more
and
more enraged about being "spammed",
	b) the business will continue to receive reports from Spamcop
and
the like - to which they cannot react (lacking the identifying
information)
	c) the mail server may end up being incorrectly black-listed.

If I read the allegations correctly, the spammer is NOT complaining
about
being black-listed - but about the fact that they are not provided with
the
necessary information to honor the customers "unsubscribe" request.
They
are also complaining that a report is filed with a third party (the
spammers
ISP) - even the spammer has not been given the opportunity to actually
comply with the wishes of the "unsubscribing" user.

Ultimately, SpamCop should have some "mailer" service, where, for a fee,
a
mailer can register their "unsubscribe" URL. Spamcop could automatically
"unsubscribe" any users who send in a spam report.  Then they could
track,
which users have been unsubcribed with this particular mailer - and if
another report comes in AFTER having unsubscribed, THEN this could
represent
a violation of law and would probably justify more drastic measures to
be
taken.

Best Regards
Andy Schmidt

H&M Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

http://www.HM-Software.com/


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Todd Hunter
Sent: Wednesday, May 12, 2004 01:53 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Injunction against SpamCop


I wouldn't dismiss this too qu

[Declude.JunkMail] ALLRECIPS CONTAINS END not ending?

[Matt]

Scott,

I have a filter called FOREIGN that I have been defeating with END 
statements for certain domains with international traffic like so

- Foreign.txt -
ALLRECIPSENDCONTAINS@clientdomain.com
I just noticed an E-mail that was held which failed this filter for this 
client.  Note that they are gatewayed, so aliasing is not affecting 
this.  The headers are below.  Any ideas about what might be wrong 
here?  I don't know if this isn't working in general yet, and the only 
thing of note from this E-mail is that the address is in all caps 
(modified for public display).

Thanks,

Matt



Received: from pc01 [213.45.252.65] by mx1.mailpure.com
 (SMTPD32-8.05) id AFEF117B021E; Wed, 12 May 2004 09:00:31 -0400
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: [14] calabria
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Date: Wed, 12 May 2004 15.15.15
Message-Id: <[EMAIL PROTECTED]>
X-MailPure: 
X-MailPure: RFC-NOABUSE: Failed, listed in abuse.rfc-ignorant.org 
(weight 1).
X-MailPure: RFC-NOPOSTMASTER: Failed, listed in 
postmaster.rfc-ignorant.org (weight 1).
X-MailPure: HELOBOGUS: Failed, bogus connecting server name (weight 3).
X-MailPure: BADHEADERS: Failed, headers not RFC compliant [801f] 
(weight 4).
X-MailPure: DYNAMIC: Message failed DYNAMIC test (line 56, weight 2) 
(weight capped at 2).
X-MailPure: FOREIGN: Message failed FOREIGN test (line 1531, weight 3) 
(weight capped at 3).
X-MailPure: RECIPIENTS: <[EMAIL PROTECTED]>
X-MailPure: 
X-MailPure: Spam Score: 14
X-MailPure: Scan Time: 09:00:39 on 05/12/2004
X-MailPure: Spool File: D1fef117b021edb91.SMD
X-MailPure: Server Name: pc01
X-MailPure: SMTP Sender: [EMAIL PROTECTED]
X-MailPure: Received From: host65-252.pool21345.interbusiness.it 
[213.45.252.65]
X-MailPure: Country Chain: ITALY->destination
X-MailPure: 
X-MailPure: Spam and virus blocking services provided by MailPure.com
X-MailPure: 

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: SPAM: Re: [Declude.JunkMail] countmein.com

[Dan Patnode]

Sounds good guys, I'll take it up with them directly.

Thanks,
Dan


> From: Darrell <[EMAIL PROTECTED]>
> Reply-To: [EMAIL PROTECTED]
> Date: Wed, 12 May 2004 08:43:22 -0400
> To: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]>
> Subject: SPAM: Re: [Declude.JunkMail] countmein.com
> 
> There is several reports on NANAE (some very recent most from 2003) -
> http://groups.google.com/groups?hl=en&lr=&q=countmein.com&meta=group%3Dnews.ad
> min.net-abuse.sightings
> 
> Here is a link to more info specifically (by the same folks that email you)
> http://groups.google.com/groups?q=countmein.com+group:news.admin.net-abuse.sig
> htings&hl=en&lr=&group=news.admin.net-abuse.sightings&scoring=d&selm=200405050
> 545.i455j4ko011765%40send.it.helsinki.fi&rnum=1
> 
> Darrell
> 
> -
> Check out http://www.invariantsystems.com for utilities for Declude and Imail.
> 
> 
> Quoting Dan Patnode <[EMAIL PROTECTED]>:
> 
>> The Institute of Biotechnology, University of Helsinki Finland just sent my
>> abuse line a report suggesting a new client of mine is a spammer.  I'm not
>> in the business of protecting these guys from each other.
>> 
>> Has anyone heard of countmein.com as a spammer?

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Injunction against SpamCop

[Todd Holt]

This could have serious implications everywhere on the internet...

- When I go to Google and see a person's poor review of a product, then
I don't buy that product, is very similar.  Google is a third party, the
reviewer is a disgruntled user, I'm deciding not to purchase (or use)
the product because of this review, and the producer of the product is
not allowed to correct the problem before the posting.  Shame on you
Google!

- When I go to Pricescan and see a list of vendors selling a product,
but one vendor has a poor Vendor Rating and I don't buy from that
vendor.  Pricescan is a third party, I choose not to buy from the poorly
rated vendor, and I don't see any ability for the vendor to review the
source of the poor rating before it's published.  Shame on you
Pricescan!

The only real difference with SpamCop (and similar services) is:
1. The amount of money the spammers will spend on fighting the issue.
2. The amount of money that SpamCop has to defend itself.
3. The speed in which the filtering mechanism occurs (vs. Google,
Pricescan)
4. The volume of complaints that can be processed in a short period of
time.
5. The lawmaker's lack of understanding of email technology (and its
costs).
6. How pervasive the public feels the problem is.

IMHO:
The only thing that will stop spam is when enough lawmakers have enough
spam sent to them to cause enough frustration!  Then they will
understand the problem.

Todd Holt
Xidix Technologies, Inc
Las Vegas, NV USA
702.319.4349
www.xidix.com
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt
Sent: Wednesday, May 12, 2004 10:38 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Injunction against SpamCop

Well, there is SOME truth behind their allegation - it's just too bad,
that
in this case, a spammer can use the truth for their purposes.

But, for anyone maintaining a VALID, subscription based mailing list,
SpamCops approach is troublesome, counterproductive at best, damaging at
worst (even if their intentions are good).  It frequently happens that a
prior customer is no longer interested in future mailings.  But, instead
of
following directions to "unsubscribe" - they simply forward the email to
a
spam-reporting service.

If that spam-reporting service doesn't provide me with the full
unsubscribe
request, then everyone will be unhappy:

a) the ex-customer will continue to receive mailings and be more
and
more enraged about being "spammed",
b) the business will continue to receive reports from Spamcop
and
the like - to which they cannot react (lacking the identifying
information)
c) the mail server may end up being incorrectly black-listed.

If I read the allegations correctly, the spammer is NOT complaining
about
being black-listed - but about the fact that they are not provided with
the
necessary information to honor the customers "unsubscribe" request.
They
are also complaining that a report is filed with a third party (the
spammers
ISP) - even the spammer has not been given the opportunity to actually
comply with the wishes of the "unsubscribing" user.

Ultimately, SpamCop should have some "mailer" service, where, for a fee,
a
mailer can register their "unsubscribe" URL. Spamcop could automatically
"unsubscribe" any users who send in a spam report.  Then they could
track,
which users have been unsubcribed with this particular mailer - and if
another report comes in AFTER having unsubscribed, THEN this could
represent
a violation of law and would probably justify more drastic measures to
be
taken.

Best Regards
Andy Schmidt

H&M Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

http://www.HM-Software.com/


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd Hunter
Sent: Wednesday, May 12, 2004 01:53 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Injunction against SpamCop


I wouldn't dismiss this too quickly.  The concern here is the 
trend.  Spammers using the law/can-spam act against companies that are 
fighting spam.  They don't have to win the suits, they just have to make
it 
expensive, or  otherwise not worth it, like they have for many
blacklists 
in the past year that shut down.

 From the looks of the judgement it appears like they are trying to
prove 
that it is illegal for us to block or hold spam at all.  Or make us
change 
our systems so that end users can see the spam and have the option to
opt-out.

Who do you think has more money to throw into this, Spammers or Spamcop?



Todd Hunter





At 12:41 PM 5/12/2004 -0400, you wrote:
>They are quite well blacklisted and the absense from SpamCop probably
>won't make a difference.
>
>Matt
>
>
>
>Jeff Maze wrote:
>
>>Anyone have a list of IP addresses that OptInRealBig.com uses to send 
>>out their mailings?  Declude Blacklist.. >:)
>>
>>The web site's IP is 6

RE: [Declude.JunkMail] Injunction against SpamCop

[Andy Schmidt]

Well, there is SOME truth behind their allegation - it's just too bad, that
in this case, a spammer can use the truth for their purposes.

But, for anyone maintaining a VALID, subscription based mailing list,
SpamCops approach is troublesome, counterproductive at best, damaging at
worst (even if their intentions are good).  It frequently happens that a
prior customer is no longer interested in future mailings.  But, instead of
following directions to "unsubscribe" - they simply forward the email to a
spam-reporting service.

If that spam-reporting service doesn't provide me with the full unsubscribe
request, then everyone will be unhappy:

a) the ex-customer will continue to receive mailings and be more and
more enraged about being "spammed",
b) the business will continue to receive reports from Spamcop and
the like - to which they cannot react (lacking the identifying information)
c) the mail server may end up being incorrectly black-listed.

If I read the allegations correctly, the spammer is NOT complaining about
being black-listed - but about the fact that they are not provided with the
necessary information to honor the customers "unsubscribe" request.  They
are also complaining that a report is filed with a third party (the spammers
ISP) - even the spammer has not been given the opportunity to actually
comply with the wishes of the "unsubscribing" user.

Ultimately, SpamCop should have some "mailer" service, where, for a fee, a
mailer can register their "unsubscribe" URL. Spamcop could automatically
"unsubscribe" any users who send in a spam report.  Then they could track,
which users have been unsubcribed with this particular mailer - and if
another report comes in AFTER having unsubscribed, THEN this could represent
a violation of law and would probably justify more drastic measures to be
taken.

Best Regards
Andy Schmidt

H&M Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

http://www.HM-Software.com/


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd Hunter
Sent: Wednesday, May 12, 2004 01:53 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Injunction against SpamCop


I wouldn't dismiss this too quickly.  The concern here is the 
trend.  Spammers using the law/can-spam act against companies that are 
fighting spam.  They don't have to win the suits, they just have to make it 
expensive, or  otherwise not worth it, like they have for many blacklists 
in the past year that shut down.

 From the looks of the judgement it appears like they are trying to prove 
that it is illegal for us to block or hold spam at all.  Or make us change 
our systems so that end users can see the spam and have the option to
opt-out.

Who do you think has more money to throw into this, Spammers or Spamcop?



Todd Hunter





At 12:41 PM 5/12/2004 -0400, you wrote:
>They are quite well blacklisted and the absense from SpamCop probably
>won't make a difference.
>
>Matt
>
>
>
>Jeff Maze wrote:
>
>>Anyone have a list of IP addresses that OptInRealBig.com uses to send 
>>out their mailings?  Declude Blacklist.. >:)
>>
>>The web site's IP is 69.6.21.239 which is assigned to JAYS WEB SERVICE 
>>JAYSWEBSERV-01 (NET-69-6-21-0-1) 69.6.21.0 - 69.6.21.255.  There are 
>>some interesting hostname when I did a scan of this IP bank, but 
>>nothing really worth while.
>>
>>-Original Message-
>>From: [EMAIL PROTECTED]
>>[mailto:[EMAIL PROTECTED] On Behalf Of Matt
>>Sent: Wednesday, May 12, 2004 11:20 AM
>>To: [EMAIL PROTECTED]
>>Subject: [Declude.JunkMail] Injunction against SpamCop
>>
>>Maybe if Scott Ricter of OptinRealBig can get himself an injunction 
>>against SpamCop, then maybe AOL, RR and every other damn ISP that 
>>they're listing can do the same :-/
>>
>>http://zdnet.com.com/2100-1104_2-5210518.html?tag=sas.email
>>
>>But seriously, we all have Congress to thank for this glorious piece 
>>of leglislation that they call CAN-SPAM.
>>
>>Matt
>>
>>--
>>=
>>MailPure custom filters for Declude JunkMail Pro. 
>>http://www.mailpure.com/software/
>>=
>>
>>
>>---
>>[This E-mail was scanned for viruses by Declude Virus 
>>(http://www.declude.com)]
>>
>>---
>>This E-mail came from the Declude.JunkMail mailing list.  To 
>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
>>"unsubscribe Declude.JunkMail".  The archives can be found at 
>>http://www.mail-archive.com.
>>
>>
>>
>>---
>>[This E-mail was scanned for viruses by Declude Virus
>>(http://www.declude.com)]
>>
>>---
>>This E-mail came from the Declude.JunkMail mailing list.  To 
>>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
>>"unsubscribe Declude.JunkMail".  The archives can be found at 
>>http://www.mail-archive.com.
>>
>>
>>
>
>--
>

Re: [Declude.JunkMail] Why does this fail routing?

[R. Scott Perry]

> Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
>   (SMTPD32-8.05) id AA05D10128; Tue, 11 May 2004 23:53:57 -0700
> Received: from [80.199.82.218] ([80.199.82.218])
>  by ns1.ssc-isp.net (SAVSMTP 3.1.6.45) with SMTP id M2004051123492224557
>  for <[EMAIL PROTECTED]>; Tue, 11 May 2004 23:49:23 -0700
> Received: from no.name.available by [80.199.82.218]
>   via smtpd (for ns1.ssc-isp.net [12.9.25.242]) with ESMTP; Wed, 
12 May 2004 08:54:08 +0200

The issue here is that the bottom Received: header includes the IP 
12.9.25.242 (North America), then it goes to 80.199.82.218 (outside North 
America), then goes back to your server in North America.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] bypasswhitelisting?

[R. Scott Perry]

I am trying to understand how this works.. We have the following in the 
Global:

EMERGENCYBYPASS   bypasswhitelisting  40  2  0  0
This should be "bypasswhitelist" not "bypasswhitelisting".

&
in the following action in the default file.
EMERGENCYBYPASS  DELETE
With "bypasswhitelist", an E-mail with a weight of 40 or higher and 2 or 
more recipients should be deleted.

We have one person in a domain that has [EMAIL PROTECTED] in 
the address book.  My understanding is with the above statement if an 
email is scored 40+ it will be deleted regardless of the 
[EMAIL PROTECTED]  Right?
Correct, if there are 2 or more recipients.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Possible Preamble to a Phishing scam?

[John Tolmachoff \(Lists\)]

Attached is the test of a html e-mail that was sent to a old user.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You





 
  
 
Email

 





.text {color: #00; font-size: 11px; font-family: arial, helvetica, 
sans-serif;}
.legal {font-size: 9px; font-family: arial, helvetica, 
sans-serif;color:#00;}


   
  http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="10" BORDER="0" ALT="">
  http://www.click-one.net/images/dnb/prenotification/bg_gray.gif"; 
ALIGN="LEFT" VALIGN="TOP">http://www.click-one.net/images/dnb/prenotification/bg_gray.gif"; HEIGHT="1" 
WIDTH="1" BORDER="0" ALT="">
  
  
  
 
http://www.dnb.com";>http://www.click-one.net/images/dnb/prenotification/hdr_logo.gif"; HEIGHT="78" 
WIDTH="538" BORDER="0" ALT="">
 
 
http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="71" BORDER="0" ALT="">
http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="2" BORDER="0" ALT="">
http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="10" BORDER="0" ALT="">
http://www.click-one.net/images/dnb/prenotification/sub_enhancementtoyour.gif"; 
HEIGHT="18" WIDTH="250" BORDER="0" ALT="">http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="10" 
WIDTH="374" BORDER="0" ALT="">
http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="71" BORDER="0" ALT="">
 
 
http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="71" BORDER="0" ALT="">
http://www.click-one.net/images/dnb/prenotification/bg_blue.gif"; 
ALIGN="LEFT" VALIGN="TOP">http://www.click-one.net/images/dnb/prenotification/bg_blue.gif"; HEIGHT="1" 
WIDTH="2" BORDER="0" ALT="">
http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="10" BORDER="0" ALT="">
Dear Blanche:

We would like to notify you that we are in the process of providing you and your 
company with greater security and convenience when you use the D&B US Contract 
Site.

Within the next few weeks, we will be introducing an improved login ID system.  Upon 
signing into the US Contract Site, you will be prompted to change your current 
six-digit User ID to your e-mail address and create a unique password.

Benefits for All Users:

Your User ID will be easily recognizable and simple to remember.
No one but you will be able request your password if it's forgotten.
You will have the option to personalize the site to your specific search 
preferences.

As an added benefit, the E-mail User ID will allow you to view the activity of each 
individual user, making it easier to track usage from month to month.

If you have any questions, please call us at 1-800-234-3867. We're pleased to offer 
this enhancement and as always, we thank you for choosing D&B.

Sincerely,


http://www.click-one.net/images/dnb/prenotification/img_signature.gif"; 
HEIGHT="40" WIDTH="102" BORDER="0" ALT="">

Ron Katoni
E-Business Solutions, DNB.com
103 JFK Parkway, Short Hills, NJ 07078  
http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="71" BORDER="0" ALT="">
 
 
http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="70" 
WIDTH="1" BORDER="0" ALT="">
 
  
  
  
  http://www.click-one.net/images/dnb/prenotification/bg_gray.gif"; 
ALIGN="LEFT" VALIGN="TOP">http://www.click-one.net/images/dnb/prenotification/bg_gray.gif"; HEIGHT="1" 
WIDTH="1" BORDER="0" ALT="">
   
   
  http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="10" BORDER="0" ALT="">
  http://www.click-one.net/images/dnb/prenotification/bg_gray.gif"; 
ALIGN="LEFT" VALIGN="TOP">http://www.click-one.net/images/dnb/prenotification/bg_gray.gif"; HEIGHT="1" 
WIDTH="1" BORDER="0" ALT="">
   
   
  http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="10" BORDER="0" ALT="">
  
  
  
 
http://www.click-one.net/images/dnb/prenotification/spacer.gif"; HEIGHT="1" 
WIDTH="85" BORDER="0" ALT="">




   
  Privacy and Unsubscribe 
Notice
  As stated in our privacy policy, Dun & Bradstreet honors its customers' 
  choices to receive information about D&B products and services. To change 
  your e-mail marketing preferences, unsubscribe, or if you received this 
  message in error, http://www.cicrm.net/mk/get/PRE-UNSUB?_EC=iSqAi98H-F6ttIQBgDszOa";>click 
here. To view D&B's Global Privacy 
  Objectives, http://www.cicrm.net/mk/get?_EC=DVyJy0cT1q6F0EdC34DQaq";>click 
here.
 
  
  
  
   

Re: [Declude.JunkMail] Injunction against SpamCop

[Todd Hunter]

I wouldn't dismiss this too quickly.  The concern here is the 
trend.  Spammers using the law/can-spam act against companies that are 
fighting spam.  They don't have to win the suits, they just have to make it 
expensive, or  otherwise not worth it, like they have for many blacklists 
in the past year that shut down.

From the looks of the judgement it appears like they are trying to prove 
that it is illegal for us to block or hold spam at all.  Or make us change 
our systems so that end users can see the spam and have the option to opt-out.

Who do you think has more money to throw into this, Spammers or Spamcop?



Todd Hunter





At 12:41 PM 5/12/2004 -0400, you wrote:
They are quite well blacklisted and the absense from SpamCop probably 
won't make a difference.

Matt



Jeff Maze wrote:

Anyone have a list of IP addresses that OptInRealBig.com uses to send out
their mailings?  Declude Blacklist.. >:)
The web site's IP is 69.6.21.239 which is assigned to JAYS WEB SERVICE
JAYSWEBSERV-01 (NET-69-6-21-0-1) 69.6.21.0 - 69.6.21.255.  There are some
interesting hostname when I did a scan of this IP bank, but nothing really
worth while.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Wednesday, May 12, 2004 11:20 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Injunction against SpamCop
Maybe if Scott Ricter of OptinRealBig can get himself an injunction against
SpamCop, then maybe AOL, RR and every other damn ISP that they're listing
can do the same :-/
   http://zdnet.com.com/2100-1104_2-5210518.html?tag=sas.email

But seriously, we all have Congress to thank for this glorious piece of
leglislation that they call CAN-SPAM.
Matt

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Injunction against SpamCop

[Matt]

They are quite well blacklisted and the absense from SpamCop probably 
won't make a difference.

Matt



Jeff Maze wrote:

Anyone have a list of IP addresses that OptInRealBig.com uses to send out
their mailings?  Declude Blacklist.. >:)
The web site's IP is 69.6.21.239 which is assigned to JAYS WEB SERVICE
JAYSWEBSERV-01 (NET-69-6-21-0-1) 69.6.21.0 - 69.6.21.255.  There are some
interesting hostname when I did a scan of this IP bank, but nothing really
worth while.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Wednesday, May 12, 2004 11:20 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Injunction against SpamCop
Maybe if Scott Ricter of OptinRealBig can get himself an injunction against
SpamCop, then maybe AOL, RR and every other damn ISP that they're listing
can do the same :-/
   http://zdnet.com.com/2100-1104_2-5210518.html?tag=sas.email

But seriously, we all have Congress to thank for this glorious piece of
leglislation that they call CAN-SPAM.
Matt

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
 

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Injunction against SpamCop

[Jeff Maze]

Anyone have a list of IP addresses that OptInRealBig.com uses to send out
their mailings?  Declude Blacklist.. >:)

The web site's IP is 69.6.21.239 which is assigned to JAYS WEB SERVICE
JAYSWEBSERV-01 (NET-69-6-21-0-1) 69.6.21.0 - 69.6.21.255.  There are some
interesting hostname when I did a scan of this IP bank, but nothing really
worth while.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Wednesday, May 12, 2004 11:20 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Injunction against SpamCop

Maybe if Scott Ricter of OptinRealBig can get himself an injunction against
SpamCop, then maybe AOL, RR and every other damn ISP that they're listing
can do the same :-/

http://zdnet.com.com/2100-1104_2-5210518.html?tag=sas.email

But seriously, we all have Congress to thank for this glorious piece of
leglislation that they call CAN-SPAM.

Matt

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Injunction against SpamCop

[Matt]

Maybe if Scott Ricter of OptinRealBig can get himself an injunction 
against SpamCop, then maybe AOL, RR and every other damn ISP that 
they're listing can do the same :-/

   http://zdnet.com.com/2100-1104_2-5210518.html?tag=sas.email

But seriously, we all have Congress to thank for this glorious piece of 
leglislation that they call CAN-SPAM.

Matt

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] countmein.com

[Matt]

Definitely a spammer, however they aren't a spam house.  Most of the 
recent complaints in the abuse newsgroups are from the same university 
admin, but there are others.

I can't tell from senderbase.org if they are using their own server, or 
relaying through their ISP.  I do always ask that my clients apply both 
the MAPS and Spamhaus standards for mailing lists, but so far no 
problems besides minor things related to list management and not with 
harvesting or opt-out spam.

Matt



Dan Patnode wrote:

The Institute of Biotechnology, University of Helsinki Finland just sent my
abuse line a report suggesting a new client of mine is a spammer.  I'm not
in the business of protecting these guys from each other.
Has anyone heard of countmein.com as a spammer?





Here's the report if you're curious:



$ host www.countmein.com
www.countmein.com   CNAME   countmein.com
countmein.com   A   66.150.173.180
Blue Gecko, Inc. PNAP-SEF-BLUGKO-RM-01 (NET-66-150-173-176-1)
 66.150.173.176 - 66.150.173.191
There never was a reply from Blue Gecko to spam complaints related to
Count Me In Corporation, so
REJECT all  --  66.150.173.176/280.0.0.0/0 n/a

$ host www.countmeincorp.com
www.countmeincorp.com   A   212.118.243.114


Only a week ago (May 4) it was on [64.74.96.249].  Could it really be
that eNom got fed up with you?  On the other hand, Internap seems
quite happy to wiggle you around.
inetnum:  212.118.224.0 - 212.118.255.255
org:  ORG-INSU1-RIPE
netname:  UK-INTERNAP-2530
descr:PROVIDER
country:  GB
I won't even discuss Internap.  You just cost the following to all
their other customers in the same network:
REJECT all  --  212.118.224.0/19 0.0.0.0/0 n/a



$ host -t mx countmein.com
countmein.com   MX  20 mx2.spamsoap.com
countmein.com   MX  30 mx3.spamsoap.com
countmein.com   MX  10 mx1.spamsoap.com
_That_, my dear audience, is the definition of "ludicrous."  There it is.

The professional spammer Count Me In Corporation has outsourced its
incoming mail handling to a spam filtering business.
$ host -t mx countmeincorp.com
countmeincorp.com   MX  10 mx.countmeincorp.com
$ host mx.countmeincorp.com
mx.countmeincorp.comA   63.229.26.240


$ host cmiservices.biz
cmiservices.biz A   12.129.237.252
AT&T WorldNet Services ATT (NET-12-0-0-0-1)
 12.0.0.0 - 12.255.255.255
CERFnet ATTENS-LAX1-1 (NET-12-129-192-0-1)
 12.129.192.0 - 12.129.255.255
iPowerWeb ATTENS-008161-002508 (NET-12-129-237-0-1)
 12.129.237.0 - 12.129.237.255
REJECT all  --  12.129.237.0/24  0.0.0.0/0 n/a

$ host countmein.wc09.net
countmein.wc09.net  A   63.214.0.227
OrgName:Level 3 Communications, Inc.
OrgID:  LVLT
Address:1025 Eldorado Blvd.
City:   Broomfield
StateProv:  CO
PostalCode: 80021
Country:US
NetRange:   63.208.0.0 - 63.215.255.255
CIDR:   63.208.0.0/13
REJECT all  --  63.208.0.0/130.0.0.0/0 n/a



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
 

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Why does this fail routing?

[Kevin Bilbee]

Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
  (SMTPD32-8.05) id AA05D10128; Tue, 11 May 2004 23:53:57 -0700
Received: from [80.199.82.218] ([80.199.82.218])
 by ns1.ssc-isp.net (SAVSMTP 3.1.6.45) with SMTP id M2004051123492224557
 for <[EMAIL PROTECTED]>; Tue, 11 May 2004 23:49:23 -0700
Received: from no.name.available by [80.199.82.218]
  via smtpd (for ns1.ssc-isp.net [12.9.25.242]) with ESMTP; Wed, 12
May 2004 08:54:08 +0200





Kevin Bilbee
Network Administrator
Standard Abrasives, Inc.
[EMAIL PROTECTED]
(805) 520-5800 x7332

Changing the way industry works.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] PDF counter balance

[Rick Davidson]

Can anybody point out reasons why it would be a bad idea for me to use this
line to stop filtering messages with file attachments? This is mainly for
PDF files which seem to get caught for strange reasons.

BODY END CONTAINS Content-Type: application/octet-stream

Rick Davidson
National Systems Manager
North American Title Group

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] bypasswhitelisting?

[Darin Cox]

The first one did show up...
Darin.
 
 
- Original Message - 
From: Kami 
Razvan 
To: [EMAIL PROTECTED] 

Sent: Wednesday, May 12, 2004 10:16 AM
Subject: [Declude.JunkMail] bypasswhitelisting?

-- 2nd attempt- 
sometimes postings do not show up.
 
Hi;
 
I am trying to 
understand how this works.. We have the following in the 
Global:
 
EMERGENCYBYPASS 
  bypasswhitelisting  40  2  0 
 0
 
&
in the following 
action in the default file.
 
EMERGENCYBYPASS  DELETE
 
Now..
 
We have one person 
in a domain that has [EMAIL PROTECTED] in the address 
book.  My understanding is with the above statement if an email is scored 
40+ it will be deleted regardless of the [EMAIL PROTECTED].  Right?
 
The number of failed tests in the following 
header would have this email rated at over 100 but yet it was delivered to 
the folks that were CC'd with his email.
 
So here is a 
recent email header (anyone cares to use this IP for years to come? :) 
)
 
==
X-RBL-Warning: 
IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate 
E-mail detected.X-RBL-Warning: CMDSPACE: Space found in RCPT TO: 
command.X-RBL-Warning: AHBL-PROXIES: "Open Proxy - http://www.ahbl.org/tools/lookup.php?ip=67.170.121.54"X-RBL-Warning: 
CBL: "Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=67.170.121.54"X-RBL-Warning: 
DSBL: "http://dsbl.org/listing?ip=67.170.121.54"X-RBL-Warning: 
FIVETEN-SPAM: 54.121.170.67.blackholes.five-ten-sg.com.X-RBL-Warning: 
NJABL-DYNA: "Dynamic/Residential IP range listed by NJABL dynablock - http://njabl.org/dynablock.html"X-RBL-Warning: 
NJABL-PROXIES: "open proxy -- 1082452804"X-RBL-Warning: XBL: "http://www.spamhaus.org/query/bl?ip=67.170.121.54"X-RBL-Warning: 
SORBS-DUL: "HTTP Proxy See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SORBS-HTTP: "SOCKS Proxy See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SORBS-SOCKS: "Spam Received See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SORBS-SPAM: "Dynamic IP Address See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SPAMCOP: "Blocked - see http://www.spamcop.net/bl.shtml?67.170.121.54"X-Declude-Sender: 
[EMAIL PROTECTED] 
[67.170.121.54]X-Declude-Spoolname: Dbc16065d0264a4ff.SMDX-Note: 
==X-Note: 
Spam Score: 0 [BLOCKED ON 20+ & DELETED ON 60+]X-Note: Scan Time: 
01:54:38 on 05/12/2004X-Note: Spool File: Dbc16065d0264a4ff.SMDX-Note: 
Server Name: c-67-170-121-54.client.comcast.netX-Note: SMTP Sender: [EMAIL PROTECTED]X-Note: Reverse 
DNS & IP: c-67-170-121-54.client.comcast.net 
[67.170.121.54]
==
 
I guess the Weight 
of 0 is because of his [EMAIL PROTECTED]
 
I am just trying 
to understand if my take on this is correct or I need to refine our 
approach.
 
Regards,
-Kami
 
 

[Declude.JunkMail] bypasswhitelisting?

[Kami Razvan]

-- 2nd attempt- 
sometimes postings do not show up.
 
Hi;
 
I am trying to 
understand how this works.. We have the following in the 
Global:
 
EMERGENCYBYPASS 
  bypasswhitelisting  40  2  0 
 0
 
&
in the following 
action in the default file.
 
EMERGENCYBYPASS  DELETE
 
Now..
 
We have one person 
in a domain that has [EMAIL PROTECTED] in the address 
book.  My understanding is with the above statement if an email is scored 
40+ it will be deleted regardless of the [EMAIL PROTECTED].  Right?
 
The number of failed tests in the following 
header would have this email rated at over 100 but yet it was delivered to 
the folks that were CC'd with his email.
 
So here is a 
recent email header (anyone cares to use this IP for years to come? :) 
)
 
==
X-RBL-Warning: 
IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate 
E-mail detected.X-RBL-Warning: CMDSPACE: Space found in RCPT TO: 
command.X-RBL-Warning: AHBL-PROXIES: "Open Proxy - http://www.ahbl.org/tools/lookup.php?ip=67.170.121.54"X-RBL-Warning: 
CBL: "Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=67.170.121.54"X-RBL-Warning: 
DSBL: "http://dsbl.org/listing?ip=67.170.121.54"X-RBL-Warning: 
FIVETEN-SPAM: 54.121.170.67.blackholes.five-ten-sg.com.X-RBL-Warning: 
NJABL-DYNA: "Dynamic/Residential IP range listed by NJABL dynablock - http://njabl.org/dynablock.html"X-RBL-Warning: 
NJABL-PROXIES: "open proxy -- 1082452804"X-RBL-Warning: XBL: "http://www.spamhaus.org/query/bl?ip=67.170.121.54"X-RBL-Warning: 
SORBS-DUL: "HTTP Proxy See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SORBS-HTTP: "SOCKS Proxy See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SORBS-SOCKS: "Spam Received See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SORBS-SPAM: "Dynamic IP Address See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SPAMCOP: "Blocked - see http://www.spamcop.net/bl.shtml?67.170.121.54"X-Declude-Sender: 
[EMAIL PROTECTED] 
[67.170.121.54]X-Declude-Spoolname: Dbc16065d0264a4ff.SMDX-Note: 
==X-Note: 
Spam Score: 0 [BLOCKED ON 20+ & DELETED ON 60+]X-Note: Scan Time: 
01:54:38 on 05/12/2004X-Note: Spool File: Dbc16065d0264a4ff.SMDX-Note: 
Server Name: c-67-170-121-54.client.comcast.netX-Note: SMTP Sender: [EMAIL PROTECTED]X-Note: Reverse 
DNS & IP: c-67-170-121-54.client.comcast.net 
[67.170.121.54]
==
 
I guess the Weight 
of 0 is because of his [EMAIL PROTECTED]
 
I am just trying 
to understand if my take on this is correct or I need to refine our 
approach.
 
Regards,
-Kami
 
 

[Declude.JunkMail] bypasswhitelisting?

[Kami Razvan]

Hi;
 
I am trying to 
understand how this works.. We have the following in the 
Global:
 
EMERGENCYBYPASS 
  bypasswhitelisting  40  2  0 
 0
 
&
in the following 
action in the default file.
 
EMERGENCYBYPASS  DELETE
 
Now..
 
We have one person 
in a domain that has [EMAIL PROTECTED] in the address 
book.  My understanding is with the above statement if an email is scored 
40+ it will be deleted regardless of the [EMAIL PROTECTED].  Right?
 
The number of failed tests in the following 
header would have this email rated at over 100 but yet it was delivered to 
the folks that were CC'd with his email.
 
So here is a 
recent email header (anyone cares to use this IP for years to come? :) 
)
 
==
X-RBL-Warning: 
IPNOTINMX: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate 
E-mail detected.X-RBL-Warning: CMDSPACE: Space found in RCPT TO: 
command.X-RBL-Warning: AHBL-PROXIES: "Open Proxy - http://www.ahbl.org/tools/lookup.php?ip=67.170.121.54"X-RBL-Warning: 
CBL: "Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=67.170.121.54"X-RBL-Warning: 
DSBL: "http://dsbl.org/listing?ip=67.170.121.54"X-RBL-Warning: 
FIVETEN-SPAM: 54.121.170.67.blackholes.five-ten-sg.com.X-RBL-Warning: 
NJABL-DYNA: "Dynamic/Residential IP range listed by NJABL dynablock - http://njabl.org/dynablock.html"X-RBL-Warning: 
NJABL-PROXIES: "open proxy -- 1082452804"X-RBL-Warning: XBL: "http://www.spamhaus.org/query/bl?ip=67.170.121.54"X-RBL-Warning: 
SORBS-DUL: "HTTP Proxy See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SORBS-HTTP: "SOCKS Proxy See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SORBS-SOCKS: "Spam Received See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SORBS-SPAM: "Dynamic IP Address See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=67.170.121.54"X-RBL-Warning: 
SPAMCOP: "Blocked - see http://www.spamcop.net/bl.shtml?67.170.121.54"X-Declude-Sender: 
[EMAIL PROTECTED] 
[67.170.121.54]X-Declude-Spoolname: Dbc16065d0264a4ff.SMDX-Note: 
==X-Note: 
Spam Score: 0 [BLOCKED ON 20+ & DELETED ON 60+]X-Note: Scan Time: 
01:54:38 on 05/12/2004X-Note: Spool File: Dbc16065d0264a4ff.SMDX-Note: 
Server Name: c-67-170-121-54.client.comcast.netX-Note: SMTP Sender: [EMAIL PROTECTED]X-Note: Reverse 
DNS & IP: c-67-170-121-54.client.comcast.net 
[67.170.121.54]
==
 
I guess the Weight 
of 0 is because of his [EMAIL PROTECTED]
 
I am just trying 
to understand if my take on this is correct or I need to refine our 
approach.
 
Regards,
-Kami
 
 

Re: [Declude.JunkMail] countmein.com

[Darrell]

There is several reports on NANAE (some very recent most from 2003) -
http://groups.google.com/groups?hl=en&lr=&q=countmein.com&meta=group%3Dnews.admin.net-abuse.sightings

Here is a link to more info specifically (by the same folks that email you)
http://groups.google.com/groups?q=countmein.com+group:news.admin.net-abuse.sightings&hl=en&lr=&group=news.admin.net-abuse.sightings&scoring=d&selm=200405050545.i455j4ko011765%40send.it.helsinki.fi&rnum=1

Darrell

-
Check out http://www.invariantsystems.com for utilities for Declude and Imail.


Quoting Dan Patnode <[EMAIL PROTECTED]>:

> The Institute of Biotechnology, University of Helsinki Finland just sent my
> abuse line a report suggesting a new client of mine is a spammer.  I'm not
> in the business of protecting these guys from each other.
> 
> Has anyone heard of countmein.com as a spammer?
> 
> 
> 
> 
> 
> 
> Here's the report if you're curious:
> 
> 
> 
> $ host www.countmein.com
> www.countmein.com   CNAME   countmein.com
> countmein.com   A   66.150.173.180
> 
> Blue Gecko, Inc. PNAP-SEF-BLUGKO-RM-01 (NET-66-150-173-176-1)
>   66.150.173.176 - 66.150.173.191
> 
> There never was a reply from Blue Gecko to spam complaints related to
> Count Me In Corporation, so
> 
> REJECT all  --  66.150.173.176/280.0.0.0/0 n/a
> 
> $ host www.countmeincorp.com
> www.countmeincorp.com   A   212.118.243.114
> 
> 
> 
> 
> Only a week ago (May 4) it was on [64.74.96.249].  Could it really be
> that eNom got fed up with you?  On the other hand, Internap seems
> quite happy to wiggle you around.
> 
> inetnum:  212.118.224.0 - 212.118.255.255
> org:  ORG-INSU1-RIPE
> netname:  UK-INTERNAP-2530
> descr:PROVIDER
> country:  GB
> 
> I won't even discuss Internap.  You just cost the following to all
> their other customers in the same network:
> 
> REJECT all  --  212.118.224.0/19 0.0.0.0/0 n/a
> 
> 
> 
> 
> $ host -t mx countmein.com
> countmein.com   MX  20 mx2.spamsoap.com
> countmein.com   MX  30 mx3.spamsoap.com
> countmein.com   MX  10 mx1.spamsoap.com
> 
> _That_, my dear audience, is the definition of "ludicrous."  There it is.
> 
> The professional spammer Count Me In Corporation has outsourced its
> incoming mail handling to a spam filtering business.
> 
> $ host -t mx countmeincorp.com
> countmeincorp.com   MX  10 mx.countmeincorp.com
> $ host mx.countmeincorp.com
> mx.countmeincorp.comA   63.229.26.240
> 
> 
> 
> $ host cmiservices.biz
> cmiservices.biz A   12.129.237.252
> 
> AT&T WorldNet Services ATT (NET-12-0-0-0-1)
>   12.0.0.0 - 12.255.255.255
> CERFnet ATTENS-LAX1-1 (NET-12-129-192-0-1)
>   12.129.192.0 - 12.129.255.255
> iPowerWeb ATTENS-008161-002508 (NET-12-129-237-0-1)
>   12.129.237.0 - 12.129.237.255
> 
> REJECT all  --  12.129.237.0/24  0.0.0.0/0 n/a
> 
> $ host countmein.wc09.net
> countmein.wc09.net  A   63.214.0.227
> 
> OrgName:Level 3 Communications, Inc.
> OrgID:  LVLT
> Address:1025 Eldorado Blvd.
> City:   Broomfield
> StateProv:  CO
> PostalCode: 80021
> Country:US
> 
> NetRange:   63.208.0.0 - 63.215.255.255
> CIDR:   63.208.0.0/13
> 
> REJECT all  --  63.208.0.0/130.0.0.0/0 n/a
> 
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 


-
Check out http://www.invariantsystems.com for utilities for Declude and Imail 
Products.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] countmein.com

[Dan Patnode]

The Institute of Biotechnology, University of Helsinki Finland just sent my
abuse line a report suggesting a new client of mine is a spammer.  I'm not
in the business of protecting these guys from each other.

Has anyone heard of countmein.com as a spammer?






Here's the report if you're curious:



$ host www.countmein.com
www.countmein.com   CNAME   countmein.com
countmein.com   A   66.150.173.180

Blue Gecko, Inc. PNAP-SEF-BLUGKO-RM-01 (NET-66-150-173-176-1)
  66.150.173.176 - 66.150.173.191

There never was a reply from Blue Gecko to spam complaints related to
Count Me In Corporation, so

REJECT all  --  66.150.173.176/280.0.0.0/0 n/a

$ host www.countmeincorp.com
www.countmeincorp.com   A   212.118.243.114




Only a week ago (May 4) it was on [64.74.96.249].  Could it really be
that eNom got fed up with you?  On the other hand, Internap seems
quite happy to wiggle you around.

inetnum:  212.118.224.0 - 212.118.255.255
org:  ORG-INSU1-RIPE
netname:  UK-INTERNAP-2530
descr:PROVIDER
country:  GB

I won't even discuss Internap.  You just cost the following to all
their other customers in the same network:

REJECT all  --  212.118.224.0/19 0.0.0.0/0 n/a




$ host -t mx countmein.com
countmein.com   MX  20 mx2.spamsoap.com
countmein.com   MX  30 mx3.spamsoap.com
countmein.com   MX  10 mx1.spamsoap.com

_That_, my dear audience, is the definition of "ludicrous."  There it is.

The professional spammer Count Me In Corporation has outsourced its
incoming mail handling to a spam filtering business.

$ host -t mx countmeincorp.com
countmeincorp.com   MX  10 mx.countmeincorp.com
$ host mx.countmeincorp.com
mx.countmeincorp.comA   63.229.26.240



$ host cmiservices.biz
cmiservices.biz A   12.129.237.252

AT&T WorldNet Services ATT (NET-12-0-0-0-1)
  12.0.0.0 - 12.255.255.255
CERFnet ATTENS-LAX1-1 (NET-12-129-192-0-1)
  12.129.192.0 - 12.129.255.255
iPowerWeb ATTENS-008161-002508 (NET-12-129-237-0-1)
  12.129.237.0 - 12.129.237.255

REJECT all  --  12.129.237.0/24  0.0.0.0/0 n/a

$ host countmein.wc09.net
countmein.wc09.net  A   63.214.0.227

OrgName:Level 3 Communications, Inc.
OrgID:  LVLT
Address:1025 Eldorado Blvd.
City:   Broomfield
StateProv:  CO
PostalCode: 80021
Country:US

NetRange:   63.208.0.0 - 63.215.255.255
CIDR:   63.208.0.0/13

REJECT all  --  63.208.0.0/130.0.0.0/0 n/a



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.