RE: [Declude.JunkMail] Latest Spam Tests

[Colbeck, Andrew]

Well, Glen, there's a LOT more that you could be doing.  I see that you've
only put forward the names of built-in tests and IP4R tests.  Do you have
Declude Junkmail Lite, Standard or Pro?  And have you upgraded to the
current version of the declude.exe application?

The manual is here: http://www.declude.com/Articles.asp?ID=116

Regarding your built-in tests, 

I'd suggest you look at adding:

CMDSPACEWARN
CONTSPACES  WARN
COUNTRY LOG
IPNOTINMX   LOG
LONGSUBJECT WARN

CMDSPACE and CONTSPACES are good but you'll have to beware of false
positives; as an ISP, you in particular may have problems with CMDSPACE and
(I believe) your own clients using Outlook Express.  Someone else here may
have a pointer about using it safely, perhaps with the "WHITELIST AUTH"
directive in your global.cfg (I'm going from memory here; I don't have that
particular issue).

COUNTRY is quite good at adding weight based the country the message
originated in.  Quite handy if you were a business that gets no legitimate
mail from Singapore or Korea or Brazil.


As for your existing IP4R tests, check
http://www.declude.com/Articles.asp?ID=97&Redirected=Y for a long list of
what's available and how to configure them.

I see that you are using CBL, but not SBL or XBL.  Check out
http://www.spamhaus.org and replace your CBL with a SBL and XBL line.  Your
users will thank you.  CBL is incorporated in XBL along with two other
lists, and the source has a lower latency than CBL.  SBL is just plain good.

I see that you have one test called REYNOLDS*.  Note that all the Reynolds
tests have gone away and been replaced by ones at DNSBL.Net.Au ... since
this is an Australian ISP, you may find their various lists far most useful
than I found them, and your latency should be much lower.

As with Reynolds, check out SORBS.  You're only using 3 tests, but you may
find that with a low latency, it's worth running more of them.

I see that you're running SPAMDOMAINS; you could probably gain from using
the latest; search the archives at
http://www.mail-archive.com/declude.junkmail@declude.com/ for the latest
SD.txt and related material.


Notes on external tests:

You only listed one Sniffer test, so I'm guessing that you are running the
demo version.  Do yourself a favour and instead of specifying "nonzero" as
the return value, make 3 tests with 3 names, and use the 63, 55, and 60 as
the values.  Declude is smart enough that it doesn't actually run the test 3
times, it just compares each test against the return value.  See this for
what these return values do:
http://www.sortmonster.com/MessageSniffer/Help/ResultCodesHelp.html and at a
US $1/day, consider getting the whole enchilada.  I suggest setting your
action for 55 to HOLD, and I seldom do that.  If your server(s) are already
working hard, you should also check out the nifty new ability of Sniffer to
do "persistent mode".  See the website for details.  Your processors will
thank you.


Notes on counterweight tests:

I see that you're using both SPFFAIL and SPFPASS; don't go crazy with too
low a "reward weight" for SPFPASS.  No trojan'ed zombie hosts are going to
use SPF, but the kind of dyed-in-the-wool spammers on SBL certainly do.  If
you lean on SPFPASS to help negatively weight good mail, you're helping
these spammers too.  Most of the vocal subscribers on this list don't use
SPFPASS at all.

To help reward the good guys, you might find useful the tests at:
http://www.trusted-forwarder.org/ which is designed to complement the SPF
tests (fwiw, they are not listed on that Declude web page of DNS based
tests).

Likewise, check out http://www.ahbl.org and on their Services page, check
out Exemptions.

Likewise, check out BondedSender from that Declude web page of DNS based
tests.


For tests that have good bang-for-your-buck to catch spam:

Check out AHBL for good spam tests, too.

Check out FIVETEN.
Check out MAILPOLICE.
Check out NJABL.
Check out SENDERDB.


Andrew 8)

p.s. Hey, mail-archive.com just got a facelift and has caught up on it's
backlog!

p.p.s. Since I wrote a different screed on getting up-to-date with your
Declude configuration recently, you can read that here:
http://www.mail-archive.com/declude.junkmail@declude.com/msg21880.html



-Original Message-
From: Glen Harvy [mailto:[EMAIL PROTECTED] 
Sent: Sunday, November 07, 2004 9:07 PM
To: Declude Junkmail
Subject: [Declude.JunkMail] Latest Spam Tests
Importance: High


Hi,

I'm about to review/update my spam tests which currently are:

BASE64 WARN
CBL WARN
COMMENTS WARN
DSBL WARN
MYFILTERS WARN X-Warning: This E-mail failed Spam filters
ORDB WARN
REYNOLDSRSMT WARN
SORBS-NOMAIL WARN
SORBS-SMTP WARN
SORBS-SPAM WARN
SPAMCOP WARN
DSN WARN
NOABUSE WARN
NOPOSTMASTER WARN
BADHEADERS WARN
HELOBOGUS WARN
MAILFROM WARN
PERCENT WARN
REVDNS WARN
ROUTING WARN
SPAMHEADERS WARN 
SPAMDOMAINS WARN
SPFPASS WARN
SPFFAIL WARN
BLACKLIST WARN
SNIFFER WARN

Can someone be king enough to share their's and/or comment on mine.

Thanks

Re: [Declude.JunkMail] Latest Spam Tests

[Pete McNeil]

I highly recommend you review this site as part of your planning:



_M

On Monday, November 8, 2004, 12:07:25 AM, Glen wrote:

GH> Hi,

GH> I'm about to review/update my spam tests which currently are:

GH> BASE64 WARN
GH> CBL WARN
GH> COMMENTS WARN
GH> DSBL WARN
GH> MYFILTERS WARN X-Warning: This E-mail failed Spam filters
GH> ORDB WARN
GH> REYNOLDSRSMT WARN
GH> SORBS-NOMAIL WARN
GH> SORBS-SMTP WARN
GH> SORBS-SPAM WARN
GH> SPAMCOP WARN
GH> DSN WARN
GH> NOABUSE WARN
GH> NOPOSTMASTER WARN
GH> BADHEADERS WARN
GH> HELOBOGUS WARN
GH> MAILFROM WARN
GH> PERCENT WARN
GH> REVDNS WARN
GH> ROUTING WARN
GH> SPAMHEADERS WARN 
GH> SPAMDOMAINS WARN
GH> SPFPASS WARN
GH> SPFFAIL WARN
GH> BLACKLIST WARN
GH> SNIFFER WARN

GH> Can someone be king enough to share their's and/or comment on mine.

GH> Thanks,
GH> _
GH> Glen Harvy
GH> Aquarius Communications
GH> for all your Internet Needs.
GH> Phone 9977 3788 Fax 9977 3844 
GH> ---
GH> [This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

GH> ---
GH> This E-mail came from the Declude.JunkMail mailing list.  To
GH> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
GH> type "unsubscribe Declude.JunkMail".  The archives can be found
GH> at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Latest Spam Tests

[Glen Harvy]

Hi,

I'm about to review/update my spam tests which currently are:

BASE64 WARN
CBL WARN
COMMENTS WARN
DSBL WARN
MYFILTERS WARN X-Warning: This E-mail failed Spam filters
ORDB WARN
REYNOLDSRSMT WARN
SORBS-NOMAIL WARN
SORBS-SMTP WARN
SORBS-SPAM WARN
SPAMCOP WARN
DSN WARN
NOABUSE WARN
NOPOSTMASTER WARN
BADHEADERS WARN
HELOBOGUS WARN
MAILFROM WARN
PERCENT WARN
REVDNS WARN
ROUTING WARN
SPAMHEADERS WARN 
SPAMDOMAINS WARN
SPFPASS WARN
SPFFAIL WARN
BLACKLIST WARN
SNIFFER WARN

Can someone be king enough to share their's and/or comment on mine.

Thanks,
_
Glen Harvy
Aquarius Communications
for all your Internet Needs.
Phone 9977 3788 Fax 9977 3844 
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] OT: Maps of Spam, Viruses, and Dictionary harvest attacks.

[Dave Doherty]

...South America, also, and most of Asia, as well.
I think this just shows that the virus generators are sophisticated enough 
to cover their tracks well by using zombies in the US.

-d

- Original Message - 
From: "Mark E. Smith" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, November 07, 2004 7:01 PM
Subject: RE: [Declude.JunkMail] OT: Maps of Spam, Viruses, and Dictionary 
harvest attacks.


Also, it could be that their ARIN IP numbers are off.
For example, UUNet might be servicing WANs in one country with IP 
allotments
from another...
Not sure if that's possibly but it could be.


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Sunday, November 07, 2004 4:17 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] OT: Maps of Spam, Viruses,
and Dictionary harvest attacks.
Wow! Practically no viruses from Europe?! Can't be true.
For my understanding the geolocation for spam and dictionary
attacks in middle europe is not very exact as several cities
like Milano (Italy), Frankfurt and Hamburg (Germany) are
missing completely and I can't believe they have better or
other computer systems and operators as other europeans.
For me it seems more like a marketing gag.
Markus

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
Mark E. Smith
> Sent: Sunday, November 07, 2004 9:30 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] OT: Maps of Spam, Viruses, and
Dictionary
> harvest attacks.
>
> Interesting maps by Postini that illuminate the
geographical origins
> of spam, viruses and directory harvest attacks.
>
> Map shortcuts:
>
> Spam
> http://postini.com/stats/world-spam-2048.jpg
>
> Viruses
> http://postini.com/stats/world-virus-2048.jpg
>
> Directory harvest attacks
> http://postini.com/stats/world-dict-2048.jpg
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
>
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be
found at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Maps of Spam, Viruses, and Dictionary harvest attacks.

[Mark E. Smith]

Also, it could be that their ARIN IP numbers are off.
For example, UUNet might be servicing WANs in one country with IP allotments
from another...
Not sure if that's possibly but it could be.


> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
> Sent: Sunday, November 07, 2004 4:17 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] OT: Maps of Spam, Viruses,
> and Dictionary harvest attacks.
>
>
> Wow! Practically no viruses from Europe?! Can't be true.
>
> For my understanding the geolocation for spam and dictionary
> attacks in middle europe is not very exact as several cities
> like Milano (Italy), Frankfurt and Hamburg (Germany) are
> missing completely and I can't believe they have better or
> other computer systems and operators as other europeans.
>
> For me it seems more like a marketing gag.
>
> Markus
>
>
>
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] On Behalf Of
> Mark E. Smith
> > Sent: Sunday, November 07, 2004 9:30 PM
> > To: [EMAIL PROTECTED]
> > Subject: [Declude.JunkMail] OT: Maps of Spam, Viruses, and
> Dictionary
> > harvest attacks.
> >
> > Interesting maps by Postini that illuminate the
> geographical origins
> > of spam, viruses and directory harvest attacks.
> >
> > Map shortcuts:
> >
> > Spam
> > http://postini.com/stats/world-spam-2048.jpg
> >
> > Viruses
> > http://postini.com/stats/world-virus-2048.jpg
> >
> > Directory harvest attacks
> > http://postini.com/stats/world-dict-2048.jpg
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> > "unsubscribe Declude.JunkMail".  The archives can be found at
> > http://www.mail-archive.com.
> >
> >
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be
> found at http://www.mail-archive.com.
>


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] OT: Maps of Spam, Viruses, and Dictionary harvest attacks.

[Markus Gufler]

Wow! Practically no viruses from Europe?! Can't be true.

For my understanding the geolocation for spam and dictionary attacks in
middle europe is not very exact as several cities like Milano (Italy),
Frankfurt and Hamburg (Germany) are missing completely and I can't believe
they have better or other computer systems and operators as other europeans.

For me it seems more like a marketing gag.

Markus



> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Mark E. Smith
> Sent: Sunday, November 07, 2004 9:30 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] OT: Maps of Spam, Viruses, and 
> Dictionary harvest attacks.
> 
> Interesting maps by Postini that illuminate the geographical 
> origins of spam, viruses and directory harvest attacks.
> 
> Map shortcuts:
> 
> Spam
> http://postini.com/stats/world-spam-2048.jpg
> 
> Viruses
> http://postini.com/stats/world-virus-2048.jpg
> 
> Directory harvest attacks
> http://postini.com/stats/world-dict-2048.jpg
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
> 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] OT: Maps of Spam, Viruses, and Dictionary harvest attacks.

[Mark E. Smith]

Interesting maps by Postini that illuminate the geographical origins of
spam, viruses and directory harvest attacks.

Map shortcuts:

Spam
http://postini.com/stats/world-spam-2048.jpg

Viruses
http://postini.com/stats/world-virus-2048.jpg

Directory harvest attacks
http://postini.com/stats/world-dict-2048.jpg


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Suggestion: Most "stringent" test

[Rick Davidson]

Try this in your global config file, it will cause an email to be 
unwhitelisted and go through the testing process

BYPASSWHITELIST   bypasswhitelist  x y 0 0
where x is the weight you want to assign
where y is the amount of recipients required to skip the whitelist
no setting is required in $default$.junkmail
works wonders for me
Rick Davidson
National Systems Manager
North American Title Group
-
- Original Message - 
From: "marc catuogno" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, November 06, 2004 5:38 PM
Subject: [Declude.JunkMail] Suggestion: Most "stringent" test

Or some other name if it is possible -
I'd like to stop e-mails from being whitelisted because my users have their
own name in their address book and someone sends to multiple people as one
of my users.  Also I'd like to stop e-mails being delivered to multiple
recipients because one person has the sender in their address book.  SO
maybe if there are multiple recipients maybe there could be a test in
Declude that causes the most restrictive action (hold, delete, etc) instead
of the least restrictive (whitelist) action.  This way the user can still
get e-mails from [EMAIL PROTECTED] if it is sent directly, but if some
idiot tries to use this to get around blocks by sending to a list of address
it will be deleted.  Is this possible?  Is there something like this?
Thanks - Marc
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] LOG Levels

[Bill Landry]

Andrew, thanks for sharing your scripts, however, I would bet that few list
member will actually see them.

Log entries:
==
11/07/2004 01:00:46 Qe43e56af00464c1b MIME file: Scripts.zip [base64;
Length=5925 Checksum=655492]
11/07/2004 01:00:46 Qe43e56af00464c1b Banning .ZIP file with cmd extension.
11/07/2004 01:00:47 Qe43e56af00464c1b Scanned: Banned file extension. [MIME:
2 11189]
11/07/2004 01:00:47 Qe43e56af00464c1b From:
[EMAIL PROTECTED] To: [EMAIL PROTECTED]
11/07/2004 01:00:47 Qe43e56af00464c1b Subject: RE: [Declude.JunkMail] LOG
Levels
==

I just happened to retrieve the Q&D files from of my virus folder so I could
view the message.  For future reference, it's best to change the extension
of .cmd files to .txt for delivery, with a note to recipients to change the
extension back to .cmd once they have received the message.

Bill

- Original Message - 
From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, November 07, 2004 12:55 AM
Subject: RE: [Declude.JunkMail] LOG Levels


> Hey, fun-seekers, I was feeling left out.
>
> Necessity being the mother of invention, I cobbled a bunch of scripts
> together that I find useful.  I just extended one a bit to do what Serge
was
> looking for.
>
> I make good use of the GNU Utilities that Bill has advised us on.  Thanks,
> Bill!
>
> Often, I just care about the weight lines, or the from lines, or the
subject
> lines, so I've got 3 scripts that pull just those lines out into
weight.txt,
> from.txt and subject.txt, and just because, another one called build3.cmd
> that builds all three of those files.  The count is output; the
discrepancy
> between the line counts is based on the repetition of lines in the log
when
> there are multiple recipients.
>
> There's a 4th script that I don't use much, called Action, that does a
count
> of the actions I care about.  I'm including a script that Bill put forward
> here, called MessagesPerHour that does what you'd expect.  I use it for
> those "are we getting a lot of mail" questions.
>
> I found that for "Help Desk calls", it was usually a matter of finding:
>
> "User X reports that they don't get email from [garbled name]"
>
> or
>
> "Company X reports that some of their mail doesn't get to our users"
>
> So I took the next step and wrote: ShowFrom and ShowTo.  They do what
you'd
> expect; they filter the From: lines, but these scripts go the next step as
> well and show you the Last Action for each of those messages too, and put
> that action early in the columns so that they're easy to spot.
>
> For Serge, I added: ShowAll, which will take some snippet of a Declude
log,
> and based on the Q column, will find all other lines in a different
file
> (presumably the full decMMDD.log).
>
> Saving the output of a ShowTo and using it as input to ShowAll would be
> quite useful.
>
> Likewise, for work on new or old tests, I have ShowWeight.  It outputs the
> Total Weight lines, where they include a certain test like SORBS.  Because
I
> take the command line as input for the gnutils, it's regexp friendly (YMMV
> ... I always use capitals).  You can add an extra parameter to this one
that
> specifies the action, which lets you, say, find all lines that matched
> SPAMCOP for which the action was IGNORE.
>
> I also use 2 little batch files that call textpad (my preferred text
editor)
> with a D*.SMD value, and copy the ?*.SMD files from the spam folder back
to
> the queue.  They work for me because I simply mouse the "*" part right off
> the screen of my command line session.  I tell myself that I'll get around
> to parsing the input, and taking the right action if a whole Qx is
> passed instead of the  part... they're called T and Q.
>
> Lastly, I should mention that I find it too slow to work on the files at
the
> server, and too slow to work on them over a file share, so I pull them
over
> to a temp folder on my desktop with RoboCopy from the Microsoft Windows
> Server Resource Kit.  So I've got two scripts that parse the date and pull
> down the correct decMMDD.log (or sysMMDD.txt) for today, and another for
> yesterday.  They're called Today and Yesterday :)
>
> Enjoy!
>
> Andrew 8)
>
> -Original Message-
> From: Bill Landry [mailto:[EMAIL PROTECTED]
> Sent: Saturday, November 06, 2004 3:27 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] LOG Levels
>
>
> - Original Message - 
> From: "Serge" <[EMAIL PROTECTED]>
>
> > Sorry, i may not expressed myself
> >
> > I need to
> > grep %variable% ...
> >
> > Where the variable takes all the values generated by the first grep:
> > grep "MAIL FROM:[EMAIL PROTECTED]" D:\log1104.txt | gawk "{print $5}"
> > |
> uniq
> >
> > Should i use some kind of
> > FOR instruction in a Windows batch file ?
> > Or is there a way to achieve that in unix util ?
> >
> > Suppose the first grep gives
> > (71c80106004a8af1)
> > (7202010b004a8b02)
> > (7206010d004a8b05)
> > (72b70136004a8b35)
> > (72f300fb004c8b48)
> >