RE: [Declude.JunkMail] High smtp traffic
We are catching the original messages as spam, but only a small percentage of the NDRs are being caught. They all come from legit mailservers, and since there is no URL in the meesage, even if it is attached Declude won't necessarily penalize it enough. The BOUNCEONLYIF won't work as the NDRs would attempt to go back to the zombies, and I doubt that they can even receive mail. My evil thought was to penalize the company itself by letting them have a few copies of each of my NDRs. :-) Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan > Sent: Monday, January 10, 2005 11:23 > To: Declude.JunkMail@declude.com > Subject: RE: [Declude.JunkMail] High smtp traffic > > > We can do a simple bounce message to his address using BOUNCEONLYIF.. > > We are bombarded by them also but they are all getting caught > as spam.. > > Kami > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Tandem Group > Sent: Monday, January 10, 2005 2:11 PM > To: Declude.JunkMail@declude.com > Subject: RE: [Declude.JunkMail] High smtp traffic > > There is definately something happening. Currently we are > seeing a mailing > which boasts of 400 million mails being sent promoting some > penny stock with > the symbol is CSYT, company name Communications Synergi Technology. > > I found out the hard way, because they are using my personal > address as > 'Reply-To', and I have received more than 2000 NDRs. > > They are being relatively clever by forging a Received From > line, complete > with our server name and IP. The only thing they've got wrong > is the time > stamp. > > We see actual senders from all over the world, pretty well > all cable or dsl > connections, so I guess it is a zombie storm. > > I am trying to figure some way of grabbing all the NDRs and > then send each > one 10 times to the company's CEO, CFO, etc. > > Apparently it is working; the stock is up 30% today. > > Erik > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of > Markus Gufler > > Sent: Monday, January 10, 2005 09:11 > > To: Declude.JunkMail@declude.com > > Subject: [Declude.JunkMail] High smtp traffic > > > > > > Anyone else can see an abnormal high smtp traffic this minutes? > > > > I haven't identified completely but something strnage is going one > > here. Lot of NDR's > > > > Markus > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] High smtp traffic
There is definately something happening. Currently we are seeing a mailing which boasts of 400 million mails being sent promoting some penny stock with the symbol is CSYT, company name Communications Synergi Technology. I found out the hard way, because they are using my personal address as 'Reply-To', and I have received more than 2000 NDRs. They are being relatively clever by forging a Received From line, complete with our server name and IP. The only thing they've got wrong is the time stamp. We see actual senders from all over the world, pretty well all cable or dsl connections, so I guess it is a zombie storm. I am trying to figure some way of grabbing all the NDRs and then send each one 10 times to the company's CEO, CFO, etc. Apparently it is working; the stock is up 30% today. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Markus Gufler > Sent: Monday, January 10, 2005 09:11 > To: Declude.JunkMail@declude.com > Subject: [Declude.JunkMail] High smtp traffic > > > Anyone else can see an abnormal high smtp traffic this minutes? > > I haven't identified completely but something strnage is > going one here. Lot > of NDR's > > Markus > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail
Title: Message I agree. We build our config file from an external interface, and if we have anything added manually or from another source, it will be overwritten the first time we make changes through our interface. Erik Erik Hjelholt, Managing DirectorAlberni-dot-Net, a div. of Tandem Security Inc.4716 Roger St., Port Alberni, BC V9Y 3Z2Phone: 250-720-8110 - Fax: 250-723-0901 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of John Tolmachoff (Lists)Sent: Friday, July 9, 2004 09:07To: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail Automatically changing the configuration files is a bad thing in my opinion. All my configuration files are built from scripts from base files, allowing to easily make changes to one section and then make the appropriate changes in what ever configuration files are needed. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy SchmidtSent: Friday, July 09, 2004 8:53 AMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Fw: New Multiple Threat Lookup Database test for Declude JunkMail I guess they wrote a "setup" program that will install new code and even activate it for you. Hopefully, there'll be some "readme" inside that mysterious .EXE file. Otherwise, it is pretty much a cat in the sack! The installation process for the MTLDB:Download Now! (MTLDB.exe 5.6 MB)Run it on your server You will be asked for some registration informationThe application will then append a line to your JunkMail configuration file. The setup process will NOT change any existing settings. Best RegardsAndy SchmidtH&M Systems Software, Inc.600 East Crescent Avenue, Suite 203Upper Saddle River, NJ 07458-1846Phone: +1 201 934-3414 x20 (Business)Fax: +1 201 934-9206http://www.HM-Software.com/
RE: [Declude.JunkMail] OT: RoadRunner Postmaster Contact
These jerks are so unresponsive that we decided to go tit-for-tat, i.e. we now block them as well. We have apparently been caught in a wider IP block by them and have been unable to clear it up. In fact, they are so knowledgable that when one of their customers in Florida contacted them via e-mail and got a callback, when he asked for a number at which we could reach them, the technical support person didn't know the number and disappeared for several minutes before eventually coming back with an 800 number. When that number was called, we got a voice mail message telling us to e-mail them with the problem. We have of course done this several times with absolutely no response, so we have take the only option left to us: to block all the IP ranges we can find for them. :-) Erik Erik Hjelholt, Managing DirectorAlberni-dot-Net, a div. of Tandem Security Inc.4716 Roger St., Port Alberni, BC V9Y 3Z2Phone: 250-720-8110 - Fax: 250-723-0901 -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Darin CoxSent: Monday, June 14, 2004 07:19To: [EMAIL PROTECTED]Subject: [Declude.JunkMail] OT: RoadRunner Postmaster Contact Sorry for the OT post, but I'm desperate this morning... Anyone have a RoadRunner postmaster contact? I'm getting a ton of MX connect fail this morning to a number of their servers. Don't know if they've blacklisted our IP range or not. Anyone else having trouble with them currently? Darin.
[Declude.JunkMail] Habeus log entry
I am not entirely sure what the log entries mean for Habeas. I have changed from the whitlisting to a standard test as follows: HABEAS habeas x x 0 10 What I get is a log entry like this: nHABEAS:10 It was intended to reduce the total if a Habeus warrant mark was detected, whether a legitimate one or not, but when I add up all scores, like this: SNIF-FINANC:16 nHABEAS:10 NOLEGITCONTENT:2 SPAMHEADERS:12 . Total weight = 40 there has been no reduction, but rather an increase. What gives? Erik Erik Hjelholt, Managing Director Alberni-dot-Net, a div. of Tandem Security Inc. 4716 Roger St., Port Alberni, BC V9Y 3Z2 Phone: 250-720-8110 - Fax: 250-723-0901 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Please check the SBL test in your global.cfg (may cause mail to back up!)
Should that not be either * for anything, or 127.0.0.2? The latter is what spamhaus.org lists on their site. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Friday, October 24, 2003 13:12 > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Please check the SBL test in your > global.cfg > (may cause mail to back up!) > > > Back in August, the Osirusoft tests died. Unfortunately, > they also were > used by SBL. As a result, many people have an SBL line in their > \IMail\Declude\global.cfg file referring to osirusoft.com. > This is causing > major delays, and causing mail to back up on some busy servers. > > Please check your \IMail\Declude\global.cfg file. If it has > any entries > with "osirusoft" in them, they should be removed (or > changed). For SBL, > you can change the line to: > > SBL ip4rsbl.spamhaus.org >127.0.0.6 > 7 0 > > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day > evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Log to syslog option
We use something called Programmer's File Editor and it will happily open large files. If anybody wants it, I'll be happy to send a zipped version to the list or individuals as you prefer. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > Sheldon Koehler > Sent: Monday, September 29, 2003 08:41 > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Log to syslog option > > > What John said... > > This is a Windows machine and the only way I know to search > log files is > with Notepad and the Find function. Not a lot of fun with > large files! > > Inquiring minds want to know... > > Sheldon > > > Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com > Ten Forward Communications 360-457-9023 > Nationwide access, neighborhood support! > > "Whenever you find yourself on the side of the majority, it's time > to pause and reflect." Mark Twain > > > - Original Message - > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, September 29, 2003 7:41 AM > Subject: RE: [Declude.JunkMail] Log to syslog option > > > > So I will ask you the same question, why do you need to > open the file for > > viewing? Why not just parse what you are looking for from > the command > > prompt? There must be something I'm not considering > > Some of smaller guys are not versed enough in command prompt > commands to > generate and find the information we want to review. Now, if > some one wanted > to either put a guide together for us or point us at a good > resource... > > Example, sometimes I need to review exactly what happen on a > particular > message. How do you pull all the log lines for a particular message? > > John Tolmachoff MCSE CSSA > Engineer/Consultant > eServices For You > www.eservicesforyou.com > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Number of times JM scans an email?
Scott, I just have to jump in here, because I raised the issue of the multiple recipients a short while ago, and my understanding was that if one receipient sets an action on a message, that action will also be performed on the message to all other receipients. I have seen that happen with several customers for whom we do not have JunkMail activated, yet an action is performed. Are you saying that individual actions will take place for individual messages if they have individual JunkMail files, but if they do not have a JunkMail file, then the action is determined by the one recipient who does have actions set? Can you clarify this, please? Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Sunday, September 21, 2003 17:45 > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Number of times JM scans an email? > > > > >That is a single item scanned 10 times - same content, same > final action. > >Why? > > > >Is this normal or am I just imagining it? > > It's normal, and you aren't imagining it -- but it isn't > exactly what you > think. > > What you are seeing is Declude JunkMail going through the list of > recipients, and determining the actions for each one. So > Declude JunkMail > runs the tests, then checks to see what action(s) it should > take, based on > the list of recipients. You'll see the log file entries for each > recipient, showing what action(s) Declude JunkMail is going to > take. However, the tests are only run once per E-mail, no > matter how many > recipients. > > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you've been missing: Ask about our free 30-day > evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Multiple recipients seeing action
Scott: That would, in my view, be quite a serious problem for anyone using per-user settings, and I hope you can find a way to deal with it. I suppose the upside is that some customers will see the Subject add-on and call and ask 'what's this?' giving us an opportunity to sell our spam control programme, but more like they are going to tell us not to mess with their messages. For those who never use or even know about WebMail, their spam mailbox could be filled over time thus blocking the main mailbox as well. Yep, quite serious indeed. Erik > > > > >I have a concern with messages to multiple recipients where > the action > >chosen by a single recipient is used on others. > > Unfortunately, that's a problem inherent in SMTP, where a > single E-mail can > be sent to multiple recipients -- and it's expected that the > E-mail be > identical for all recipients. > > >Is this normal behaviour for DJM? If so, that would be a > concern because > >obviously some mail which one person would delete would not > get to another. > > That is correct. However, this is more a social issue -- if > someone sends > a legitimate E-mail to multiple recipients, they need to > realize that by > sending it as a single E-mail, the E-mail needs to be treated > the same way > for all the recipients. > > We are, however, looking into ways around this. If we do, > though, it would > require significant extra resources. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Multiple recipients seeing action
I have a concern with messages to multiple recipients where the action chosen by a single recipient is used on others. In one case, a message was sent to nine recipients (eight in the Bcc) and one of the Bcc recipients is signed up for our spam control, but another is seeing the action, in this case the Subject action, on their end. Is this normal behaviour for DJM? If so, that would be a concern because obviously some mail which one person would delete would not get to another. Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelistfile problem
Thanks. I guess there is a fairly low probability of seeing mainstream spam from a mailing list, so I will use your suggestion. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Monday, September 8, 2003 09:25 > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Whitelistfile problem > > > > >I am having a whitelistfile problem with a mailing list. > There are the odd > >messages which get caught in our regular tests and I need to > whitelist the > >address. The X-Declude-Sender: line is as follows: > > > >[EMAIL PROTECTED] > ps.yahoo.com > > > >where the second set of numbers change for each message. I > don't know about > >the first. It may be a group identifier. > > > >I have tried the following: > [EMAIL PROTECTED] > > Unfortunately, that won't work -- the whitelistfile requires > an exact match > (except for domains/subdomains). In this case, you could use > "@returns.groups.yahoo.com". Since it starts with an "@", it doesn't > require an exact match. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelistfile problem
I am having a whitelistfile problem with a mailing list. There are the odd messages which get caught in our regular tests and I need to whitelist the address. The X-Declude-Sender: line is as follows: [EMAIL PROTECTED] where the second set of numbers change for each message. I don't know about the first. It may be a group identifier. I have tried the following: [EMAIL PROTECTED] but don't know if it is a valid address as far as JunkMail is concerned. Any body have any ideas? This is in a per-user whitelistfile, not a global one. Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelistfile syntax
Scott: Well, maybe that is why we are having problems. We are working with the WHITELISTFILE option, not the global WHITELIST option. Perhaps we are working under the wrong assumptions but we rather expected that the syntax in the WHITELISTFILE would be the same as that for the WHITELIST option. So, it appears that we simply need the address or partial address in the file with no FROM included. This apparently will also mean that we cannot whitelist by subject such as is often used by mailing lists, incuding this one. Is this correct? Yet, why on earth would the following then work: FROM"WebMaster" <[EMAIL PROTECTED]> when this does not: FROM[EMAIL PROTECTED] Again, this is using the WHITELISTFILE option on a per user basis. Can you point me to a URL which has the syntax for the WHITELISTFILE, preferably with some samples. I have been unable to find this in the archives. I should also like to know whether there are other functions of the whitelist file option other than simply working on a full or partial sender's address. Thanks, Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Tuesday, September 2, 2003 11:34 > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Whitelistfile syntax > > > > >It would appear that when using the FROM function in the per user > >whitelistfile, we cannot use the straight E-mail address, > but must copy the > >FROM information out of the header of a received E-mail. > That would mean > >that unless a user has actually already received an e-mail > from someone, > >he/she might not know what to use in the filter, and > generally speaking we > >shouldn't depend on users knowing how to obtain information > from the header. > > > >Using the Declude spam test message we obtained the following: > > > >This does not work: > >FROM[EMAIL PROTECTED] > >ANYWHERE[EMAIL PROTECTED] > > > >This does work: > > > > I'm not sure what you mean? Are you referring to the > WHITELISTFILE option > (which doesn't use FROM or ANYWHERE, and can work on a > per-user/per-domain > basis), or the WHITELIST option (which does use FROM and > ANYWHERE, but is a > global option)? > > If you are using "WHITELIST FROM", any E-mail that is whitelisted by > 'WHITELIST FROM "WebMaster" <[EMAIL PROTECTED]>' will also be > whitelisted by 'WHITELIST FROM [EMAIL PROTECTED]'. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelistfile syntax
Scott: It would appear that when using the FROM function in the per user whitelistfile, we cannot use the straight E-mail address, but must copy the FROM information out of the header of a received E-mail. That would mean that unless a user has actually already received an e-mail from someone, he/she might not know what to use in the filter, and generally speaking we shouldn't depend on users knowing how to obtain information from the header. Using the Declude spam test message we obtained the following: This does not work: FROM[EMAIL PROTECTED] ANYWHERE[EMAIL PROTECTED] This does work: FROM"WebMaster" <[EMAIL PROTECTED]> Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Tandem Group > Sent: Tuesday, September 2, 2003 10:47 > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Whitelistfile syntax > > > Thanks Scott. > > I'll chase the problem a bit more. > > With respect to the manual: yes, I am aware that the archives > are a great > help, but they are occasionally down and, in at least one case, the > declude.junkmail archive has a major hole in it taking out > several days > worth of messages and can therefore not take the place of a manual > completely. > > Erik > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of R. > Scott Perry > > Sent: Tuesday, September 2, 2003 10:34 > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] Whitelistfile syntax > > > > > > > > >We are having a bit of a problem with the per user whitelist > > and would like > > >to confirm the format for setting up the file in the user's > > user.junkmail > > >file. Is this the correct format? > > > > > >WHITELISTFILE > > E:\IMail\Declude\domain.com\user-whitelist.txt > > > > That will work fine. > > > > >Also, is there any chance of seeing the new manual any time > > soon? It would > > >be very helpful as there are a large number of changes > since 1.65 and > > >although there have been release notes, they don't seem to > cover all > > >features. > > > > We're slowly adding new features to the manual. All new > > features *are* > > listed in the release notes (and most are discussed in this > > list, with > > details on how they work and how to use them). > > > > -Scott > > --- > > Declude JunkMail: The advanced anti-spam solution for IMail > > mailservers. > > Declude Virus: Catches known viruses and is the leader in mailserver > > vulnerability detection. > > Find out what you have been missing: Ask for a free 30-day > evaluation. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Whitelistfile syntax
Thanks Scott. I'll chase the problem a bit more. With respect to the manual: yes, I am aware that the archives are a great help, but they are occasionally down and, in at least one case, the declude.junkmail archive has a major hole in it taking out several days worth of messages and can therefore not take the place of a manual completely. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Tuesday, September 2, 2003 10:34 > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Whitelistfile syntax > > > > >We are having a bit of a problem with the per user whitelist > and would like > >to confirm the format for setting up the file in the user's > user.junkmail > >file. Is this the correct format? > > > >WHITELISTFILE > E:\IMail\Declude\domain.com\user-whitelist.txt > > That will work fine. > > >Also, is there any chance of seeing the new manual any time > soon? It would > >be very helpful as there are a large number of changes since 1.65 and > >although there have been release notes, they don't seem to cover all > >features. > > We're slowly adding new features to the manual. All new > features *are* > listed in the release notes (and most are discussed in this > list, with > details on how they work and how to use them). > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Whitelistfile syntax
Scott: We are having a bit of a problem with the per user whitelist and would like to confirm the format for setting up the file in the user's user.junkmail file. Is this the correct format? WHITELISTFILE E:\IMail\Declude\domain.com\user-whitelist.txt Also, is there any chance of seeing the new manual any time soon? It would be very helpful as there are a large number of changes since 1.65 and although there have been release notes, they don't seem to cover all features. Thanks, Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test is different between header and log
OK. Thanks. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Friday, August 29, 2003 10:37 > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Test is different between > header and log > > > > >Well yes, but if I see the IPNOTINMX as failed in the > header, should it not > >also show in the log? > > No -- because it has a weight of 0, it is not listed. The > line with the > "nNOLEGITCONTENT" in it is used for determining how Declude JunkMail > arrived at the total weight for the E-mail. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Test is different between header and log
Well yes, but if I see the IPNOTINMX as failed in the header, should it not also show in the log? The nNOLEGITCONTENT was the *only* entry in the log. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry > Sent: Friday, August 29, 2003 10:15 > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Test is different between > header and log > > > > >Here is the associated log output for that message and it > shows a different > >test as failed: > > > >Q809c2823013c78d3 nNOLEGITCONTENT:-3 . Total weight = -3 > > > >How come? > > At LOGLEVEL MID, you'll see that line -- the "n" means > "negative", so the > E-mail did not fail the NOLEGITCONTENT test (and therefore > had 3 points > removed from its score). > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Test is different between header and log
Scott: Here's a partial header from a message and it shows clearly that the spam test failed was IPNOTINMX X-Declude-Spoolname: D809c2823013c78d3.SMD X-Note: This E-mail was sent from tandem.alberni.net ([64.141.6.11]). X-Note: This E-mail was scanned for spam by Declude JunkMail. X-Spam-Tests-Failed: IPNOTINMX [-3] Here is the associated log output for that message and it shows a different test as failed: Q809c2823013c78d3 nNOLEGITCONTENT:-3 . Total weight = -3 How come? Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Web based User Configurations
We have just put our own web interface on-line. Have a look at https://ss.alberni.net/spamcontrol/Login.asp The userid is 'declude' and the password is 'junkmail'. I'll leave that address up for a couple of days but don't nobody start spamming from it. :-) We have also written a management module which allows us to do per domain configurations for our domain customers. We sell per address service at $2.29 Cdn., and a per domain bundle including junkmail, virus and webmail for $9.95 per month for up to 20 addresses. Have just started this week, so don't know yet where that is going. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Peter Lent > Sent: Tuesday, August 19, 2003 15:18 > To: '[EMAIL PROTECTED]' > Subject: [Declude.JunkMail] Web based User Configurations > > > Hi All, > > Is there anything that will work with I-mail or stand alone > that will enable > the end user to adjust their declude settings from a web > based terminal? > > Trying not to re-invent the wheel if I do not have to. > > THANKS > > Peter > > -Peter Lent > Technology Services Manager > Goodwill Industries of Orange County > Shop online @ www.shopgoodwill.com > www.ocgoodwill.org > [EMAIL PROTECTED] > 714.547.6308 x 377 > 714.543.4826 - Fax > 714.240.4342 - Cell > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] sure to be silly question
That would be cool, but wouldn't that increment from zero, so that even one single comment would score a 6? Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry > Sent: Tuesday, August 19, 2003 12:28 > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] sure to be silly question > > > Another way to scale the weight of this test is to use: > > COMMENTS comments weight x 5 0 > > where the test will accumulate the total number of > obfuscation comments it > finds and add 5 to that number and apply that to the weight > result for the > test. I don't see the comments test documented on the > JunkMail manual site > yet, so Scott, please correct me if I am wrong. > > Bill > > - Original Message - > From: "Tandem Group" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Tuesday, August 19, 2003 11:46 AM > Subject: RE: [Declude.JunkMail] sure to be silly question > > > > That's right. Each is incremental, so if you have 75 > comments it will give > a > > weight of 10+10+10=30 > > > > You may wish to change the weight assigned for each to suit your > > circumstances. We use a weight system at approx. twice the > default ones in > > order to arrive at a safe delete point of 100. > > > > Erik > > > > > -Original Message- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] Behalf Of paul > > > Sent: Tuesday, August 19, 2003 11:47 > > > To: [EMAIL PROTECTED] > > > Subject: Re: [Declude.JunkMail] sure to be silly question > > > > > > > > > > Here's what I did with the comments: I created the > following tests > > > > > > > > COMMENTS20 comments 20 x 10 0 > > > > COMMENTS40 comments 40 x 10 0 > > > > COMMENTS60 comments 60 x 10 0 > > > > COMMENTS80 comments 80 x 10 0 > > > > COMMENTS100 comments 100 x 10 0 > > > > COMMENTS120 comments 120 x 10 0 > > > > > > Hmmm, ok, so am I reading this right? COMMENTS20 checks for > > > 20 comments? if > > > there are 20 comments, 10 is added to the weight, etc etc. ? > > > > > > Let me know if I'm right and I'll add them in, sounds > > > promising, I think I > > > may give these a HOLD action / zero weight first, to see how > > > they work. > > > > > > Thanks Erik, > > > > > > Paul > > > > > > > > > --- > > > [This E-mail scanned for viruses by Declude Virus] > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > > (http://www.declude.com)] > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] sure to be silly question
That's right. Each is incremental, so if you have 75 comments it will give a weight of 10+10+10=30 You may wish to change the weight assigned for each to suit your circumstances. We use a weight system at approx. twice the default ones in order to arrive at a safe delete point of 100. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of paul > Sent: Tuesday, August 19, 2003 11:47 > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] sure to be silly question > > > > Here's what I did with the comments: I created the following tests > > > > COMMENTS20 comments 20 x 10 0 > > COMMENTS40 comments 40 x 10 0 > > COMMENTS60 comments 60 x 10 0 > > COMMENTS80 comments 80 x 10 0 > > COMMENTS100 comments 100 x 10 0 > > COMMENTS120 comments 120 x 10 0 > > Hmmm, ok, so am I reading this right? COMMENTS20 checks for > 20 comments? if > there are 20 comments, 10 is added to the weight, etc etc. ? > > Let me know if I'm right and I'll add them in, sounds > promising, I think I > may give these a HOLD action / zero weight first, to see how > they work. > > Thanks Erik, > > Paul > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] sure to be silly question
Here's what I did with the comments: I created the following tests COMMENTS20 comments20 x 10 0 COMMENTS40 comments40 x 10 0 COMMENTS60 comments60 x 10 0 COMMENTS80 comments80 x 10 0 COMMENTS100 comments100 x 10 0 COMMENTS120 comments120 x 10 0 This allows me to increment the penalty by the number of comments in a message. For each of 20 comments, a cumulative weight of 10 is added. Seems to work. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of paul > Sent: Tuesday, August 19, 2003 11:04 > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] sure to be silly question > > > Ok, I've got a question about the COMMENTS test. Since I have > a copy of > every email I've gotten from this and the AV list since I > joined, I looked > through them and didn't see my answer. I also looked at the > JM revisions > page and found nothing either, so here goes. Below is the > line from the > message source of an email I got this morning. to spam the > guy in charge of email. =) > anyway, since the words gen*eric > via*gra minus > the *s in case of filters, are shoen in the email, but > seperated by the junk > in the "". What's the way to set a block/test for this? I've > yet to use the > COMMENTS test, but want to know the BEST way to do so. > > Generic Vi style="margin-bottom: -20"> color="#FF">xvtAXyZLNqZbKsaWiqfpgagra > > Any help is appreciated! > > Paul > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Report System
I would be interested as well, thank you. Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of i360 Support > Sent: Friday, August 1, 2003 09:14 > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Report System > > > Please add me too. > > Would like to see it. > > Thanks > Heimir > > > - Original Message - > From: "James James" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, August 01, 2003 10:53 AM > Subject: Re: [Declude.JunkMail] Report System > > > > I hate filling the list with another of these, but I would > like a copy to. > > This sounds like the utility I've always wanted but could > never find. > > > > Thanks > > James James > > Help Desk/Systems Administration > > Lile International > > > > - Original Message - > > From: "Dave Jordan" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Friday, August 01, 2003 8:44 AM > > Subject: Re: [Declude.JunkMail] Report System > > > > > > > Hey, Don't leave me out! It looks like it's just what > the Dr. ordered. > > > > > > Dave Jordan > > > > > > - Original Message - > > > From: "GlobalWeb.net Webmaster" <[EMAIL PROTECTED]> > > > To: <[EMAIL PROTECTED]> > > > Sent: Friday, August 01, 2003 11:23 AM > > > Subject: RE: [Declude.JunkMail] Report System > > > > > > > > > > Add me to the list too - a donation will be in order... > > > > > > > > > > > > Sincerely, > > > > > > > > Randy Armbrecht > > > > Global Web SolutionsR, Inc. > > > > 804-346-5300 ext. 1 > > > > 877-800-GLOBAL (4562) ext. 1 > > > > http://globalweb.net > > > > > > > > > > > > -Original Message- > > > > From: [EMAIL PROTECTED] > > > > [mailto:[EMAIL PROTECTED] On Behalf > Of Shayne Embry > > > > Sent: Friday, August 01, 2003 11:07 AM > > > > To: [EMAIL PROTECTED] > > > > Subject: RE: [Declude.JunkMail] Report System > > > > > > > > > > > > Darrel, > > > > > > > > Maybe you should start charging for it. As long as > you're not...please > > > > include me. (Actually, I'd consider a donation if it > works as well as > > > > you claim.) > > > > > > > > Thanks, > > > > Shayne Embry > > > > [EMAIL PROTECTED] > > > > > > > > > > > > > > > > > -Original Message- > > > > > From: [EMAIL PROTECTED] > > > > > [mailto:[EMAIL PROTECTED] On Behalf Of Glenn > Brooks > > > > > Sent: Friday, August 01, 2003 9:48 AM > > > > > To: [EMAIL PROTECTED] > > > > > Subject: RE: [Declude.JunkMail] Report System > > > > > > > > > > > > > > > add me, also > > > > > > > > > > At 12:17 PM 8/1/2003 +0200, you wrote: > > > > > >Hi Darrel, > > > > > > > > > > > >Please add me to your list, I'd love to try it out > > > > > > > > > > > >Best regards > > > > > >Lachezar > > > > > >[EMAIL PROTECTED] > > > > > > > > > > > >-Original Message- > > > > > >From: [EMAIL PROTECTED] > > > > > >[mailto:[EMAIL PROTECTED] Behalf > Of VanTech.Net > > > > > >Sent: Thursday, July 31, 2003 11:40 PM > > > > > >To: [EMAIL PROTECTED] > > > > > >Subject: RE: [Declude.JunkMail] Report System > > > > > > > > > > > > > > > > > >Darrel, > > > > > > > > > > > >I would be interested in trying it out. I like Delog, but I > > > > > would like > > > > > >to have some format options such as .html. > > > > > > > > > > > >Thank you, > > > > > >Aaron Caviglia > > > > > >[EMAIL PROTECTED] > > > > > > > > > > > > > > > > > >-Original Message- > > > > > >From: [EMAIL PROTECTED] > > > > > >[mailto:[EMAIL PROTECTED] On Behalf Of > > > > > Darrell LaRock > > > > > >Sent: Thursday, July 31, 2003 2:06 PM > > > > > >To: [EMAIL PROTECTED] > > > > > >Subject: RE: [Declude.JunkMail] Report System > > > > > > > > > > > > > > > > > >Terry, > > > > > > > > > > > >I used delog for awhile, but I needed several other features > > > > > that did > > > > > >not come with delog. So I developed an application that had > > > > > all of the > > > > > >features that I needed. Below is a sample report that I > > > > > generated(tab > > > > > >format). The reports can be in tab, csv, or html format and > > > > > you have > > > > > >the ability to email them as well. > > > > > > > > > > > >There are many other things that dlanalyzer can report on. > > > > > You can get > > > > > >reports on domains, users, tests, and different reporting > > > > > periods. The > > > > > >combinations are endless. > > > > > > > > > > > >Right now I am finishing up database support and a few other > > > > > >miscellaneous features I wanted to add in.. > > > > > > > > > > > >If you would like to try it out let me know and I > will make it > > > > > >available.. > > > > > > > > > > > >Darrell > > > > > > > > > > > > > > > > > >Start Time: 6/1/2003 12:00:00 AM > > > > > >End Time: 6/2/2003 12:00:00 AM > > > > > >Total Messages: 25935 > > > > > >Messages That Failed: 18252 > > > > > >Spam Percentage: 70.38% > > > > > > > > > > > >TEST# FAILEDPercentage > > > > > >BADHEADERS 373514.40% > > > > > >BASE
[Declude.JunkMail] New manuals
Any progress on the new manuals? We are holding off completing a user interface until we can go through the current JM manual, just in case there is something new that will impact it. Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] IGNORE action vs. no entry
Scott: Just need to confirm that the omission of a test and its associated action in the .junkmail files will by default set the action for that test as IGNORE. Thanks, Erik --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] BLACKLISTFILE function
Scott: While there is a per domain/per user WHITELISTFILE feature, I do not see a BLACKLISTFILE feature that works per domain/per user. Is this something which is under consideration? We would like to offer our customers limited access to blacklisting individual addresses, and it would be much easier to do via Declude than through IMail rules, particularly since we have a web interface written for Declude. Erik Erik Hjelholt, Managing Director Alberni-dot-Net, a div. of Tandem Security Inc. 4716 Roger St., Port Alberni, BC V9Y 3Z2 Phone: 250-720-8110 - Fax: 250-723-0901 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] JM logging
Is there any way to prevent logging scan results for all incoming mail? Ideally, I would prefer to log only for those domains and/or users which I designate by giving them their own $default$.junkmail file. I have tried to delete the top level $default$.junkmail file, but Declude complains loudly. I now have all actions commented out but still see the scans in the logfile, with actions on all tests as IGNORE. We are setting Declude up to be a for-pay service to our customers, and while I realize I cannot prevent the scanning of the incoming mails, I would rather not have the logfiles filled with irrelevant information. Any thoughts? Erik Erik Hjelholt, Managing Director Alberni-dot-Net, a div. of Tandem Security Inc. 4716 Roger St., Port Alberni, BC V9Y 3Z2 Phone: 250-720-8110 - Fax: 250-723-0901 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Regarding Obfuscation
Well, Declude certainly works as it caught this message. :-) Erik > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Rob Salmond > Sent: Wednesday, July 16, 2003 08:54 > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Regarding Obfuscation > > > There was some talk a while ago about blocking the tags used > to make it > difficult to parse text in spam. > > this stuff: > > ou thousands over the life of your > loan! What are you > waiting for? href="http://mtggreat1.com/4/index.asp?RefID=588897";> > Visit Now > > > Scott suggested this would be impracticle since any number of > random tags > could be invented and the browser must handle them cleanly so > scanning for > each one is useless. However it would be possible to add a > text comparison > function that examines only the text outside of the <>'s > This way you could seperate your rules into those which can > work on the > entire html body. For instance; > > CONTAINS 10 > > and those which must ignore html > > HTML_CLEAN_CONTAINS 10 pen1s > > That way you don't burn CPU cycles parsing HTML tags on stuff > thats not > important, but you can spend them in cases where you want to. > > Rob Salmond > Ontario Die Company > (519)-576-8950 ext. 132 > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
