Re: [Declude.JunkMail] OT: ldap2aliases error

2005-07-26 Thread System Administrator
on 7/25/05 5:11 PM, Sanford Whiteman wrote:

 Any ideas?
 
 Add this line
 
   sizelimit -1
 
 to the OpenLDAP slapd.conf.

Excellent idea!

Thanks,
Greg

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Whitelisting

2005-07-26 Thread David Franco-Rocha [ Declude ]



Richard,

The problem here is, first of all, that Declude 
does not look at the cc: or bcc: in the headers. It deals with recipients of the 
email solely on the basis of what is in the message envelope (q*.smd file), 
which is discarded by IMail after processing; all you eventually see is the 
contents of the message itself (the d*.smd file).

Whitelisting ensures that the email will pass all 
tests. Under optimal circumstances, if an email source or destination is 
whitelisted, all tests should be skipped. If there are two recipients and only 
one were whitelisted, the headers of te email would have to indicate a 
whitelisted weight of 0 for one recipient and the actual weight for the other 
(non-whitelisted) recipient. That would necessitate two different sets of 
headers, which would require two separate message files and therefore two 
separate envelopes: If the non-whitelisted weight exceeded the HOLD threshold, 
one copy of the email would be placed into the HOLD folder with the envelope 
modified for that single recipient; the other would be whitelisted and the held 
recipient would be deleted from that envelope. In other words, Declude would 
have to generate multiple emails from a single email, which is not practical. 
How would Declude assign a new queue number to the duplicate email? If one 
recipient were whitelisted and the other had a weight of 5 (to be delivered), 
there would be different sets of headers and therefore different emails. They 
could not both have the same queue number because they could no be placed into 
the spool at the same time (one would overwrite the other).

The email server generates a separate copy of the 
email for each recipient after processing by Declude. However, there is no 
practical way for Declude to create multiple emails from a single 
message.

David Franco-Rocha
Declude Technical Support



  - Original Message - 
  From: 
  Richard 
  Farris 
  To: Declude.JunkMail@declude.com 
  
  Sent: Monday, July 25, 2005 4:24 PM
  Subject: [Declude.JunkMail] 
  Whitelisting
  
  I just took out all the email addresses I had 
  whitelisted in my Global file last week because I thought this would 
  helpstop more spam getting thruand of course folks are now emailing 
  me saying they are missing mail..newsletters and such...
  
  My question is "Why is it not possible with 
  Declude to whitelist an email address and it only applies to that email 
  address and not any others that might be in CC or BCC"?
  Richard FarrisEthixs Online1.270.247. 
  Office1.800.548.3877 Tech Support"Crossroads to a Cleaner 
  Internet"
  
- Original Message - 
From: 
Matt 

To: Declude.JunkMail@declude.com 

Sent: Monday, July 25, 2005 1:47 
PM
Subject: Re: [Declude.JunkMail] Filter 
not triggering
Kevin,Just a thought if you wanted to confirm this as 
a bug, maybe try a filter for this same message, but match a full word to 
see if it triggers. I did decode this segment and there is no 
additional encoding or other tricks that would cause a filter to not 
hit.IMO, knowing about bugs like this would be very helpful at 
times, especially considering the time that it would take each one of us 
that was affected by it to figure it out on our own. Maybe if Declude 
doesn't want to post this information on their site, we could take it upon 
ourselves to share such information with the list when it is 
discovered. This is for the most part how the list used to function in 
the old days, though most of us seemed to desire a page dedicated to the 
topic regardless.MattKevin Bilbee wrote: 

  
  

  Well that would explain why many of my filters are not as effective 
  as they used to be. Has Declude announced when the fix will be 
  available
  
  
  
  Kevin Bilbee
  
-Original Message-From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]]On 
Behalf Of John CarterSent: Monday, July 25, 2005 8:05 
AMTo: Declude.JunkMail@declude.comSubject: 
RE: [Declude.JunkMail] Filter not triggering
I have reported to Declude a problem with the 
"CONTAINS" statement. Prior to 2.0.6 (or somewhere around 
there)it worked oncharacter match, but after an upgrade to 
Declude it only works on a word match. (In other words you could not 
longer match on a string of characters within a word.) This would 
affect your situation.

I believe the fix is caught up in the wait for the 
newest version (the one they are testing now.)

John


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]] 
On Behalf Of Kevin BilbeeSent: Monday, July 25, 2005 
9:10 AMTo: JunkMail DecludeSubject: 
[Declude.JunkMail] Filter not triggering
The attached email is not getting trapped 
  

[Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?

2005-07-26 Thread Avolve Support
Any word on the fix to stop the errors that have been cropping up with 2.0.6 
and beta .16 with the latest Imail versions ? 





Sent via the WebMail system at avolve.net


 
   
---
[This E-mail scanned for viruses by Declude Virus By Avolve.net]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] OT: ldap (ldap2aliases)

2005-07-26 Thread System Administrator
I'm trying to start the ldap service on another imail server (win2000) and
it won't start (I'd like to run ldap2aliases on it). Changing the ldap port
in imail to 1389 allows the ldap service to start. Port scanning, I see ldap
(port 389) is running, so something else must be using it. Anyone have this
happen to them? I'm trying to figure out what is starting ldap without
stopping every service on the computer.

The server is running -

declude
imail
f-prot
avg
sniffer
dns
ftp
iis

For Sandy, if I change the ldap port to 1389, I get an error in
ldap2aliases. I assume that happens because it is looking at port 389 on
this server and not 1389. Can I change something to fix this in
ldap2aliases?

I'd like to either turn off the mystery ldap or change the port in
ldap2aliases.

Thanks,
Greg

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] local delivery appears to not run some external tests

2005-07-26 Thread Roderick A. Anderson

Bill wrote:

We had the same problem last year.  It was a bug in one of the
releases of Imail and was latter fixed.  I am not sure what version had
the problem but the latest version (8.20 with hotfix 2) works correctly.


Thanks.  It appears we stumped Declude with this one.  I was going to 
follow up with them today.  Yesterday in a flurry of INBOX cleaning I 
deleted this message without reading it.  I just happened to realize 
that as I was INBOX cleaning this AM.  Close call.



Again thanks,
Rod
--

---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] OT: ldap (ldap2aliases)

2005-07-26 Thread System Administrator
on 7/26/05 11:49 AM, System Administrator wrote:

 I'm trying to start the ldap service on another imail server (win2000) and
 it won't start (I'd like to run ldap2aliases on it).

For those following along -

I've discovered that Active Directory uses port 389 in Win2000. I haven't
located any way to change that port yet, so hopefully Sandy can tell me how
to allow ldap2aliases to reference another port.

Greg

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread Nick Hayer

Hi David,

Are you aware of any bugs with the CONTAINS filter statement?

Thanks!

-Nick


David Barker wrote:


Kevin,

After reviewing your files you had sent me this is the problem you are
having:

1. The email you received was encoded in BASE64 (Msg failed BASE64)

2. In your global.cfg you have the following directive:

DECODE  OFF

Therefore your STOCKFILTER did not trigger - as nowhere in the encoded text
of the email is the following phrase (OTC:

In order for your filters to work on encoded messages I would suggest
commenting out #DECODE  OFF

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are the
log lines. They do not indicate any issues with the STOCKFILTER. In the
STOCKFILTER this line should be hitting

BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10
points Could declude not be decoding the BASE64 This also seems to
be an intermittent issue!


07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
[EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded
text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108

07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN
BASE64=WARN IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [copyall_account]

= IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
[EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded
text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L2 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED] [EMAIL PROTECTED]
IP: 200.182.78.150 ID: M2005072419564304108

07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN
BASE64=WARN IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for

[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) taken on this
email = IGNORE WARN  [LAST ACTION=WARN]



Kevin Bilbee

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread David Barker
Kevin,
 
After reviewing your files you had sent me this is the problem you are
having:
 
1. The email you received was encoded in BASE64 (Msg failed BASE64)
 
2. In your global.cfg you have the following directive:
 
DECODE  OFF
 
Therefore your STOCKFILTER did not trigger - as nowhere in the encoded text
of the email is the following phrase (OTC:
 
In order for your filters to work on encoded messages I would suggest
commenting out #DECODE  OFF
 
David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are the
log lines. They do not indicate any issues with the STOCKFILTER. In the
STOCKFILTER this line should be hitting
 
BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10
points Could declude not be decoding the BASE64 This also seems to
be an intermittent issue!
 
 
07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail
due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
[EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded
text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN
BASE64=WARN IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [copyall_account]
= IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting
[EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded
text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L2 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED] [EMAIL PROTECTED]
IP: 200.182.78.150 ID: M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN
BASE64=WARN IPNOTINMX=IGNORE 
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) taken on this
email = IGNORE WARN  [LAST ACTION=WARN]

 
 
Kevin Bilbee

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread David Barker
Nick,

I am not aware of any bugs with the CONTAINS filter statement.

However there are some items on our wish list, currently CONTAINS  searches
for a string eg. ABC

So this will trigger XXXABCXXX

Currently there is not a way to use CONTAINS with SPACEABC as the config
file does not see the space as in

BODY10  CONTAINSSPACEABC

Because we allow for spaces between CONTAINS and the text. We are looking
into providing a way where you can include spaces such as:

BODY10  CONTAINS ABC

*Please note SPACE is not syntax it is just there so you can see the space
I am talking about :)

David B
www.declude.com



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Tuesday, July 26, 2005 1:19 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter not triggering

Hi David,

Are you aware of any bugs with the CONTAINS filter statement?

Thanks!

-Nick


David Barker wrote:

Kevin,
 
After reviewing your files you had sent me this is the problem you are
having:
 
1. The email you received was encoded in BASE64 (Msg failed BASE64)
 
2. In your global.cfg you have the following directive:
 
DECODE  OFF
 
Therefore your STOCKFILTER did not trigger - as nowhere in the encoded 
text of the email is the following phrase (OTC:
 
In order for your filters to work on encoded messages I would suggest 
commenting out #DECODE  OFF
 
David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are 
the log lines. They do not indicate any issues with the STOCKFILTER. In 
the STOCKFILTER this line should be hitting
 
BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10 
points Could declude not be decoding the BASE64 This also seems 
to be an intermittent issue!
 
 
07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file 
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting 
[EMAIL PROTECTED] to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not 
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary 
encoded text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: 
[EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: 
NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for 
[copyall_account] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file 
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting 
[EMAIL PROTECTED] to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not 
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary 
encoded text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L2 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: 
[EMAIL PROTECTED]
To: [EMAIL PROTECTED] 
[EMAIL PROTECTED]
IP: 200.182.78.150 ID: M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: 
NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for 
[EMAIL PROTECTED] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) 

Re[2]: [Declude.JunkMail] OT: ldap (ldap2aliases)

2005-07-26 Thread Sanford Whiteman
 I've  discovered  that  Active Directory uses port 389 in Win2000.

Indeed it does!

 I  haven't located any way to change that port yet. . .

Don't try.

 .  .  .  so hopefully Sandy can tell me how to allow ldap2aliases to
 reference another port.

When using the -s option to specify the LDAP server, append the port:

-s 1.2.3.4:1389

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
  http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases!
  
http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/
  
http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread John Carter
Then may I ask why prior to 2.0.6.12(or so) did the following work

HEADER 1 CONTAINS gfsinc.com  against the header information of:

Received: from mail.gfsinc.com [206.165.223.43] by bobcat.jcjc.edu
  (SMTPD32-8.15) id A9D24988001E; Wed, 09 Mar 2005 23:23:30 -0600


Now to catch this, I have to use

HEADER 1 CONTAINS mail.gfsinc.com


So if gfsinc.com changes to mail2.gfsinc.com, it is not caught.

John 


 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Tuesday, July 26, 2005 12:27 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Filter not triggering

Nick,

I am not aware of any bugs with the CONTAINS filter statement.

However there are some items on our wish list, currently CONTAINS  searches
for a string eg. ABC

So this will trigger XXXABCXXX

Currently there is not a way to use CONTAINS with SPACEABC as the config
file does not see the space as in

BODY10  CONTAINSSPACEABC

Because we allow for spaces between CONTAINS and the text. We are looking
into providing a way where you can include spaces such as:

BODY10  CONTAINS ABC

*Please note SPACE is not syntax it is just there so you can see the space
I am talking about :)

David B
www.declude.com



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Tuesday, July 26, 2005 1:19 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter not triggering

Hi David,

Are you aware of any bugs with the CONTAINS filter statement?

Thanks!

-Nick


David Barker wrote:

Kevin,
 
After reviewing your files you had sent me this is the problem you are
having:
 
1. The email you received was encoded in BASE64 (Msg failed BASE64)
 
2. In your global.cfg you have the following directive:
 
DECODE  OFF
 
Therefore your STOCKFILTER did not trigger - as nowhere in the encoded 
text of the email is the following phrase (OTC:
 
In order for your filters to work on encoded messages I would suggest 
commenting out #DECODE  OFF
 
David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are 
the log lines. They do not indicate any issues with the STOCKFILTER. In 
the STOCKFILTER this line should be hitting
 
BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10 
points Could declude not be decoding the BASE64 This also seems 
to be an intermittent issue!
 
 
07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping 
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file 
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting 
[EMAIL PROTECTED] to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not 
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary 
encoded text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From: 
[EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108
 
07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: 
NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE
07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for 
[copyall_account] = IGNORE WARN  [LAST ACTION=WARN]
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file 
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting 
[EMAIL PROTECTED] to file 
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not 
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 

[Declude.JunkMail] RBL's becoming worthless...

2005-07-26 Thread Chuck Schick
In the last several months we have seen large quantity of spam coming from
IP blocks that never seem to get listed on any RBL.  Spamcop is about the
only one that picks some of them up and once in awhile spamhaus.  There was
a block last night that sent several hundred and sendbase.org showed they
had detected no email from that block.

The reason I bring this up is because when we first started blocking spam I
would say the blacklists would catch almost 90% so we relied heavily on the
blacklist.  With the blacklists not being as effective we need to rely on
other tests like sniffer but that misses alot also.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] RBL's becoming worthless...

2005-07-26 Thread Darrell \([EMAIL PROTECTED])

Chuck,

Agreeded.  This is why URI filtering is essential now.  From the SURBL site.

 [URI Filtering] We feel this is a promising approach since it addresses
the core problem of spam most directly: the sites advertised in the spams.
Spammers have found ways to get around conventional RBLs by stealing
services from multiple open relays or hijacking computers using viruses or
trojan horse programs. Because of this theft of services and forced entry
into unsuspecting victim computers, spammers are able to exploit multiple
new mail sources, sometimes for only a few minutes at a time, faster than
RBLs can identify and block mail from those addresses. This is a significant
weakness in conventional RBLs, and spammers have devised various ways to
exploit it. There are other problems with conventional RBLs that can make
their use potentially problematic. (This is not meant to be a criticism of
RBLs however. Like most other mail administrators, I use some conventional
RBLs on my mail servers to do things like block open relays, etc. So
conventional RBLs can be used effectively together with SURBL.)

Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude And
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.



Chuck Schick writes:


In the last several months we have seen large quantity of spam coming from
IP blocks that never seem to get listed on any RBL.  Spamcop is about the
only one that picks some of them up and once in awhile spamhaus.  There was
a block last night that sent several hundred and sendbase.org showed they
had detected no email from that block.

The reason I bring this up is because when we first started blocking spam I
would say the blacklists would catch almost 90% so we relied heavily on the
blacklist.  With the blacklists not being as effective we need to rely on
other tests like sniffer but that misses alot also.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.







---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] RBL's becoming worthless...

2005-07-26 Thread Dave Marchette
Agreed.  I had to take my INV URI filtering offline for a few days for
some testing.  Upon looking back at my kill stats I was intrigued by how
much is actually missed by RBL but is caught by INV URI.  

  

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Tuesday, July 26, 2005 11:02 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] RBL's becoming worthless...


Chuck, 

Agreeded.  This is why URI filtering is essential now.  From the SURBL
site. 

 [URI Filtering] We feel this is a promising approach since it
addresses 
the core problem of spam most directly: the sites advertised in the
spams. 
Spammers have found ways to get around conventional RBLs by stealing 
services from multiple open relays or hijacking computers using viruses
or 
trojan horse programs. Because of this theft of services and forced
entry 
into unsuspecting victim computers, spammers are able to exploit
multiple 
new mail sources, sometimes for only a few minutes at a time, faster
than 
RBLs can identify and block mail from those addresses. This is a
significant 
weakness in conventional RBLs, and spammers have devised various ways to

exploit it. There are other problems with conventional RBLs that can
make 
their use potentially problematic. (This is not meant to be a criticism
of 
RBLs however. Like most other mail administrators, I use some
conventional 
RBLs on my mail servers to do things like block open relays, etc. So 
conventional RBLs can be used effectively together with SURBL.) 

Darrell
 ---
Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration,
MRTG 
Integration, and Log Parsers. 

 

Chuck Schick writes: 

 In the last several months we have seen large quantity of spam coming 
 from IP blocks that never seem to get listed on any RBL.  Spamcop is 
 about the only one that picks some of them up and once in awhile 
 spamhaus.  There was a block last night that sent several hundred and 
 sendbase.org showed they had detected no email from that block.
 
 The reason I bring this up is because when we first started blocking 
 spam I would say the blacklists would catch almost 90% so we relied 
 heavily on the blacklist.  With the blacklists not being as effective 
 we need to rely on other tests like sniffer but that misses alot also.
 
 Chuck Schick
 Warp 8, Inc.
 (303)-421-5140
 www.warp8.com
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To 
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
 unsubscribe Declude.JunkMail.  The archives can be found at 
 http://www.mail-archive.com.
 


 




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
unsubscribe Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Filter not triggering

2005-07-26 Thread Scott Fisher

I use this method in one of my external programs to look for a space.
Working this way would mean no existing filters would need to be changed.
Different characters could be used as a space substitute, which means no 
character would be locked out of being used in filters. I'd hate to see a  
chosen as a space character, then I couldn't filter for that quote.


The filter file contains the lines:
SPACECHAR ~  (this means in the filter 
replace all ~ with spaces). Can be set to any character you want.

BODY 1 CONTAINS ~ABC  (the ~ will be replaced with a space)

It takes me 7 lines of vb code to get this working:
Dim strspacechar As String =  

If UCase(strfilterarray(0)) = SPACECHAR Then 
strfilterarray is a breakout of my filter lines.

strspacechar = Left(strfilterarray(1), 1)
End If

If strspacecharThen
strmatch = Replace(strmatch, strspacechar,  )strmatch 
is the filter line to match (~ABC)

End If

If I were more ambitious, I might also add code for SPACECHAR OFF that would 
reset the strspacechar back to  


- Original Message - 
From: David Barker [EMAIL PROTECTED]

To: Declude.JunkMail@declude.com
Sent: Tuesday, July 26, 2005 12:26 PM
Subject: RE: [Declude.JunkMail] Filter not triggering



Nick,

I am not aware of any bugs with the CONTAINS filter statement.

However there are some items on our wish list, currently CONTAINS 
searches

for a string eg. ABC

So this will trigger XXXABCXXX

Currently there is not a way to use CONTAINS with SPACEABC as the config
file does not see the space as in

BODY 10 CONTAINS SPACEABC

Because we allow for spaces between CONTAINS and the text. We are looking
into providing a way where you can include spaces such as:

BODY 10 CONTAINS  ABC

*Please note SPACE is not syntax it is just there so you can see the 
space

I am talking about :)

David B
www.declude.com



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Tuesday, July 26, 2005 1:19 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Filter not triggering

Hi David,

Are you aware of any bugs with the CONTAINS filter statement?

Thanks!

-Nick


David Barker wrote:


Kevin,

After reviewing your files you had sent me this is the problem you are
having:

1. The email you received was encoded in BASE64 (Msg failed BASE64)

2. In your global.cfg you have the following directive:

DECODE  OFF

Therefore your STOCKFILTER did not trigger - as nowhere in the encoded
text of the email is the following phrase (OTC:

In order for your filters to work on encoded messages I would suggest
commenting out #DECODE  OFF

David B
www.declude.com



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee
Sent: Monday, July 25, 2005 10:10 AM
To: JunkMail Declude
Subject: [Declude.JunkMail] Filter not triggering


The attached email is not getting trapped by my STOCKFILTER??? Here are
the log lines. They do not indicate any issues with the STOCKFILTER. In
the STOCKFILTER this line should be hitting

BODY 10 CONTAINS (OTC:

Any idea why this email is not triggering this line and assigning 10
points Could declude not be decoding the BASE64 This also seems
to be an intermittent issue!


07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5.
07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15.
07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping
E-mail due to current weight of 2.
07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 .  Total weight = 2.
07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file
D:\IMAIL\Declude\$default$.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Redirecting
[EMAIL PROTECTED] to file
D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail.
07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not
supporting [EMAIL PROTECTED]). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary
encoded text or HTML section was found in this E-mail.). Action=WARN.
07/24/2005 19:57:36 Q551E097C0333 L1 Message OK
07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play
07/24/2005 19:57:36 Q551E097C0333 From:
[EMAIL PROTECTED]
To: [EMAIL PROTECTED]  IP: 200.182.78.150 ID:
M2005072419564304108


RE: [Declude.JunkMail] RBL's becoming worthless...

2005-07-26 Thread David Barker
Chuck,

Send me your global.cfg and $default$.junkmail that I can have a look to see
if there are additional tests that we can use, to help increase scoring on
spam.

David B
dbarker @ declude.com 
www.declude.com

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick
Sent: Tuesday, July 26, 2005 1:57 PM
To: Declude. JunkMail
Subject: [Declude.JunkMail] RBL's becoming worthless...

In the last several months we have seen large quantity of spam coming from
IP blocks that never seem to get listed on any RBL.  Spamcop is about the
only one that picks some of them up and once in awhile spamhaus.  There was
a block last night that sent several hundred and sendbase.org showed they
had detected no email from that block.

The reason I bring this up is because when we first started blocking spam I
would say the blacklists would catch almost 90% so we relied heavily on the
blacklist.  With the blacklists not being as effective we need to rely on
other tests like sniffer but that misses alot also.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?

2005-07-26 Thread David Barker
We have identified compatibility issues with Imail version 8.20 and all
versions of Declude. A new release of Declude is in the works and we are
currently entering into volume testing. This release is our highest
priority.

David B
www.declude.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Avolve Support
Sent: Tuesday, July 26, 2005 10:51 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?

Any word on the fix to stop the errors that have been cropping up with 2.0.6
and beta .16 with the latest Imail versions ? 





Sent via the WebMail system at avolve.net


 
   
---
[This E-mail scanned for viruses by Declude Virus By Avolve.net]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] How they deal w/ Spammers in Russia

2005-07-26 Thread Jeff Kratka
Oops,. bummer. Sucks to be him

Jeff Kratka

TymeWyse Internet
P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417
tel: (541) 839-6027  -  [EMAIL PROTECTED]



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Kim Premuda
Sent: Monday, July 25, 2005 5:36 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How they deal w/ Spammers in Russia


http://www.mosnews.com/news/2005/07/25/spammerdead.shtml

--
Kim W. Premuda
FastWave Internet Services
San Diego, CA

--
---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] RBL's becoming worthless...

2005-07-26 Thread Scott Fisher

I'll third the URIBL filtering.
Darrell has a free trial of the product.
And the price is $30. Pretty affordable.

I've been using it happily all year.

- Original Message - 
From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED]

To: Declude.JunkMail@declude.com
Sent: Tuesday, July 26, 2005 1:01 PM
Subject: Re: [Declude.JunkMail] RBL's becoming worthless...


Chuck,

Agreeded.  This is why URI filtering is essential now.  From the SURBL site.

 [URI Filtering] We feel this is a promising approach since it addresses
the core problem of spam most directly: the sites advertised in the spams.
Spammers have found ways to get around conventional RBLs by stealing
services from multiple open relays or hijacking computers using viruses or
trojan horse programs. Because of this theft of services and forced entry
into unsuspecting victim computers, spammers are able to exploit multiple
new mail sources, sometimes for only a few minutes at a time, faster than
RBLs can identify and block mail from those addresses. This is a significant
weakness in conventional RBLs, and spammers have devised various ways to
exploit it. There are other problems with conventional RBLs that can make
their use potentially problematic. (This is not meant to be a criticism of
RBLs however. Like most other mail administrators, I use some conventional
RBLs on my mail servers to do things like block open relays, etc. So
conventional RBLs can be used effectively together with SURBL.)

Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude And
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG
Integration, and Log Parsers.



Chuck Schick writes:


In the last several months we have seen large quantity of spam coming from
IP blocks that never seem to get listed on any RBL.  Spamcop is about the
only one that picks some of them up and once in awhile spamhaus.  There 
was

a block last night that sent several hundred and sendbase.org showed they
had detected no email from that block.
The reason I bring this up is because when we first started blocking spam 
I
would say the blacklists would catch almost 90% so we relied heavily on 
the

blacklist.  With the blacklists not being as effective we need to rely on
other tests like sniffer but that misses alot also.
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.




 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] RBL's becoming worthless...

2005-07-26 Thread Colbeck, Andrew
URI blacklists are certainly making up the difference on my system.

But far more important, Sniffer from SortMonster.com is making the
biggest difference on my network.

Sniffer has the advantage of both URI filtering and traditional content
filters because Sniffer is picking up the content that is the same
across spam runs, whether that happens to be a URI, a phone number, the
GIF attachment that is a drug billboard, or the HTML text that describes
the GIF attachment, or the obfuscation of a URI or HTML itself.

Sniffer is easily worth a buck a day.

Andrew 8)


 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick
 Sent: Tuesday, July 26, 2005 10:57 AM
 To: Declude. JunkMail
 Subject: [Declude.JunkMail] RBL's becoming worthless...
 
 In the last several months we have seen large quantity of 
 spam coming from IP blocks that never seem to get listed on 
 any RBL.  Spamcop is about the only one that picks some of 
 them up and once in awhile spamhaus.  There was a block last 
 night that sent several hundred and sendbase.org showed they 
 had detected no email from that block.
 
 The reason I bring this up is because when we first started 
 blocking spam I would say the blacklists would catch almost 
 90% so we relied heavily on the blacklist.  With the 
 blacklists not being as effective we need to rely on other 
 tests like sniffer but that misses alot also.
 
 Chuck Schick
 Warp 8, Inc.
 (303)-421-5140
 www.warp8.com
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To 
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
 type unsubscribe Declude.JunkMail.  The archives can be 
 found at http://www.mail-archive.com.
 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] RBL's becoming worthless...

2005-07-26 Thread [EMAIL PROTECTED]
Less if you buy through Declude :-) 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Tuesday, July 26, 2005 3:56 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] RBL's becoming worthless...

URI blacklists are certainly making up the difference on my system.

But far more important, Sniffer from SortMonster.com is making the biggest
difference on my network.

Sniffer has the advantage of both URI filtering and traditional content
filters because Sniffer is picking up the content that is the same across
spam runs, whether that happens to be a URI, a phone number, the GIF
attachment that is a drug billboard, or the HTML text that describes the GIF
attachment, or the obfuscation of a URI or HTML itself.

Sniffer is easily worth a buck a day.

Andrew 8)


 -Original Message-
 From: [EMAIL PROTECTED]
 [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick
 Sent: Tuesday, July 26, 2005 10:57 AM
 To: Declude. JunkMail
 Subject: [Declude.JunkMail] RBL's becoming worthless...
 
 In the last several months we have seen large quantity of spam coming 
 from IP blocks that never seem to get listed on any RBL.  Spamcop is 
 about the only one that picks some of them up and once in awhile 
 spamhaus.  There was a block last night that sent several hundred and 
 sendbase.org showed they had detected no email from that block.
 
 The reason I bring this up is because when we first started blocking 
 spam I would say the blacklists would catch almost 90% so we relied 
 heavily on the blacklist.  With the blacklists not being as effective 
 we need to rely on other tests like sniffer but that misses alot also.
 
 Chuck Schick
 Warp 8, Inc.
 (303)-421-5140
 www.warp8.com
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To 
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
 unsubscribe Declude.JunkMail.  The archives can be found at 
 http://www.mail-archive.com.
 
---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] How they deal w/ Spammers in Russia

2005-07-26 Thread Dave Doherty

Umm...  Sucked to be him, actually...




- Original Message - 
From: Jeff Kratka [EMAIL PROTECTED]

To: Declude.JunkMail@declude.com
Sent: Tuesday, July 26, 2005 3:32 PM
Subject: RE: [Declude.JunkMail] How they deal w/ Spammers in Russia



Oops,. bummer. Sucks to be him

Jeff Kratka

TymeWyse Internet
P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417
tel: (541) 839-6027  -  [EMAIL PROTECTED]



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Kim Premuda
Sent: Monday, July 25, 2005 5:36 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How they deal w/ Spammers in Russia


http://www.mosnews.com/news/2005/07/25/spammerdead.shtml

--
Kim W. Premuda
FastWave Internet Services
San Diego, CA

--
---
[This E-mail scanned for viruses by Declude Virus]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Declude's responsiveness on this list

2005-07-26 Thread declude
Yesterday I complained about the lack of participation on this list from
Declude.  Today alone there have been over a half a dozen posts.  This has
not gone unnoticed.

Keep up the good work!

Don

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] RBL's becoming worthless...

2005-07-26 Thread Markus Gufler
Chuck,

Here some numbers from my side:

100k messages in the last 7 days
50.5% identified as legit, 49.5% as spam (viruses was filtered out before)

The best IP4R-based tests was
CBL (21%, 0.37%FP), SPAMCOP (21%, 0.47%FP) and XBL-DYNA (19%, 0.27%FP)
So they catch less then 50% of incoming spam without creating a significant
number of false positives.
FIVETEN-SRC was able to catch 24% of spam but has also had FP's on around 6%
of all processed messages.

A text-filter combining the results of different IP4R-based tests has
reached a catch rate of 36%. I consider it the current maximum that can be
reached with IP4r-based tests by having a - let's say - moderate number of
false positives.

INV-URIBL instead can catch 37% of all messages as spam and I must say that
up to now I haven't had time to try improving the INV-URIBL configfile. (Any
suggestion is welcome!) It's also important that the number of FP's for this
test is near to zero.

SNIFFER was able to catch 47% of all spam messages but I must also say that
there was a significant number of false positives (5%). Most of them
generated by SNIFFER-GENERAL and SNIFFER-RICH.

SPAMCHK has had correct results on around 45% of all messages, but also had
around 7% of FP's

Other excelent tests was CMDSPACE (30%, 1%FP) and HELOISIP (13%, 0.17%FP)

Due to Decludes weighting system and the combination of all this tests I can
see between 10 and 20 spam messages each month in my inbox, by catching more
then 300 spams each day.

Markus



 -Original Message-
 From: [EMAIL PROTECTED] 
 [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick
 Sent: Tuesday, July 26, 2005 7:57 PM
 To: Declude. JunkMail
 Subject: [Declude.JunkMail] RBL's becoming worthless...
 
 In the last several months we have seen large quantity of 
 spam coming from IP blocks that never seem to get listed on 
 any RBL.  Spamcop is about the only one that picks some of 
 them up and once in awhile spamhaus.  There was a block last 
 night that sent several hundred and sendbase.org showed they 
 had detected no email from that block.
 
 The reason I bring this up is because when we first started 
 blocking spam I would say the blacklists would catch almost 
 90% so we relied heavily on the blacklist.  With the 
 blacklists not being as effective we need to rely on other 
 tests like sniffer but that misses alot also.
 
 Chuck Schick
 Warp 8, Inc.
 (303)-421-5140
 www.warp8.com
 
 ---
 This E-mail came from the Declude.JunkMail mailing list.  To 
 unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
 type unsubscribe Declude.JunkMail.  The archives can be 
 found at http://www.mail-archive.com.
 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] How is declude working with smartermail?

2005-07-26 Thread Dave Beckstrom
I've been kind of half following the discussions about declude and
smartermail and I'm hoping I can get an update from some of you.

How is declude working with smartermail now?  As I recall, I believe some
folks had some problems?  Have they been resolved?

Also, I'm loathe to put declude on the smartermail mail server and to have
it sucking up processor resources doing mail filtering on the mail server.
Is anyone running declude in some kind of gateway configuration where it
runs on a box ahead of the mail server?  If so, how big a server and what
are you seeing for resource consumption?  How do you prevent spammers from
bypassing the gateway server since smartermail doesn't support a mail port
which is a send only port with authorization?

Thanks for any feedback you might have to offer!


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?

2005-07-26 Thread Darin Cox
Does this only apply to IMail 8.20?  Are there any known issues with 2.0.6
and IMail 8.05 or 8.15?

Darin.


- Original Message - 
From: David Barker [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Tuesday, July 26, 2005 3:29 PM
Subject: RE: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?


We have identified compatibility issues with Imail version 8.20 and all
versions of Declude. A new release of Declude is in the works and we are
currently entering into volume testing. This release is our highest
priority.

David B
www.declude.com


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Avolve Support
Sent: Tuesday, July 26, 2005 10:51 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?

Any word on the fix to stop the errors that have been cropping up with 2.0.6
and beta .16 with the latest Imail versions ?





Sent via the WebMail system at avolve.net




---
[This E-mail scanned for viruses by Declude Virus By Avolve.net]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
Declude.JunkMail.  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.