Re: [Declude.JunkMail] MAILBOX spam
That's just how IMail works. Thanks. Sheldon --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] MAILBOX spam
I sent this to the wrong list earlier... When using the MAILBOX action for test failures, we have noticed that forward or alias addresses do not get sent to the spam folder but actually get delivered to the main inbox. Do we have something configured wrong or is there way to fix this or are we stuck with it? Sheldon --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Spam getting through
This is a good argument for the delayed-scan-and-deliver feature I suggested previously. The porn guys you are probably talking about we call the "mad-lib pornsters". Every day or so they will come out with a brand new set of domains delivering a wide array of porn traffic. Actually, our robots usually manage to pick up quite a bit of it, but they have huge bandwidth behind them so they get quite a bit of content out before the updated rules can go in place. It is obvious they are using "disposable" domain names. They come in flavors like gbzqrx.info and so on. By the time my customers check their email, forward it to me and then I forward it to Sniffer, it is probably 6-24 hours old. How many millions have been delivered in that time? Ugh... Sheldon --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam getting through
We have been experiencing the same thing. The spammers seem to be getting better at passing filters and probably changing IPs and domains as fast as they can be listed in the spam databases. We have some really hard core coming to a few users and passing all tests including Sniffer. Most of it is porno and they are not failing mailpolice-porn on top of sniffer-porn. John, the logs are fine, they just do not seem to fail ANY tests. They look like a normal email. Sheldon --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Anti-Virus Feeds for Web Site
I've been a little unimpressed by their AV feeds. I'm curious to know if there are any other good ones out there. We use Sophos feeds on our site: http://www.sophos.com/virusinfo/infofeed/ Sheldon Sheldon Koehler http://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam getting through
Lately we have been seeing a lot of spam getting through passing ALL tests. We are starting to get complaints from customers on this and I wonder if we are alone in this problem or not. These are all coming in with a weight of 0, no whitelisting or any simple tests are failing (i.e. rDNS). Sheldon --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Per user configuration web interface?
C:\imail\immsgexp.exe -td:\imail\domains\yadayada.com\users -d7 -mspam Thanks Dave! This is what I was looking for. Will I get a help screen with the /? flag or is there more information on the flags for this? Sheldon --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Per user configuration web interface?
There was discussion about a year or so ago and I was part of it, but I cannot find the threads or info. I sold my company in April but I am helping their new guy get up to speed on Imail/Declude/Sniffer and so on. Someone made a way for users via the KWM to configure Declude themselves. We can figure out most of the scripting for this, but if someone would share theirs, it would be greatly appreciated! Mostly I need to know how to limit the number of days Spam is kept in the Spam folder? A blanket delete of old email would delete email in all folders correct? Right now we just delete it all to keep it from building up and filling the hard drives. Sheldon Sheldon Koehler, Former owner/partnerhttp://www.tenforward.com Ten Forward Communications --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Gibberish and Anti-Gibberish Testing
> I know [EMAIL PROTECTED] has new filters out in his Beta area that > don't utilize the anti-gibberish test. There is just a gibberish and > a gibberish-sub tests. I was beginning to wonder as nothing new has been posted at http://www.mailpure.com/software/decludefilters/ since last year. Sheldon Sheldon Koehler, Sr. SysAdminhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Surbl.org
> OK, just give me some time to add comments to the scripts. I will > post a download link tomorrow or so. Very cool Roger!!! Sheldon Sheldon Koehler, Sr. SysAdminhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Surbl.org
> However I hope to see SURBL soon as an additional Declude test. I just got caught up on this thread and checked out the website for SURBL and I agree! This would help with the stuff that passes all of the other tests. Sheldon Sheldon Koehler, Sr. SysAdminhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Habeas win judgment
> Just noticed this in the news and didn't see it on this list. > http://www.theregister.co.uk/2004/04/07/habeas_spam_lawsuit/ > Glad they are doing something about it. "Meanwhile Habeas is implementing technical modifications that will render future Habeas Warrant Mark spoofing attacks ineffective." It is the above sentence that caused me to remove Habeas from our server within days of implementing it. It is too easy to spoof and Spam was getting past because of it. I still have not seen anything get past Bondedsender. This is a good way to do this in my opinion! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
> here is also a list of rbl's that we trust and directly bounce: > (most of them are spam traps, open relay lists or filters by country so you > should be safe) What if we get a lot of legit email from these countries? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Yahoo, Sendmail to test antispam system
Anyone have any comments on how effective this will be (or not...)? http://news.com.com/2100-1032_3-5164279.html?tag=nefd_top Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Domain Registrar recommendation
> Very heavy claim! Can you support this information...not doubting what you > are saying but it would be nice to have some sources that can prove what > you say. Your log files. Just look to see who the registrar is on any of the spammers domains. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Domain Registrar recommendation
> http://resellers.tucows.com/ > > I don't sell registrations because of the profit, I sell them because I > have a certain level of control and don't have to wait on the phone for > 30 minutes only to have to explain to tech support how things really > work and try to convince them to forward me to their supervisor (good > luck with NSI). I charge between $15 and $25 per year, but I take care > of everything for my customers. We pretty much do the same thing and are very happy with OpenSRS. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hey Scott - Here's a feature request
> Top 9 reasons not to use C/R Very well said and I concur! Since C/R started, I have had several friends not take my advice and use it anyway. They all stopped within a couple weeks of starting. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bonded Sender
> Yep, been using BondedSender here for a long time, as well. I was asking > about how we might use SenderBase: www.senderbase.com OK. I missed that part... I will wait for Cyan's reply then too... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bonded Sender
Bill, This is my line for using BONDEDSENDER with Declude. It is in the Global.cfg file: BONDEDSENDER ip4r query.bondedsender.org 127.0.0.10 -10 0 We have been pleased with it so far. I think we have been using it since last spring sometime. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] RR.COM
> Please let the list know if this works, though I'm just stabbing in the > dark of course. I've seen places as large as GM block on just reverse > DNS alone, which is pretty stupid in my book, and that warning from > AOL's HELO has been there for months at least, and shows that they have > at least considered this idiotic move. I would LOVE to see AOL start blocking on RDNS! If they do it, then we can start doing it. Then within a few months, all of the legitimate mail servers on the planet will have proper RDNS and the Spammers will have a much harder time with life. Spam will decline a LOT!!! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sniffer
> I am considering Maps too. But it's $1500/yr. Anyone using them? I have problems at $1500/yr. If it was like $500 I would probably be using it. It was a good list when it was free and I am sure it is still a good list. I just cannot justify the expense for it. For now Sniffer is the only paid add on to Declude (well F-Prot for the anti virus...). Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] sniffer
> Is sniffer worth the $300/year? > > Thinking about trying it. I think I tried the demo for about 2 days before sending my CC number in. Well worth the money in my opinion! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] EASYNET tests going away December 1
Andy, What weight to you hold and delete on? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, November 28, 2003 8:43 AM Subject: RE: [Declude.JunkMail] EASYNET tests going away December 1 NJABLRELAYS ip4r dnsbl.njabl.org 127.0.0.2 4 0 NJABLDUL ip4r dnsbl.njabl.org 127.0.0.3 4 0 NJABLSOURCES ip4r dnsbl.njabl.org 127.0.0.4 7 0 NJABLMULTI ip4r dnsbl.njabl.org 127.0.0.5 5 0 NJABLFORMMAIL ip4r dnsbl.njabl.org 127.0.0.8 8 0 NJABLPROXIES ip4r dnsbl.njabl.org 127.0.0.9 8 0 AHBLRELAYS ip4r dnsbl.ahbl.org 127.0.0.2 5 0 AHBLPROXIES ip4r dnsbl.ahbl.org 127.0.0.3 8 0 AHBLSOURCES ip4r dnsbl.ahbl.org 127.0.0.4 7 0 AHBLPSSL ip4r dnsbl.ahbl.org 127.0.0.5 5 0 AHBLFORMMAIL ip4r dnsbl.ahbl.org 127.0.0.6 8 0 AHBLENDUSER ip4r dnsbl.ahbl.org 127.0.0.9 5 0 AHBLEXEMPT ip4r exemptions.ahbl.org * -8 0 SORBS-HTTP ip4r dnsbl.sorbs.net 127.0.0.2 8 0 SORBS-SOCKS ip4r dnsbl.sorbs.net 127.0.0.3 8 0 SORBS-MISC ip4r dnsbl.sorbs.net 127.0.0.4 8 0 SORBS-SMTP ip4r dnsbl.sorbs.net 127.0.0.5 5 0 #SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 3 0 SORBS-WEB ip4r dnsbl.sorbs.net 127.0.0.7 8 0 SORBS-BLOCK ip4r dnsbl.sorbs.net 127.0.0.8 6 0 SORBS-ZOMBIE ip4r dnsbl.sorbs.net 127.0.0.9 6 0 SORBS-DUL ip4r dnsbl.sorbs.net 127.0.0.10 5 0 AHBLDOMAINS rhsbl rhsbl.ahbl.org * 5 0 SORBS-BADCONF rhsbl rhsbl.sorbs.net 127.0.0.11 5 0 SORBS-NOMAIL rhsbl rhsbl.sorbs.net 127.0.0.12 7 0 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Comments on this ?
I would probably place a Postfix/IMGate box in front of the Imail server at this point. Postfix can deal with this load a lot better than Imail. Use the RBL's on Postfix and let Declude/Imail do what they do best in the weighted tests, filters and so on. This is what we do and it works very well for us. Our setup has 2 Postfix boxes as MX10 and MX20. They get the brunt of the Internet force. They then pass on to the Imail/Declude/Sniffer box. This last box is not listed as an MX. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "IS - Systems Eng. (Karl Drugge)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, November 07, 2003 8:41 AM Subject: [Declude.JunkMail] Comments on this ? I have a client that is getting HAMMERED by mass SPAM emailings. In excess of 500,000 emails a month are getting deleted on an 80 user network. His Internet connection is totally flooded. I've been working with him over the past 9 months or so and have been trying to track things down to a single spammer or set of spammers. First, he is the target of the 'reflected email" attack/delivery system. He was getting loads of these. He still gets these, but only about 100-150,000 a month. The rest are pure garbage items, at a much heavier than normal load of SPAM for a site of his size. What's curious is that I have been attempting to run MID level logging in order to get the connecting IP's, reasoning that if I could find the IP ranges, I could blow them off at the firewall and spare DECLUDE from having to process the emails. But, to my surprise, after running a few PERL scripts on the logs, the number of offending IP's, even listing those with over 50 deletes, is something on the order of over 2,000 ! There are no real ranges that I can find. If I include servers sending 10 emails that DECLUDE deletes, I have over 5 thousand for the month. It's a massive deluge from thousands of servers sending 4 or 5 emails a day. It's beginning to look that whoever is sending the mail has hundreds of zombie 'bots out on the internet and can direct them at will. Short of telling him he needs to just dump his domain name and get a new one, or co-locate a server upstream at an ISP for Declude, I am out of answers. Is anyone else seeing this type of attack ? Are Spammers now using zombie 'bots ? Karl Drugge --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Do you use ColdFusion? - Java?
> I'd gladly pay for something that worked. I did not expect it for free. I have the KWM price in mind as a point I could get my partners to go for. Any higher than this and it would be a very hard sell for me. So this means a lot of people need to be interested in it! Our local competition uses Postini. And I have lost a few customers over to them as people do seem to like that interface. However, I have thrown out the "security" thing to muddy the waters ;-) We do not send their email "out" to someone else's servers... I let them draw their own wrong conclusions... But if I could lighten my own load and give users an easy to use interface, I would be extremely happy! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Do you use ColdFusion? - Java?
> As a dedicated Java app it would be cross-platform compatible (in > theory), relatively secure, lightweight, and could be configured to run > along side any web services that might be present (such as KWM). In an > IMail environment we could even present a postini-like interface for > users to "release" their held spam - and generate accurate false > positive reporting in the process, etc... (these are the ideas we have > anyway...) > > Thoughts? How much and when will it be ready? ;-) Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Do you use ColdFusion? - Java?
I am not a programmer by any stretch of the word! Bit I would love to see a user interface and a domain interface for Declude Junkmail that works from the KWM menus. I have tossed around this idea before but always get distracted with other projects. I do not remember who (I could search my email...) I talked to this past spring, but someone was working on this I think. I never heard anything more so I never followed up (my own fault). We host about 150 domains on our Imail server. There are about 5000 mailboxes on it. I spend a couple hours per day tweaking settings answering Spam related email and tracking down FP's. If I could offload some of this on the users in a way that would be easy for them, I would love it! The Auto Whitelist is OK, but we have had several people put [EMAIL PROTECTED] and then complain they are getting tons of Spam. I did like Scot's interface, as it was simple and clean but having user remember another password would not be a good option. And since our KWM sees a lot of use, having the menus there would be easy for users to find it. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Filter client.attbi.com
Can I safely block email that comes from client.attbi.com? I see an aweful lot of spam from this network and I think this is just dialup or DSL? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Body filters
> Oops, maybe that wasn't off-list afterall :) I hate it when that happens ;) John, we use Sniffer for that very reason. It was well worth the money instead of me spending all the time needed to do body check rules. And this is the stuff that changes the most. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS redux
Ebay and greeting card companies fail the SPAMDOMAINS test on a regular basis. Since they also fail the nopostmaster and noabuse and a few other small ones, this adds up to a reject. Any suggestions on keeping these false positives from happening? Christmas is coming and the E-cards are going to get real busy again... As Matt has demonstrated with his wonderful filters, is there a good way to set up and AntiSpamdomains test? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Test suggestion
> 1: REMOVE all HTML > 2: Test & see if anything is left behind.. > > That will take care of 100% of JPG only emails.. As a photographer (part time for over 30 years...), I often send emails that have a subject and an attached JPG or PSD file(s). I know I am not alone in this method of sending image files! But a weighted test would be very nice to add. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] WHITELIST REVDNS and HELO for Kami (and others)
> Just for the records.. Not that it truly matters.. But it should be "his > normal ftp site." :) [at least based on my current understanding of myself] His email must be victim to the spill chucker... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "He who sends a message by the hand of a fool Cuts off his own feet and drinks violence." -- Proverbs 26:6 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Watch out for your white lists...
> Perhaps we should start a collaborative SCAM filter file.. > > Lets have our scam URL's and content filters posted so we can trap them even > if we have not seen them yet.. The problem with this is the scammers are most likely on this list too... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Imail Issues
Kudos John! Already filled in and good luck. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, October 03, 2003 11:30 AM Subject: [Declude.JunkMail] Imail Issues Hello all. In an attempt to help everyone with issues than have been reported lately, I have put together a survey that I would like everyone to take. I will then post the results here as well as send them to Ipswitch for review. I know we are all busy, but if I can take the hour it took to create this, you can take 5 minutes to fill it out. No tracking is being done, only the answers. (No IPs, No countries, No browser type, no e-mail, nothing.) The link is this: http://www.createsurvey.com/cgi-bin/pollfrm?s=11436&magic=HoUsvn3wsnt8eJb There are no images, hence the red boxes. (Hey, what do you expect for free?) I will leave this up until next Wednesday night, October 8. Thanks for you participation. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Record header size?
I got this spam last night to my personal address. I have never seen a header like this one!!! Anyone know what a Transfer Stamp is? Received: from Hyperion.tenforward.com [65.161.10.61] by tenforward.com with ESMTP (SMTPD32-7.15) id A6912F0A0076; Tue, 30 Sep 2003 21:22:41 -0700 Received: from optintravel1.us (unknown [69.42.143.47]) by Hyperion.tenforward.com (Postfix) with SMTP id E2C483B5F1 for <[EMAIL PROTECTED]>; Tue, 30 Sep 2003 21:25:06 -0700 (PDT) X-transfer-stamp: RXJBXM+BEDUAYHHM+WXTOIQEBV$OCGTXLHWSYVFYFLDL+JLCMSD_U$_CBIQQOMOJRRNTO$WBNEVL HNOLMA$XK.IGFCEOOSFGKGRRCS+MFI+ETUTWQJOCYGEN-SSYYBUURKXJEC Received: from 3ff.optintravel1.us by optintravel1.us for [EMAIL PROTECTED]; Tue, 30 Sep 2003 21:20:52 -0800 X-TRANSFER-STAMP: 174t6Ohtq58s1AhN X-TRANSFER-STAMP: JQUCJGLWPJETFFL$IPDGHHHPUBBLPI X-transfer-stamp: 9gho0p1YeTLwL1QQ6 X-TRANSFER-STAMP: VYAQMEDODFPBSVSSHV+EXDM_MJHRLQQJTBPSDX-KKXFGEMFXO_QH_VTWBIUIOABLGRRCWAB_CIXG QOXKEBSOJSD.UYYWGGUMGPBX_DEADGRPTEUKQY+XE_XEFKGNQYS.KOIJNUVKHOUEYL.OTPB+GINT QQDHDFTICNOXW x-transfer-stamp: 94u7Gv752j9m23Ai5n8a X-transfer-stamp: CFGFOKPKFYPNJSALJ-_YJQGI+KGFYYRTTEQXVW$QAMJJC+IACS+L-QTESLTOMIARUUVN$HCULRFK OAWC_KDJMHWRVXTPXMSPJUT-_MSUJH-JUMXXCBEHEHYWROH$UETDOBMQBTPQVE.YYTBJ_TJNXGRQ FTCUNAGA-QOIGAWXYVDMCKR X-transfer-number: 30303223596965383 x-transfer-stamp: LJPLCPBQVMLENFICPHW X-TRANSFER-STAMP: UIX$XSFLPJTSC_RUGPBWBG.LPIULIGYKW_MEBLPS_ML_WKYXX X-TRANSFER-NUMBER: 306.5036677+1779363422309925.578$3037319+021297363097234_08041425342.1728134 6325239 X-transfer-number: X-TRANSFER-NUMBER: 918400437671857331 X-transfer-stamp: epqxwowiuwoyjuexpu X-transfer-number: 6EQb6lb58g1d93al1k6v X-transfer-stamp: 9lN98vSaS2bm8yh07 X-transfer-number: 4 X-transfer-stamp: TMYTCVIELIHUQKSSH-_PSBVO+IALOW-KKXVVWYPKYSI$NCMMLGLCINIIWWEP$MWUYSJYENQRQVA- C_ENTGIVLBE+JNABMJXNITVN.MBRGDCXYKAXRXW.UVSMWAVTEOUCNRNPH_CGJUGAMPCHDBP_GSBT PCWCNPELI.U_DUARWJAQWW x-transfer-stamp: YDHYJEYWWLAEJRXOKBY Date: Tue, 30 Sep 2003 21:20:52 -0800 X-transfer-stamp: 1xJ9YpD3XU0nP4y3u x-transfer-stamp: YYGYEIWCXALCDSREBVTV x-transfer-stamp: mgpouyordmkhprdwwah x-transfer-stamp: PIFj1s1teG8qbQw29s3 X-Priority: 3 (Normal) X-transfer-stamp: 2YA3Bo0yxw8x23Nh0 X-TRANSFER-NUMBER: EWUmJFI8dH6anOnIeu0N x-transfer-stamp: hujqiseexigavli X-TRANSFER-NUMBER: 1748830435840639 X-TRANSFER-NUMBER: 5uDsQq857v2w9634NG X-TRANSFER-STAMP: NPK-LIHKU+LEVNKBIV.GJOP.UW.GXTKHAHWSAXNGQVF+LOXXC$WN-JGQFVXAUCJDOKNWG-ILJYWO VD-MYLL_HGYOYTFVSKEYWJOK_UILHIQRYDNUEL$FGKBDXQWJF x-transfer-number: 4LaW7u7kFd7v8M2o3My8 X-transfer-stamp: wtvofslhdmcqyusf X-TRANSFER-STAMP: jsculffwtwoeuleg X-transfer-number: 23819-5627439567334_552023743733098+5290019005_364052966076.959252299850 4396495$096224019487-700_1939124.29490481964496+28867323429969$7245923936584 684243+615024527 Importance: Normal X-transfer-number: t6jp9nHdOs0dP5cc9aO x-transfer-stamp: CHLGFQYIJXOQQBA x-transfer-stamp: MEONYRDU+AONJGS_EBCTN-LELHUIJ$$FUWVJKOISIEA+EBFNMNS$Q.PUKPSKLTGFTNM+JTTITJ_J HI_ANGW+XOXIWG$FBESHIFBUCY x-transfer-number: 02861418794$6+6452096-834207359937+5970421112764_79438978957140.312483955+02 _201645-5615297083$48389001420377653$19832_52877699442989858_395207786920 X-TRANSFER-STAMP: exfsndwielhrpmcrhqk X-TRANSFER-STAMP: POR.XOYJYNFBSUP_VNALHWPAJIXF_ x-transfer-stamp: TU06MwJXvY8m2MR29y2 X-Sender: [EMAIL PROTECTED] x-transfer-number: 4Gmv6Q63Hu8k3K8u4l6S X-transfer-number: 03387308967075484 X-transfer-stamp: olnnhsklijtprqqxjqvm X-TRANSFER-STAMP: qvhxofcdmitrvmudyxyu X-TRANSFER-STAMP: TFEGGXCBEHSBQXWVGA x-transfer-number: 6928783_48920370858.79$378679104+9035601783-372825_2701289181$53 X-transfer-number: 51784015289576603 X-TRANSFER-STAMP: 1SC37khjfsyjr1LX x-transfer-number: 95_14298652_65322919829934430 X-TRANSFER-NUMBER: 6i5w0lTDoI6f0f3y X-transfer-stamp: I_MKJEQLGQCLOEFVOQR+MTFXXTGEPVB.SAFB_MUDCJXHHQCQQKJV.JYPUIU-BFHSXTRNCOR+MIFM ITQY-SWERY.IUDVWKMBELBYXC$RE-MOEXQJD$VDXAV_FXKRRGYWKEXAEBE x-transfer-stamp: YOHCJTBXGYMARQTWQYH x-transfer-stamp: .LNMK_HXDPQFC_BU+BHFPIPQR+LVLDIRIRHIXM-PA.LCVEVGWYPGKBNU_TONBHTW-GMPPYRVLWG$ OWRMRRHGUAEH+DSVGETCGLELM x-transfer-stamp: BGEJMLWGOQCPKULPV x-transfer-number: 576q5m167P3n9ggl x-transfer-stamp: ktamcudxfpvyilg X-TRANSFER-STAMP: JPOHXGYSDOWQSEF X-transfer-stamp: bwkeebuwypatrqxvwd X-transfer-stamp: RTIDOPPKCIYJPVXJTG x-transfer-number: 0801265723816531790 X-transfer-number: 3780+987394787701$42228_3_96786.9$130651073603497.36775887665987 X-transfer-stamp: QKNSWEFBVO X-TRANSFER-STAMP: YTLGSV+HQMUDKQTH-WXJKUKFJRHDQBW$OAQ+MJYUWHGEI.UMINMMFBHBSSH$OPVFTA$IYUX.UJTX NNF-_VID.YAKIFNHXSQKS-QG.RCAOWP X-TRANSFER-STAMP: 99h29SFF6w1p8aF6D X-transfer-stamp: 7lRh6r8Hc9mo2tflilQ x-transfer-stamp: HSQBYTNGAPTYYPELN X-TRANSFER-STAMP: tfxarvektegltgo x-transfer-stamp: kjnwleedgrgnpbcyee X-TRANSFER-STAMP: asankqhhfscmjktj X-TRANSFER-NUMBER: 87840615506321856 X-TRANSFER-STAMP: IKTQUX_RCBKIWJHNVPLP+ESLQPBV_ISLCXOLOQY-CSQIM+JYMB.T-YBVXXDVYCYQ+SH_ECJBXYTY EVWHNQ X-TRANSFER-NUMBER: -54928360_3079896$88168883$5396346.688735.6 X-transfer-stamp: du
Re: [Declude.JunkMail] Log to syslog option
> This query produced this result in less then 10 seconds. So again, if you > or anyone else is interested, I will spend some time putting together a > cheat-sheet and reference guide. I would appreciate it a lot! I can also add this to the 3 ring binder I keep in case I am unable to be here for whatever reason... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Log to syslog option
What John said... This is a Windows machine and the only way I know to search log files is with Notepad and the Find function. Not a lot of fun with large files! Inquiring minds want to know... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, September 29, 2003 7:41 AM Subject: RE: [Declude.JunkMail] Log to syslog option > So I will ask you the same question, why do you need to open the file for > viewing? Why not just parse what you are looking for from the command > prompt? There must be something I'm not considering Some of smaller guys are not versed enough in command prompt commands to generate and find the information we want to review. Now, if some one wanted to either put a guide together for us or point us at a good resource... Example, sometimes I need to review exactly what happen on a particular message. How do you pull all the log lines for a particular message? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Auto White Listing
Scott added this in 1.76 beta: BYPASSWHITELIST bypasswhitelisting 20 3 0 0 This tries to defeat this if the email has a weight of 20 and has 3 or more recipients. I enabled it right away and have not seen the usual emails I had been getting because one of my users is whitelisting [EMAIL PROTECTED] Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Attacks prompt shutdown of antispam lists
> I've said it before, I'll say it again. It's time to leverage the power > of the network agianst abuse on that same network. Pete, You are preaching to the choir ;) When will it be ready? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "He who sends a message by the hand of a fool Cuts off his own feet and drinks violence." -- Proverbs 26:6 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Attacks prompt shutdown of antispam lists
> DNS blacklist databases are very much larger than the Sniffer rule set > files. OK, bad idea... Sheldon --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Attacks prompt shutdown of antispam lists
I get the Sniffer updates several times per day. And if it was a CNAME and not an IP, it could be changed. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "He who sends a message by the hand of a fool Cuts off his own feet and drinks violence." -- Proverbs 26:6 - Original Message - From: "Bill Landry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, September 26, 2003 11:00 AM Subject: Re: [Declude.JunkMail] Attacks prompt shutdown of antispam lists > You would have to download the lists quite often to stay current, and they > are rather large. And if the site is being DDoSed, and it cannot even > respond to regular DNS queries, how are you going to be able to connect to > download the updates? > > Bill > - Original Message - > From: "Sheldon Koehler" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, September 26, 2003 10:50 AM > Subject: Re: [Declude.JunkMail] Attacks prompt shutdown of antispam lists > > > > > Three Web sites that provide spam-blocking lists have been forced > > > offline as a result of crippling Internet attacks in what experts on > > > Thursday said is an escalation in the war between spammers and opponents > > > of unsolicited e-mails. > > > > These lists that we all have come to love, could be made available via FTP > > and we can host them on our own servers... > > > > Sheldon > > > > > > Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com > > Ten Forward Communications 360-457-9023 > > Nationwide access, neighborhood support! > > > > "Whenever you find yourself on the side of the majority, it's time > > to pause and reflect." Mark Twain > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Attacks prompt shutdown of antispam lists
> Three Web sites that provide spam-blocking lists have been forced > offline as a result of crippling Internet attacks in what experts on > Thursday said is an escalation in the war between spammers and opponents > of unsolicited e-mails. These lists that we all have come to love, could be made available via FTP and we can host them on our own servers... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam lists
Darrell, Does DLA also do Imail log files? I would love to have a program that can email me a summary every day and then a larger report text file I can look at if needed. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Some good info on the Verislime coup
http://homepages.tesco.net./~J.deBoynePollard/FGA/verisign-internet-coup.html Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] A slight increase in spam not getting caught thanks to Network Solutions
Scott, Will adding 64.94.110.0/24 to the ipfile block these? BLACKLISTIP ipfile D:\IMail\Declude\ipfile.txt x 20 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] AUTOWHITELIST
Never mind... I found that I had saved it from a web page someone sent me and I have a text file already. Here is the text in case someone else wants it: Personal Whitelist A personal whitelist allows you to accept email messages from any email address you want no matter how many Spam tests the message actually fails. There are three options currently available in the personal whitelist feature. You can whitelist individual email addresses, whitelist all messages from a certain domain and, if you do not want the anti-Spam service at all, you can whitelist all messages sent to your address. E-mail Options - 1. [EMAIL PROTECTED] - whitelist a single email address. 2. [EMAIL PROTECTED] - whitelist all messages from a certain domain. To whitelist all messages from hotmail.com enter [EMAIL PROTECTED] For all messages from aol.com enter [EMAIL PROTECTED] 3. [EMAIL PROTECTED] - whitelist all messages from everyone (turns off Spam filtering). Enter [EMAIL PROTECTED] to whitelist all messages sent to your address. >From that point on, any message sent to your e-mail address will be checked against your address book in WebMail. If the "from" address of the message is in your address book, you'll receive the message no matter how many Spam tests the message fails. If the "from" address is not in your address book, the message will be processed by the anti-Spam system as it normally processes messages. To add an email address to your personal whitelist: Go to http://mail.tenforward.com and supply your e-mail address and your e-mail password. Once you are logged into WebMail, click the Contacts link at the top right. You will see some examples on that page of how to add an address or addresses to your address book. If you have further questions, please email [EMAIL PROTECTED] or call our help desk at 360-457-9023. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain > When Scott added the AUTOWHITELIST ON option to Declude, someone posted a > wonderful text file explaining to end users how to add email addresses to > their webmail. I cannot find this. Can someone post it or email a copy to me > please? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AUTOWHITELIST
When Scott added the AUTOWHITELIST ON option to Declude, someone posted a wonderful text file explaining to end users how to add email addresses to their webmail. I cannot find this. Can someone post it or email a copy to me please? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Increased AOL, Hotmail, Yahoo, etc. false positives positives
The real irony about this is [EMAIL PROTECTED] actually works! Go figure... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, September 04, 2003 3:30 PM Subject: RE: [Declude.JunkMail] Increased AOL, Hotmail, Yahoo, etc. false positives positives It is known that AOL, Hotmail and Yahoo will often fail NOABUSE, NOPOSTMASTER and REVDNS, as they are not setup nor do they care. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Thursday, September 04, 2003 1:36 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Increased AOL, Hotmail, Yahoo, etc. false positives positives It's just you :) The From address is often forged. The address that matters the most is the server from which the E-mail came, which is listed in the top of the headers, i.e. Received: from declude.com [24.107.232.14] by igaia.com with ESMTP (SMTPD32-7.13) id A78F250118; Thu, 04 Sep 2003 15:50:39 -0400 The information in that line in the messages you receive is what is responsible for tripping most of the tests you indicated (real AOL trips NOPOSTMASTER for instance). If you reverse lookup the IPs that you find there, my bet is that they won't match the domains of the From addresses they are using. The software and your filters are actually doing their job very well if those messages are failing. Matt Paul Hung wrote: Has anyone found that AOL, Hotmail, and Yahoo.com addresses have been failing on the following tests: helobogus, nopostmaster, noabuse, revdns These e-mails usually fail these four tests, and thus trigger my Weight10 rule. I performed a reverse DNS lookup on several of the IP addresses and found that there was no entry for reverse DNS. Any ideas? Is it just me? - Paul --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spammers know OSRelay is down too.
> Number of spam messages not caught has gone up since the tests went down. I have seen this here too. I have been testing some of the other lists but so far no noticeable change for the good. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Declude notification and SoBig assault.
> >What opinion do others have about these notifications? > > They absolutely, positively should not be sent out for forging viruses > (such as Sobig). I turned off the postmaster and other postmaster emails the second day we ran Declude Virus. It was a huge waste of time. Then I have tried to keep up with the viruses that forge the sender and block them. I am now thinking of turning the notifications off completely and permanently. The downside is they have been a decent source of advertisement... but with so many being sent this week, they have become Spam! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Ebay and Spamdomians
I searched but with so many emails regarding SPAMDOMAINS I could not find the answer. I know it was discussed a few weeks ago about email coming from Ebay and legit greeting card sites that use the senders email address. Email from domains in the SD get bounced. Any ideas? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Ebay and Spamdomians
> My current SPAMDOMAINS has a weight of 10. The hold weights on most of my > domains is well below 10 so almost every message failing SPAMDOMAINS is > held. My current SD.TXT file has 118 lines in it. I'll see maybe 1 legit > e-mail caught by SPAMDOMAINS for every 1000 messages, i.e. a message being > sent from a spam domain through an alternate. So far I've been able to > tweak SD.TXT and add an alias to deal with those. You mean to tell me none of your users use Ebay? I you were to sell something on Ebay using your email address you use on this list, it would come from Ebay's servers but saying it was your email address. In the case of Hotmail, the reply to is [EMAIL PROTECTED] but was sent from ebay.com. This will fail the SD test for hotmail.com. I would love to see a copy of your SD file! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] AVG emails bouncing?
> In this case, you would really need to see at least the full bounce message > (which would determine if IMail or Declude bounced the E-mail, whether it > was a real bounce or a "mailbox full" bounce, etc.). Sniffer is the cause of the bounces and I have not had any response from them on this. I hate to disable sniffer altogether! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] AVG emails bouncing?
> Do you use the BOUNCE action on any spam tests? The presence of the footer > by itself should cause any problems, unless perhaps you have a filter that > is catching something in the footer. > > In this case, you would really need to see at least the full bounce message > (which would determine if IMail or Declude bounced the E-mail, whether it > was a real bounce or a "mailbox full" bounce, etc.). It was not a full mailbox bounce, but I do bounce some email (I have a narrow weight for this). It was Declude doing the bouncing, but until I can get to the log files, I do not know what test is failing them. I am going this afternoon now that company has left (the outlaws...err inlaws...). Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] AVG emails bouncing?
> Check you body filters, when I scan the bodies for links, I make sure I > don't catch anything like this. But even as hard as I try, I occasionally > get something like this into the filter. I am not using any body filters at all. I let Sniffer do that part. But I have not done any changes in at least a week or longer. The last change I tried was for a header check and I did that wrong and gave up until next week. For some reason I cannot get into my PC at the office with Remote Desktop this weekend (it may have locked up...) and that is usually how I would check log files from home. So I guess I will have to take a walk to the office and look at the logs. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] AVG emails bouncing?
I am not at the office this weekend, so I cannot easily search the log files. A friend emailed me saying that when he let his antivirus software "do it's thing" and attach the footer his email to our server bounced. Below is the footer and I am wondering if anyone else has noticed this? --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.504 / Virus Database: 302 - Release Date: 7/24/2003 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is the list down?
> Nothing personal, but can I start laughing at the AOL of > Domain Name services? By all means do! Notwork Delusions has earned it... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is the list down?
I don't want to go home, I want a vacation! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 31, 2003 9:02 AM Subject: RE: [Declude.JunkMail] Is the list down? > I am not here. Your message was not delivered. Everyone went home. > > John Tolmachoff MCSE CSSA > Engineer/Consultant > eServices For You > www.eservicesforyou.com > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Sheldon Koehler > > Sent: Thursday, July 31, 2003 8:32 AM > > To: [EMAIL PROTECTED] > > Subject: [Declude.JunkMail] Is the list down? > > > > Anyone on? > > > > > > Sheldon > > > > > > Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com > > Ten Forward Communications 360-457-9023 > > Nationwide access, neighborhood support! > > > > "Whenever you find yourself on the side of the majority, it's time > > to pause and reflect." Mark Twain > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Is the list down?
Good to know! I was beginning to think I got tossed from the list as we have had some hackers trying real hard the last 2 weeks to make my life miserable... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "Terry Parks" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 31, 2003 8:52 AM Subject: RE: [Declude.JunkMail] Is the list down? > I'm here. > > Terry > I was just thinking the same thing. Until yours the last message I got was > 12:54PM yesterday. > > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Sheldon Koehler > Sent: Thursday, July 31, 2003 8:32 AM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Is the list down? > > Anyone on? > > > Sheldon > > > Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com > Ten Forward Communications 360-457-9023 > Nationwide access, neighborhood support! > > "Whenever you find yourself on the side of the majority, it's time > to pause and reflect." Mark Twain > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Surfside Internet] > > --- > [This E-mail scanned for viruses by Surfside Internet] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Is the list down?
Anyone on? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Yahoo Groups.
This is an attempt at Monday humor right? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "Rifat Levis" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, July 21, 2003 5:17 PM Subject: [Declude.JunkMail] Yahoo Groups. > Hi , > > I dont know if anyone else has made a suggestion like this. > > Do you think that we can move the declude list to yahoo for the following > reasons. > > People can put their config files and share it with others, we can use the > database feature. > Using the bookmarks ,we can put the link to some interesting web pages , > etc. > > The final decision belong to Scott of course. > > > Regards > Rifat Levis > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelist (was OT: National Do Not Call Registry)
> There are ways to get around the limitation though -- we are investigating > to see if there is a good way that we can do so. I certainly hope so! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] whitelist (was OT: National Do Not Call Registry)
> postmaster to take advantage of declude's inability to separate messages > into multiple copies -- since postmaster is whitelisted, the message was > whitelisted to all recipients. I was told that it is not Declude but SMTP that has this problem (Stupid Mail Transport Protocol). I would love a way around this as we have 3 users that wish to be whitelisted and any spam with their email addy in it, gets to all intended recipients even though Declude would have blocked it to other users. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Issue with Whitelisting
> If you want to whitelist E-mail sent from Paypal mailservers, and you are > running the latest beta, you can use: > > WHITELIST REVDNS .paypal.com Would this same test also work for legitimate yahoo groups email? WHITELIST REVDNS .yahoo.com Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] How can I turn off Virus Scanning on a specific user (Pro Ver)
> Is it possible to remove virus scanning from one user? We do not give users that option here and only 1 person has ever asked. I simply told them it was for network security. They are still a customer! My original reason for installing Declude Virus was I woke up one Monday morning and had like 12 viruses tagged in my inbox by my AV software on my PC. I said enough is enough! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Bizarre DJM Pro Situation
I had a very interesting and nice talk with the CEO of Topica at ISPCon in April. She was very proactive on the double opt-in service and to get their higher level of service, you must be double opt-in only! I encouraged her to set a deadline for everyone on their servers to be double opt-in and stick to it. They are way ahead of the rest of the mail houses and she was very blunt in saying it is actually good for their service as it all but eliminates customer support issues. But she also said she is meeting a lot of unnecessary resistance to it... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "Dan Patnode" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, July 09, 2003 2:48 PM Subject: Re: [Declude.JunkMail] Bizarre DJM Pro Situation .tpcper is Topica. They come out with new spamming domains continuously while keeping their IPs fixed. Blocking their IPs however, also blocks all the newsletters they publish. I've been testing their removal system for the last 2 months, if you enter the recipients email address here with the bottom 2 boxes checked, the tpcper spam stops: http://www.topica.com/help/unsub_all.html Dan On Wednesday, July 9, 2003 9:31, Dan Geiser <[EMAIL PROTECTED]> wrote: >Hello, All, >We are using DJM Pro. I'm having an issue with a message that I don't think >should have been delivered. > >Here are the headers... > >- >Received: from out017.tpcper.com [69.24.239.37] by pagerover.com > (SMTPD32-6.06) id A4323AA80134; Sun, 06 Jul 2003 15:10:42 -0400 >To: [EMAIL PROTECTED] >From: Distribution <[EMAIL PROTECTED]> >Subject: re: Take a Short Survey, Win a New Computer System! >Date: Sun, 06 Jul 2003 12:08:04 -0700 >Message-ID: <[EMAIL PROTECTED]> >Errors-To: <[EMAIL PROTECTED]> >Mime-Version: 1.0 >Content-Type: text/plain >Content-Transfer-Encoding: quoted-printable >X-Declude-Sender: >[EMAIL PROTECTED] >[69.24.239.37] >X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for >spam. >X-Spam-Tests-Failed: OSSRC, EASYNET-DNSBL, IPNOTINMX, WEIGHT05, WEIGHT07, >WEIGHTRANGE05-59, WEIGHTRANGE07-59 [8] >X-Spam-Prob: 0.451398 >X-RCPT-TO: <[EMAIL PROTECTED]> >X-UIDL: 345762330 >Status: U >- > >This message was sent to one of our internal domains "microgallery.com" >which is a host aliases on the IMail site "pagerover.com" > >The active entries in the $default$.junkmail are... > >- >CATCHALLMAILS COPYTO [EMAIL PROTECTED] > >FROMFILE-HOLD HOLD >IPFILE-HOLD HOLD >MAILFROM HOLD >WEIGHTRANGE05-59 HOLD >WEIGHT60 ROUTETO [EMAIL PROTECTED] > >FILTER-BODY-IP WARN >FILTER-BODY-PHONE WARN >FILTER-BODY-URL WARN >FILTER-MAILFROM WARN >SPAMCOP WARN >- > >and associated entries in GLOBAL.CFG are > >- >WEIGHT60 weight x x 60 0 > >WEIGHTRANGE05-59 weightrange x x 5 59 > >FILTER-BODY-IP filter D:\iMail\declude\JunkMail.Filter.Body.IP.txt x 0 0 >FILTER-BODY-PHONE filter D:\iMail\declude\JunkMail.Filter.Body.Phone.txt x >0 0 >FILTER-BODY-URL filter D:\iMail\declude\JunkMail.Filter.Body.URL.txt x 0 0 >FILTER-MAILFROM filter >D:\iMail\declude\JunkMail.Filter.MailFrom.txt x 0 0 > >FROMFILE-HOLD fromfile D:\iMail\declude\JunkMail.FromFile.Hold.txt x 0 0 >IPFILE-HOLD ipfile D:\iMail\declude\JunkMail.IPFile.Hold.txt x 0 0 >- > >For the life of me I cannot figure out why this was delivered to the >recipient. > >Does anyone have any insight? > >Thanks, >Dan Geiser <[EMAIL PROTECTED]> > > >This E-mail is scanned and free from viruses. >www.nexustechgroup.com > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] interesting idea from a bulk marketer
No, I do not think so with this guy. His web page would be simply for adding a domain to NOT send to at all. No personal email addresses to be entered. I would not enter our domain as we are an ISP (and this all started with one of our users not getting his opt-in stuff). But an business or whatever can enter their domain name and no email will be sent to email addresses with that domain name. I do not know how well this would work in the real world, but at the very least it was a nice gesture!!! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, June 27, 2003 2:14 PM Subject: RE: [Declude.JunkMail] interesting idea from a bulk marketer Or is it a ploy to harvest more addresses? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Original Message- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Sheldon Koehler > Sent: Friday, June 27, 2003 1:25 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] interesting idea from a bulk marketer > > Since yesterday I have been in contact with a very helpful mail admin. It > seems one of my users has an outside email address at bigfoot and was > forwarding all his email to our server from there. One opt-in list he is on > was getting bounced. > > In the process of finding out that email sent directly to us was fine and so > on, this guy asked if ISP's would be interested in a blacklist at HIS end. > This idea intrigued me a lot. He is willing to have a web page setup so a > domain can be entered and no email at all will go to any address on that > domain. I can see abuse against him though. > > Nice to work with a helpful bulk mailer for a change!!! > > > Sheldon > > > Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com > Ten Forward Communications 360-457-9023 > Nationwide access, neighborhood support! > > "Whenever you find yourself on the side of the majority, it's time > to pause and reflect." Mark Twain > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] interesting idea from a bulk marketer
Since yesterday I have been in contact with a very helpful mail admin. It seems one of my users has an outside email address at bigfoot and was forwarding all his email to our server from there. One opt-in list he is on was getting bounced. In the process of finding out that email sent directly to us was fine and so on, this guy asked if ISP's would be interested in a blacklist at HIS end. This idea intrigued me a lot. He is willing to have a web page setup so a domain can be entered and no email at all will go to any address on that domain. I can see abuse against him though. Nice to work with a helpful bulk mailer for a change!!! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS
Yesterday I posted that ameritech.net was coming from a yahoo mail server. Today this one os coming from adelphia.net... as a result I have removed amertiech.net from the sd.txt file. Received: from Hyperion.tenforward.com [65.161.10.61] by tenforward.com with ESMTP (SMTPD32-7.15) id A6C982F01F6; Wed, 25 Jun 2003 11:15:37 -0700 Received: from mta8.adelphia.net (mta8.adelphia.net [64.8.50.196]) by Hyperion.tenforward.com (Postfix) with ESMTP id 02D803ADD5 for <[EMAIL PROTECTED]>; Wed, 25 Jun 2003 11:15:35 -0700 (PDT) Received: from nick0hp8iie4j8 ([68.70.184.73]) by mta8.adelphia.net (InterMail vM.5.01.05.32 201-253-122-126-132-20030307) with ESMTP id <[EMAIL PROTECTED]> for <[EMAIL PROTECTED]>; Wed, 25 Jun 2003 14:15:33 -0400 From: "PCP Unlimited Sales Team" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: RE: Undeliverable Mail Date: Wed, 25 Jun 2003 14:14:59 -0400 Message-ID: <[EMAIL PROTECTED]> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600. Importance: Normal In-Reply-To: <[EMAIL PROTECTED]> X-Declude-Sender: [EMAIL PROTECTED] [64.8.50.196] X-Note: This E-mail was scanned for spam. X-Spam-Tests-Failed: Whitelisted X-Note: This E-mail was scanned for Viruses and found clean. X-Note: This E-mail was sent from mta8.adelphia.net ([64.8.50.196]). X-Spam-Prob: 0.05 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 319669515 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whitelisting problems
> We just cam out with a policy to add our helpdesk phone number to the > headers telling them to ask for the mail administrator if they do not get an > email response. This is a good option, providing they know how to get to the headers... The false positives we get are usually from the totally clueless. I have been seeing some strange stuff lately too, like what I posted earlier today with ameritech. I decided to follow suit with not whitelisting postmaster and they will just have to read the body of the bounce message to send the email properly for help. Our phone number is also in the error message. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS sprintpcs.com
I have two today that I question. First it seems sprintpcs.com is coming from not only sprint.com but sprintip.com: Received: from Hyperion.tenforward.com [65.161.10.61] by tenforward.com with ESMTP (SMTPD32-7.15) id A859C0A90086; Mon, 23 Jun 2003 18:24:41 -0700 Received: from dedicated59-bos.wh.sprintip.net (unknown [63.167.114.16]) by Hyperion.tenforward.com (Postfix) with ESMTP id A42663AE0B for <[EMAIL PROTECTED]>; Mon, 23 Jun 2003 18:24:38 -0700 (PDT) Received: from TRAVELERS (000-116-823.area7.spcsdns.net [68.25.203.238]) by dedicated59-bos.wh.sprintip.net (iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003)) with ESMTPA id <[EMAIL PROTECTED]> for [EMAIL PROTECTED]; Tue, 24 Jun 2003 01:24:38 + (GMT) Date: Mon, 23 Jun 2003 18:24:29 -0700 From: traveler <[EMAIL PROTECTED]> Subject: delivery problem please help To: [EMAIL PROTECTED] Message-id: <[EMAIL PROTECTED]> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600. X-Mailer: Microsoft Outlook Express 6.00.2600. Content-type: multipart/mixed; boundary="Boundary_(ID_CWjq/YnYkzKdW4cfcZlOYw)" X-Priority: 3 X-MSMail-priority: Normal X-Declude-Sender: [EMAIL PROTECTED] [63.167.114.16] X-Note: This E-mail was scanned for spam. X-Spam-Tests-Failed: Whitelisted X-Note: This E-mail was scanned for Viruses and found clean. X-Note: This E-mail was sent from [No Reverse DNS] ([63.167.114.16]). X-Spam-Prob: 0.000430 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 319667998 Would the SD.TXT file work with: sprintpcs.comsprint No punctuation or anything? How about: sprintsprint And then Prodigy strikes again with: Received: from Hyperion.tenforward.com [65.161.10.61] by tenforward.com with ESMTP (SMTPD32-7.15) id A57C14C20150; Tue, 24 Jun 2003 05:35:08 -0700 Received: from pimout6-ext.prodigy.net (pimout6-ext.prodigy.net [207.115.63.78]) by Hyperion.tenforward.com (Postfix) with ESMTP id 5094D3ACEB for <[EMAIL PROTECTED]>; Tue, 24 Jun 2003 05:35:06 -0700 (PDT) Received: from compaq (adsl-65-43-166-101.dsl.bcvloh.ameritech.net [65.43.166.101]) by pimout6-ext.prodigy.net (8.12.9/8.12.9) with SMTP id h5OCZ46r029590 for <[EMAIL PROTECTED]>; Tue, 24 Jun 2003 08:35:04 -0400 Message-ID: <[EMAIL PROTECTED]> From: "Joan Gibbs" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: Fw: Undeliverable Mail Date: Tue, 24 Jun 2003 08:35:27 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.3110.1 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 X-Declude-Sender: [EMAIL PROTECTED] [207.115.63.78] X-Note: This E-mail was scanned for spam. X-Spam-Tests-Failed: Whitelisted X-Note: This E-mail was scanned for Viruses and found clean. X-Note: This E-mail was sent from pimout6-ext.prodigy.net ([207.115.63.78]). X-Spam-Prob: 0.000430 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 319668419 Is Ameritech part of Prodigy/Yahoo? What a mess... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS strangeness
> Make the spamdomains entry for yahoo: > > yahoo. > > instead of: > > @yahoo. .yahoo. > > There is no need to have it setup with these extra parameters. Let us know > if that resolves your problem. I made the change yesterday, but have not heard from anyone yet. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelisting problems
It seems some spammers are figuring out that postmaster is whitelisted. Therefor they are making sure postmaster is in the CC or BCC field as in the headers below. Then everyone gets the spam email!!! Any ideas on how to keep this from happening? Received: from Hyperion.tenforward.com [65.161.10.61] by tenforward.com with ESMTP (SMTPD32-7.15) id A16642430150; Tue, 24 Jun 2003 07:34:14 -0700 Received: from 210006095043.ctinets.com (210006095043.ctinets.com [210.6.95.43]) by Hyperion.tenforward.com (Postfix) with SMTP id D4E6B3AD12; Tue, 24 Jun 2003 07:34:09 -0700 (PDT) Received: from h8ni.wxio.net ([105.164.244.193]) by 210006095043.ctinets.com with ESMTP id <612508-69068> for <[EMAIL PROTECTED]>; Tue, 24 Jun 2003 14:29:57 -0100 Message-ID: <[EMAIL PROTECTED]> From: "" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Re: are they OK for you? Date: Tue, 24 Jun 03 14:29:57 GMT X-Mailer: Microsoft Outlook Express 5.00.2919.6700 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=".8E11._.7D" X-Priority: 3 X-MSMail-Priority: Normal X-Declude-Sender: [EMAIL PROTECTED] [210.6.95.43] X-Note: This E-mail was scanned for spam. X-Spam-Tests-Failed: Whitelisted X-Note: This E-mail was scanned for Viruses and found clean. X-Note: This E-mail was sent from 210006095043.ctinets.com ([210.6.95.43]). X-Spam-Prob: 0.934722 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 319668496 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS strangeness
> This E-mail should not have failed the SPAMDOMAINS test, but it was > whitelisted, so it is not possible to tell whether or not it failed the > SPAMDOMAINS test without looking at the log file. This was the last email she received from the list. She is now getting messages saying her email is being rejected for this group but her other group is fine. And my HAM radio IRLP group is working... The fact that most yahoogroup email is getting through is what has me stumped. I am going through log files, but DANG! A lot of our users are on yahoogroups... and my dec log files are about 20mb per day... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS strangeness
Some yahoogroups.com email is bouncing and some is not... Below is a header. Right now my sd.txt file has: @yahoo. .yahoo. Any suggestions? Received: from Hyperion.tenforward.com [65.161.10.61] by tenforward.com with ESMTP (SMTPD32-7.15) id A4CA78D0088; Mon, 16 Jun 2003 15:29:30 -0700 Received: from n31.grp.scd.yahoo.com (n31.grp.scd.yahoo.com [66.218.66.99]) by Hyperion.tenforward.com (Postfix) with SMTP id 2752B3AD68 for <[EMAIL PROTECTED]>; Mon, 16 Jun 2003 15:29:29 -0700 (PDT) X-eGroups-Return: [EMAIL PROTECTED] m Received: from [66.218.67.200] by n31.grp.scd.yahoo.com with NNFMP; 16 Jun 2003 22:27:02 - X-Sender: [EMAIL PROTECTED] X-Apparently-To: [EMAIL PROTECTED] Received: (qmail 23134 invoked from network); 16 Jun 2003 22:27:01 - Received: from unknown (66.218.66.218) by m8.grp.scd.yahoo.com with QMQP; 16 Jun 2003 22:27:01 - Received: from unknown (HELO web10602.mail.yahoo.com) (216.136.130.166) by mta3.grp.scd.yahoo.com with SMTP; 16 Jun 2003 22:27:01 - Message-ID: <[EMAIL PROTECTED]> Received: from [64.118.100.102] by web10602.mail.yahoo.com via HTTP; Mon, 16 Jun 2003 15:27:01 PDT To: [EMAIL PROTECTED] In-Reply-To: <[EMAIL PROTECTED]> From: Christine Toll <[EMAIL PROTECTED]> X-Yahoo-Profile: silksbychristine MIME-Version: 1.0 Mailing-List: list [EMAIL PROTECTED]; contact [EMAIL PROTECTED] Delivered-To: mailing list [EMAIL PROTECTED] Precedence: bulk List-Unsubscribe: <mailto:[EMAIL PROTECTED]> Date: Mon, 16 Jun 2003 15:27:01 -0700 (PDT) Subject: Re: [silkpainters] Brownie's field trip Reply-To: [EMAIL PROTECTED] Content-Type: multipart/alternative; boundary="0-569215176-1055802421=:3627" X-Declude-Sender: [EMAIL PROTECTED] m [66.218.66.99] X-Note: This E-mail was scanned for spam. X-Spam-Tests-Failed: Whitelisted X-Note: This E-mail was scanned for Viruses and found clean. X-Note: This E-mail was sent from n31.grp.scd.yahoo.com ([66.218.66.99]). X-Spam-Prob: 0.78 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 326342966 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Challenge Response- No way to win
I got this too. My fix is the "Block Sender" option... I never see another one! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "Kami Razvan" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, June 17, 2003 1:15 PM Subject: [Declude.JunkMail] Challenge Response- No way to win Hi; Look at the new challenge response we just received. There is no way to fix this problem. - *** Attention! *** In order to complete delivery of your email to [EMAIL PROTECTED] please reply on this message by typing the following passcode on the first line. Please reply within 4 day(s) to avoid automatic deletion of your original email. Keep this text in your reply. - MailSword_Code: 6482 -- MailSword 1.20 Beta -- MailSword_Verify: [EMAIL PROTECTED] MailSword_Original_Message_Id: 348618345 MailSword_Local_Message_Id: ###<91FD7332>### === Now there is a code that you have to type before your message is delivered. eCommerce is dead! Regards, Kami --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMDOMAINS prodigy.net
Follow-up... I guess I must have missed the news last year that Yahoo purchased Prodigy. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "Sheldon Koehler" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, June 17, 2003 9:10 AM Subject: [Declude.JunkMail] SPAMDOMAINS prodigy.net > I am having a lot of people using prodigy complain about being rejected. > With the headers that have been sent, they are ALL being sent through > yahoo.com. Is yahoo and prodigy in cahoots for email or something? > > I have temporarily added: > > prodigy.netyahoo.com > > to the sd.txt file. So far this seems to work. > > Sheldon > > > Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com > Ten Forward Communications 360-457-9023 > Nationwide access, neighborhood support! > > "Whenever you find yourself on the side of the majority, it's time > to pause and reflect." Mark Twain > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS prodigy.net
I am having a lot of people using prodigy complain about being rejected. With the headers that have been sent, they are ALL being sent through yahoo.com. Is yahoo and prodigy in cahoots for email or something? I have temporarily added: prodigy.netyahoo.com to the sd.txt file. So far this seems to work. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPAMDOMAINS comcast.net
It looks like these headers tell me to add: attbi..comcomcast.net to the sd.txt file. Received: from Hyperion.tenforward.com [65.161.10.61] by tenforward.com with ESMTP (SMTPD32-7.15) id A15AE91F00FC; Mon, 16 Jun 2003 10:41:46 -0700 Received: from sccrmhc13.attbi.com (unknown [204.127.202.64]) by Hyperion.tenforward.com (Postfix) with ESMTP id 17D683AD90 for <[EMAIL PROTECTED]>; Mon, 16 Jun 2003 10:41:45 -0700 (PDT) Received: from sparelaptop (12-231-40-5.client.attbi.com[12.231.40.5](untrusted sender)) by attbi.com (sccrmhc13) with SMTP id <20030616174143016001kraje>; Mon, 16 Jun 2003 17:41:43 + Message-ID: <[EMAIL PROTECTED]> Reply-To: "Amy Fraser" <[EMAIL PROTECTED]> From: "Amy Fraser" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: Regarding Delivery Failure Date: Mon, 16 Jun 2003 10:42:15 -0700 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_NextPart_000_00CD_01C333F3.F36D4540" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-Declude-Sender: [EMAIL PROTECTED] [204.127.202.64] X-Note: This E-mail was scanned for spam. X-Spam-Tests-Failed: Whitelisted X-Note: This E-mail was scanned for Viruses and found clean. X-Note: This E-mail was sent from sccrmhc13.comcast.net ([204.127.202.64]). X-Spam-Prob: 0.000430 X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 319661753 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] spamdomains btinternet.com
Added: btinternet.com Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SKIPIFVIRUSNAMEHAS
OK, I am going through my config files and in the sender.eml file I have: SKIPIFVIRUSNAMEHAS Yaha SKIPIFVIRUSNAMEHAS Lentin SKIPIFVIRUSNAMEHAS Magistr SKIPIFVIRUSNAMEHAS Klez SKIPIFVIRUSNAMEHAS Vulnerability SKIPIFVIRUSNAMEHAS Bugbear SKIPIFVIRUSNAMEHAS Bridex SKIPIFVIRUSNAMEHAS Braid SKIPIFVIRUSNAMEHAS Sobig SKIPIFVIRUSNAMEHAS Palyh And want to know if I am missing anything. And I have nothing for the recip.eml file, so I would like suggestions on that one as well. (I screwed up earlier in the week and deleted them all... I should know better than to do work when I have the flu...). Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] spam domains shaw.ca?
> First problem I heard about with Bell Canada. I get a few of these per month from them: > Reporting-MTA: dns; Hyperion.tenforward.com > Arrival-Date: Mon, 9 Jun 2003 09:15:34 -0700 (PDT) > > Final-Recipient: rfc822; [EMAIL PROTECTED] > Action: failed > Status: 4.0.0 > Diagnostic-Code: X-Postfix; connect to smtp.bellnexxia.net[209.226.175.82]: > Operation timed out Customer emails do not get through and they blame me for it... This happens mostly with hosted domains on their system. This has been going on for about 2 years. Emails have never been responded to. Very frustrating! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] spam domains shaw.ca?
How can I look up what are legal rDNS's for shaw.ca? We get a lot of spam from them. Or are they like Bell Canada and could care less about being setup correctly? --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spamdomains: att.net
> > I started out with Bill B.'s file and have been following this list with > > changes. So far SPAMDOMAINS has worked like a dream. > > Could you post what you have so far? I was waiting for a good example file > before I jumped in to using the test. Attached is my latest version. But if you followed the list starting with Bill B.'s version it should be pretty much the same. Thanks Bill!!! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain amazon.com aol.com netscape.net att.att. attbi.com bellatlantic.netverizon.net bellsouth.net charter.net china.com comcast.net compuserve.com .aol.com concentric. .cnchost.com cox.net cs.com .aol.com earthlink. email.itwebmessenger.it excite.com excitenetwork.com gte.net verizon.net hotmail.com msn.com juno.comuntd.com lycos.com lycos.atspray.net mac.com apple.com mailcity.comlycos.com mindspring. earthlink. msn.com hotmail.com netscape.netaol.com netzero.com untd.com prodigy.prodigy. qwest.net .rr.com sympatico.cabellnexxia.net usa.net mx.net @yahoo. .yahoo. zzn.com mailcentro.com @2die4.com outblaze.com @accountant.com outblaze.com @adexec.com outblaze.com @africamail.com outblaze.com @allergist.com outblaze.com @alumnidirector.com outblaze.com @archaeologist.com outblaze.com @arcticmail.com outblaze.com @artlover.com outblaze.com @asia.com outblaze.com @australiamail.com outblaze.com @berlin.com outblaze.com @bikerider.com outblaze.com @catlover.com outblaze.com @cheerful.com outblaze.com @chemist.comoutblaze.com @clerk.com outblaze.com @cliffhanger.comoutblaze.com @columnist.com outblaze.com @comic.com outblaze.com @consultant.com outblaze.com @counsellor.com outblaze.com @cutey.com outblaze.com @deliveryman.comoutblaze.com @diplomats.com outblaze.com @doctor.com outblaze.com @doglover.com outblaze.com @dr.com outblaze.com @dublin.com outblaze.com @earthling.net outblaze.com @email.com outblaze.com @engineer.com outblaze.com @europe.com outblaze.com @execs.com outblaze.com @financier.com outblaze.com @gardener.com outblaze.com @geologist.com outblaze.com @graphic-designer.com outblaze.com @hairdresser.netoutblaze.com @hot-shot.com outblaze.com @iname.com outblaze.com @inorbit.comoutblaze.com @insurer.comoutblaze.com @japan.com outblaze.com @journalist.com outblaze.com @lawyer.com outblaze.com @legislator.com outblaze.com @lobbyist.com outblaze.com @london.com outblaze.com @loveable.com outblaze.com @mad.scientist.com outblaze.com @madrid.com outblaze.com @mail.com outblaze.com @mindless.com outblaze.com @minister.com outblaze.com @moscowmail.com outblaze.com @munich.com outblaze.com @musician.org outblaze.com @myself.com outblaze.com @nycmail.comoutblaze.com @optician.com outblaze.com @paris.com outblaze.com @pediatrician.com outblaze.com @playful.comoutblaze.com @poetic.com outblaze.com @popstar.comoutblaze.com @post.com outblaze.com @presidency.com outblaze.com @priest.com outblaze.com @programmer.net outblaze.com @publicist.com outblaze.com @realtyagent.comoutblaze.com @registerednurses.com outblaze.com @repairman.com outblaze.com @representative.com outblaze.com @rescueteam.com outblaze.com @rome.com outblaze.com @saintly.comoutblaze.com @samerica.com outblaze.com @sanfranmail.comoutblaze.com @scientist.com outblaze.com @seductive.com outblaze.com @singapore.com outblaze.com @sociologist.comoutblaze.com @soon.com outblaze.com @teacher.comoutblaze.com @techie.com outblaze.com @tokyo.com outblaze.com @umpire.com outblaze.com @usa.comoutblaze.com @whoever.comoutblaze.com @winning.comoutblaze.com @witty.com outblaze.com @writeme.comoutblaze.com @yours.com outblaze.com
[Declude.JunkMail] Spamdomains: att.net
I had a spam get through that only failed sniffer. It said it came from att.com and I only had att.net in the sd.txt file. So I changed it to: att.att. I started out with Bill B.'s file and have been following this list with changes. So far SPAMDOMAINS has worked like a dream. With the exception of the one this morning (to one of my alias's), spam has only got past if a user is whitelisted. I sure wish there was a way to stop spam from going to the users that are not whitelisted... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SpamDomains: compuserve.com
Compuserver.com is also known as cs.com and comes from aol.com compuserve.comaol.com cs.comaol.com Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] bigfoot.com?
That is what I thought. Logs show this too... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain - Original Message - From: "Kami Razvan" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, April 02, 2003 9:15 AM Subject: RE: [Declude.JunkMail] bigfoot.com? Hi; We have received much SPAM from that address and they are in our blacklist - which simply means automatic deletion. Regards, Kami -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sheldon Koehler Sent: Wednesday, April 02, 2003 11:55 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] bigfoot.com? Anyone know anything about bigfoot.com? One of our users says they are an email forwarding service and Spamcop shows a large ammount of Spam coming from their IP's: http://spamcop.net/w3m?action=checkblock&ip=64.15.239.131 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] bigfoot.com?
Anyone know anything about bigfoot.com? One of our users says they are an email forwarding service and Spamcop shows a large ammount of Spam coming from their IP's: http://spamcop.net/w3m?action=checkblock&ip=64.15.239.131 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spaced Out
> A new spammer technique, though he still managed to fail: I got one too, but mine was in Spanish. I love the line "n o n - a c c r e d i t e d u n i v e r s i t i e s". Made my day! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What do I have set wrong?
> The return address of the E-mail is [EMAIL PROTECTED], so if you > whitelisted E-mail with a return address that includes "@tenforward.com", > this E-mail would be whitelisted. In most cases it is impossible to detect > whether or not a return address is forged. I took out @tenforward.com in the global.cfg file, but how do I keep Declude from scanning outbound email then? The Imail message limits should help keep down abuse correct? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] What do I have set wrong?
> >X-Spam-Tests-Failed: Whitelisted > > So the question here is which one of your whitelists caught this E-mail? bottom-line-prices.com is not in either global.cfg or whitelist. txt. It is in blacklist.txt. tenforward.com is our own domain and is whitelisted in global.cfg. Could this be the problem as they forged our domain? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] What do I have set wrong?
This email got through as whitelisted. The dial up IP is not ours but they have our domain in there. The from domain is in our blacklist, yet this email shows as being whitelisted: Received: from StarGazer.TenForward.com [65.161.10.3] by tenforward.com (SMTPD32-7.14) id A28147C012E; Mon, 17 Mar 2003 11:31:13 -0800 Received: from tenforward.com (ppp-65-43-1-156.dialup.sbndin.ameritech.net [65.43.1.156]) by StarGazer.TenForward.com (Postfix Relay Hub) with SMTP id 0A215CC4C for <[EMAIL PROTECTED]>; Mon, 17 Mar 2003 11:31:09 -0800 (PST) From: "Bottom Line" <[EMAIL PROTECTED]> Subject: Glass Dragon - VERY COOL Content-Type: text/html Date: Sun, 16 Mar 2003 12:06:51 -0500 X-Priority: 3 X-Library: Indy 9.0.3-B Message-Id: <[EMAIL PROTECTED]> To: undisclosed-recipients:; X-Declude-Sender: [EMAIL PROTECTED] [65.43.1.156] X-Note: This E-mail was scanned for spam. X-Note: This E-mail was scanned for Viruses and found clean. X-Spam-Tests-Failed: Whitelisted X-Note: This E-mail was sent from ppp-65-43-1-156.dialup.sbndin.ameritech.net ([65.43.1.156]). X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 319600430 Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Whats up with blars.org?
> What do you mean they can not get to their web page? That has nothing to do with e-mail. Apparently blars blocks everything at their router, probably a Linux router. >From the hospital, they cannot even browse to the web page. I find it rather bizarre myself, but the IT guy is a friend and I have known him for 13 years. So I believe him when he says it... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whats up with blars.org?
This is from their web page: "In general, an entire netblock is added rather than just a single IP or customer of a larger ISP. (For example, if hugeisp has a /16 that they allocate a single /24 to spamcustomer, the /16 will be listed rather than just the /24.) An entire ISP may be added if they show a pattern of rejecting valid spam complaints for invalid reasons." Our local hospital just contacted me (they are not a customer, but I know their IT guy) that they were blocked by blars.org. They could not even get to their web page! It seems they are an innocent victim of the above policy of blocking the whole /16. I would urge anyone using this BL to stop using it as this gives blocking it's undeserved bad reputation. Now to see if I can help our hospital out... Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Filtering on a header
> >When you are attempting to filter on a header for example this header > > > >X-Mailer: The Bat! (v1.52f) Business > > > > Only the first one will work. > > The key here is that Declude JunkMail is looking at the *entire* headers > (it isn't going through each one, line-by-line). So "IS" would only work > if you had the entire headers in the filter. Oooh! I seem to have missed this idea completely. Is there a list of the spamming software we can look for? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Log Analyzer - Comments Needed
> However, I was looking for features that people would like that I may > not have thought of at this point. > Things Still to be added > 1.) Ability to email the reports Darrell, I like your list so far. Can the email be a small summary and how hard would it be to have a web page for the detailed stats? For example, I get today's email and see a big spike and want to see why and I just click on the link in the email... Can you include Virus info as well? Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Action for Multiple Tests
> Imagine if a spammer sends out 1,000,000 E-mails with *YOUR* return > address. How are you going to feel about the company or ISP that bounces > that spam to you? I have adjusted my weights enough that the real spam does get trashed for the most part. But the bounce messages help me know about the false positives and people really do appreciate it when I help them get their mail server fixed. And I had to laugh when postmaster was a spammer a couple weeks ago :) My postmaster box was real busy for a few days! Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Action for Multiple Tests
> 99% of spam is sent with bogus return addresses, you just end up making the > spam problem worse. For example, if you receive 1,000 spams a day that are > caught (held) with the WEIGHT20 test, and then today change that action to > bounce the E-mail, you are increasing spam worldwide by 1,000 spams a > day. That's bad. I have it set so WEIGHT 10 marks it (in headers, I should do this in the subject), WEIGHT 15 bounces and WEIGHT 20 deletes it. It works for me so far. I do get some responses from people on bounced email and I do my best to help them and/or whitelist their email address. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] PostfixGate removal ... ?
> Anyone know how the heck to submit a removal for postfixgate? is there even > a way? > > The link on their website (www.postfixgate.com <http://www.postfixgate.com> > ) is a js popup, > which when I pulled the js page it refers to > http://www.liswireless.net/postfixgate/dispute/default.htm > <http://www.liswireless.net/postfixgate/dispute/default.htm> > > When you go there, its a redirect to > http://www.brandxwireless.com/ <http://www.brandxwireless.com/> > > Which gives no links for submitting a removal. Postfixgate had been dead for about a year. No updates or anything. Why it is still running is beyond me and no one should be using it anymore. Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Mail loop?
> Unless you add a line "WHITELIST TO [EMAIL PROTECTED]", E-mail to the > postmaster@ account will still get scanned. Postmaster is whitelisted... > You've got a number of options here -- you could blacklist in Declude > JunkMail, based on the return address or IP of the remote mailserver, or > you could do the same with IMail's Kill List or Control Access file. I blocked it in the IMGate/Postfix box. No more problem! I tried a couple other things in Declude Junkmail first and nothing worked. I figured the whitelisting of postmaster was the culprit. Now I know for sure. Thanks, Sheldon Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com Ten Forward Communications 360-457-9023 Nationwide access, neighborhood support! "Whenever you find yourself on the side of the majority, it's time to pause and reflect." Mark Twain --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
