[Declude.JunkMail] ENDing surbl filter file
I've seen an initial line: BODYEND NOTCONTAINS http: in Kami's body filterfiles. It seems to be a good idea even if I'm not sure if it will not let slip trough messages containing simple www. URLs. If this would not create any problem it would be also very usefull to use it in our surbl filter files. I've added the following line echo BODY END NOTCONTAINS http: surbl.filter.tmp in Roger Eriksson's surbl_filter.cmd version 1.0 (line 58) Any suggestions, drawback's ? It would be very usefull if we could END if NO http: AND NO www. is part of the message body. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Large attachment -- black hole
I have a user that was sent a 10mb attachment. They report that it was kicked back to the sender saying max message size exceeded. This domain doesn't have a max message size set, nor does the particular user, nor does he have a max MAILBOX size. In the logs, I am seeing something very strange: SMTPD (b07e000b01ca61ae) [64.4.56.32 (bay101-f22.bay101.hotmail.com) ] EHLO hotmail.com SMTPD (b07e000b01ca61ae) [64.4.56.32 (bay101-f22.bay101.hotmail.com) ] MAIL FROM:[EMAIL PROTECTED] SMTPD (b07e000b01ca61ae) [64.4.56.32 (bay101-f22.bay101.hotmail.com) ] RCPT TO:[EMAIL PROTECTED] SMTP (b07e000b01ca61ae) processing S:\imail\spool\Qb07e000b01ca61ae.SMD There is about a 30 minute difference in the timestamps on the last two lines. These are ALL the lines containing the queue number. The log file seems incomplete, because on every incoming connection, I usually get first a connect REMOTEIP (REMOTE_SERVER) port PORTNO line, followed by the ehlo, mail from, rcpt to. Then I usually get a spoolfilepath line after the rcpt to. Then I usually get Imail's performing antispam checks before the processing line, even though I have completely disabled all of Imail's antispam features. So some lines seem to be missing. After that is where it passes off to Declude, and Declude reports that its last action was IGNORE on this message (My logs are on HIGH, so I won't post the whole thing, just the last line, but all expected lines are there): 11/23/2004 17:19:08 Qb07e000b01ca61ae Last action = IGNORE. But there is no further mention of the queue number in the Imail logs. Did Declude bomb while passing back to Imail? Or did Imail drop the ball? How can I tell? I'm almost sure this isn't a hardware issue, because we are pretty seriously overpowered for our current mail volume (less than 30K/day) with a dual 2.4 Xeon w/ HT enabled, gig RAM, SCSI 15Krpm drives, separate physical mirrors for system/mailboxes/spool, defragged daily. I mean we aren't even pushing this thing yet. Dan Horne Web Services Administrator TAIS Web Wilcox World Travel Tours [EMAIL PROTECTED] CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. SPAM-FREE 1.0(2476) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude 2.0
It pays to be patient http://www.declude.com/Articles.asp?ID=122 2.00 [Beta testing - Available soon] FIX Fixes an issue where Declude could use an IP address in the E-mail body, if no IP appeared in the E-mail headers. FIX Ensures correct identification of message subject AV ADD Adds support for %REVDNS% variable to show reverse DNS entry of remote mailserver JM FIX Changes DELETE action to only delete the E-mail for recipients using the DELETE action (so it will deliver to any other recipients) JM FIX Changes logging so that all log file entries for a given E-mail will be grouped together. JM ADD Changes HOLDaction so that users can specify the directory to hold spam in. HI ADD Adds support for event logging to Declude Hijack. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] ENDing surbl filter file
One of the current spam tricks (coming from zombies, I think) is to not use the www. or the http:; here are two examples: uhpvoegq.portable7attachable[munged].info irzvu.adventist7announcer[munged].info and this next technique has become popular, and the messages are so similar it has to be the same spam gang: ___copypÅste _lInk_bew_low Ín your_brower_ jp.gny.roliosaa.com/ at some point recently the bad guys realized that their text indicating the instructions for pasting the link were themselves trappable text, they've moved to the extreme obfuscation indicated above. As a third example, I've seen the bad guys use http:\\ or with just one / or inserting a space in the URL with paste instructions. Sometimes it's heard to tell if it's genius at finding stuff that still works in Internet Explorer, or just broken typing on their part. So... I don't know how antispam software in general is adapting to those anti-SURBL (or just anti-filtering) techniques, but the short of is that your optimization is a good idea to save mail processing time, but not against at least one spam gang. Andrew 8) -Original Message- From: Markus Gufler [mailto:[EMAIL PROTECTED] Sent: Monday, December 06, 2004 5:50 AM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [Declude.JunkMail] ENDing surbl filter file I've seen an initial line: BODYEND NOTCONTAINS http: in Kami's body filterfiles. It seems to be a good idea even if I'm not sure if it will not let slip trough messages containing simple www. URLs. If this would not create any problem it would be also very usefull to use it in our surbl filter files. I've added the following line echo BODY END NOTCONTAINS http: surbl.filter.tmp in Roger Eriksson's surbl_filter.cmd version 1.0 (line 58) Any suggestions, drawback's ? It would be very usefull if we could END if NO http: AND NO www. is part of the message body. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Large attachment -- black hole
I have a user that was sent a 10mb attachment. They report that it was kicked back to the sender saying max message size exceeded. This domain doesn't have a max message size set, nor does the particular user, nor does he have a max MAILBOX size. In the logs, I am seeing something very strange: SMTPD (b07e000b01ca61ae) [64.4.56.32 (bay101-f22.bay101.hotmail.com) ] EHLO hotmail.com SMTPD (b07e000b01ca61ae) [64.4.56.32 (bay101-f22.bay101.hotmail.com) ] MAIL FROM:[EMAIL PROTECTED] SMTPD (b07e000b01ca61ae) [64.4.56.32 (bay101-f22.bay101.hotmail.com) ] RCPT TO:[EMAIL PROTECTED] SMTP (b07e000b01ca61ae) processing S:\imail\spool\Qb07e000b01ca61ae.SMD There is about a 30 minute difference in the timestamps on the last two lines. These are ALL the lines containing the queue number. That is unusual. There definitely should have been a connect line. Note, however, that if this was at the beginning of the day (~12:00AM to 12:05AM), it could be that the connect line was in the previous log file. The log file seems incomplete, because on every incoming connection, I usually get first a connect REMOTEIP (REMOTE_SERVER) port PORTNO line, followed by the ehlo, mail from, rcpt to. Then I usually get a spoolfilepath line after the rcpt to. Then I usually get Imail's performing antispam checks before the processing line, even though I have completely disabled all of Imail's antispam features. So some lines seem to be missing. That too is unusual -- from the information so far, I would normally suspect that IMail mishandled the E-mail, and didn't pass it on to Declude. But since there are Declude log file entries, Declude did indeed scan it. After that is where it passes off to Declude, and Declude reports that its last action was IGNORE on this message (My logs are on HIGH, so I won't post the whole thing, just the last line, but all expected lines are there): 11/23/2004 17:19:08 Qb07e000b01ca61ae Last action = IGNORE. How does this time compare to the IMail log file times? Was there a long delay in the Declude processing of the E-mail? But there is no further mention of the queue number in the Imail logs. Did Declude bomb while passing back to Imail? Or did Imail drop the ball? How can I tell? Unfortunately, it isn't easy to tell. The Last action = IGNORE *should* mean that Declude ended up successfully passing the E-mail to IMail. But there is a very slight chance that something could have gone wrong after Declude logged that entry and before Declude passed the E-mail to IMail. You might want to try searching your hard drive for the Db07e000b01ca61ae.SMD file, to see if it is there somewhere. If Declude couldn't pass the E-mail on to IMail, the Db07e000b01ca61ae.SMD file should be in the \IMail\spool directory (but if that is the case, IMail should have delivered it within 1-2 hours later). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Ipowerweb
Any one have any opinions on them? I have on the different servers I work on seen many spam messages from servers on the Ipowerweb network. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] ZIP files
I am blocking zip files in the virus filterbut I have one customer who really needs to use them without renaming files...is there a way to have one customers not looked at for a particular virus or all viruses..or is there a way that zip files can be filtered with a spam rule... Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Ipowerweb
Amazing that you send this today. We just got a new development customer today that is hosted with them. Don't know much about iPowerWeb yet, but I'll be talking to them over the next day or two to get the customer's site straightened out and will let you know if I find out anything interesting. Darin. - Original Message - From: John Tolmachoff (Lists) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 06, 2004 1:39 PM Subject: [Declude.JunkMail] Ipowerweb Any one have any opinions on them? I have on the different servers I work on seen many spam messages from servers on the Ipowerweb network. John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ZIP files
Afraid not. With Virus it's all or nothing...no domain or user-specific configurations, though that has been requested. Darin. - Original Message - From: Richard Farris [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 06, 2004 2:53 PM Subject: [Declude.JunkMail] ZIP files I am blocking zip files in the virus filterbut I have one customer who really needs to use them without renaming files...is there a way to have one customers not looked at for a particular virus or all viruses..or is there a way that zip files can be filtered with a spam rule... Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] ENDing surbl filter file
On Monday, December 6, 2004, 10:50:19 AM, Andrew wrote: snip/ CA So... I don't know how antispam software in general is adapting to those CA anti-SURBL (or just anti-filtering) techniques, but the short of is that CA your optimization is a good idea to save mail processing time, but not CA against at least one spam gang. I love it when they do things like this. We simply code for the structure of their obfuscation and frequently this is enough to capture whole families of new campaigns. ... what is it that Scotty said about the hyperwarp drive as he was handing parts to McCoy... The more they rethink the plumbing, the easier it is to stop up the works... A good argument for a diversified approach to spam filtering is that one mechanism often creates countermeasures that can be exploited by another. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] ZIP files
Requested like forever ago.. Or. how about an Attach Filter for Junkmail ? this would solve the delima :-) - Original Message - From: Darin Cox [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 06, 2004 4:17 PM Subject: Re: [Declude.JunkMail] ZIP files Afraid not. With Virus it's all or nothing...no domain or user-specific configurations, though that has been requested. Darin. - Original Message - From: Richard Farris [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, December 06, 2004 2:53 PM Subject: [Declude.JunkMail] ZIP files I am blocking zip files in the virus filterbut I have one customer who really needs to use them without renaming files...is there a way to have one customers not looked at for a particular virus or all viruses..or is there a way that zip files can be filtered with a spam rule... Richard Farris Ethixs Online 1.270.247. Office 1.800.548.3877 Tech Support Crossroads to a Cleaner Internet --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Large attachment -- black hole
Note, however, that if this was at the beginning of the day No, it was 5:00pm. How does this time compare to the IMail log file times? There is no delay between Imail's processing line and Declude's first entry for the email, and the whole thing scanned through Declude in less than a second. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, December 06, 2004 10:57 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Large attachment -- black hole I have a user that was sent a 10mb attachment. They report that it was kicked back to the sender saying max message size exceeded. This domain doesn't have a max message size set, nor does the particular user, nor does he have a max MAILBOX size. In the logs, I am seeing something very strange: SMTPD (b07e000b01ca61ae) [64.4.56.32 (bay101-f22.bay101.hotmail.com) ] EHLO hotmail.com SMTPD (b07e000b01ca61ae) [64.4.56.32 (bay101-f22.bay101.hotmail.com) ] MAIL FROM:[EMAIL PROTECTED] SMTPD (b07e000b01ca61ae) [64.4.56.32 (bay101-f22.bay101.hotmail.com) ] RCPT TO:[EMAIL PROTECTED] SMTP (b07e000b01ca61ae) processing S:\imail\spool\Qb07e000b01ca61ae.SMD There is about a 30 minute difference in the timestamps on the last two lines. These are ALL the lines containing the queue number. That is unusual. There definitely should have been a connect line. Note, however, that if this was at the beginning of the day (~12:00AM to 12:05AM), it could be that the connect line was in the previous log file. The log file seems incomplete, because on every incoming connection, I usually get first a connect REMOTEIP (REMOTE_SERVER) port PORTNO line, followed by the ehlo, mail from, rcpt to. Then I usually get a spoolfilepath line after the rcpt to. Then I usually get Imail's performing antispam checks before the processing line, even though I have completely disabled all of Imail's antispam features. So some lines seem to be missing. That too is unusual -- from the information so far, I would normally suspect that IMail mishandled the E-mail, and didn't pass it on to Declude. But since there are Declude log file entries, Declude did indeed scan it. After that is where it passes off to Declude, and Declude reports that its last action was IGNORE on this message (My logs are on HIGH, so I won't post the whole thing, just the last line, but all expected lines are there): 11/23/2004 17:19:08 Qb07e000b01ca61ae Last action = IGNORE. How does this time compare to the IMail log file times? Was there a long delay in the Declude processing of the E-mail? But there is no further mention of the queue number in the Imail logs. Did Declude bomb while passing back to Imail? Or did Imail drop the ball? How can I tell? Unfortunately, it isn't easy to tell. The Last action = IGNORE *should* mean that Declude ended up successfully passing the E-mail to IMail. But there is a very slight chance that something could have gone wrong after Declude logged that entry and before Declude passed the E-mail to IMail. You might want to try searching your hard drive for the Db07e000b01ca61ae.SMD file, to see if it is there somewhere. If Declude couldn't pass the E-mail on to IMail, the Db07e000b01ca61ae.SMD file should be in the \IMail\spool directory (but if that is the case, IMail should have delivered it within 1-2 hours later). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] ENDing surbl filter file
I believe it was the more they OVERTAKE the plumbing, the easier it is to stop up the drain Oh geez I need a life -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Monday, December 06, 2004 4:23 PM To: Colbeck, Andrew Subject: Re[2]: [Declude.JunkMail] ENDing surbl filter file On Monday, December 6, 2004, 10:50:19 AM, Andrew wrote: snip/ CA So... I don't know how antispam software in general is adapting to those CA anti-SURBL (or just anti-filtering) techniques, but the short of is that CA your optimization is a good idea to save mail processing time, but not CA against at least one spam gang. I love it when they do things like this. We simply code for the structure of their obfuscation and frequently this is enough to capture whole families of new campaigns. ... what is it that Scotty said about the hyperwarp drive as he was handing parts to McCoy... The more they rethink the plumbing, the easier it is to stop up the works... A good argument for a diversified approach to spam filtering is that one mechanism often creates countermeasures that can be exploited by another. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
