Re: [Declude.JunkMail] OT: ldap2aliases error
on 7/25/05 5:11 PM, Sanford Whiteman wrote: Any ideas? Add this line sizelimit -1 to the OpenLDAP slapd.conf. Excellent idea! Thanks, Greg --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting
Richard, The problem here is, first of all, that Declude does not look at the cc: or bcc: in the headers. It deals with recipients of the email solely on the basis of what is in the message envelope (q*.smd file), which is discarded by IMail after processing; all you eventually see is the contents of the message itself (the d*.smd file). Whitelisting ensures that the email will pass all tests. Under optimal circumstances, if an email source or destination is whitelisted, all tests should be skipped. If there are two recipients and only one were whitelisted, the headers of te email would have to indicate a whitelisted weight of 0 for one recipient and the actual weight for the other (non-whitelisted) recipient. That would necessitate two different sets of headers, which would require two separate message files and therefore two separate envelopes: If the non-whitelisted weight exceeded the HOLD threshold, one copy of the email would be placed into the HOLD folder with the envelope modified for that single recipient; the other would be whitelisted and the held recipient would be deleted from that envelope. In other words, Declude would have to generate multiple emails from a single email, which is not practical. How would Declude assign a new queue number to the duplicate email? If one recipient were whitelisted and the other had a weight of 5 (to be delivered), there would be different sets of headers and therefore different emails. They could not both have the same queue number because they could no be placed into the spool at the same time (one would overwrite the other). The email server generates a separate copy of the email for each recipient after processing by Declude. However, there is no practical way for Declude to create multiple emails from a single message. David Franco-Rocha Declude Technical Support - Original Message - From: Richard Farris To: Declude.JunkMail@declude.com Sent: Monday, July 25, 2005 4:24 PM Subject: [Declude.JunkMail] Whitelisting I just took out all the email addresses I had whitelisted in my Global file last week because I thought this would helpstop more spam getting thruand of course folks are now emailing me saying they are missing mail..newsletters and such... My question is "Why is it not possible with Declude to whitelist an email address and it only applies to that email address and not any others that might be in CC or BCC"? Richard FarrisEthixs Online1.270.247. Office1.800.548.3877 Tech Support"Crossroads to a Cleaner Internet" - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Monday, July 25, 2005 1:47 PM Subject: Re: [Declude.JunkMail] Filter not triggering Kevin,Just a thought if you wanted to confirm this as a bug, maybe try a filter for this same message, but match a full word to see if it triggers. I did decode this segment and there is no additional encoding or other tricks that would cause a filter to not hit.IMO, knowing about bugs like this would be very helpful at times, especially considering the time that it would take each one of us that was affected by it to figure it out on our own. Maybe if Declude doesn't want to post this information on their site, we could take it upon ourselves to share such information with the list when it is discovered. This is for the most part how the list used to function in the old days, though most of us seemed to desire a page dedicated to the topic regardless.MattKevin Bilbee wrote: Well that would explain why many of my filters are not as effective as they used to be. Has Declude announced when the fix will be available Kevin Bilbee -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of John CarterSent: Monday, July 25, 2005 8:05 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Filter not triggering I have reported to Declude a problem with the "CONTAINS" statement. Prior to 2.0.6 (or somewhere around there)it worked oncharacter match, but after an upgrade to Declude it only works on a word match. (In other words you could not longer match on a string of characters within a word.) This would affect your situation. I believe the fix is caught up in the wait for the newest version (the one they are testing now.) John From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kevin BilbeeSent: Monday, July 25, 2005 9:10 AMTo: JunkMail DecludeSubject: [Declude.JunkMail] Filter not triggering The attached email is not getting trapped
[Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?
Any word on the fix to stop the errors that have been cropping up with 2.0.6 and beta .16 with the latest Imail versions ? Sent via the WebMail system at avolve.net --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] OT: ldap (ldap2aliases)
I'm trying to start the ldap service on another imail server (win2000) and it won't start (I'd like to run ldap2aliases on it). Changing the ldap port in imail to 1389 allows the ldap service to start. Port scanning, I see ldap (port 389) is running, so something else must be using it. Anyone have this happen to them? I'm trying to figure out what is starting ldap without stopping every service on the computer. The server is running - declude imail f-prot avg sniffer dns ftp iis For Sandy, if I change the ldap port to 1389, I get an error in ldap2aliases. I assume that happens because it is looking at port 389 on this server and not 1389. Can I change something to fix this in ldap2aliases? I'd like to either turn off the mystery ldap or change the port in ldap2aliases. Thanks, Greg --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] local delivery appears to not run some external tests
Bill wrote: We had the same problem last year. It was a bug in one of the releases of Imail and was latter fixed. I am not sure what version had the problem but the latest version (8.20 with hotfix 2) works correctly. Thanks. It appears we stumped Declude with this one. I was going to follow up with them today. Yesterday in a flurry of INBOX cleaning I deleted this message without reading it. I just happened to realize that as I was INBOX cleaning this AM. Close call. Again thanks, Rod -- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: ldap (ldap2aliases)
on 7/26/05 11:49 AM, System Administrator wrote: I'm trying to start the ldap service on another imail server (win2000) and it won't start (I'd like to run ldap2aliases on it). For those following along - I've discovered that Active Directory uses port 389 in Win2000. I haven't located any way to change that port yet, so hopefully Sandy can tell me how to allow ldap2aliases to reference another port. Greg --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter not triggering
Hi David, Are you aware of any bugs with the CONTAINS filter statement? Thanks! -Nick David Barker wrote: Kevin, After reviewing your files you had sent me this is the problem you are having: 1. The email you received was encoded in BASE64 (Msg failed BASE64) 2. In your global.cfg you have the following directive: DECODE OFF Therefore your STOCKFILTER did not trigger - as nowhere in the encoded text of the email is the following phrase (OTC: In order for your filters to work on encoded messages I would suggest commenting out #DECODE OFF David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, July 25, 2005 10:10 AM To: JunkMail Declude Subject: [Declude.JunkMail] Filter not triggering The attached email is not getting trapped by my STOCKFILTER??? Here are the log lines. They do not indicate any issues with the STOCKFILTER. In the STOCKFILTER this line should be hitting BODY 10 CONTAINS (OTC: Any idea why this email is not triggering this line and assigning 10 points Could declude not be decoding the BASE64 This also seems to be an intermittent issue! 07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5. 07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15. 07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 . Total weight = 2. 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L1 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [copyall_account] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L2 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] Kevin Bilbee --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter not triggering
Kevin, After reviewing your files you had sent me this is the problem you are having: 1. The email you received was encoded in BASE64 (Msg failed BASE64) 2. In your global.cfg you have the following directive: DECODE OFF Therefore your STOCKFILTER did not trigger - as nowhere in the encoded text of the email is the following phrase (OTC: In order for your filters to work on encoded messages I would suggest commenting out #DECODE OFF David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, July 25, 2005 10:10 AM To: JunkMail Declude Subject: [Declude.JunkMail] Filter not triggering The attached email is not getting trapped by my STOCKFILTER??? Here are the log lines. They do not indicate any issues with the STOCKFILTER. In the STOCKFILTER this line should be hitting BODY 10 CONTAINS (OTC: Any idea why this email is not triggering this line and assigning 10 points Could declude not be decoding the BASE64 This also seems to be an intermittent issue! 07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5. 07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15. 07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 . Total weight = 2. 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L1 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [copyall_account] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L2 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s) taken on this email = IGNORE WARN [LAST ACTION=WARN] Kevin Bilbee --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter not triggering
Nick, I am not aware of any bugs with the CONTAINS filter statement. However there are some items on our wish list, currently CONTAINS searches for a string eg. ABC So this will trigger XXXABCXXX Currently there is not a way to use CONTAINS with SPACEABC as the config file does not see the space as in BODY10 CONTAINSSPACEABC Because we allow for spaces between CONTAINS and the text. We are looking into providing a way where you can include spaces such as: BODY10 CONTAINS ABC *Please note SPACE is not syntax it is just there so you can see the space I am talking about :) David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, July 26, 2005 1:19 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Filter not triggering Hi David, Are you aware of any bugs with the CONTAINS filter statement? Thanks! -Nick David Barker wrote: Kevin, After reviewing your files you had sent me this is the problem you are having: 1. The email you received was encoded in BASE64 (Msg failed BASE64) 2. In your global.cfg you have the following directive: DECODE OFF Therefore your STOCKFILTER did not trigger - as nowhere in the encoded text of the email is the following phrase (OTC: In order for your filters to work on encoded messages I would suggest commenting out #DECODE OFF David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, July 25, 2005 10:10 AM To: JunkMail Declude Subject: [Declude.JunkMail] Filter not triggering The attached email is not getting trapped by my STOCKFILTER??? Here are the log lines. They do not indicate any issues with the STOCKFILTER. In the STOCKFILTER this line should be hitting BODY 10 CONTAINS (OTC: Any idea why this email is not triggering this line and assigning 10 points Could declude not be decoding the BASE64 This also seems to be an intermittent issue! 07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5. 07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15. 07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 . Total weight = 2. 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L1 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [copyall_account] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L2 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [EMAIL PROTECTED] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C0333 Cumulative action(s)
Re[2]: [Declude.JunkMail] OT: ldap (ldap2aliases)
I've discovered that Active Directory uses port 389 in Win2000. Indeed it does! I haven't located any way to change that port yet. . . Don't try. . . . so hopefully Sandy can tell me how to allow ldap2aliases to reference another port. When using the -s option to specify the LDAP server, append the port: -s 1.2.3.4:1389 --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Filter not triggering
Then may I ask why prior to 2.0.6.12(or so) did the following work HEADER 1 CONTAINS gfsinc.com against the header information of: Received: from mail.gfsinc.com [206.165.223.43] by bobcat.jcjc.edu (SMTPD32-8.15) id A9D24988001E; Wed, 09 Mar 2005 23:23:30 -0600 Now to catch this, I have to use HEADER 1 CONTAINS mail.gfsinc.com So if gfsinc.com changes to mail2.gfsinc.com, it is not caught. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, July 26, 2005 12:27 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Filter not triggering Nick, I am not aware of any bugs with the CONTAINS filter statement. However there are some items on our wish list, currently CONTAINS searches for a string eg. ABC So this will trigger XXXABCXXX Currently there is not a way to use CONTAINS with SPACEABC as the config file does not see the space as in BODY10 CONTAINSSPACEABC Because we allow for spaces between CONTAINS and the text. We are looking into providing a way where you can include spaces such as: BODY10 CONTAINS ABC *Please note SPACE is not syntax it is just there so you can see the space I am talking about :) David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, July 26, 2005 1:19 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Filter not triggering Hi David, Are you aware of any bugs with the CONTAINS filter statement? Thanks! -Nick David Barker wrote: Kevin, After reviewing your files you had sent me this is the problem you are having: 1. The email you received was encoded in BASE64 (Msg failed BASE64) 2. In your global.cfg you have the following directive: DECODE OFF Therefore your STOCKFILTER did not trigger - as nowhere in the encoded text of the email is the following phrase (OTC: In order for your filters to work on encoded messages I would suggest commenting out #DECODE OFF David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, July 25, 2005 10:10 AM To: JunkMail Declude Subject: [Declude.JunkMail] Filter not triggering The attached email is not getting trapped by my STOCKFILTER??? Here are the log lines. They do not indicate any issues with the STOCKFILTER. In the STOCKFILTER this line should be hitting BODY 10 CONTAINS (OTC: Any idea why this email is not triggering this line and assigning 10 points Could declude not be decoding the BASE64 This also seems to be an intermittent issue! 07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5. 07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15. 07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 . Total weight = 2. 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L1 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108 07/24/2005 19:57:36 Q551E097C0333 Tests failed [weight=2]: NOABUSE=WARN BASE64=WARN IPNOTINMX=IGNORE 07/24/2005 19:57:36 Q551E097C0333 Action(s) taken for [copyall_account] = IGNORE WARN [LAST ACTION=WARN] 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36
[Declude.JunkMail] RBL's becoming worthless...
In the last several months we have seen large quantity of spam coming from IP blocks that never seem to get listed on any RBL. Spamcop is about the only one that picks some of them up and once in awhile spamhaus. There was a block last night that sent several hundred and sendbase.org showed they had detected no email from that block. The reason I bring this up is because when we first started blocking spam I would say the blacklists would catch almost 90% so we relied heavily on the blacklist. With the blacklists not being as effective we need to rely on other tests like sniffer but that misses alot also. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] RBL's becoming worthless...
Chuck, Agreeded. This is why URI filtering is essential now. From the SURBL site. [URI Filtering] We feel this is a promising approach since it addresses the core problem of spam most directly: the sites advertised in the spams. Spammers have found ways to get around conventional RBLs by stealing services from multiple open relays or hijacking computers using viruses or trojan horse programs. Because of this theft of services and forced entry into unsuspecting victim computers, spammers are able to exploit multiple new mail sources, sometimes for only a few minutes at a time, faster than RBLs can identify and block mail from those addresses. This is a significant weakness in conventional RBLs, and spammers have devised various ways to exploit it. There are other problems with conventional RBLs that can make their use potentially problematic. (This is not meant to be a criticism of RBLs however. Like most other mail administrators, I use some conventional RBLs on my mail servers to do things like block open relays, etc. So conventional RBLs can be used effectively together with SURBL.) Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Chuck Schick writes: In the last several months we have seen large quantity of spam coming from IP blocks that never seem to get listed on any RBL. Spamcop is about the only one that picks some of them up and once in awhile spamhaus. There was a block last night that sent several hundred and sendbase.org showed they had detected no email from that block. The reason I bring this up is because when we first started blocking spam I would say the blacklists would catch almost 90% so we relied heavily on the blacklist. With the blacklists not being as effective we need to rely on other tests like sniffer but that misses alot also. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] RBL's becoming worthless...
Agreed. I had to take my INV URI filtering offline for a few days for some testing. Upon looking back at my kill stats I was intrigued by how much is actually missed by RBL but is caught by INV URI. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Tuesday, July 26, 2005 11:02 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] RBL's becoming worthless... Chuck, Agreeded. This is why URI filtering is essential now. From the SURBL site. [URI Filtering] We feel this is a promising approach since it addresses the core problem of spam most directly: the sites advertised in the spams. Spammers have found ways to get around conventional RBLs by stealing services from multiple open relays or hijacking computers using viruses or trojan horse programs. Because of this theft of services and forced entry into unsuspecting victim computers, spammers are able to exploit multiple new mail sources, sometimes for only a few minutes at a time, faster than RBLs can identify and block mail from those addresses. This is a significant weakness in conventional RBLs, and spammers have devised various ways to exploit it. There are other problems with conventional RBLs that can make their use potentially problematic. (This is not meant to be a criticism of RBLs however. Like most other mail administrators, I use some conventional RBLs on my mail servers to do things like block open relays, etc. So conventional RBLs can be used effectively together with SURBL.) Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Chuck Schick writes: In the last several months we have seen large quantity of spam coming from IP blocks that never seem to get listed on any RBL. Spamcop is about the only one that picks some of them up and once in awhile spamhaus. There was a block last night that sent several hundred and sendbase.org showed they had detected no email from that block. The reason I bring this up is because when we first started blocking spam I would say the blacklists would catch almost 90% so we relied heavily on the blacklist. With the blacklists not being as effective we need to rely on other tests like sniffer but that misses alot also. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filter not triggering
I use this method in one of my external programs to look for a space. Working this way would mean no existing filters would need to be changed. Different characters could be used as a space substitute, which means no character would be locked out of being used in filters. I'd hate to see a chosen as a space character, then I couldn't filter for that quote. The filter file contains the lines: SPACECHAR ~ (this means in the filter replace all ~ with spaces). Can be set to any character you want. BODY 1 CONTAINS ~ABC (the ~ will be replaced with a space) It takes me 7 lines of vb code to get this working: Dim strspacechar As String = If UCase(strfilterarray(0)) = SPACECHAR Then strfilterarray is a breakout of my filter lines. strspacechar = Left(strfilterarray(1), 1) End If If strspacecharThen strmatch = Replace(strmatch, strspacechar, )strmatch is the filter line to match (~ABC) End If If I were more ambitious, I might also add code for SPACECHAR OFF that would reset the strspacechar back to - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, July 26, 2005 12:26 PM Subject: RE: [Declude.JunkMail] Filter not triggering Nick, I am not aware of any bugs with the CONTAINS filter statement. However there are some items on our wish list, currently CONTAINS searches for a string eg. ABC So this will trigger XXXABCXXX Currently there is not a way to use CONTAINS with SPACEABC as the config file does not see the space as in BODY 10 CONTAINS SPACEABC Because we allow for spaces between CONTAINS and the text. We are looking into providing a way where you can include spaces such as: BODY 10 CONTAINS ABC *Please note SPACE is not syntax it is just there so you can see the space I am talking about :) David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Tuesday, July 26, 2005 1:19 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Filter not triggering Hi David, Are you aware of any bugs with the CONTAINS filter statement? Thanks! -Nick David Barker wrote: Kevin, After reviewing your files you had sent me this is the problem you are having: 1. The email you received was encoded in BASE64 (Msg failed BASE64) 2. In your global.cfg you have the following directive: DECODE OFF Therefore your STOCKFILTER did not trigger - as nowhere in the encoded text of the email is the following phrase (OTC: In order for your filters to work on encoded messages I would suggest commenting out #DECODE OFF David B www.declude.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Monday, July 25, 2005 10:10 AM To: JunkMail Declude Subject: [Declude.JunkMail] Filter not triggering The attached email is not getting trapped by my STOCKFILTER??? Here are the log lines. They do not indicate any issues with the STOCKFILTER. In the STOCKFILTER this line should be hitting BODY 10 CONTAINS (OTC: Any idea why this email is not triggering this line and assigning 10 points Could declude not be decoding the BASE64 This also seems to be an intermittent issue! 07/24/2005 19:57:36 Q551E097C0333 Filter HELOFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter VIRUSTRAP: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter REVDNSFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 19. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 13. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 14. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 5. 07/24/2005 19:57:36 Q551E097C0333 Filter STOCKFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 Filter: Set max weight to 15. 07/24/2005 19:57:36 Q551E097C0333 Filter BODYFILTER: Not skipping E-mail due to current weight of 2. 07/24/2005 19:57:36 Q551E097C0333 NOABUSE:2 . Total weight = 2. 07/24/2005 19:57:36 Q551E097C0333 Using [incoming] CFG file D:\IMAIL\Declude\$default$.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Redirecting [EMAIL PROTECTED] to file D:\Imail\declude\junkmailfiles\standardabrasives.com.junkmail. 07/24/2005 19:57:36 Q551E097C0333 Msg failed NOABUSE (Not supporting [EMAIL PROTECTED]). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 Msg failed BASE64 (A binary encoded text or HTML section was found in this E-mail.). Action=WARN. 07/24/2005 19:57:36 Q551E097C0333 L1 Message OK 07/24/2005 19:57:36 Q551E097C0333 Subject: Stocks in Play 07/24/2005 19:57:36 Q551E097C0333 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 200.182.78.150 ID: M2005072419564304108
RE: [Declude.JunkMail] RBL's becoming worthless...
Chuck, Send me your global.cfg and $default$.junkmail that I can have a look to see if there are additional tests that we can use, to help increase scoring on spam. David B dbarker @ declude.com www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: Tuesday, July 26, 2005 1:57 PM To: Declude. JunkMail Subject: [Declude.JunkMail] RBL's becoming worthless... In the last several months we have seen large quantity of spam coming from IP blocks that never seem to get listed on any RBL. Spamcop is about the only one that picks some of them up and once in awhile spamhaus. There was a block last night that sent several hundred and sendbase.org showed they had detected no email from that block. The reason I bring this up is because when we first started blocking spam I would say the blacklists would catch almost 90% so we relied heavily on the blacklist. With the blacklists not being as effective we need to rely on other tests like sniffer but that misses alot also. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?
We have identified compatibility issues with Imail version 8.20 and all versions of Declude. A new release of Declude is in the works and we are currently entering into volume testing. This release is our highest priority. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Avolve Support Sent: Tuesday, July 26, 2005 10:51 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ? Any word on the fix to stop the errors that have been cropping up with 2.0.6 and beta .16 with the latest Imail versions ? Sent via the WebMail system at avolve.net --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] How they deal w/ Spammers in Russia
Oops,. bummer. Sucks to be him Jeff Kratka TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 tel: (541) 839-6027 - [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kim Premuda Sent: Monday, July 25, 2005 5:36 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How they deal w/ Spammers in Russia http://www.mosnews.com/news/2005/07/25/spammerdead.shtml -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] RBL's becoming worthless...
I'll third the URIBL filtering. Darrell has a free trial of the product. And the price is $30. Pretty affordable. I've been using it happily all year. - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, July 26, 2005 1:01 PM Subject: Re: [Declude.JunkMail] RBL's becoming worthless... Chuck, Agreeded. This is why URI filtering is essential now. From the SURBL site. [URI Filtering] We feel this is a promising approach since it addresses the core problem of spam most directly: the sites advertised in the spams. Spammers have found ways to get around conventional RBLs by stealing services from multiple open relays or hijacking computers using viruses or trojan horse programs. Because of this theft of services and forced entry into unsuspecting victim computers, spammers are able to exploit multiple new mail sources, sometimes for only a few minutes at a time, faster than RBLs can identify and block mail from those addresses. This is a significant weakness in conventional RBLs, and spammers have devised various ways to exploit it. There are other problems with conventional RBLs that can make their use potentially problematic. (This is not meant to be a criticism of RBLs however. Like most other mail administrators, I use some conventional RBLs on my mail servers to do things like block open relays, etc. So conventional RBLs can be used effectively together with SURBL.) Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Chuck Schick writes: In the last several months we have seen large quantity of spam coming from IP blocks that never seem to get listed on any RBL. Spamcop is about the only one that picks some of them up and once in awhile spamhaus. There was a block last night that sent several hundred and sendbase.org showed they had detected no email from that block. The reason I bring this up is because when we first started blocking spam I would say the blacklists would catch almost 90% so we relied heavily on the blacklist. With the blacklists not being as effective we need to rely on other tests like sniffer but that misses alot also. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] RBL's becoming worthless...
URI blacklists are certainly making up the difference on my system. But far more important, Sniffer from SortMonster.com is making the biggest difference on my network. Sniffer has the advantage of both URI filtering and traditional content filters because Sniffer is picking up the content that is the same across spam runs, whether that happens to be a URI, a phone number, the GIF attachment that is a drug billboard, or the HTML text that describes the GIF attachment, or the obfuscation of a URI or HTML itself. Sniffer is easily worth a buck a day. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: Tuesday, July 26, 2005 10:57 AM To: Declude. JunkMail Subject: [Declude.JunkMail] RBL's becoming worthless... In the last several months we have seen large quantity of spam coming from IP blocks that never seem to get listed on any RBL. Spamcop is about the only one that picks some of them up and once in awhile spamhaus. There was a block last night that sent several hundred and sendbase.org showed they had detected no email from that block. The reason I bring this up is because when we first started blocking spam I would say the blacklists would catch almost 90% so we relied heavily on the blacklist. With the blacklists not being as effective we need to rely on other tests like sniffer but that misses alot also. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] RBL's becoming worthless...
Less if you buy through Declude :-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew Sent: Tuesday, July 26, 2005 3:56 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] RBL's becoming worthless... URI blacklists are certainly making up the difference on my system. But far more important, Sniffer from SortMonster.com is making the biggest difference on my network. Sniffer has the advantage of both URI filtering and traditional content filters because Sniffer is picking up the content that is the same across spam runs, whether that happens to be a URI, a phone number, the GIF attachment that is a drug billboard, or the HTML text that describes the GIF attachment, or the obfuscation of a URI or HTML itself. Sniffer is easily worth a buck a day. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: Tuesday, July 26, 2005 10:57 AM To: Declude. JunkMail Subject: [Declude.JunkMail] RBL's becoming worthless... In the last several months we have seen large quantity of spam coming from IP blocks that never seem to get listed on any RBL. Spamcop is about the only one that picks some of them up and once in awhile spamhaus. There was a block last night that sent several hundred and sendbase.org showed they had detected no email from that block. The reason I bring this up is because when we first started blocking spam I would say the blacklists would catch almost 90% so we relied heavily on the blacklist. With the blacklists not being as effective we need to rely on other tests like sniffer but that misses alot also. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How they deal w/ Spammers in Russia
Umm... Sucked to be him, actually... - Original Message - From: Jeff Kratka [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, July 26, 2005 3:32 PM Subject: RE: [Declude.JunkMail] How they deal w/ Spammers in Russia Oops,. bummer. Sucks to be him Jeff Kratka TymeWyse Internet P.O.Box 84 - 110 Ecklund St., Canyonville, OR 97417 tel: (541) 839-6027 - [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kim Premuda Sent: Monday, July 25, 2005 5:36 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] How they deal w/ Spammers in Russia http://www.mosnews.com/news/2005/07/25/spammerdead.shtml -- Kim W. Premuda FastWave Internet Services San Diego, CA -- --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Declude's responsiveness on this list
Yesterday I complained about the lack of participation on this list from Declude. Today alone there have been over a half a dozen posts. This has not gone unnoticed. Keep up the good work! Don --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] RBL's becoming worthless...
Chuck, Here some numbers from my side: 100k messages in the last 7 days 50.5% identified as legit, 49.5% as spam (viruses was filtered out before) The best IP4R-based tests was CBL (21%, 0.37%FP), SPAMCOP (21%, 0.47%FP) and XBL-DYNA (19%, 0.27%FP) So they catch less then 50% of incoming spam without creating a significant number of false positives. FIVETEN-SRC was able to catch 24% of spam but has also had FP's on around 6% of all processed messages. A text-filter combining the results of different IP4R-based tests has reached a catch rate of 36%. I consider it the current maximum that can be reached with IP4r-based tests by having a - let's say - moderate number of false positives. INV-URIBL instead can catch 37% of all messages as spam and I must say that up to now I haven't had time to try improving the INV-URIBL configfile. (Any suggestion is welcome!) It's also important that the number of FP's for this test is near to zero. SNIFFER was able to catch 47% of all spam messages but I must also say that there was a significant number of false positives (5%). Most of them generated by SNIFFER-GENERAL and SNIFFER-RICH. SPAMCHK has had correct results on around 45% of all messages, but also had around 7% of FP's Other excelent tests was CMDSPACE (30%, 1%FP) and HELOISIP (13%, 0.17%FP) Due to Decludes weighting system and the combination of all this tests I can see between 10 and 20 spam messages each month in my inbox, by catching more then 300 spams each day. Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chuck Schick Sent: Tuesday, July 26, 2005 7:57 PM To: Declude. JunkMail Subject: [Declude.JunkMail] RBL's becoming worthless... In the last several months we have seen large quantity of spam coming from IP blocks that never seem to get listed on any RBL. Spamcop is about the only one that picks some of them up and once in awhile spamhaus. There was a block last night that sent several hundred and sendbase.org showed they had detected no email from that block. The reason I bring this up is because when we first started blocking spam I would say the blacklists would catch almost 90% so we relied heavily on the blacklist. With the blacklists not being as effective we need to rely on other tests like sniffer but that misses alot also. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] How is declude working with smartermail?
I've been kind of half following the discussions about declude and smartermail and I'm hoping I can get an update from some of you. How is declude working with smartermail now? As I recall, I believe some folks had some problems? Have they been resolved? Also, I'm loathe to put declude on the smartermail mail server and to have it sucking up processor resources doing mail filtering on the mail server. Is anyone running declude in some kind of gateway configuration where it runs on a box ahead of the mail server? If so, how big a server and what are you seeing for resource consumption? How do you prevent spammers from bypassing the gateway server since smartermail doesn't support a mail port which is a send only port with authorization? Thanks for any feedback you might have to offer! --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ?
Does this only apply to IMail 8.20? Are there any known issues with 2.0.6 and IMail 8.05 or 8.15? Darin. - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Tuesday, July 26, 2005 3:29 PM Subject: RE: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ? We have identified compatibility issues with Imail version 8.20 and all versions of Declude. A new release of Declude is in the works and we are currently entering into volume testing. This release is our highest priority. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Avolve Support Sent: Tuesday, July 26, 2005 10:51 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Declude Fix/Update Above 2.0.6 ? Any word on the fix to stop the errors that have been cropping up with 2.0.6 and beta .16 with the latest Imail versions ? Sent via the WebMail system at avolve.net --- [This E-mail scanned for viruses by Declude Virus By Avolve.net] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
