Re: [Declude.JunkMail] SURBL as RHSBL
I would rather not add six new tests to my config. Would you recommend a single SURBL test? Which one seems to work better? Regards, Jason - Original Message - From: "Darin Cox" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, November 23, 2004 8:02 AM Subject: Re: [Declude.JunkMail] SURBL as RHSBL > Hi Bill, > > You seem to always be one of the first to share new blacklists. Where do > you find this info? Is there another list that would be worth joining? > > Thanks, man. > > Darin. > > > - Original Message - > From: "Bill Landry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Tuesday, November 23, 2004 5:04 AM > Subject: Re: [Declude.JunkMail] SURBL as RHSBL > > > Modification, since I was not thinking, but Declude JunkMail does not > support bitmasked responses. So instead of using the multi zone, you will > need to use: > > SURBL_AB rhsbl ab.surbl.org127.0.0.2 1 0 > SURBL_JP rhsbl jp.surbl.org127.0.0.2 1 0 > SURBL_OB rhsbl ob.surbl.org127.0.0.2 1 0 > SURBL_PH rhsbl ph.surbl.org127.0.0.2 1 0 > SURBL_SC rhsbl sc.surbl.org127.0.0.2 1 0 > SURBL_WS rhsbl ws.surbl.org127.0.0.2 1 0 > > Which will require six different queries if you want to use all SURBL lists. > > Bill > - Original Message - > From: Bill Landry > To: [EMAIL PROTECTED] > Sent: Tuesday, November 23, 2004 12:47 AM > Subject: Re: [Declude.JunkMail] SURBL as RHSBL > > > Markus, if you want to test against all of the SURBLs, since it's only a > single query to the multi zone, use: > > SURBL_AB rhsbl multi.surbl.org127.0.0.32 1 0 > SURBL_JP rhsbl multi.surbl.org127.0.0.64 1 0 > SURBL_OB rhsbl multi.surbl.org127.0.0.16 1 0 > SURBL_PH rhsbl multi.surbl.org127.0.0.8 1 0 > SURBL_SC rhsbl multi.surbl.org127.0.0.2 1 0 > SURBL_WS rhsbl multi.surbl.org127.0.0.4 1 0 > > AB = AbuseButler data > JP = Combination of Prolocation data & Joe Wein's SpamSpy data > OB = OutBlaze data > PH = Combination of MailPolice "Fraud" list data & MailSecurity "Phishing" > list data > SC = SpamCop top 200 hits data > WS = William Stearns & submitter data > > I have been testing this for about an hour, and am getting a few hits. > We'll see how it goes over the next 24 hours... > > > Bill > - Original Message - > From: Markus Gufler > To: [EMAIL PROTECTED] > Sent: Monday, November 22, 2004 11:41 PM > Subject: RE: [Declude.JunkMail] SURBL as RHSBL > > > Is this the correct configruation line for doing this? > > SURBLS-RHSBL rhsbl %MAILFROM%.sc.surbl.org 127.0.0.2 5 0 > > > Markus > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Blackice
Could be a DNS issue. Make sure that you can perform DNS lookups from that box since you've set your settings to paranoid in BI. Jason - Original Message - From: "Dan Horne" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, November 19, 2004 10:36 AM Subject: [Declude.JunkMail] Blackice > Is anyone here running both Blackice and Declude? After running both for > about 20 minutes, all 4 processors on my server were pegged at 100%. Task > manager was filled with about 20-30 Declude.exe's, many instances of > Sniffer, many instances of SPAMCHK.exe, etc. A reboot of the server and the > same behavior (this time it didn't take 20 minutes, either, it was almost > instantaneous on boot). > > Dan Horne > Web Services Administrator > TAIS Web > Wilcox World Travel & Tours > [EMAIL PROTECTED] > > > CONFIDENTIALITY NOTICE: > This email message, including any attachments, is for the sole use of the > intended recipient(s) and may contain confidential and privileged > information. Any unauthorized review, use, disclosure or distribution is > prohibited. If you are not the intended recipient, please contact the sender > by reply email and destroy all copies of the original message. > > SPAM-FREE 1.0(2476) > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam Bounty Hunters...?
http://www.msnbc.msn.com/id/5326107/ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Messages slipping through JM
Don't believe that will work. Does anyone know why a forwarded message isn't processed by the rules? Thanks, Jason -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Grant Griffith - Declude JM Sent: Tuesday, June 29, 2004 4:44 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Messages slipping through JM Not sure if this would really work, but you could send it to a separate mailbox using the ROUTETO function by putting [EMAIL PROTECTED] Will this work if it is to the same user? Might be a way around the problem? Sincerely, Grant Griffith EI8HT LEGS Enhanced Web Management A Division of ETC http://www.getafreewebsite.com 877-483-3393 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jason @ AreaTech Sent: Tuesday, June 29, 2004 4:44 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Messages slipping through JM - Original Message - From: "Grant Griffith - Declude JM" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, June 29, 2004 4:19 PM Subject: RE: [Declude.JunkMail] Messages slipping through JM > Why not use the command in Declude to do this directly? In looking at > the manual it appears to be ROUTETO . You could do > this for the > WEIGHT20 Piece. I'm not sending all WEIGHT20 to a separate e-mail address. I'm shooting it to a sub mailbox. For this I would use the MAILBOX action, and that requires PRO which we do not have. Jason --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Messages slipping through JM
- Original Message - From: "Grant Griffith - Declude JM" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, June 29, 2004 4:19 PM Subject: RE: [Declude.JunkMail] Messages slipping through JM > Why not use the command in Declude to do this directly? In looking at the > manual it appears to be ROUTETO . You could do this for the > WEIGHT20 Piece. I'm not sending all WEIGHT20 to a separate e-mail address. I'm shooting it to a sub mailbox. For this I would use the MAILBOX action, and that requires PRO which we do not have. Jason --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Messages slipping through JM
- Original Message - From: "Ken Weise" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, June 29, 2004 4:16 PM Subject: Re: [Declude.JunkMail] Messages slipping through JM > If this was forwarded from another account, it would skip the IMail rule. I > just went through that, when one of our sales people went on vacation and > forwarded their mail to the CEO, who then received all their spam. :-) Is this by design? I'm confused now (doesn't take much). So an e-mail comes in, it gets processed by declude, processed by rules, and delivered. Now we take that same e-mail and forward it to my account. Where does it go south, does it go from declude to an odd 'forward' process bypassing the rules, and straight to delivery? Thanks Jason --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Messages slipping through JM
Sorry Scott, should have been more clear. We don't do a declude Hold at Weight20, we do a warn, and then I have a rule in Imail (7.15) that sends anything with "WEIGHT20" to a spambox submailbox. Here are the JM logs: [trunc] 06/29/2004 14:49:58 Qc7df09da00840372 L1 Message OK 06/29/2004 14:49:58 Qc7df09da00840372 Tests failed [weight=39]: SORBS-DUHL=IGNORE DSN=WARN IPNOTINMX=IGNORE SPAMCHK=WARN WEIGHT10=WARN WEIGHT20=WARN CATCHALLMAILS=IGNORE 06/29/2004 14:49:58 Qc7df09da00840372 L2 Message OK 06/29/2004 14:49:58 Qc7df09da00840372 Tests failed [weight=39]: SORBS-DUHL=IGNORE DSN=WARN IPNOTINMX=IGNORE SPAMCHK=WARN WEIGHT10=WARN WEIGHT20=WARN CATCHALLMAILS=IGNORE 06/29/2004 14:49:58 Qc7df09da00840372 L3 Message OK 06/29/2004 14:49:58 Qc7df09da00840372 Tests failed [weight=39]: SORBS-DUHL=IGNORE DSN=WARN IPNOTINMX=IGNORE SPAMCHK=WARN WEIGHT10=WARN WEIGHT20=WARN CATCHALLMAILS=IGNORE 06/29/2004 14:49:58 Qc7df09da00840372 L4 Message OK [/trunc] So I'm gonna answer my own question here, and say that Declude got it right, but Imail didn't catch it in the Rule. Anyone have a clue on why Imail rule wouldn't catch the text WEIGHT20 using this rule: H~(WEIGHT20):spambox TIA Jason - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, June 29, 2004 3:11 PM Subject: RE: [Declude.JunkMail] Messages slipping through JM > Jason, > > What does the Declude log file indicate for these messages? > > Best Regards > Andy Schmidt > > H&M Systems Software, Inc. > 600 East Crescent Avenue, Suite 203 > Upper Saddle River, NJ 07458-1846 > > Phone: +1 201 934-3414 x20 (Business) > Fax:+1 201 934-9206 > > http://www.HM-Software.com/ > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Messages slipping through JM
We have had a many e-mails showing up as of late that have no subject/body. Further investigation shows that these messages are far above our hold weight. The latest one I've received has a subject, but no body. Here are the headers from the message: Received: from host107-183.pool80181.interbusiness.it [80.181.183.107] by areatech.com (SMTPD32-7.14) id A7EC9DA0084; Tue, 29 Jun 2004 14:50:04 -0500 From: <[EMAIL PROTECTED]> To: Subject: Pay less money - receive more software.. It's too simple. ;-) quibble Date: Tue, 29 Jun 2004 14:48:37 -0600 Message-ID: <3[4 X-RBL-Warning: DSN: "Not supporting null originator (DSN)" [2-19-9800] X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 12. [2-36-12000] X-RBL-Warning: WEIGHT10: Weight of 39 reaches or exceeds the limit of 10. [2-37-12800] X-RBL-Warning: WEIGHT20: Weight of 39 reaches or exceeds the limit of 27. [2-40-14000] X-Declude-Sender: [EMAIL PROTECTED] [80.181.183.107] X-Spam-Tests-Failed: SORBS-DUHL, DSN, SPAMCHK, WEIGHT10, WEIGHT20 [39] X-UIDL: 385498355 Can someone shed some light on what may be causing this to be delivered? Thanks Jason --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] nospamproxy
Anyone here try using Nospamproxy? Looks promising http://www.nospamproxy.de Please let me know. Jason --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
