Re: [Declude.JunkMail] Interesting spam footer
Just kids with more imagination than knowledge Sunday, September 18, 2005, 6:38:03 PM, Darin Cox [EMAIL PROTECTED] wrote: DC DC DC Thought this was interesting... a spammer trying to use fear of DC prosecution to stop people from reporting their email as spam. DC DC DC DC The spam was sent to a postmaster address never used for outgoing mail... DC DC DC DC Darin. DC DC DC DC = DC IMPORTANT INFORMATION CONCERNING THIS COMMERCIAL MESSAGE DC IN COMPLIANCE WITH THE CAN-SPAM ACT OF 2003 DC This is one of a number of commercial email messages that you, DC or someone using your computer, agreed to receive this message DC WARNING!!! DC ANY PERSON REPORTING ALLEGED SPAM TO ANY PERSON, PERSONS, ISPs DC OR ENTITIES WITHOUT PHYSICAL PROOF OF SAID CLAIM IS GUILTY OF DC BOTH FRAUD AND A CIVIL CRIME AND WILL BE PURSUED AND PROSECUTED DC TO THE FULLEST EXTENT OF THE LAW. FURTHER, SHOULD SAID ALLEGATION DC RESULT IN ANY INTERRUPTION OF NORMAL BUSINESS ACTIVITY OF THE DC COMPANY AND/OR RESULT IN LOSS OF INCOME AND/OR RESULT IN DC UNNECESSARY EXPENSES, A CIVIL SUIT WILL BE BROUGHT DC DC DC DC DC Don Brown - Dallas, Texas USA Internet Concepts, Inc. [EMAIL PROTECTED] http://www.inetconcepts.net (972) 788-2364Fax: (972) 788-5049 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Scott, I agree, unfortunately I do not have that information at present, I have requested this information from the engineers and will post it a soon as this is available. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 5:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe
[Declude.JunkMail] Latest ALL_LIST.DAT
Hello, All, I think it's possible that my ALL_LIST.DAT needs to be updated because I'm starting to receive legit e-mails from Yahoo IPs that come up as ARIN Unlisted. My current ALL_LIST.DAT is dated 4/08/2005. Is there a newer copy that we can download somewhere? Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help in creating a Filter
Thanks David. It's good to have you monitoring the list. - Original Message - From: David Barker [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, September 19, 2005 10:26 AM Subject: RE: [Declude.JunkMail] Help in creating a Filter Scott, I agree, unfortunately I do not have that information at present, I have requested this information from the engineers and will post it a soon as this is available. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, September 16, 2005 5:30 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter I don't have the order... But I believe filters are done last after External comments. If David's monitoring the list, I think a list of what order the tests run in would be a great addition to the Junkmail manual. - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 3:44 PM Subject: RE: [Declude.JunkMail] Help in creating a Filter We've been monitoring the MN-COMBO test (multiple tests failed) for the past 2 months. Most are failing INV-URIBL and SNIFFER; but some only failing one of them (either SNIFFER or INV-URIBL) but will fail DSBL/CBL/ROUTING/MXRATE. We've noticed that all the emails that we've monitored with the MN-COMBO that are spam; have multiple country hops. This is what we want to catch. Deleting based just on MN-COMBO will delete some false positives. But detecting our MN-COMBO test and then filtering the country hops will eliminate the false positives as they all originate outside of USA and/or start in USA then bounce to another country, then back to USA. Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an external program? I've thought of developing an EXE that does this final scan after MN-COMBO is tested. TIA, Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, September 16, 2005 2:31 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Just to second this - I have seen a large amount of customers also farm out filtering to companies like big fish which scan the mail in oversea's countries. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Scott Fisher writes: I think this would do it in two filters: filter 1: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO COUNTRIES 100 NOTCONTAINS US filter 2: SKIPIFWEIGHT 100 TESTSFAILED END NOTCONTAINS MN-COMBO TESTSFAILED END CONTAINS filter1 COUNTRIES END STARTSWITH US COUNTRIES 100 CONTAINS US I'd be careful. Lots of US subsidaries are owned by a foreign company and have their mail server overseas. Also watch out for these special country codes: (which can belong to valid servers): # # Special Codes # *1 Multi-Regional *2 Europe *3 North America *4 Central/South America *5 Pacific Rim *A ARIN Unlisted (North America/South Africa) *B Public Data Network *E RIPE Unlisted (Europe, North Africa, Middle East) *I Private IP *L Loopback *M Multicast *P APNIC Unlisted (Asia Pacific) *R IANA Reserved *U Unknown - Original Message - From: Erik [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, September 16, 2005 12:45 PM Subject: [Declude.JunkMail] Help in creating a Filter Could someone help me in creating a filter? I need something to this effect. Can this be done in one filter? If WEIGHT = 100 or Higher then END If TESTFAILED CONTAINS MN-COMBO Then If CountryChain NOTCONTAINS UNITED STATES Then Then DELETE (triggers the filter - return 100 as weight) End If If CountryChain CONTAINS UNITED STATES-destination Then 'Email is probably good (return zero) Else DELETE (triggers the filter - return 100 as weight) End If End If Thanks! Erik --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail.
RE: [Declude.JunkMail] Help in creating a Filter
Erik, I have also asked the engineers to look into this for us, ie. A directive to force tests to run in a specific order. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Saturday, September 17, 2005 5:34 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help in creating a Filter It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Wow, that would be great! :-) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Monday, September 19, 2005 9:38 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help in creating a Filter Erik, I have also asked the engineers to look into this for us, ie. A directive to force tests to run in a specific order. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Erik Sent: Saturday, September 17, 2005 5:34 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Help in creating a Filter It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Latest ALL_LIST.DAT
Dan, This would make sense since ARIN just completed another round of assignment of the BOGON's. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I think it's possible that my ALL_LIST.DAT needs to be updated because I'm starting to receive legit e-mails from Yahoo IPs that come up as ARIN Unlisted. My current ALL_LIST.DAT is dated 4/08/2005. Is there a newer copy that we can download somewhere? Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Help in creating a Filter
Title: Message Thanks Matt. The variable %COUNTRIES% does not pass to a parm line; nor does %COUNTRY%. But, I've noticed in our config file, we do not have a country test; but I thought this was internal to Declude? Is this what I need to add to my config? At one point we did have this in our config as we still have the ALL_LIST.DAT file. http://support.declude.com/Customer/KBArticle.aspx?articleid=6KBSearchID=1012 I want to be able to detect multiple countries and pass that to our external program. But as Scott mentioned, externals are ran before filters. Erik -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Saturday, September 17, 2005 4:10 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help in creating a FilterErik,Flexibility is a nice thing, but this isn't really practical to do for Declude without a major, major rewrite.The better approach would be to actually introduce the ability to use operators and variables in custom filters so that the exact order didn't matter. That would also be a rather involved new feature, but it would seem more practical and would have a greater overall utility. I'm sure if time wasn't an issue and there weren't more pressing things, they would have leaped to provide this a long time ago.As far as your specific need, some of this could be written in _vbscript_ as an external test in Declude. Note that %COUNTRIES% is definitely preferable to %COUNTRYCHAIN% as the data used for %COUNTRIES% is updated more often if I am not mistaken. The two letter country codes in standardized format are also preferable for filtering. You can then combo a single test with the others and probably have no concern about the order of tests that you can't easily overcome.MattErik wrote: It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Latest ALL_LIST.DAT
I'm still on v1.82 but have a valid SA and my all_list.dat file is older then 04/08/2005. Where can I get the newest dat-file? Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Monday, September 19, 2005 5:29 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Latest ALL_LIST.DAT Hello, All, I think it's possible that my ALL_LIST.DAT needs to be updated because I'm starting to receive legit e-mails from Yahoo IPs that come up as ARIN Unlisted. My current ALL_LIST.DAT is dated 4/08/2005. Is there a newer copy that we can download somewhere? Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Latest ALL_LIST.DAT
I guess this would be the best source for current country codes: http://www.iso.ch/iso/en/prods-services/iso3166ma/02iso-3166-code-lists/list-en1.html ARIN's list lets you break it down by region: http://www.arin.net/community/countries.html Original Message From: Darrell \([EMAIL PROTECTED]) [EMAIL PROTECTED] Sent: Monday, September 19, 2005 11:50 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Latest ALL_LIST.DAT Dan, This would make sense since ARIN just completed another round of assignment of the BOGON's. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I think it's possible that my ALL_LIST.DAT needs to be updated because I'm starting to receive legit e-mails from Yahoo IPs that come up as ARIN Unlisted. My current ALL_LIST.DAT is dated 4/08/2005. Is there a newer copy that we can download somewhere? Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Help in creating a Filter
Title: Message Erik, The all_list.dat file is required for testing COUNTRIES in a filter file. If you have determined that %COUNTRIES% is not passed to external tests and you have an all_list.dat, that would indicate that Declude doesn't populate that value or expose it to external tests. Not all such variables are available when external tests run, and I am not aware of a list of what is and isn't, but I know that things like %REVDNS%, %REMOTEIP%, %HELO%, %MAILFROM% and %WEIGHT% are. In the case of %WEIGHT% this is something that was enabled after it was asked for, and I would imagine that the %COUNTRIES% variable could also be populated before running external tests. As far as test order goes, I would too like to run external tests sometimes after custom filters, but I also desire to run them before as well, so if Declude does allow for changing the order, maybe they could just simply add an after-filter external program call so you could have them both. It would seem that almost all of the utility in running tests in a customized order would be to have some external tests run after custom filters, and instead of allowing us to rearrange things, it would make sense to just allow us to run external tests before and after custom filters and call it a day. The utility that I see in running tests after everything else would be to create specific external tests that could handle messages in different ways. One way for instance would be to run a test last and if the message was good and looked like personal E-mail, the external test could log the IP and Mail From somewhere and you could use that information for crediting weight on future messages from the same person. You could do the same thing with bad E-mail and build a blacklist. I personally would definitely make use of that functionality, but I wouldn't want to run all external tests last since some of them are deeply important for adding on points and most spam reaches my delete weight before custom filters are run and that saves on processing power when using SKIPIFWEIGHT or STOPALLTESTS. Matt Erik wrote: Thanks Matt. The variable %COUNTRIES% does not pass to a parm line; nor does %COUNTRY%. But, I've noticed in our config file, we do not have a country test; but I thought this was internal to Declude? Is this what I need to add to my config? At one point we did have this in our config as we still have the ALL_LIST.DAT file. http://support.declude.com/Customer/KBArticle.aspx?articleid=6KBSearchID=1012 I want to be able to detect multiple countries and pass that to our external program. But as Scott mentioned, externals are ran before filters. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Saturday, September 17, 2005 4:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik, Flexibility is a nice thing, but this isn't really practical to do for Declude without a major, major rewrite. The better approach would be to actually introduce the ability to use operators and variables in custom filters so that the exact order didn't matter. That would also be a rather involved new feature, but it would seem more practical and would have a greater overall utility. I'm sure if time wasn't an issue and there weren't more pressing things, they would have leaped to provide this a long time ago. As far as your specific need, some of this could be written in _vbscript_ as an external test in Declude. Note that %COUNTRIES% is definitely preferable to %COUNTRYCHAIN% as the data used for %COUNTRIES% is updated more often if I am not mistaken. The two letter country codes in standardized format are also preferable for filtering. You can then combo a single test with the others and probably have no concern about the order of tests that you can't easily overcome. Matt Erik wrote: It would be nice if there was a directive that forced the tests to run as they are in the order of which the appear in the CONFIG file. I know this may/would be a performance decrease but it would give end users control of external tests. Erik -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer Sent: Saturday, September 17, 2005 3:23 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Help in creating a Filter Erik wrote: If Declude could confirm the order of how/which tests are run, it would be nice to know. I agree. The archives may help but as I recall Scott [former of Declude] was nebulous in what the order is. The only thing for sure was filters ran last in the order listed in global.cfg listing - generally :) Running in debug mode does confirm this. -Nick --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail
Re[2]: [Declude.JunkMail] DNS RBL's
I am in the process of adding ORF into the mix for address validation. Can you or others describe the process that you employ with ORF? Two options in this area: (1) a simple ASCII text file of the valid recipient addresses exported from your mailbox server directory (2) an LDAP directory server populated with the recipient addresses from your mailbox server directory (1) is the method used by almost everyone using ORF to front mailbox servers other than Exchange. It's simple to set up, but somewhat cumbersome to maintain. The cumbersome part is that when an updated text file is posted to the ORF server, it is not reread until the service is restarted. For environments with a high add/change/delete rate, this can mean a ton of service restarts. I appreciate the ease of this scenario, but I'm uneasy about restarting Windows services that have not been specifically tested for this constant-restart type of deployment. I thus use option (2). (2) is used primarily by those gatewaying for Exchange servers, since ORF's LDAP query (hard-coded at least through 2.0) expects to be hitting an AD server with Exchange's LDAP schema extensions applied. However, it's possible to apply the extensions to an AD server without actually owning Exchange. You then import your mailbox server's users into this AD domain for your lookups. ORF's LDAP lookups occur either in real-time or from a periodically updated local cache, and they never require a service restart, which makes me a lot more comfy with this approach. (It's also possible to use OpenLDAP -- but _not_ the OpenLDAP that comes with IMail, unfortunately. I worked on an ORF cookbook for a standard OpenLDAP with more extensions compiled in, but decided in the end that it's a heckuva lot easier to use AD or ADAM.) --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Latest ALL_LIST.DAT
I think the ALL_LIST.DAT file is some sort of compressed list and not accessible via an editor... right??? Anyway, I found have a link where I got it some time back. http://www.declude.com/release/178/all_list.dat I haven't updated our server with it yet, so I have no idea how recent it is. Does anyone know if it's been updated recently? ~Joe - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, September 19, 2005 10:58 AM Subject: Re: [Declude.JunkMail] Latest ALL_LIST.DAT I guess this would be the best source for current country codes: http://www.iso.ch/iso/en/prods-services/iso3166ma/02iso-3166-code-lists/list-en1.html ARIN's list lets you break it down by region: http://www.arin.net/community/countries.html Original Message From: Darrell \([EMAIL PROTECTED]) [EMAIL PROTECTED] Sent: Monday, September 19, 2005 11:50 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Latest ALL_LIST.DAT Dan, This would make sense since ARIN just completed another round of assignment of the BOGON's. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I think it's possible that my ALL_LIST.DAT needs to be updated because I'm starting to receive legit e-mails from Yahoo IPs that come up as ARIN Unlisted. My current ALL_LIST.DAT is dated 4/08/2005. Is there a newer copy that we can download somewhere? Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses at HNB.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Latest ALL_LIST.DAT
At this point the latest ALL_LIST.DAT (Monday, April 11, 2005) is currently located here: http://www.declude.com/version/release/all_list.dat There will be a new ALL_LIST.DAT with the release of Declude 3.0 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J Porter Sent: Monday, September 19, 2005 5:02 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Latest ALL_LIST.DAT I think the ALL_LIST.DAT file is some sort of compressed list and not accessible via an editor... right??? Anyway, I found have a link where I got it some time back. http://www.declude.com/release/178/all_list.dat I haven't updated our server with it yet, so I have no idea how recent it is. Does anyone know if it's been updated recently? ~Joe - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, September 19, 2005 10:58 AM Subject: Re: [Declude.JunkMail] Latest ALL_LIST.DAT I guess this would be the best source for current country codes: http://www.iso.ch/iso/en/prods-services/iso3166ma/02iso-3166-code-lists/list -en1.html ARIN's list lets you break it down by region: http://www.arin.net/community/countries.html Original Message From: Darrell \([EMAIL PROTECTED]) [EMAIL PROTECTED] Sent: Monday, September 19, 2005 11:50 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Latest ALL_LIST.DAT Dan, This would make sense since ARIN just completed another round of assignment of the BOGON's. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I think it's possible that my ALL_LIST.DAT needs to be updated because I'm starting to receive legit e-mails from Yahoo IPs that come up as ARIN Unlisted. My current ALL_LIST.DAT is dated 4/08/2005. Is there a newer copy that we can download somewhere? Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses at HNB.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Latest ALL_LIST.DAT
So what is the ALL_LIST.DAT? How is it used? I couldn't find it described in the JunkMail documentation or in the Knowledge Base. Is this a binary file that we shouldn't be messing with? How can we correlate it with any country filter we might be using? Though while looking through the Knowledge Base, I found this new entry: http://support.declude.com/Customer/KBArticle.aspx?articleid=35KBSearchID=1023 I found a copy of ALL_LIST.DAT in the Declude directory that was installed with 2.0.6. It has a date on it of 4/11/2005. Original Message From: David Barker [EMAIL PROTECTED] Sent: Monday, September 19, 2005 5:23 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Latest ALL_LIST.DAT At this point the latest ALL_LIST.DAT (Monday, April 11, 2005) is currently located here: http://www.declude.com/version/release/all_list.dat There will be a new ALL_LIST.DAT with the release of Declude 3.0 David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J Porter Sent: Monday, September 19, 2005 5:02 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Latest ALL_LIST.DAT I think the ALL_LIST.DAT file is some sort of compressed list and not accessible via an editor... right??? Anyway, I found have a link where I got it some time back. http://www.declude.com/release/178/all_list.dat I haven't updated our server with it yet, so I have no idea how recent it is. Does anyone know if it's been updated recently? ~Joe - Original Message - From: Gary Steiner [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, September 19, 2005 10:58 AM Subject: Re: [Declude.JunkMail] Latest ALL_LIST.DAT I guess this would be the best source for current country codes: http://www.iso.ch/iso/en/prods-services/iso3166ma/02iso-3166-code-lists/list -en1.html ARIN's list lets you break it down by region: http://www.arin.net/community/countries.html Original Message From: Darrell \([EMAIL PROTECTED]) [EMAIL PROTECTED] Sent: Monday, September 19, 2005 11:50 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Latest ALL_LIST.DAT Dan, This would make sense since ARIN just completed another round of assignment of the BOGON's. Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Dan Geiser writes: Hello, All, I think it's possible that my ALL_LIST.DAT needs to be updated because I'm starting to receive legit e-mails from Yahoo IPs that come up as ARIN Unlisted. My current ALL_LIST.DAT is dated 4/08/2005. Is there a newer copy that we can download somewhere? Thanks, Much! Dan Geiser [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
