RE: [Declude.JunkMail] Spamcop blocked message but not blocked

[Colbeck, Andrew]

You can follow the link in the text that the SpamCop RBL returns, and
then follow a link there for further information:

http://www.spamcop.net/w3m?action=blcheck&ip=216.9.248.51

Which shows that this Blackberry server is listed again and will be for
the next 16 hours.  It also shows the recent history of this IP address
with SpamCop:

Listing History
In the past 9.8 days, it has been listed 5 times for a total of 2.7 days

What I've noticed is that service providers like Blackberry run afoul of
SpamCop and other lists due to their clients' autoresponders which reply
to every virus and forged MAILFROM, so the provider gets listed as
sending to spamtraps or listed for sending viruses.

The advice to use REVDNS or other counterweight tests to smooth out
blacklists sounds good to me, too.

Andrew 8)

 

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of Panda Consulting S.A. Luis Alberto Arango
> Sent: Tuesday, September 19, 2006 8:20 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] Spamcop blocked message but not blocked
> 
>  
> Today I found this in a message (declude logs)
> 
> Msg failed SPAMCOP ("Blocked - see
> http://www.spamcop.net/bl.shtml?216.9.248.51";
> 
> I verified why was this address blocked and found out that 
> Spamcop site says
> "216.9.248.51 not listed in bl.spamcop.net" Verification was 
> done 5 hours after the blocked message was received.
> 
> IP belongs to one of the Blackberry's smtp servers.
> 
> Any ideas? Could an address be removed within few hours?.
> 
> Any ideas? Is Spamcop failing or this is common?
> 
> Luis
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
> 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spamcop blocked message but not blocked

[Panda Consulting S.A. Luis Alberto Arango]

John and Darrel. Thank you for your answers. I will be extremely careful
then with Spamcop, the revdns is a very good suggestion.

Regards
Luis 

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On 
> Behalf Of Darrell ([EMAIL PROTECTED])
> Sent: Miércoles, 20 de Septiembre de 2006 07:45 a.m.
> To: declude.junkmail@declude.com
> Subject: Re: [Declude.JunkMail] Spamcop blocked message but 
> not blocked
> 
> Yes, servers can be removed from Spamcop pretty quick 
> depending on various factors.  FWIW IMO Spamcop tends to list 
> known legit mailservers fairly often (gmail, aol, earthlink, 
> etc).  I use it, but I also counter weight revdns for some of 
> those big providers mailservers to counter spamcop hits.
> 
> Darrell
> --
> --
> Check out http://www.invariantsystems.com for utilities for 
> Declude And Imail.  IMail/Declude Overflow Queue Monitoring, 
> SURBL/URI integration, MRTG Integration, and Log Parsers.
> 
> - Original Message -
> From: "Panda Consulting S.A. Luis Alberto Arango" 
> <[EMAIL PROTECTED]>
> To: 
> Sent: Tuesday, September 19, 2006 11:20 PM
> Subject: [Declude.JunkMail] Spamcop blocked message but not blocked
> 
> 
> 
> Today I found this in a message (declude logs)
> 
> Msg failed SPAMCOP ("Blocked - see
> http://www.spamcop.net/bl.shtml?216.9.248.51";
> 
> I verified why was this address blocked and found out that 
> Spamcop site says
> "216.9.248.51 not listed in bl.spamcop.net" Verification was 
> done 5 hours
> after the blocked message was received.
> 
> IP belongs to one of the Blackberry's smtp servers.
> 
> Any ideas? Could an address be removed within few hours?.
> 
> Any ideas? Is Spamcop failing or this is common?
> 
> Luis
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Spamcop blocked message but not blocked

[Darrell \([EMAIL PROTECTED])]

Yes, servers can be removed from Spamcop pretty quick depending on various 
factors.  FWIW IMO Spamcop tends to list known legit mailservers fairly 
often (gmail, aol, earthlink, etc).  I use it, but I also counter weight 
revdns for some of those big providers mailservers to counter spamcop hits.

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers.

- Original Message - 
From: "Panda Consulting S.A. Luis Alberto Arango" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, September 19, 2006 11:20 PM
Subject: [Declude.JunkMail] Spamcop blocked message but not blocked



Today I found this in a message (declude logs)

Msg failed SPAMCOP ("Blocked - see
http://www.spamcop.net/bl.shtml?216.9.248.51";

I verified why was this address blocked and found out that Spamcop site says
"216.9.248.51 not listed in bl.spamcop.net" Verification was done 5 hours
after the blocked message was received.

IP belongs to one of the Blackberry's smtp servers.

Any ideas? Could an address be removed within few hours?.

Any ideas? Is Spamcop failing or this is common?

Luis




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spamcop blocked message but not blocked

[John T \(Lists\)]

Yes, an IP could be delisted within a few hours.

John T
eServices For You

"Seek, and ye shall find!"

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Panda
> Consulting S.A. Luis Alberto Arango
> Sent: Tuesday, September 19, 2006 8:20 PM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] Spamcop blocked message but not blocked
> 
> 
> Today I found this in a message (declude logs)
> 
> Msg failed SPAMCOP ("Blocked - see
> http://www.spamcop.net/bl.shtml?216.9.248.51";
> 
> I verified why was this address blocked and found out that Spamcop site
says
> "216.9.248.51 not listed in bl.spamcop.net" Verification was done 5 hours
> after the blocked message was received.
> 
> IP belongs to one of the Blackberry's smtp servers.
> 
> Any ideas? Could an address be removed within few hours?.
> 
> Any ideas? Is Spamcop failing or this is common?
> 
> Luis
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Spamcop blocked message but not blocked

[Panda Consulting S.A. Luis Alberto Arango]

 
Today I found this in a message (declude logs)

Msg failed SPAMCOP ("Blocked - see
http://www.spamcop.net/bl.shtml?216.9.248.51";

I verified why was this address blocked and found out that Spamcop site says
"216.9.248.51 not listed in bl.spamcop.net" Verification was done 5 hours
after the blocked message was received.

IP belongs to one of the Blackberry's smtp servers.

Any ideas? Could an address be removed within few hours?.

Any ideas? Is Spamcop failing or this is common?

Luis




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Spamcop listing google's IPs

[Panda Consulting S.A. Luis Alberto Arango]

Check 
http://www.spamcop.net/w3m?action=blcheck&ip=66.249.82.224

So.. Be careful if you are giving spamcop high scores.

Luis Arango




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] spamcop

[Travis Sullivan]

With this being said, no spam test is perfect.  Therefore, I don't recomend 
a single test, regardless how effective it is, being equal to your 
hold/delete weight.


I love the spamcop test, however, it is set to 60% of my hold weight, 
requiring another test or two to fail before the email is held.


Removing spamcop from your testing would be a mistake IMHO.

Travis

- Original Message - 
From: "Matt" <[EMAIL PROTECTED]>

To: 
Sent: Tuesday, November 22, 2005 9:20 AM
Subject: Re: [Declude.JunkMail] spamcop



Richard,

Last I checked, SpamCop was tagging about 50% of all of my spam, and while 
it certainly isn't perfect, it doesn't tag IP's that are perfectly clean. 
It is somewhat doubtful that one could remove SpamCop and not see more 
spam leakage.  As a Declude user, I think that you might want to consider 
changing the weight that you apply to SpamCop instead, and make sure that 
you aren't automatically taking action on just that single hit.


Personally I have few problems with SpamCop, and when they occur, they are 
almost always with bulk E-mail.  Since I weight it low enough and it takes 
multiple false positives to result in blocking a legitimate personal 
E-mail on my system, hits from SpamCop on places like Gmail, AOL, etc. go 
almost completely unnoticed.  The bulk E-mail is a different story though 
because many places have false positive issues with such traffic and 
varying definitions of spam, but people rarely complain about missing 
something like an Overstock.com ad if they do get blocked.


Matt



Richard Farris wrote:

I have already deactivated Spamcop...should I just leave it that way..I 
have seen where spamcop caught some pretty nasty email..but the declude 
may have caught it anyway...


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

- Original Message - From: "Darrell 
([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Monday, November 21, 2005 4:19 PM
Subject: Re: [Declude.JunkMail] spamcop


gmail has many outbound servers - chances are one of the messages went 
via a server listed in spamcop.  Spamcop these days has been proving to 
be less and less reliable - I can't tell you how often AOL, Earthlink, 
Gmail, Attbi, and other big ISP's get listed...

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, 
MRTG Integration, and Log Parsers.


Richard Farris writes:

I just sent myself 4 messages all the same from my gmail to my 
ethixs.com account and 3 came thru and one got caught in the filter 
because of spamcop? 3 of the messages had a weight of 0 and the one 
that was caught had a weight of 33does this make any sense...all 
the messages were the same except I put test 1, test 2, test 3 and test 
4 in the subject.. Richard Farris

Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet" ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] spamcop

[Darrell \([EMAIL PROTECTED])]

For my system I would not deactivate it, but the weight assigned to it is 
not very much.  It's a good test when used in a well structured weighting 
system. 


Darrell

DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus.  
Supports all versions of Declude from 1.5x - 3.x.  
http://www.invariantsystems.com 

Richard Farris writes: 

I have already deactivated Spamcop...should I just leave it that way..I 
have seen where spamcop caught some pretty nasty email..but the declude 
may have caught it anyway... 


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet" 

- Original Message - From: "Darrell 
([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Monday, November 21, 2005 4:19 PM
Subject: Re: [Declude.JunkMail] spamcop 



gmail has many outbound servers - chances are one of the messages went 
via a server listed in spamcop.  Spamcop these days has been proving to 
be less and less reliable - I can't tell you how often AOL, Earthlink, 
Gmail, Attbi, and other big ISP's get listed...

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, 
MRTG Integration, and Log Parsers. 


Richard Farris writes:
I just sent myself 4 messages all the same from my gmail to my 
ethixs.com account and 3 came thru and one got caught in the filter 
because of spamcop? 3 of the messages had a weight of 0 and the one that 
was caught had a weight of 33does this make any sense...all the 
messages were the same except I put test 1, test 2, test 3 and test 4 in 
the subject.. Richard Farris

Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet" ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] spamcop

[Scott Fisher]

For me this month spamcop has been correct 99.3% of the time.
It has detected about 45% of all spams.

- Original Message - 
From: "Richard Farris" <[EMAIL PROTECTED]>

To: 
Sent: Tuesday, November 22, 2005 9:02 AM
Subject: Re: [Declude.JunkMail] spamcop


I have already deactivated Spamcop...should I just leave it that way..I 
have seen where spamcop caught some pretty nasty email..but the declude may 
have caught it anyway...


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Monday, November 21, 2005 4:19 PM
Subject: Re: [Declude.JunkMail] spamcop


gmail has many outbound servers - chances are one of the messages went 
via a server listed in spamcop.  Spamcop these days has been proving to 
be less and less reliable - I can't tell you how often AOL, Earthlink, 
Gmail, Attbi, and other big ISP's get listed...

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, 
MRTG Integration, and Log Parsers.


Richard Farris writes:
I just sent myself 4 messages all the same from my gmail to my 
ethixs.com account and 3 came thru and one got caught in the filter 
because of spamcop? 3 of the messages had a weight of 0 and the one that 
was caught had a weight of 33does this make any sense...all the 
messages were the same except I put test 1, test 2, test 3 and test 4 in 
the subject.. Richard Farris

Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet" ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] spamcop

[Matt]

Richard,

Last I checked, SpamCop was tagging about 50% of all of my spam, and 
while it certainly isn't perfect, it doesn't tag IP's that are perfectly 
clean.  It is somewhat doubtful that one could remove SpamCop and not 
see more spam leakage.  As a Declude user, I think that you might want 
to consider changing the weight that you apply to SpamCop instead, and 
make sure that you aren't automatically taking action on just that 
single hit.


Personally I have few problems with SpamCop, and when they occur, they 
are almost always with bulk E-mail.  Since I weight it low enough and it 
takes multiple false positives to result in blocking a legitimate 
personal E-mail on my system, hits from SpamCop on places like Gmail, 
AOL, etc. go almost completely unnoticed.  The bulk E-mail is a 
different story though because many places have false positive issues 
with such traffic and varying definitions of spam, but people rarely 
complain about missing something like an Overstock.com ad if they do get 
blocked.


Matt



Richard Farris wrote:

I have already deactivated Spamcop...should I just leave it that 
way..I have seen where spamcop caught some pretty nasty email..but the 
declude may have caught it anyway...


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

- Original Message - From: "Darrell 
([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Monday, November 21, 2005 4:19 PM
Subject: Re: [Declude.JunkMail] spamcop


gmail has many outbound servers - chances are one of the messages 
went via a server listed in spamcop.  Spamcop these days has been 
proving to be less and less reliable - I can't tell you how often 
AOL, Earthlink, Gmail, Attbi, and other big ISP's get listed...

Darrell

Check out http://www.invariantsystems.com for utilities for Declude 
And Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI 
integration, MRTG Integration, and Log Parsers.


Richard Farris writes:

I just sent myself 4 messages all the same from my gmail to my 
ethixs.com account and 3 came thru and one got caught in the filter 
because of spamcop? 3 of the messages had a weight of 0 and the one 
that was caught had a weight of 33does this make any sense...all 
the messages were the same except I put test 1, test 2, test 3 and 
test 4 in the subject.. Richard Farris

Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet" ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] spamcop

[Richard Farris]

I have already deactivated Spamcop...should I just leave it that way..I have 
seen where spamcop caught some pretty nasty email..but the declude may have 
caught it anyway...


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>

To: 
Sent: Monday, November 21, 2005 4:19 PM
Subject: Re: [Declude.JunkMail] spamcop


gmail has many outbound servers - chances are one of the messages went via 
a server listed in spamcop.  Spamcop these days has been proving to be 
less and less reliable - I can't tell you how often AOL, Earthlink, Gmail, 
Attbi, and other big ISP's get listed...

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, 
MRTG Integration, and Log Parsers.


Richard Farris writes:
I just sent myself 4 messages all the same from my gmail to my ethixs.com 
account and 3 came thru and one got caught in the filter because of 
spamcop? 3 of the messages had a weight of 0 and the one that was caught 
had a weight of 33does this make any sense...all the messages were 
the same except I put test 1, test 2, test 3 and test 4 in the subject.. 
Richard Farris

Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet" ---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] spamcop

[Darrell \([EMAIL PROTECTED])]

gmail has many outbound servers - chances are one of the messages went via a 
server listed in spamcop.  Spamcop these days has been proving to be less 
and less reliable - I can't tell you how often AOL, Earthlink, Gmail, Attbi, 
and other big ISP's get listed... 

Darrell 



Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers. 



Richard Farris writes: 

I just sent myself 4 messages all the same from my gmail to my ethixs.com 
account and 3 came thru and one got caught in the filter because of 
spamcop? 3 of the messages had a weight of 0 and the one that was caught 
had a weight of 33does this make any sense...all the messages were the 
same except I put test 1, test 2, test 3 and test 4 in the subject.. 


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet" 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] spamcop

[Richard Farris]

I just sent myself 4 messages all the same from my gmail to my ethixs.com 
account and 3 came thru and one got caught in the filter because of spamcop? 
3 of the messages had a weight of 0 and the one that was caught had a weight 
of 33does this make any sense...all the messages were the same except I 
put test 1, test 2, test 3 and test 4 in the subject..


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Spamcop catching Gmail

[Travis Sullivan]

I noticed that Spamcop is catching email from GMAIL.COM

Is there another real-time black list to use that is as good Spamcop was.


Gmail is slow on their TOS reports.  I have sent in 30 so far and it 
normally takes 5 working days for them to kill the account and reply.


However, I have spamcop set to 40% hold weight.  I also use spamhause.

There are many good ones, when used together with declude's weight system, 
they are very affective.


I found most of mine at declude's web site under the free tools listing I 
think.


Travis 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Spamcop catching Gmail

[Frederick Samarelli]

I noticed that Spamcop is catching email from GMAIL.COM

Is there another real-time black list to use that is as good Spamcop was.

Fred


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Spamcop catching gmail

[Richard Farris]

I will send one next time I get one...I guess I could lower the spamcop to a 
weight of 8 which is just under my hold @ 9...but spamcop does catch a lot 
of junk sometimes..


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

- Original Message - 
From: "Colbeck, Andrew" <[EMAIL PROTECTED]>

To: 
Sent: Monday, July 11, 2005 11:58 AM
Subject: RE: [Declude.JunkMail] Spamcop catching gmail


Do you have an example, Richard?


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris
Sent: Monday, July 11, 2005 9:48 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Spamcop catching gmail

I am finding several legitimate emails held by spamcop...why would they
list gmail..

Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Spamcop catching gmail

[Richard Farris]

Also, all of a sudden I am catching a lot of  seemingly lagitimate mail from 
yahoo with ..

Subject
To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding;

Headers
Received: from spamwall.apid.com [63.238.52.89] by ethixs.com with ESMTP
 (SMTPD32-7.11) id A86D12EA0280; Fri, 08 Jul 2005 19:12:45 -0400
Received: by spamwall.apid.com (Postfix, from userid 777)
id 1212646B31; Fri,  8 Jul 2005 18:15:04 -0500 (CDT)
Received: from web30006.mail.mud.yahoo.com (web30006.mail.mud.yahoo.com 
[68.142.200.69])

by spamwall.apid.com (Postfix) with SMTP id 9A1FF46B24
for <[EMAIL PROTECTED]>; Fri,  8 Jul 2005 18:15:01 -0500 (CDT)
Received: (qmail 83119 invoked by uid 60001); 8 Jul 2005 23:14:56 -
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
 s=s1024; d=yahoo.com;
 
h=Message-ID:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding;
 b=OxuY1eFj1ERm0jX9xrPSfNJnZL/Ir0gnXAo6+OngyuFtf0eX6mf8SEX6Metj8cd6h5LooW+IgNfA5bGOeAjLmTM0Ss0FpyYBuAS2sbvSuOrxTmca5HexiuNObp3eDhSREJ3P6O6kogLO+r20oHW/DZUvDDRqgeNyPn3zOMx/p7s= 
;

Message-ID: <[EMAIL PROTECTED]>
Received: from [12.220.65.198] by web30006.mail.mud.yahoo.com via HTTP; Fri, 
08 Jul 2005 16:14:56 PDT

Date: Fri, 8 Jul 2005 16:14:56 -0700 (PDT)
From: Payton Harris <[EMAIL PROTECTED]>
Subject: Re: Jaclyn
To: Courtney Carter <[EMAIL PROTECTED]>
In-Reply-To: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-83948726-1120864496=:81139"
Content-Transfer-Encoding: 8bit
X-Filtered-By: SublimeMail (http://sublimemail.com)
X-Declude-Sender: [EMAIL PROTECTED] [68.142.200.69]
X-Declude-Spoolname: D086d12ea0280ee76.SMD
X-Note: Total Spam Weight Of This Email Is 23.

Any Ideas whyit started about a month ago..

Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

- Original Message - 
From: "Richard Farris" <[EMAIL PROTECTED]>

To: 
Sent: Monday, July 11, 2005 11:48 AM
Subject: [Declude.JunkMail] Spamcop catching gmail


I am finding several legitimate emails held by spamcop...why would they 
list gmail..


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Spamcop catching gmail

[Colbeck, Andrew]

Do you have an example, Richard?
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Richard Farris
Sent: Monday, July 11, 2005 9:48 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Spamcop catching gmail

I am finding several legitimate emails held by spamcop...why would they
list gmail..

Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Spamcop catching gmail

[Darrell \([EMAIL PROTECTED])]

Richard, 

This is a common complaint of a lot of people about Spamcop including 
myself.  They have no issues listing AOL, Hotmail, etc.  It's just the way 
their system works.  It takes in really no consideration that yes they may 
leak some spam - but all in all they are legit servers. 


Darrell
-
DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus.
http://www.invariantsystems.com 

Richard Farris writes: 

I am finding several legitimate emails held by spamcop...why would they 
list gmail.. 


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet" 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Spamcop catching gmail

[Richard Farris]

I am finding several legitimate emails held by spamcop...why would they list 
gmail..


Richard Farris
Ethixs Online
1.270.247. Office
1.800.548.3877 Tech Support
"Crossroads to a Cleaner Internet"

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop blacklist "Misdirected bounces"

[Dave Doherty]

This can also come about through use 
of a mail gateway. I used a Symantec SMTP 
virus gateway for a while. I stopped using it because I couldn't turn off the 
bounce messages. 
 
When I 
asked Symantec how to stop the bounces, they said they never even 
considered making that possible because it would violate the RFCs. 
They told me that the RFCs required that receiving mail server notify the 
sender that it can't deliver, either with a 550 at envelope time or with a 
bounce message. 
 
Of course, if that's true, we 
are all violating the RFCs every day.
 
-Dave Doherty
 Skywaves, Inc.
 
 
 

  - Original Message - 
  From: 
  John Tolmachoff (Lists) 
  To: Declude.JunkMail@declude.com 
  
  Sent: Tuesday, April 12, 2005 2:58 
  PM
  Subject: RE: [Declude.JunkMail] SpamCop 
  blacklist "Misdirected bounces" 
  
  
  Let me guess, you 
  are using the evil BOUNCEIFYOUMUST action in Declude JM?
   
  
  John 
  T
  eServices For 
  You
   
  
  -Original 
  Message-From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED] On Behalf Of Technical 
  SupportSent: 
  Tuesday, April 12, 
  2005 11:34 
  AMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] SpamCop 
  blacklist "Misdirected bounces" 
   
  I just found out that our mail 
  server has been blacklisted by spamcop, apparently for "Misdirected bounces" 
  which seems to be nothing more than bouncing a message after first accepting 
  it  (I pasted Spamcop's explanation below).  I'm running Imail v8.05 
  with declude v1.82, and I'm not sure how to fix this to Spamcop's 
  satisfaction.  Has anyone else had this issue before, and if so, what can 
  be done to fix it?
  
   
  
  Thanks 
  much,
  
   
  
  Tom Wright
  
   
  
   
  
  Problem: Misdirected bounces 
  Description: When a mail server accepts a 
  message and later decides that it can't deliver the message, it is required to 
  send back a bounce email to the sender of the original message. These bounce 
  emails are often misdirected. 
  Solution: Upgrade and/or configure your mail server 
  software so that this situation is never encountered. Configure your software 
  to either reject messages during delivery or accept them permanently. Do not 
  let your software make choices about delivery after it has accepted a message. 
  If you must accept delivery before you know the status of a message, then file 
  it internally - do not send, forward or bounce it outside your organization. 
  The errant message can be placed in a special folder or routed to your 
  postmaster

Re: [Declude.JunkMail] SpamCop blacklist "Misdirected bounces"

[System Administrator]

on 4/12/05 2:33 PM, Technical Support wrote:

> Has anyone else had this issue before,
> and if so, what can be done to fix it?

Yes, one of my servers is listed somewhere (sorbs I think).

Setup an outbound rule in IMail, any message from
[EMAIL PROTECTED] with a subject of "undeliverable mail" gets
deleted.

Greg

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop blacklist "Misdirected bounces"

[John Tolmachoff \(Lists\)]

Let me guess, you are using the evil
BOUNCEIFYOUMUST action in Declude JM?

 



John T

eServices For You



 



-Original Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Technical Support
Sent: Tuesday, April
 12, 2005 11:34 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail]
SpamCop blacklist "Misdirected bounces" 

 

I just found out that our mail server has been blacklisted
by spamcop, apparently for "Misdirected bounces" which seems to be
nothing more than bouncing a message after first accepting it  (I pasted
Spamcop's explanation below).  I'm running Imail v8.05 with declude v1.82,
and I'm not sure how to fix this to Spamcop's satisfaction.  Has anyone
else had this issue before, and if so, what can be done to fix it?



 





Thanks much,





 





Tom Wright





 





 





Problem: Misdirected bounces 

Description: When a mail server accepts a message and
later decides that it can't deliver the message, it is required to send back a
bounce email to the sender of the original message. These bounce emails are
often misdirected. 

Solution: Upgrade and/or configure your mail server
software so that this situation is never encountered. Configure your software
to either reject messages during delivery or accept them permanently. Do not
let your software make choices about delivery after it has accepted a message.
If you must accept delivery before you know the status of a message, then file
it internally - do not send, forward or bounce it outside your organization.
The errant message can be placed in a special folder or routed to your
postmaster

[Declude.JunkMail] SpamCop blacklist "Misdirected bounces"

[Technical Support]

I 
just found out that our mail server has been blacklisted by spamcop, apparently 
for "Misdirected bounces" which seems to be nothing more than bouncing a message 
after first accepting it  (I pasted Spamcop's explanation below).  
I'm running 
Imail v8.05 with declude v1.82, and I'm not sure how to fix this to Spamcop's 
satisfaction.  Has anyone else had this issue before, and if so, what can 
be done to fix it?
 
Thanks 
much,
 
Tom 
Wright
 
 

Problem: Misdirected bounces 
Description: When a mail server accepts a message and later decides that it 
can't deliver the message, it is required to send back a bounce email to the 
sender of the original message. These bounce emails are often misdirected. 
Solution: Upgrade and/or configure your mail server software so that this 
situation is never encountered. Configure your software to either reject 
messages during delivery or accept them permanently. Do not let your software 
make choices about delivery after it has accepted a message. If you must accept 
delivery before you know the status of a message, then file it internally - do 
not send, forward or bounce it outside your organization. The errant message can 
be placed in a special folder or routed to your 
postmaster

Re: [Declude.JunkMail] SpamCop listing AOL webmail servers

[Dave Doherty]

I do the same.
-d
- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
To: 
Sent: Monday, February 28, 2005 2:02 PM
Subject: Re: [Declude.JunkMail] SpamCop listing AOL webmail servers


SpamCop and pretty well every other blacklisting service make no
allowance for how much good mail is coming from an IP address.  They
only do blacklisting.
I am not sure how many people actually do this, but I give a small weight 
back to the message if it was truely sent from an AOL MX.  This helps when 
specific AOL servers get listed in Spamcop.  To be honest I see very 
little spam sent directly from AOL servers.  So this method of credit I 
have been doing has never been a real problem.
Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, 
MRTG Integration, and Log Parsers.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop listing AOL webmail servers

[John Tolmachoff \(Lists\)]

I also should have expounded more on my post.

The MX servers are not listed, rather the webmail servers are. Since I scan
2 hops, it is the 2nd hop that is getting hit on. 

What I have done for that is the following filter:

MAILFROM END NOTENDSWITH @aol.com
TESTSFAILED END NOTCONTAINS SPAMCOP
REVDNS -15 ENDSWITH .mx.aol.com

The -15 is counter weight for SPAMCOP which I only weigh at 15. (Hold at 25
delete at 35) 

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
> Sent: Monday, February 28, 2005 9:37 AM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] SpamCop listing AOL webmail servers
> 
> Well, John.  I'm sure that's a rhetorical question, but I'm feeling a
> little chatty while I listen to hold music.
> 
> SpamCop and pretty well every other blacklisting service make no
> allowance for how much good mail is coming from an IP address.  They
> only do blacklisting.
> 
> The funny thing is that since IronPort now owns SpamCop.net, you'd think
> that they could use the statistics that they expose at SenderBase.org to
> adjust the weighting mechanism that SpamCop uses.
> 
> I'm sure that
> 
> a) AOL isn't perfect, and spam does come from some accounts,
> b) Automated (and semi-automated) listing mechanisms like SpamCop will
> impede traffic
> c) AOL is the ISP that everyone loves to hate.  SpamCop users may well
> go ahead and
>and report suspicious emails.
> d) Spam and virus blowblack needs to be carefully weeded out by ISPs so
> that they
>don't get listed by sending unexpected responses to forged addresses.
> 
> It's been said by wiser heads, but I'll say it again for folks without
> John's depth of experience:  Don't weigh individual tests high enough to
> be caught by a single false positive.  That likely means that you will
> get some spam in, but that's preferable to blocking mail that you
> shouldn't.
> 
> I've been burned by multiple ip4r tests blocking ISPs, and have
> counterweighted those mail servers accordingly.  That also means that
> I'm more likely to get spam.
> 
> I'll also add that false positives in blacklisting has made content
> inspection much more important to me.  Mail Sniffer from SortMonster.com
> helps me out a huge amount, and has taken away much of my burden for
> maintaining my own filter text files.
> 
> A SURBL lookup like invIURIBL from invariantsystems.com or via
> spamassassin would certainly help out too (but I'm not there yet).
> 
> Andrew 8)
> 
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
> (Lists)
> Sent: Monday, February 28, 2005 7:10 AM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] SpamCop listing AOL webmail servers
> 
> 
> http://www.spamcop.net/bl.shtml?205.188.139.132
> 
> WHY? (grumble mumble grumble &^%&^$^*(&^%^%&^&^&)
> 
> John Tolmachoff
> Engineer/Consultant/Owner
> eServices For You
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop listing AOL webmail servers

[Colbeck, Andrew]

Indeed.  Hypothetically, of course, one could do add these lines to a
filter:

#Sep-12-2003 AC The ISP everyone loves to hate, always has a weight of 8
due to NOABUSE:3 NOPOSTMASTER:3 IPNOTINMX:2
#Sep-23-2003And is always on someone's shit list; added another 10
to the counterweight
#Feb-28-2005 AC Updated the list of CIDR blocks via SenderBase.org and
split the weight between revdns and remoteip
REVDNS-9 ENDSWITH .mx.aol.com
REVDNS-9 ENDSWITH .webmail.aol.com
REMOTEIP  -9 CIDR 152.163.225.0/24
REMOTEIP  -9 CIDR 205.188.139.0/24
REMOTEIP  -9 CIDR 205.188.144.0/24
REMOTEIP  -9 CIDR 205.188.155.0/24
REMOTEIP  -9 CIDR 205.188.156.0/24
REMOTEIP  -9 CIDR 205.188.158.0/24
REMOTEIP  -9 CIDR 205.188.159.0/24
REMOTEIP  -9 CIDR 64.12.136.0/24
REMOTEIP  -9 CIDR 64.12.137.0/24
REMOTEIP  -9 CIDR 64.12.138.0/24

Of course, hypothetically speaking, one could also contrive a Scott
Fisher-esque TRUE-AOL test based entirely on his technique for his
TRUE-TLD tests, thus only rewarding messages with a negative weight if
the mailfrom and the revdns are both aol.com ...

Andrew 8)

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Monday, February 28, 2005 11:02 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] SpamCop listing AOL webmail servers


> SpamCop and pretty well every other blacklisting service make no 
> allowance for how much good mail is coming from an IP address.  They 
> only do blacklisting.

I am not sure how many people actually do this, but I give a small
weight 
back to the message if it was truely sent from an AOL MX.  This helps
when 
specific AOL servers get listed in Spamcop.  To be honest I see very
little 
spam sent directly from AOL servers.  So this method of credit I have
been 
doing has never been a real problem. 

Darrell 

 

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration,
MRTG 
Integration, and Log Parsers. 


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop listing AOL webmail servers

[Darrell \([EMAIL PROTECTED])]

SpamCop and pretty well every other blacklisting service make no
allowance for how much good mail is coming from an IP address.  They
only do blacklisting.
I am not sure how many people actually do this, but I give a small weight 
back to the message if it was truely sent from an AOL MX.  This helps when 
specific AOL servers get listed in Spamcop.  To be honest I see very little 
spam sent directly from AOL servers.  So this method of credit I have been 
doing has never been a real problem. 

Darrell 


Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers. 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop listing AOL webmail servers

[Colbeck, Andrew]

Well, John.  I'm sure that's a rhetorical question, but I'm feeling a
little chatty while I listen to hold music.

SpamCop and pretty well every other blacklisting service make no
allowance for how much good mail is coming from an IP address.  They
only do blacklisting.

The funny thing is that since IronPort now owns SpamCop.net, you'd think
that they could use the statistics that they expose at SenderBase.org to
adjust the weighting mechanism that SpamCop uses.

I'm sure that

a) AOL isn't perfect, and spam does come from some accounts,
b) Automated (and semi-automated) listing mechanisms like SpamCop will
impede traffic
c) AOL is the ISP that everyone loves to hate.  SpamCop users may well
go ahead and
   and report suspicious emails.
d) Spam and virus blowblack needs to be carefully weeded out by ISPs so
that they
   don't get listed by sending unexpected responses to forged addresses.

It's been said by wiser heads, but I'll say it again for folks without
John's depth of experience:  Don't weigh individual tests high enough to
be caught by a single false positive.  That likely means that you will
get some spam in, but that's preferable to blocking mail that you
shouldn't.

I've been burned by multiple ip4r tests blocking ISPs, and have
counterweighted those mail servers accordingly.  That also means that
I'm more likely to get spam.

I'll also add that false positives in blacklisting has made content
inspection much more important to me.  Mail Sniffer from SortMonster.com
helps me out a huge amount, and has taken away much of my burden for
maintaining my own filter text files.

A SURBL lookup like invIURIBL from invariantsystems.com or via
spamassassin would certainly help out too (but I'm not there yet).

Andrew 8)

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Monday, February 28, 2005 7:10 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] SpamCop listing AOL webmail servers


http://www.spamcop.net/bl.shtml?205.188.139.132

WHY? (grumble mumble grumble &^%&^$^*(&^%^%&^&^&)

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SpamCop listing AOL webmail servers

[John Tolmachoff \(Lists\)]

http://www.spamcop.net/bl.shtml?205.188.139.132

WHY? (grumble mumble grumble &^%&^$^*(&^%^%&^&^&)

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop not testing?

[Ernesto]

Darrell,

Thanks for the tip.  Though it doesn't apply to me, it was
my DNS setting in my SMTP service in IMail.  Once I changed
those, all was well in email land.

Ernesto

- Original Message - 
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
To: 
Sent: Wednesday, January 12, 2005 5:02 PM
Subject: Re: [Declude.JunkMail] SpamCop not testing?


> Ernesto,
>
> I am not sure if anyone else has covered this or even if this is
applicable,
> but some ISP's like AT&T will deny DNS queries for known spam lists like
> SPAMCOP while allowing other ones to go through.
>
> Darrell
>
>  
> Check out http://www.invariantsystems.com for utilities for Declude And
> Imail.  IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log
> Parsers.
>
>
>
> Ernesto writes:
>
> > Scott,
> >Thanks for the reply.  I have checked my DNS settings, but everything
is
> > fine.
> > I've checked again, and nothing is being detected as spam, even when the
IPs
> > are
> > listed.  Actually, none of the other tests, such as SORBS, DSBL, AHBL,
etc
> > are giving
> > any positives.
> >
> >   If it really is my DNS settings, how can I check to make sure that I
do
> > have it correct.
> > thanks
> >
> > - Original Message - 
> > From: "R. Scott Perry" <[EMAIL PROTECTED]>
> > To: 
> > Sent: Tuesday, January 11, 2005 11:18 AM
> > Subject: Re: [Declude.JunkMail] SpamCop not testing?
> >
> >
> >>
> >> >Has there been a change in the cfg files lately, or something?
> >> >I've seen a few domains/IPs that Spamcop does have listed,
> >> >yet, they don't appear to have failed the spamcop test.
> >> >This is the line I have in my cfg file:
> >> >
> >> >SPAMCOP ip4r bl.spamcop.net 127.0.0.2 5 0
> >> >
> >> >
> >> >
> >> >Is there something I should notice so that I can see
> >> >
> >> >why this test isn't being run?  (I used to see it all the time too.)
> >>
> >> Are any E-mails failing the SPAMCOP test?  If not, then there is
probably
> > a
> >> DNS or configuration issue.
> >>
> >> If some E-mails are failing the SPAMCOP test, the problem may just be
that
> >> you are receiving the E-mail before the IP gets listed in the SPAMCOP
> >> database.  Unfortunately, the company that now runs SPAMCOP no longer
lets
> >> you see when the IP was added, so it is impossible to know for certain
> >> whether or not that is the case.
> >>
> >> -Scott
> >> ---
> >> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> >> since 2000.
> >> Declude Virus: Ultra reliable virus detection and the leader in
mailserver
> >> vulnerability detection.
> >> Find out what you've been missing: Ask for a free 30-day evaluation.
> >>
> >>
> >> 
> >> This outgoing message is guaranteed to be authentic by Message Level
> > users.
> >> Guarantee the authenticity of your email @ http://www.messagelevel.com.
> >> ---
> >> [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >>
> >> ---
> >> This E-mail came from the Declude.JunkMail mailing list.  To
> >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> >> type "unsubscribe Declude.JunkMail".  The archives can be found
> >> at http://www.mail-archive.com.
> >>
> >>
> >>
> >>
> >>
> >
> >
> >
> >
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>
>
>
>





---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop not testing?

[Darrell \([EMAIL PROTECTED])]

Ernesto, 

I am not sure if anyone else has covered this or even if this is applicable, 
but some ISP's like AT&T will deny DNS queries for known spam lists like 
SPAMCOP while allowing other ones to go through. 

Darrell 


Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log 
Parsers. 


Ernesto writes: 

Scott,
   Thanks for the reply.  I have checked my DNS settings, but everything is
fine.
I've checked again, and nothing is being detected as spam, even when the IPs
are
listed.  Actually, none of the other tests, such as SORBS, DSBL, AHBL, etc
are giving
any positives. 

  If it really is my DNS settings, how can I check to make sure that I do
have it correct.
thanks 

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 11:18 AM
Subject: Re: [Declude.JunkMail] SpamCop not testing? 


>Has there been a change in the cfg files lately, or something?
>I've seen a few domains/IPs that Spamcop does have listed,
>yet, they don't appear to have failed the spamcop test.
>This is the line I have in my cfg file:
>
>SPAMCOP ip4r bl.spamcop.net 127.0.0.2 5 0
>
>
>
>Is there something I should notice so that I can see
>
>why this test isn't being run?  (I used to see it all the time too.) 

Are any E-mails failing the SPAMCOP test?  If not, then there is probably
a
DNS or configuration issue. 

If some E-mails are failing the SPAMCOP test, the problem may just be that
you are receiving the E-mail before the IP gets listed in the SPAMCOP
database.  Unfortunately, the company that now runs SPAMCOP no longer lets
you see when the IP was added, so it is impossible to know for certain
whether or not that is the case. 

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation. 


This outgoing message is guaranteed to be authentic by Message Level
users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com. 



 

 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop not testing?

[R. Scott Perry]

Do you have do you have any further information about this statement - what
type of errors, etc.
"It is important to note that you should only have one DNS server listed in
the IMail SMTP settings (IMail has a known sporadic issue if there are
multiple DNS servers listed)."
The issue I am aware of will occur when something goes wrong with the first 
DNS server (a simple dropped packet can do it), and the backup DNS server 
is denying DNS lookups.  IMail will try an MX record lookup, it will fail, 
and IMail will then try the A record on the primary DNS server.  This 
causes the E-mail to incorrectly be sent to the wrong IP address, causing 
bounces, deleted E-mails, and other such nasty things.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop not testing?

[Chuck Schick]

Scott:

Do you have do you have any further information about this statement - what
type of errors, etc.

"It is important to note that you should only have one DNS server listed in 
the IMail SMTP settings (IMail has a known sporadic issue if there are 
multiple DNS servers listed)."

We have used 3 DNS servers in Imail for 6 years and I was not aware of any
problems.  We even change the order sometimes so Imail is querying the least
busy one.

Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop not testing?

[Ernesto]

That did it!
I completely forgot to look in the SMTP dns settings.
Once I changed that, bang...lot's o' Spam being caught.
Thanks!

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: 
Sent: Wednesday, January 12, 2005 9:13 AM
Subject: Re: [Declude.JunkMail] SpamCop not testing?


>
> >Thanks for the reply.  I have checked my DNS settings, but everything
is
> >fine.
>
> It is important to note that you should only have one DNS server listed in
> the IMail SMTP settings (IMail has a known sporadic issue if there are
> multiple DNS servers listed).
>
> >I've checked again, and nothing is being detected as spam, even when the
IPs
> >are listed.
>
> That is very useful, and:
>
> >   Actually, none of the other tests, such as SORBS, DSBL, AHBL, etc
> >are giving any positives.
>
> so is this.  If none of the DNS-based spam tests are failing, it usually
> indicates a DNS problem.  However, if some DNS-based spam tests (such as
> REVDNS) are working, then it likely means that you are running a gateway
> and/or backup mailserver that you forgot to tell Declude JunkMail about
> (with IPBYPASS settings).
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
>
> 
> This outgoing message is guaranteed to be authentic by Message Level
users.
> Guarantee the authenticity of your email @ http://www.messagelevel.com.
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>
>
>
>





---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop not testing?

[R. Scott Perry]

> It is important to note that you should only have one DNS
> server listed in the IMail SMTP settings (IMail has a known
> sporadic issue if there are multiple DNS servers listed).
Really?
I've listed 3 DNS for over 4 years now without any problem. Is there any KB
article?
I'm not sure if they have a KB article about it.
The issue I am aware of will occur when something goes wrong with the first 
DNS server (a simple dropped packet can do it), and the backup DNS server 
is denying DNS lookups.  IMail will try an MX record lookup, it will fail, 
and IMail will then try the A record on the primary DNS server.  This 
causes the E-mail to incorrectly be sent to the wrong IP address, causing 
bounces, deleted E-mails, and other such nasty things.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop not testing?

[R. Scott Perry]

   Thanks for the reply.  I have checked my DNS settings, but everything is
fine.
It is important to note that you should only have one DNS server listed in 
the IMail SMTP settings (IMail has a known sporadic issue if there are 
multiple DNS servers listed).

I've checked again, and nothing is being detected as spam, even when the IPs
are listed.
That is very useful, and:
  Actually, none of the other tests, such as SORBS, DSBL, AHBL, etc
are giving any positives.
so is this.  If none of the DNS-based spam tests are failing, it usually 
indicates a DNS problem.  However, if some DNS-based spam tests (such as 
REVDNS) are working, then it likely means that you are running a gateway 
and/or backup mailserver that you forgot to tell Declude JunkMail about 
(with IPBYPASS settings).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop not testing?

[Markus Gufler]

> It is important to note that you should only have one DNS 
> server listed in the IMail SMTP settings (IMail has a known 
> sporadic issue if there are multiple DNS servers listed).

Really?
I've listed 3 DNS for over 4 years now without any problem. Is there any KB
article?

Markus


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop not testing?

[Ernesto]

Scott,
   Thanks for the reply.  I have checked my DNS settings, but everything is
fine.
I've checked again, and nothing is being detected as spam, even when the IPs
are
listed.  Actually, none of the other tests, such as SORBS, DSBL, AHBL, etc
are giving
any positives.

  If it really is my DNS settings, how can I check to make sure that I do
have it correct.
thanks

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: 
Sent: Tuesday, January 11, 2005 11:18 AM
Subject: Re: [Declude.JunkMail] SpamCop not testing?


>
> >Has there been a change in the cfg files lately, or something?
> >I've seen a few domains/IPs that Spamcop does have listed,
> >yet, they don't appear to have failed the spamcop test.
> >This is the line I have in my cfg file:
> >
> >SPAMCOP ip4r bl.spamcop.net 127.0.0.2 5 0
> >
> >
> >
> >Is there something I should notice so that I can see
> >
> >why this test isn't being run?  (I used to see it all the time too.)
>
> Are any E-mails failing the SPAMCOP test?  If not, then there is probably
a
> DNS or configuration issue.
>
> If some E-mails are failing the SPAMCOP test, the problem may just be that
> you are receiving the E-mail before the IP gets listed in the SPAMCOP
> database.  Unfortunately, the company that now runs SPAMCOP no longer lets
> you see when the IP was added, so it is impossible to know for certain
> whether or not that is the case.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
>
> 
> This outgoing message is guaranteed to be authentic by Message Level
users.
> Guarantee the authenticity of your email @ http://www.messagelevel.com.
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
>
>
>
>





---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop not testing?

[R. Scott Perry]

Has there been a change in the cfg files lately, or something?
I've seen a few domains/IPs that Spamcop does have listed,
yet, they don't appear to have failed the spamcop test.
This is the line I have in my cfg file:
SPAMCOP ip4r bl.spamcop.net 127.0.0.2 5 0

Is there something I should notice so that I can see
why this test isn't being run?  (I used to see it all the time too.)
Are any E-mails failing the SPAMCOP test?  If not, then there is probably a 
DNS or configuration issue.

If some E-mails are failing the SPAMCOP test, the problem may just be that 
you are receiving the E-mail before the IP gets listed in the SPAMCOP 
database.  Unfortunately, the company that now runs SPAMCOP no longer lets 
you see when the IP was added, so it is impossible to know for certain 
whether or not that is the case.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SpamCop not testing?

[Ernesto Nieto]

Has there been a change in the cfg files lately, or something?
I've seen a few domains/IPs that Spamcop does have listed,
yet, they don't appear to have failed the spamcop test.
This is the line I have in my cfg file:

SPAMCOP ip4r bl.spamcop.net 127.0.0.2 5 0



Is there something I should notice so that I can see

why this test isn't being run?  (I used to see it all the time too.)

Thanks






---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop Listed

[David Franco-Rocha]

Serge,

If you want to use the list manually, or from custom 
software, you should instruct your system to do a dns query for the information. 
For example, if you want to check if 1.2.3.4 is on the blacklist, you might type 
this at the command-line: 
nslookup 4.3.2.1.bl.spamcop.net
If you get back an IP address (typically 127.0.0.2), 
then the IP you asked about is listed. If you get back a non-existant message, 
then the IP you asked about is not listed. 
"nslookup" is just the most common method for looking 
up a hostname. Your system may have another name for it. Other common names are 
"host" and "dig". 


Accordingly, if you do nslookup 6.200.154.208.bl.spamcop.net, 
the lookup returns 127.0.0.2, which means your IP is listed. On the other hand, 
when you enter your IP in the interactive query on their website, it says that 
your IP is not listed. That is an issue you will have to address with Spamcop. 
Declude uses the DNS-type of lookup, and is reporting the result 
accordingly.
David Franco-Rocha
Declude Technical Support
 
 

- Original Message - 
From: "Serge" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, August 15, 2004 7:53 PM
Subject: [Declude.JunkMail] SpamCop 
Listed
> Hi all> > DNSStuff shows my server listed in 
spamcop:> >   SPAMCOP  LISTED 
(127.0.0.2)  TXT= "Blocked - see> http://www.spamcop.net/bl.shtml?208.154.200.6"  1745 seconds  0 ms> > > But spamcop.net 
showing it as not listed:> > 208.154.200.6 not listed in 
bl.spamcop.net> > What is going on ?> > > 
---> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]> 
> ---> This E-mail came from the Declude.JunkMail mailing 
list.  To> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and> type 
"unsubscribe Declude.JunkMail".  The archives can be found> at 
http://www.mail-archive.com.

[Declude.JunkMail] SpamCop Listed

[Serge]

Hi all

DNSStuff shows my server listed in spamcop:

  SPAMCOP  LISTED (127.0.0.2)  TXT= "Blocked - see
http://www.spamcop.net/bl.shtml?208.154.200.6";  1745 seconds  0 ms


But spamcop.net showing it as not listed:

208.154.200.6 not listed in bl.spamcop.net

What is going on ?


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP

[Kevin Bilbee]

We use AT&T for out T1. We had so many problems with AT&T DNS we had them
delegate the reverse to us and now we host our own DNS.


Kevin Bilbee

> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Darrell LaRock
> Sent: Thursday, April 01, 2004 8:41 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] SPAMCOP
>
>
> Scott,
>
> It's AT&T's DNS servers.  I wonder if they are doing something to block
> those kinds of lookup's.
>
> Darrell
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
> Sent: Thursday, April 01, 2004 11:02 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] SPAMCOP
>
>
> >I noticed that several RBL's have not been triggered off one of
> our backup
> >mail servers over the last 24 hours.  For example SPAMCOP
> hasn't.  I turned
> >on "DEBUG" mode and noticed that it was reporting this
> >
> >04/01/2004 10:56:53.296 Q3bbb215802381bda Test #18 [ORDB] is same as Test
> >#18 [ORDB=*]. Answer=root.loopback.?
> >04/01/2004 10:56:53.296 Q3bbb215802381bda Test #19 [SPAMCOP] is same as
> Test
> >#19 [SPAMCOP=127.0.0.2]. Answer=root.loopback.?
> >04/01/2004 10:56:53.296 Q3bbb215802381bda Test #20 [DSBL] is same as Test
> >#20 [DSBL=*]. Answer=root.loopback.?
> >
> >Is this a normal answer?
>
> No, that is not a normal answer -- the "Answer=root.loopback.?" indicates
> that the DNS server is responding, but reporting an answer of
> "root.loopback" which isn't correct.  It sounds like your DNS server is
> having problems.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in
> mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP

[niceman]

I noticed this about a year ago on some of the other DNSBL's; they are trying to 
reduce DNS load by making these types of queries fail.


> Scott,
> 
> It's AT&T's DNS servers.  I wonder if they are doing something to block
> those kinds of lookup's.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP

[Darrell LaRock]

Scott,

It's AT&T's DNS servers.  I wonder if they are doing something to block
those kinds of lookup's.

Darrell

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, April 01, 2004 11:02 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] SPAMCOP


>I noticed that several RBL's have not been triggered off one of our backup
>mail servers over the last 24 hours.  For example SPAMCOP hasn't.  I turned
>on "DEBUG" mode and noticed that it was reporting this
>
>04/01/2004 10:56:53.296 Q3bbb215802381bda Test #18 [ORDB] is same as Test
>#18 [ORDB=*]. Answer=root.loopback.?
>04/01/2004 10:56:53.296 Q3bbb215802381bda Test #19 [SPAMCOP] is same as
Test
>#19 [SPAMCOP=127.0.0.2]. Answer=root.loopback.?
>04/01/2004 10:56:53.296 Q3bbb215802381bda Test #20 [DSBL] is same as Test
>#20 [DSBL=*]. Answer=root.loopback.?
>
>Is this a normal answer?

No, that is not a normal answer -- the "Answer=root.loopback.?" indicates 
that the DNS server is responding, but reporting an answer of 
"root.loopback" which isn't correct.  It sounds like your DNS server is 
having problems.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP

[R. Scott Perry]

I noticed that several RBL's have not been triggered off one of our backup
mail servers over the last 24 hours.  For example SPAMCOP hasn't.  I turned
on "DEBUG" mode and noticed that it was reporting this
04/01/2004 10:56:53.296 Q3bbb215802381bda Test #18 [ORDB] is same as Test
#18 [ORDB=*]. Answer=root.loopback.?
04/01/2004 10:56:53.296 Q3bbb215802381bda Test #19 [SPAMCOP] is same as Test
#19 [SPAMCOP=127.0.0.2]. Answer=root.loopback.?
04/01/2004 10:56:53.296 Q3bbb215802381bda Test #20 [DSBL] is same as Test
#20 [DSBL=*]. Answer=root.loopback.?
Is this a normal answer?
No, that is not a normal answer -- the "Answer=root.loopback.?" indicates 
that the DNS server is responding, but reporting an answer of 
"root.loopback" which isn't correct.  It sounds like your DNS server is 
having problems.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SPAMCOP

[Darrell LaRock]

I noticed that several RBL's have not been triggered off one of our backup
mail servers over the last 24 hours.  For example SPAMCOP hasn't.  I turned
on "DEBUG" mode and noticed that it was reporting this

04/01/2004 10:56:53.296 Q3bbb215802381bda Test #18 [ORDB] is same as Test
#18 [ORDB=*]. Answer=root.loopback.?
04/01/2004 10:56:53.296 Q3bbb215802381bda Test #19 [SPAMCOP] is same as Test
#19 [SPAMCOP=127.0.0.2]. Answer=root.loopback.?
04/01/2004 10:56:53.296 Q3bbb215802381bda Test #20 [DSBL] is same as Test
#20 [DSBL=*]. Answer=root.loopback.?

Is this a normal answer?
Darrell

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop acting up

[Matt]

Sounds like something that would be easy for them to improve.  I hope 
that you've given them the recommendation of exposing the data in TXT 
records.

I just started building some spamtraps myself, and before I can make use 
of them, I'm going to have to weed out at least the large ISP and 
broadband mail servers.  Seems like common sense to me.

Matt



R. Scott Perry wrote:


SpamCop is a very important test, and I would imagine that with a 
week's work, they could correct all issues with tagging mail servers 
that handle over 50% of legitimate E-mail traffic in the US.


For years, I have thought that they should return the spam/total ratio 
for mailservers (which they keep track of), in a TXT record.  That 
would give people the option of choosing their own level.  Clearly 
mail from a mailserver that has 98 legitimate E-mails for every 2 
spams reported is much more likely to be wanted than mail from a 
mailserver where there are 0 legitimate E-mail for every 100 spams 
reported.

To get around the problem of requiring special support to process the 
TXT records, they could do something like return 127.0.0.1 for a 
mailserver that has 0-10% spam, 127.0.0.2 for one that has 11-20% 
spam, etc.  While not as precise as using the TXT record, it would be 
compatible with existing spam programs.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop acting up

[R. Scott Perry]

SpamCop is a very important test, and I would imagine that with a week's 
work, they could correct all issues with tagging mail servers that handle 
over 50% of legitimate E-mail traffic in the US.
For years, I have thought that they should return the spam/total ratio for 
mailservers (which they keep track of), in a TXT record.  That would give 
people the option of choosing their own level.  Clearly mail from a 
mailserver that has 98 legitimate E-mails for every 2 spams reported is 
much more likely to be wanted than mail from a mailserver where there are 0 
legitimate E-mail for every 100 spams reported.

To get around the problem of requiring special support to process the TXT 
records, they could do something like return 127.0.0.1 for a mailserver 
that has 0-10% spam, 127.0.0.2 for one that has 11-20% spam, etc.  While 
not as precise as using the TXT record, it would be compatible with 
existing spam programs.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop acting up

[Matt]

I'm quite sure that they were relaying spam from zombies, however, you
shouldn't be listing the world's largest ISP's mail servers in the same
group as direct sources of spam.  When they list AOL's mail servers,
they wind up tagging probably 99.9% or more of the E-mail coming from
those servers improperly.  There's a big difference between that and a
direct source.

I speculated the other day that spammers relaying through ISP mail
servers from zombies instead of attempting direct delivery would lead
to RBL's listing legitimate servers with a higher frequency, and that
sure seems to be happening.  SpamCop is a very important test, and I
would imagine that with a week's work, they could correct all issues
with tagging mail servers that handle over 50% of legitimate E-mail
traffic in the US.  Clearly if they are still listing AOL's servers,
they have made no attempt to properly address these problems.

The less reliable a test is, the less value it offers.

Matt



Dan Geiser wrote:

  Matt,
Did you ever consider that they tagged 2 different AOL mail servers because
they were sending spam?

Dan Geiser
[EMAIL PROTECTED]

- Original Message - 
From: "Matt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, January 15, 2004 4:03 PM
Subject: [Declude.JunkMail] SpamCop acting up


  
  
Earlier this week, SpamCop tagged at least two different AOL mail
servers.  I don't get it.

Minus one more point for SpamCop...

Matt

-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


---
[This E-mail was scanned for viruses by Declude Virus

  
  (http://www.declude.com)]
  
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan



  
  
---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=

Re: [Declude.JunkMail] SpamCop acting up

[Dan Geiser]

Matt,
Did you ever consider that they tagged 2 different AOL mail servers because
they were sending spam?

Dan Geiser
[EMAIL PROTECTED]

- Original Message - 
From: "Matt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, January 15, 2004 4:03 PM
Subject: [Declude.JunkMail] SpamCop acting up


> Earlier this week, SpamCop tagged at least two different AOL mail
> servers.  I don't get it.
>
> Minus one more point for SpamCop...
>
> Matt
>
> -- 
> =
> MailPure custom filters for Declude JunkMail Pro.
> http://www.mailpure.com/software/
> =
>
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop acting up

[Rick Klinge]

Well I'm getting spam from aol too.. And we are a small small (62 ip's).. So
shut them off.. Easy concept since they are the ones that force the rest of
us email admins to mush have a rDNS in order for them to accept our legit
mail.. 

~Rick

> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Matt
> Sent: Thursday, January 15, 2004 3:03 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] SpamCop acting up
> 
> 
> Earlier this week, SpamCop tagged at least two different AOL mail 
> servers.  I don't get it.
> 
> Minus one more point for SpamCop...
> 

___
Virus Scanned and Filtered by http://www.FamHost.com E-Mail System.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SpamCop acting up

[Matt]

Earlier this week, SpamCop tagged at least two different AOL mail 
servers.  I don't get it.

Minus one more point for SpamCop...

Matt

--
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop listing Webtv.net IP

[Matthew Bramble]

SpamCop and MailPolice both got demoted on my system by a point today, 
and I hope to bring them down another point soon (after measuring the 
effect on my system).

When I see ISP mail servers listed, it is generally due to one of two 
things...they either have no controls on someone doing a bulk mailing 
through their servers, or much more likely, they are forwarding E-mail 
to an off-server account.  I see legit E-mail being tagged by SpamCop 
and MailPolice all the time because it passed through a server that is 
used for forwarding such things.  AT&T for instance has a set of servers 
for just this purpose which get tagged all the time.  The problem is 
that people are either using spamtraps that forward this forwarded spam, 
or they are reporting forwarded messages as spam and the systems 
consider the AT&T gateway to be the source (a problem with the design).  
All of the RBL's need to generate lists of large ISP mail servers, 
especially the gateways, in order to prevent this from happening.

On my own system, I have AT&T's gateway's IPBYPASSed primarily because 
of this issue, though it also helps a great deal with filtering of the 
accounts forwarded through them since I am only scanning on the last hop 
still.  The issue of course is that IPBYPASS only allows 20 entries 
since it was designed only to be used on your own gateways and not a 
large list of servers from other sources (I hope to see this turned into 
a separate file sometime).  Just to repeat so that someone doesn't make 
a mistake...Declude only accepts the first IPBYPASSed addresses, after 
that it will ignore the entries.  Here's what I'm using for AT&T 
currently for instance:

# mtiwgwc11.worldnet.att.net - mtiwgwc18.worldnet.att.net
IPBYPASS204.127.131.121
IPBYPASS204.127.131.122
IPBYPASS204.127.131.123
IPBYPASS204.127.131.124
IPBYPASS204.127.131.125
IPBYPASS204.127.131.126
IPBYPASS204.127.131.127
IPBYPASS204.127.131.118
I believe some other ISP's have pages listing the servers from which 
they forward E-mail on.  I generated my list though from looking up one 
known server from SenderBase, and then doing some follow up reverse DNS 
digging.  It's important to make sure that these servers are never an 
SMTP server for end users to send E-mail from, otherwise you might be 
hitting the dial-up IP's instead of another mail server.  This has been 
working for me, but in general, this isn't going to be a fix for 
forwarded E-mail until either IPBYPASS gets expanded, or the RBL's stop 
listing ISP gateway mail servers.

Matt



John Tolmachoff (Lists) wrote:

Great, SpamCop is listing WebTV.net mail server IP falsely. Looking at the
samples, they look legit to me.
Has anyone actually seen spam come from a WebTV.net server?

John Tolmachoff
Engineer/Consultant/Owner
eServices For You
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SpamCop listing Webtv.net IP

[John Tolmachoff \(Lists\)]

Great, SpamCop is listing WebTV.net mail server IP falsely. Looking at the
samples, they look legit to me.

Has anyone actually seen spam come from a WebTV.net server?

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Question

[Burzin Sumariwalla]

Doug,

I don't think anything is wrong.  SpamC. is returning a TXT record with 
that information.
The link says that's experimental.

Burzin

At 12:22 PM 12/19/2003, you wrote:
I was looking at the headers and saw SPAMCOP : Blocked

Is that how it should be - what it's returning? If not, ideas on what 
could be wrong?

X-RBL-Warning: SORBS-SPAM: Spam Received See: 
http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=66.111.254.21
X-RBL-Warning: SPAMCOP: Blocked - see 
http://www.spamcop.net/bl.shtml?66.111.254.21
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam 
[4000120e].
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 303, weight 0)
X-RBL-Warning: ANTI-GIBBERISH: Message failed ANTI-GIBBERISH test (line 
283, weight 0)
X-RBL-Warning: BLASTER: Message failed BLASTER test (line 3, weight 0)
X-Declude-Sender: [EMAIL PROTECTED] 
[66.111.254.21]
X-Declude-Spoolname: D25320b0a00f84423.SMD
X-Note: This E-mail was scanned by Declude JunkMail 
(www.declude.com) for spam.
X-Spam-Tests-Failed: SORBS-SPAM, SPAMCOP, SPAMHEADERS, GIBBERISH, 
ANTI-GIBBERISH, BLASTER, WEIGHT10, WEIGHT20 [22]
X-Note: This E-mail was sent from net21.netholdem.com ([66.111.254.21]).
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 367795725
--
Burzin Sumariwalla   Phone: (314) 994-9411 x291
[EMAIL PROTECTED]  Fax:   (314) 997-7615
  Pager: (314) 407-3345
Networking and Telecommunications Manager
Information Technology Services
St. Louis County Library District
1640 S. Lindbergh Blvd.
St. Louis, MO  63131 

---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Question

[R. Scott Perry]

I was looking at the headers and saw SPAMCOP : Blocked

Is that how it should be - what it's returning? If not, ideas on what 
could be wrong?
That is what it is returning:

X-RBL-Warning: SPAMCOP: Blocked - see 
http://www.spamcop.net/bl.shtml?66.111.254.21
Spamcop is returning a TXT record of "Blocked - see 
http://www.spamcop.net/bl.shtml?66.111.254.21";, 
which is what Declude JunkMail uses by default in the X-RBL-Warning: header.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SPAMCOP Question

[Doug Anderson]

I was looking at the headers and saw SPAMCOP : 
Blocked
 
Is that how it should be - what it's returning? If not, ideas 
on what could be wrong?
 
 
X-RBL-Warning: SORBS-SPAM: Spam Received See: http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=66.111.254.21X-RBL-Warning: 
SPAMCOP: Blocked - see http://www.spamcop.net/bl.shtml?66.111.254.21X-RBL-Warning: 
SPAMHEADERS: This E-mail has headers consistent with spam 
[4000120e].X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 
303, weight 0)X-RBL-Warning: ANTI-GIBBERISH: Message failed ANTI-GIBBERISH 
test (line 283, weight 0)X-RBL-Warning: BLASTER: Message failed BLASTER test 
(line 3, weight 0)X-Declude-Sender: [EMAIL PROTECTED] 
[66.111.254.21]X-Declude-Spoolname: D25320b0a00f84423.SMDX-Note: This 
E-mail was scanned by Declude JunkMail (www.declude.com) for 
spam.X-Spam-Tests-Failed: SORBS-SPAM, SPAMCOP, SPAMHEADERS, GIBBERISH, 
ANTI-GIBBERISH, BLASTER, WEIGHT10, WEIGHT20 [22]X-Note: This E-mail was sent 
from net21.netholdem.com ([66.111.254.21]).X-RCPT-TO: <[EMAIL PROTECTED]>Status: 
UX-UIDL: 367795725

RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Kami Razvan]

Dan:

FILTER-REVDNS filterC:\IMail\Declude\Filters\IMail_Filter_REVDNS.txt
x 0 0

This is our Global entry for the file.

Regards,
Kami

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Friday, December 05, 2003 12:00 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

Kami,
What is the name of the filter file that you have entries of those type in?

Thanks,
Dan

- Original Message -
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, December 05, 2003 10:51 AM
Subject: RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses


> Yes...
>
> Like a filter file:
>
> REVDNS -20 ENDSWITH .amazon.com
>
> I put the period before Amazon to just make sure no funky domain like
> .spamamazon.com can get through.
>
> Regards,
> Kami
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
> Sent: Friday, December 05, 2003 10:39 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses
>
> Kami:
> I've been taking a look at your configuration files every few weeks and
> based on what I saw there a couple of months ago, I also started
> WHITELISTing based on Reverse DNS and HELO a few months back.  So there's
> probably many I'm not seeing as flagged by SPAMCOP because of the
whitelist.
> It just so happened that the 3 I listed had not been whitelisted.  I know
> that whitelisting will fix the problems but I also know that there's is
> definitely something up with SPAMCOP.
>
> Am I correct that you can only add 100 WHITELIST entries to the GLOBAL.CFG
> file?  Is that 100 each for REVDNS and HELO or 100 total?  Is there anyway
> to go past that limit and/or else offload those into a separate file?
>
> How do you do the negative Reverse DNS entries?  Is that just by using the
> FILTER test?
>
> Thanks,
> Dan
>
> - Original Message -
> From: "Kami Razvan" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Friday, December 05, 2003 10:24 AM
> Subject: RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses
>
>
> > Dan:
> >
> > We made a decision a long time ago to whitelist REVDNS of all the folks
> you
> > had listed.
> >
> > We now have two REVDNS negative files.
> >
> > 1:  Whitelist as entered in the Global.cfg (I only hope one day Scott
> moves
> > these entries to their own files).
> >
> > 2:  Negative reverseDNS files that adds negative weight to the ones that
> are
> > legitimate and used by our users.
> >
> > That took care of a lot of problems..
> >
> > Regards,
> > Kami
> >
> >
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
> > Sent: Friday, December 05, 2003 10:10 AM
> > To: [EMAIL PROTECTED]
> > Subject: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses
> >
> > Hello, All,
> > Has anyone noticed in the last few days that the IP addresses of a lot
of
> > legitimate e-mailers are showing up on SPAMCOP's blocklists?
Specifically
> > I've seen IP addresses for NYTIMES.COM, MICROSOFT.COM and MACROMEDIA.COM
> and
> > a few others.  Does anyone think it's possible that SPAMCOP's databases
> are
> > being gamed by Spammers by submitting lots of e-mails with legit IP
> > addresses and pretend that they came across as spam?  Or maybe there are
> > uninformed SPAMCOP users who are submitting legit e-mail to SPAMCOP as
> > representative of spam?  Or even that IronPort's purchase of SPAMCOP has
> > somehow affected the way that they do things?
> >
> > Just curious.  These legit IPs showing up on SPAMCOP are really throwing
> > lots of False Positives in my weighting system.
> >
> > Thanks,
> > Dan
> > [EMAIL PROTECTED]
> >
> > ---
> > Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> > http://www.nexustechgroup.com/mailscan
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe,
> > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> > Declude.JunkMail".  The archives can be found at
> > http://www.mail-archive.com.
> >
> > ---
> > [This E-mail was scanned for viruses b

Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[R. Scott Perry]

Do you have plans to offer offloading for WHITELIST HELO and WHITELIST
REVDNS?
Not at this time, simply because we can't envision there being a need for 
200 such entries.  :)

However, the WHITELIST limit is something that comes up frequently, so it 
is quite possible that more changes will be made to allow for more 
WHITELIST entries.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Hosting Support]

I'm not sure if everyone has heard, but IronPort bought SpamCop.  It's
likely that they're fiddling with it.  There's an article on Slashdot from
Wednesday about it.

http://yro.slashdot.org/article.pl?sid=03/12/03/2016218&mode=thread&tid=111&tid=126&tid=137&tid=187

Personally, After seeing so many FPs as a result of SpamCop weighting, I
stopped using it a year ago.

Darin.


- Original Message - 
From: "Dan Geiser" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, December 05, 2003 10:10 AM
Subject: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses


Hello, All,
Has anyone noticed in the last few days that the IP addresses of a lot of
legitimate e-mailers are showing up on SPAMCOP's blocklists?  Specifically
I've seen IP addresses for NYTIMES.COM, MICROSOFT.COM and MACROMEDIA.COM and
a few others.  Does anyone think it's possible that SPAMCOP's databases are
being gamed by Spammers by submitting lots of e-mails with legit IP
addresses and pretend that they came across as spam?  Or maybe there are
uninformed SPAMCOP users who are submitting legit e-mail to SPAMCOP as
representative of spam?  Or even that IronPort's purchase of SPAMCOP has
somehow affected the way that they do things?

Just curious.  These legit IPs showing up on SPAMCOP are really throwing
lots of False Positives in my weighting system.

Thanks,
Dan
[EMAIL PROTECTED]

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

_
[This E-mail virus scanned by 4C Web]


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Dan Geiser]

Scott,
Do you have plans to offer offloading for WHITELIST HELO and WHITELIST
REVDNS?

Thanks,
Dan

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, December 05, 2003 11:07 AM
Subject: Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses


>
> >Or does it just apply to WHITELIST FROM entries contained in GLOBAL.CFG?
>
> Only the WHITELIST FROM lines can be moved out of the global.cfg file.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Dan Geiser]

Kami,
What is the name of the filter file that you have entries of those type in?

Thanks,
Dan

- Original Message - 
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, December 05, 2003 10:51 AM
Subject: RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses


> Yes...
>
> Like a filter file:
>
> REVDNS -20 ENDSWITH .amazon.com
>
> I put the period before Amazon to just make sure no funky domain like
> .spamamazon.com can get through.
>
> Regards,
> Kami
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
> Sent: Friday, December 05, 2003 10:39 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses
>
> Kami:
> I've been taking a look at your configuration files every few weeks and
> based on what I saw there a couple of months ago, I also started
> WHITELISTing based on Reverse DNS and HELO a few months back.  So there's
> probably many I'm not seeing as flagged by SPAMCOP because of the
whitelist.
> It just so happened that the 3 I listed had not been whitelisted.  I know
> that whitelisting will fix the problems but I also know that there's is
> definitely something up with SPAMCOP.
>
> Am I correct that you can only add 100 WHITELIST entries to the GLOBAL.CFG
> file?  Is that 100 each for REVDNS and HELO or 100 total?  Is there anyway
> to go past that limit and/or else offload those into a separate file?
>
> How do you do the negative Reverse DNS entries?  Is that just by using the
> FILTER test?
>
> Thanks,
> Dan
>
> - Original Message -
> From: "Kami Razvan" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Friday, December 05, 2003 10:24 AM
> Subject: RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses
>
>
> > Dan:
> >
> > We made a decision a long time ago to whitelist REVDNS of all the folks
> you
> > had listed.
> >
> > We now have two REVDNS negative files.
> >
> > 1:  Whitelist as entered in the Global.cfg (I only hope one day Scott
> moves
> > these entries to their own files).
> >
> > 2:  Negative reverseDNS files that adds negative weight to the ones that
> are
> > legitimate and used by our users.
> >
> > That took care of a lot of problems..
> >
> > Regards,
> > Kami
> >
> >
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
> > Sent: Friday, December 05, 2003 10:10 AM
> > To: [EMAIL PROTECTED]
> > Subject: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses
> >
> > Hello, All,
> > Has anyone noticed in the last few days that the IP addresses of a lot
of
> > legitimate e-mailers are showing up on SPAMCOP's blocklists?
Specifically
> > I've seen IP addresses for NYTIMES.COM, MICROSOFT.COM and MACROMEDIA.COM
> and
> > a few others.  Does anyone think it's possible that SPAMCOP's databases
> are
> > being gamed by Spammers by submitting lots of e-mails with legit IP
> > addresses and pretend that they came across as spam?  Or maybe there are
> > uninformed SPAMCOP users who are submitting legit e-mail to SPAMCOP as
> > representative of spam?  Or even that IronPort's purchase of SPAMCOP has
> > somehow affected the way that they do things?
> >
> > Just curious.  These legit IPs showing up on SPAMCOP are really throwing
> > lots of False Positives in my weighting system.
> >
> > Thanks,
> > Dan
> > [EMAIL PROTECTED]
> >
> > ---
> > Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> > http://www.nexustechgroup.com/mailscan
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe,
> > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> > Declude.JunkMail".  The archives can be found at
> > http://www.mail-archive.com.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> > type "unsubscribe Declude.JunkMail".  The archives can be found
> > at http://www.mail-archive.com.
> > --

RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Markus Gufler]

> Yes...
> 
> Like a filter file:
> 
> REVDNS -20 ENDSWITH .amazon.com
> 
> I put the period before Amazon to just make sure no funky 
> domain like .spamamazon.com can get through.


Hmmpfff

I hoped already that that could be a reason for unlimited IPBYPASS
entries...  ;-)

Markus 


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[R. Scott Perry]

Or does it just apply to WHITELIST FROM entries contained in GLOBAL.CFG?
Only the WHITELIST FROM lines can be moved out of the global.cfg file.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Dan Geiser]

Hi, Scott,
If I am using...

WHITELIST REVDNS .ebay.com

or

WHITELIST HELO .mail.yahoo.com

entries in my GLOBAL.CFG can those also be offloaded into a separate file?
Or does it just apply to WHITELIST FROM entries contained in GLOBAL.CFG?

Thanks,
Dan

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, December 05, 2003 10:46 AM
Subject: Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses


>
> >Am I correct that you can only add 100 WHITELIST entries to the
GLOBAL.CFG
> >file?  Is that 100 each for REVDNS and HELO or 100 total?  Is there
anyway
> >to go past that limit and/or else offload those into a separate file?
>
> Actually, it's a limit of 200.
>
> The WHITELIST FROM entries can be offloaded to a separate file (with
> unlimited entries), using the WHITELISTFILE option.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Burzin Sumariwalla]

Hi Dan,

I've only seen one FP from SpamCop in the last week.  I routinely see email 
sent by legitimate firms get tagged as spam, but usually
these firms are using third party mailers to send information.

Burzin

At 09:10 AM 12/5/2003, you wrote:
Hello, All,
Has anyone noticed in the last few days that the IP addresses of a lot of
legitimate e-mailers are showing up on SPAMCOP's blocklists?  Specifically
I've seen IP addresses for NYTIMES.COM, MICROSOFT.COM and MACROMEDIA.COM and
a few others.  Does anyone think it's possible that SPAMCOP's databases are
being gamed by Spammers by submitting lots of e-mails with legit IP
addresses and pretend that they came across as spam?  Or maybe there are
uninformed SPAMCOP users who are submitting legit e-mail to SPAMCOP as
representative of spam?  Or even that IronPort's purchase of SPAMCOP has
somehow affected the way that they do things?
Just curious.  These legit IPs showing up on SPAMCOP are really throwing
lots of False Positives in my weighting system.
Thanks,
Dan
[EMAIL PROTECTED]
---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]
--
Burzin Sumariwalla   Phone: (314) 994-9411 x291
[EMAIL PROTECTED]  Fax:   (314) 997-7615
  Pager: (314) 407-3345
Networking and Telecommunications Manager
Information Technology Services
St. Louis County Library District
1640 S. Lindbergh Blvd.
St. Louis, MO  63131 

---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Kami Razvan]

Yes...

Like a filter file:

REVDNS -20 ENDSWITH .amazon.com

I put the period before Amazon to just make sure no funky domain like
.spamamazon.com can get through.

Regards,
Kami


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Friday, December 05, 2003 10:39 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

Kami:
I've been taking a look at your configuration files every few weeks and
based on what I saw there a couple of months ago, I also started
WHITELISTing based on Reverse DNS and HELO a few months back.  So there's
probably many I'm not seeing as flagged by SPAMCOP because of the whitelist.
It just so happened that the 3 I listed had not been whitelisted.  I know
that whitelisting will fix the problems but I also know that there's is
definitely something up with SPAMCOP.

Am I correct that you can only add 100 WHITELIST entries to the GLOBAL.CFG
file?  Is that 100 each for REVDNS and HELO or 100 total?  Is there anyway
to go past that limit and/or else offload those into a separate file?

How do you do the negative Reverse DNS entries?  Is that just by using the
FILTER test?

Thanks,
Dan

- Original Message -
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, December 05, 2003 10:24 AM
Subject: RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses


> Dan:
>
> We made a decision a long time ago to whitelist REVDNS of all the folks
you
> had listed.
>
> We now have two REVDNS negative files.
>
> 1:  Whitelist as entered in the Global.cfg (I only hope one day Scott
moves
> these entries to their own files).
>
> 2:  Negative reverseDNS files that adds negative weight to the ones that
are
> legitimate and used by our users.
>
> That took care of a lot of problems..
>
> Regards,
> Kami
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
> Sent: Friday, December 05, 2003 10:10 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses
>
> Hello, All,
> Has anyone noticed in the last few days that the IP addresses of a lot of
> legitimate e-mailers are showing up on SPAMCOP's blocklists?  Specifically
> I've seen IP addresses for NYTIMES.COM, MICROSOFT.COM and MACROMEDIA.COM
and
> a few others.  Does anyone think it's possible that SPAMCOP's databases
are
> being gamed by Spammers by submitting lots of e-mails with legit IP
> addresses and pretend that they came across as spam?  Or maybe there are
> uninformed SPAMCOP users who are submitting legit e-mail to SPAMCOP as
> representative of spam?  Or even that IronPort's purchase of SPAMCOP has
> somehow affected the way that they do things?
>
> Just curious.  These legit IPs showing up on SPAMCOP are really throwing
> lots of False Positives in my weighting system.
>
> Thanks,
> Dan
> [EMAIL PROTECTED]
>
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[R. Scott Perry]

Am I correct that you can only add 100 WHITELIST entries to the GLOBAL.CFG
file?  Is that 100 each for REVDNS and HELO or 100 total?  Is there anyway
to go past that limit and/or else offload those into a separate file?
Actually, it's a limit of 200.

The WHITELIST FROM entries can be offloaded to a separate file (with 
unlimited entries), using the WHITELISTFILE option.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Dan Geiser]

Kami:
I've been taking a look at your configuration files every few weeks and
based on what I saw there a couple of months ago, I also started
WHITELISTing based on Reverse DNS and HELO a few months back.  So there's
probably many I'm not seeing as flagged by SPAMCOP because of the whitelist.
It just so happened that the 3 I listed had not been whitelisted.  I know
that whitelisting will fix the problems but I also know that there's is
definitely something up with SPAMCOP.

Am I correct that you can only add 100 WHITELIST entries to the GLOBAL.CFG
file?  Is that 100 each for REVDNS and HELO or 100 total?  Is there anyway
to go past that limit and/or else offload those into a separate file?

How do you do the negative Reverse DNS entries?  Is that just by using the
FILTER test?

Thanks,
Dan

- Original Message - 
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, December 05, 2003 10:24 AM
Subject: RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses


> Dan:
>
> We made a decision a long time ago to whitelist REVDNS of all the folks
you
> had listed.
>
> We now have two REVDNS negative files.
>
> 1:  Whitelist as entered in the Global.cfg (I only hope one day Scott
moves
> these entries to their own files).
>
> 2:  Negative reverseDNS files that adds negative weight to the ones that
are
> legitimate and used by our users.
>
> That took care of a lot of problems..
>
> Regards,
> Kami
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
> Sent: Friday, December 05, 2003 10:10 AM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses
>
> Hello, All,
> Has anyone noticed in the last few days that the IP addresses of a lot of
> legitimate e-mailers are showing up on SPAMCOP's blocklists?  Specifically
> I've seen IP addresses for NYTIMES.COM, MICROSOFT.COM and MACROMEDIA.COM
and
> a few others.  Does anyone think it's possible that SPAMCOP's databases
are
> being gamed by Spammers by submitting lots of e-mails with legit IP
> addresses and pretend that they came across as spam?  Or maybe there are
> uninformed SPAMCOP users who are submitting legit e-mail to SPAMCOP as
> representative of spam?  Or even that IronPort's purchase of SPAMCOP has
> somehow affected the way that they do things?
>
> Just curious.  These legit IPs showing up on SPAMCOP are really throwing
> lots of False Positives in my weighting system.
>
> Thanks,
> Dan
> [EMAIL PROTECTED]
>
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Kami Razvan]

Dan:

We made a decision a long time ago to whitelist REVDNS of all the folks you
had listed.

We now have two REVDNS negative files.

1:  Whitelist as entered in the Global.cfg (I only hope one day Scott moves
these entries to their own files).

2:  Negative reverseDNS files that adds negative weight to the ones that are
legitimate and used by our users.

That took care of a lot of problems..

Regards,
Kami


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Friday, December 05, 2003 10:10 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

Hello, All,
Has anyone noticed in the last few days that the IP addresses of a lot of
legitimate e-mailers are showing up on SPAMCOP's blocklists?  Specifically
I've seen IP addresses for NYTIMES.COM, MICROSOFT.COM and MACROMEDIA.COM and
a few others.  Does anyone think it's possible that SPAMCOP's databases are
being gamed by Spammers by submitting lots of e-mails with legit IP
addresses and pretend that they came across as spam?  Or maybe there are
uninformed SPAMCOP users who are submitting legit e-mail to SPAMCOP as
representative of spam?  Or even that IronPort's purchase of SPAMCOP has
somehow affected the way that they do things?

Just curious.  These legit IPs showing up on SPAMCOP are really throwing
lots of False Positives in my weighting system.

Thanks,
Dan
[EMAIL PROTECTED]

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Technical Support]

I have noticed this as well, and it is causing me a never-ending stream
of headaches.
 
Jim O'Keefe 
Technical Support 
@YourNET Connection, Inc. 
[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>  


-Original Message-
From: Dan Geiser [mailto:[EMAIL PROTECTED]
Sent: Friday, December 05, 2003 9:10 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] SPAMCOP Having Legit IP Addresses


Hello, All,
Has anyone noticed in the last few days that the IP addresses of a lot
of
legitimate e-mailers are showing up on SPAMCOP's blocklists?
Specifically
I've seen IP addresses for NYTIMES.COM, MICROSOFT.COM and MACROMEDIA.COM
and
a few others.  Does anyone think it's possible that SPAMCOP's databases
are
being gamed by Spammers by submitting lots of e-mails with legit IP
addresses and pretend that they came across as spam?  Or maybe there are
uninformed SPAMCOP users who are submitting legit e-mail to SPAMCOP as
representative of spam?  Or even that IronPort's purchase of SPAMCOP has
somehow affected the way that they do things?

Just curious.  These legit IPs showing up on SPAMCOP are really throwing
lots of False Positives in my weighting system.

Thanks,
Dan
[EMAIL PROTECTED]

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail has been scanned for viruses by the YourNet Connection
Virus system]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SPAMCOP Having Legit IP Addresses

[Dan Geiser]

Hello, All,
Has anyone noticed in the last few days that the IP addresses of a lot of
legitimate e-mailers are showing up on SPAMCOP's blocklists?  Specifically
I've seen IP addresses for NYTIMES.COM, MICROSOFT.COM and MACROMEDIA.COM and
a few others.  Does anyone think it's possible that SPAMCOP's databases are
being gamed by Spammers by submitting lots of e-mails with legit IP
addresses and pretend that they came across as spam?  Or maybe there are
uninformed SPAMCOP users who are submitting legit e-mail to SPAMCOP as
representative of spam?  Or even that IronPort's purchase of SPAMCOP has
somehow affected the way that they do things?

Just curious.  These legit IPs showing up on SPAMCOP are really throwing
lots of False Positives in my weighting system.

Thanks,
Dan
[EMAIL PROTECTED]

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop news

[Bill Landry]

That was the Trustic model, and its founder, Mark Fletcher, shut down the
service after less than a year declaring the experiment a failure:

"We regret to inform you that we are no longer taking registrations and will
soon be closing the service. We have determined that the system as it
currently is designed will not achieve the level of accuracy that we
require, and an inaccurate system is worse than no system."

In a later e-mail, Mark explained:

"The reason we pulled Trustic was because the underlying data submitted by
the users was too unreliable. People are lazy (not a cut-down, just a fact).
People will gladly forward messages they consider spam, but they won't stop
and make sure they are really spam. And they won't consider if the messages
originated from a large ISP that has a generally good record at spam
prevention. This will always result in listings of ISPs that should not be
listed, unless you come up with arbitrary thresholds and internal
whitelists. The goal of Trustic was to not be arbitrary, for everything to
be based on user recommendations. That's why we couldn't do that. Also,
people will not submit positive recommendations in any proportion to the
negative recommendations they'll submit, even if it's easy to do."

I think Mark was right.  If you make it too easy for people to report spam
by automating the reporting process, you will end up with a database that is
virtually worthless due to the lack of personal involvement in the
validation and verification process, and like Mark said, "an inaccurate
system is worse than no system."

Bill
- Original Message - 
From: "Andy Schmidt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, November 19, 2003 6:49 PM
Subject: RE: [Declude.JunkMail] SpamCop news


>
> May be a commercial enterprise will be more open to adding a "hands-off"
> reporting system.  Manually confirming every spam that I already
determined
> as spam makes the system not practical.
>
> What they need is a commercial (for fee) account which includes the
> (revocable) right to submit directly into their system.
>
> Best Regards
> Andy Schmidt
>
> Phone:  +1 201 934-3414 x20 (Business)
> Fax:+1 201 934-9206
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop news

[Andy Schmidt]

May be a commercial enterprise will be more open to adding a "hands-off"
reporting system.  Manually confirming every spam that I already determined
as spam makes the system not practical.

What they need is a commercial (for fee) account which includes the
(revocable) right to submit directly into their system.

Best Regards
Andy Schmidt

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SpamCop news

[Colbeck, Andrew]

Sure... if all they do is provide cash such that the spamcop services
provides don't go down due to lack of funding, that will be a good thing.

If they also take over some of the operations, then Matt would get his wish
and they could afford to put in place some filters to make their service
less volatile regarding legitimate mail runs.

Speaking of operations, I don't mind the current level of SpamCop's
transparency of operations (uhh, opacity), but a single programmer who is
also the network manager, ops manager, chief cook and bottle washer, has
been a bad thing... Julian makes continual changes, which means that the
functionality is continually evolving and continually breaking too.

SpamCop has been worth every penny, but in order to grow up, SpamCop needs
to be more consistent.  An excellent counter-example has been the lean
declude.com operations; when something changes with my JunkMail, I know it's
been self-inflicted!

I wonder whether Julian is tired of the struggle, or just wants to pursue
his antispam interest while getting a paycheque, or maybe IronPort Systems
just made him an offer too good to refuse?
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop news

[Bill Landry]

IronPort owns the bondedsender.com whitelist service, as well, and I have
had good results using their ip4r service.  So this sounds like it could be
a good combination of services.

Bill
- Original Message - 
From: "Colbeck, Andrew" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, November 19, 2003 3:45 PM
Subject: [Declude.JunkMail] SpamCop news


> Check out:
>
> http://www.infoworld.com/article/03/11/19/HNironport_1.html
>
> SpamCop is neither confirming nor denying the report, but has put an
> announcement of an announcement (for November 24, 2003) on their news page
> which links to this URL.
>
> Form your own conclusions... I think it's a good thing.
>
> Andrew 8)
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SpamCop news

[Matthew Bramble]

Even though they say that it will remain free, it seems like good 
business sense for them.  The value of SpamCop, imperfect as it is, 
still is immense and only MailPolice would seem to be able to carry on 
that torch.  Hopefully with just a little more effort, they can clean up 
some of their issues with FP'ing high volume legit mail blasts (a 
problem created by thier members).

I'm a little worried though about corporate influence into this realm in 
general as companies like Symantec and McAfee get into the picture 
selling desktop implementations of sub-par software which seems to only 
mask part of the problem and could create others.  Because the 
open-source movement that is popular in anti-spam efforts, things like 
SpamCop can get taken over for mere pennies according to the value they 
provide.  I would hate to see the best tools removed from public access, 
or to have license fees be applied which might seem too excessive.  I'm 
quite worried about the likes of Brightmail and others claiming patents, 
ridiculous as many of them are, and seemingly starting to shore up 
segments of the community at large.  Of course this is just limited to 
concern at the moment, but where there's money, there's greed, and I 
feel it is only a matter of time.

The first step has already happened with spammers trying to sell 
anti-spam software, then anti-virus companies who themselves are the 
subject of many unsolicited messages, join in the fray and throw this 
stuff on top of pop-up blocking, and overzealous personal firewalls 
which seem to be more alarmist and counterproductive than useful.  Then 
just the other day Bill Gates starts touting Longhorn as something that 
will validate E-mail at every point of origination in their system, 
specifically targeting spam (we all know how that will work out, coming 
from the RFC masters they aren't).  How many calls did you get about 
your service blocking attachments when Microsoft decided to blacklist 
some common file types by default in OE6?  I'm just thinking that it 
won't be long before I find myself on hold for 2 hours just trying to 
reach a person that can possibly fix their own problem which is killing 
my business, and never receiving anything but frusturation as a result 
(NSI circa 1998...anyone remember the 2 month registration delays?).

When these companies can do a better job and do it for the same or less 
money, I'll hang up my hat, but I don't expect for that to happen for 
some time, it might even require SMTP to die as a protocol before that 
happens.

Matt



Colbeck, Andrew wrote:

Check out:

http://www.infoworld.com/article/03/11/19/HNironport_1.html

SpamCop is neither confirming nor denying the report, but has put an
announcement of an announcement (for November 24, 2003) on their news page
which links to this URL.
Form your own conclusions... I think it's a good thing.

Andrew 8)
 



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SpamCop news

[Colbeck, Andrew]

Check out:

http://www.infoworld.com/article/03/11/19/HNironport_1.html

SpamCop is neither confirming nor denying the report, but has put an
announcement of an announcement (for November 24, 2003) on their news page
which links to this URL.

Form your own conclusions... I think it's a good thing.

Andrew 8)
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] spamcop

[Fritz Squib]

Terry,
 Remember the notices you get from your registrar telling you that they need
you to verify your information for ICANN ?

http://www.julianhaight.com/jokerstupidity.shtml

Fritz

Frederick P. Squib, Jr.
Network Operations/Mail Administrator
Citizens Telephone Company of Kecksburg
http://www.wpa.net

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Smart Business
Lists
Sent: Saturday, November 01, 2003 7:10 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] spamcop


SpamCop's dns is probably hacked:

   Your NS records at the parent servers are:
  invalid-address.joker.com. [194.176.0.5] [TTL=172800]
   [These were obtained from b.gtld-servers.net]

Must have been down since sometime yesterday evening.


Terry Fritts


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]


---
[This E-mail scanned by Citizens Internet Services with Declude Virus.]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] spamcop

[Smart Business Lists]

SpamCop's dns is probably hacked:

   Your NS records at the parent servers are:
  invalid-address.joker.com. [194.176.0.5] [TTL=172800]
   [These were obtained from b.gtld-servers.net]

Must have been down since sometime yesterday evening.


Terry Fritts


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP Account

[Andy Schmidt]

>> I don't see the reasoning behind sending SPAMCOP thousands of e-mails per
day that are already stopped by your system.  <<

Presence in SPAMCOP is temporary. To REMAIN listed, you need to keep
submitting SPAM so that the senders keep getting listed.

Best Regards
Andy Schmidt

H&M Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846

Phone:  +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206

http://www.HM-Software.com/

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP Account

[Kami Razvan]

Dan:

To answer your question I think the DELETE action is a final action.
Meaning you can not ROUTETO and then DELETE the same message.  Scott..
Correct me if this is not the case.

What we had was a COPYTO and ROUTETO so we would review it in our spam
account and then go to SPAMCOP and report it there as well.

I do not think you can ROUTETO and the DELETE.  But I could be wrong... 

Regards,
Kami


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Thursday, October 30, 2003 5:49 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] SPAMCOP Account

Scott,
I understand what you are saying.  But I am only going to be forwarding High
Weight spam to SPAMCOP.  This is just the spam that I would normally delete.
I'm talking about mail that is scored like 55 or higher in my current setup.
A message which scores 55 typically has to fail 7 or 8 tests.  In the case
of Ipswitch, they might have got on a Blacklist but there's no way in my
system that they would've failed enough other tests to be flagged as a high
weight spam message.

Any feedback on my other 2 questions?

Thanks,
Dan

- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 30, 2003 5:36 PM
Subject: Re: [Declude.JunkMail] SPAMCOP Account


>
> >I understand what you are saying here.  If there's any chance whatsoever
> >that I would send a legit e-mail to Spamcop as spam then I won't set it
up.
>
> I think the real problem is that the idea behind Spamcop is people
> reporting unsolicted E-mail.  The failure of enough Declude tests *should*
> indicate that an E-mail is spam.  However, that isn't guaranteed.
>
> A good case in point is that Ipswitch made it into a spam database today
> simply because an E-mail they sent failed too many spam tests.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Account

[Dan Geiser]

Scott,
I understand what you are saying.  But I am only going to be forwarding High
Weight spam to SPAMCOP.  This is just the spam that I would normally delete.
I'm talking about mail that is scored like 55 or higher in my current setup.
A message which scores 55 typically has to fail 7 or 8 tests.  In the case
of Ipswitch, they might have got on a Blacklist but there's no way in my
system that they would've failed enough other tests to be flagged as a high
weight spam message.

Any feedback on my other 2 questions?

Thanks,
Dan

- Original Message - 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 30, 2003 5:36 PM
Subject: Re: [Declude.JunkMail] SPAMCOP Account


>
> >I understand what you are saying here.  If there's any chance whatsoever
> >that I would send a legit e-mail to Spamcop as spam then I won't set it
up.
>
> I think the real problem is that the idea behind Spamcop is people
> reporting unsolicted E-mail.  The failure of enough Declude tests *should*
> indicate that an E-mail is spam.  However, that isn't guaranteed.
>
> A good case in point is that Ipswitch made it into a spam database today
> simply because an E-mail they sent failed too many spam tests.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
> Declude Virus: Catches known viruses and is the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask about our free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Account

[Dan Geiser]

Jason,
>From what I can see on the Spamcop web site the way they decide whether a
message should be blacklisted is not solely based on one report.  Instead it
is based on how many different people submit it, among other things.  As
long as I'm only submitting unique messages that I am 100% sure are spam
then I think I would be helping to enforce the algorithm that Spamcop uses
to decide whether messages which are being submitted are spam or not.  I'm
not talking about submitting thousands of e-mails a day.  I think I my
current setup deletes about 1200 messages a week.

Any feedback on my other 2 questions?

Thanks,
Dan

- Original Message - 
From: "Jason Newland" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 30, 2003 5:17 PM
Subject: RE: [Declude.JunkMail] SPAMCOP Account


> Typically I only send SPAMCOP e-mails that pass through our Declude
> filters.  The theory being that now SPAMCOP will know about that
> address, list it, and it won't clear Declude again.
>
> I don't see the reasoning behind sending SPAMCOP thousands of e-mails
> per day that are already stopped by your system.  The benefit of
> manually sending is exactly what Kami noted below.  You won't
> inadvertently submit good guys.  Also, if you poke around SPAMCOPS site,
> there is a program you can get called SpamSource that plugs into
> Outlook.  Once installed/configured, all I have to do to report spam is
> click on the SpamSource button, and it submits to SPAMCOP.
>
>
> Jason
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
> Sent: Thursday, October 30, 2003 4:00 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] SPAMCOP Account
>
>
> Dan..
>
> BE VERY CAREFUL IF YOU DO THIS...
>
> We were doing this and once someone from the list sent me an email with
> bunch of keywords in it.. The system automatically forwarded it to the
> SPAMCop account.
>
> If you do this make sure you review every spam that goes into your
> account and approve them knowing it is a spam and not someone that just
> happen to send you bunch of words in your filter file.
>
> Regards,
> Kami
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
> Sent: Thursday, October 30, 2003 4:53 PM
> To: Declude JunkMail
> Subject: [Declude.JunkMail] SPAMCOP Account
>
> Hello, All,
> I signed up for a free Spamcop account a few weeks ago and I've been
> using it to submit spam via their web-based form.  In addition to
> allowing spam submittal via a web-based form they also give you a unique
> e-mail address which you can forward spam to.  I was thinking about
> setting up Declude JunkMail to send all the mail which I would normally
> just DELETE because of High weight to this unique e-mail address.
> Before I do this I had a few questions...
>
> 1)  Does anyone else do what I am describing?  If so, does it work well?
>
> 2)  If I want to forward all mail above a certain weight, say a weight
> of 45, would the ROUTETO action be the correct action to use.  I don't
> want to keep a copy of the e-mail in my HOLD directory.
>
> 3)  If ROUTETO is the correct action, when the message is sent to
> Spamcop what will the FROM address be?  Will it be the original sender's
> e-mail address or a special e-mail address which DJM assigns to itself?
>
> I think that's all for now.
>
> Thanks, Much!
> Dan Geiser [EMAIL PROTECTED]
>
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
> "unsubscribe Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be fo

Re: [Declude.JunkMail] SPAMCOP Account

[R. Scott Perry]

I understand what you are saying here.  If there's any chance whatsoever
that I would send a legit e-mail to Spamcop as spam then I won't set it up.
I think the real problem is that the idea behind Spamcop is people 
reporting unsolicted E-mail.  The failure of enough Declude tests *should* 
indicate that an E-mail is spam.  However, that isn't guaranteed.

A good case in point is that Ipswitch made it into a spam database today 
simply because an E-mail they sent failed too many spam tests.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] SPAMCOP Account

[Dan Geiser]

Hi, Kami,
I understand what you are saying here.  If there's any chance whatsoever
that I would send a legit e-mail to Spamcop as spam then I won't set it up.
In the scenario you describe below, I'm not worried that something will
happen as we are currently not going any filtering on the content of
messages.  Do you have any feedback re: my other 2 questions?

Thanks,
Dan

- Original Message - 
From: "Kami Razvan" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 30, 2003 5:00 PM
Subject: RE: [Declude.JunkMail] SPAMCOP Account


> Dan..
>
> BE VERY CAREFUL IF YOU DO THIS...
>
> We were doing this and once someone from the list sent me an email with
> bunch of keywords in it.. The system automatically forwarded it to the
> SPAMCop account.
>
> If you do this make sure you review every spam that goes into your account
> and approve them knowing it is a spam and not someone that just happen to
> send you bunch of words in your filter file.
>
> Regards,
> Kami
>
>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
> Sent: Thursday, October 30, 2003 4:53 PM
> To: Declude JunkMail
> Subject: [Declude.JunkMail] SPAMCOP Account
>
> Hello, All,
> I signed up for a free Spamcop account a few weeks ago and I've been using
> it to submit spam via their web-based form.  In addition to allowing spam
> submittal via a web-based form they also give you a unique e-mail address
> which you can forward spam to.  I was thinking about setting up Declude
> JunkMail to send all the mail which I would normally just DELETE because
of
> High weight to this unique e-mail address.  Before I do this I had a few
> questions...
>
> 1)  Does anyone else do what I am describing?  If so, does it work well?
>
> 2)  If I want to forward all mail above a certain weight, say a weight of
> 45, would the ROUTETO action be the correct action to use.  I don't want
to
> keep a copy of the e-mail in my HOLD directory.
>
> 3)  If ROUTETO is the correct action, when the message is sent to Spamcop
> what will the FROM address be?  Will it be the original sender's e-mail
> address or a special e-mail address which DJM assigns to itself?
>
> I think that's all for now.
>
> Thanks, Much!
> Dan Geiser [EMAIL PROTECTED]
>
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
> just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
> Declude.JunkMail".  The archives can be found at
> http://www.mail-archive.com.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> ---
> Sign up for virus-free and spam-free e-mail with Nexus Technology Group
> http://www.nexustechgroup.com/mailscan
>
>

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP Account

[Jason Newland]

Typically I only send SPAMCOP e-mails that pass through our Declude
filters.  The theory being that now SPAMCOP will know about that
address, list it, and it won't clear Declude again.

I don't see the reasoning behind sending SPAMCOP thousands of e-mails
per day that are already stopped by your system.  The benefit of
manually sending is exactly what Kami noted below.  You won't
inadvertently submit good guys.  Also, if you poke around SPAMCOPS site,
there is a program you can get called SpamSource that plugs into
Outlook.  Once installed/configured, all I have to do to report spam is
click on the SpamSource button, and it submits to SPAMCOP.  


Jason


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent: Thursday, October 30, 2003 4:00 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] SPAMCOP Account


Dan..

BE VERY CAREFUL IF YOU DO THIS...

We were doing this and once someone from the list sent me an email with
bunch of keywords in it.. The system automatically forwarded it to the
SPAMCop account.

If you do this make sure you review every spam that goes into your
account and approve them knowing it is a spam and not someone that just
happen to send you bunch of words in your filter file.

Regards,
Kami


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Thursday, October 30, 2003 4:53 PM
To: Declude JunkMail
Subject: [Declude.JunkMail] SPAMCOP Account

Hello, All,
I signed up for a free Spamcop account a few weeks ago and I've been
using it to submit spam via their web-based form.  In addition to
allowing spam submittal via a web-based form they also give you a unique
e-mail address which you can forward spam to.  I was thinking about
setting up Declude JunkMail to send all the mail which I would normally
just DELETE because of High weight to this unique e-mail address.
Before I do this I had a few questions...

1)  Does anyone else do what I am describing?  If so, does it work well?

2)  If I want to forward all mail above a certain weight, say a weight
of 45, would the ROUTETO action be the correct action to use.  I don't
want to keep a copy of the e-mail in my HOLD directory.

3)  If ROUTETO is the correct action, when the message is sent to
Spamcop what will the FROM address be?  Will it be the original sender's
e-mail address or a special e-mail address which DJM assigns to itself?

I think that's all for now.

Thanks, Much!
Dan Geiser [EMAIL PROTECTED]

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] SPAMCOP Account

[Kami Razvan]

Dan..

BE VERY CAREFUL IF YOU DO THIS...

We were doing this and once someone from the list sent me an email with
bunch of keywords in it.. The system automatically forwarded it to the
SPAMCop account.

If you do this make sure you review every spam that goes into your account
and approve them knowing it is a spam and not someone that just happen to
send you bunch of words in your filter file.

Regards,
Kami


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Thursday, October 30, 2003 4:53 PM
To: Declude JunkMail
Subject: [Declude.JunkMail] SPAMCOP Account

Hello, All,
I signed up for a free Spamcop account a few weeks ago and I've been using
it to submit spam via their web-based form.  In addition to allowing spam
submittal via a web-based form they also give you a unique e-mail address
which you can forward spam to.  I was thinking about setting up Declude
JunkMail to send all the mail which I would normally just DELETE because of
High weight to this unique e-mail address.  Before I do this I had a few
questions...

1)  Does anyone else do what I am describing?  If so, does it work well?

2)  If I want to forward all mail above a certain weight, say a weight of
45, would the ROUTETO action be the correct action to use.  I don't want to
keep a copy of the e-mail in my HOLD directory.

3)  If ROUTETO is the correct action, when the message is sent to Spamcop
what will the FROM address be?  Will it be the original sender's e-mail
address or a special e-mail address which DJM assigns to itself?

I think that's all for now.

Thanks, Much!
Dan Geiser [EMAIL PROTECTED]

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] SPAMCOP Account

[Dan Geiser]

Hello, All,
I signed up for a free Spamcop account a few weeks ago and I've been using
it to submit spam via their web-based form.  In addition to allowing spam
submittal via a web-based form they also give you a unique e-mail address
which you can forward spam to.  I was thinking about setting up Declude
JunkMail to send all the mail which I would normally just DELETE because of
High weight to this unique e-mail address.  Before I do this I had a few
questions...

1)  Does anyone else do what I am describing?  If so, does it work well?

2)  If I want to forward all mail above a certain weight, say a weight of
45, would the ROUTETO action be the correct action to use.  I don't want to
keep a copy of the e-mail in my HOLD directory.

3)  If ROUTETO is the correct action, when the message is sent to Spamcop
what will the FROM address be?  Will it be the original sender's e-mail
address or a special e-mail address which DJM assigns to itself?

I think that's all for now.

Thanks, Much!
Dan Geiser [EMAIL PROTECTED]

---
Sign up for virus-free and spam-free e-mail with Nexus Technology Group 
http://www.nexustechgroup.com/mailscan

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Spamcop as reliable source?

[R. Scott Perry]

Lately a reputable Listserv I belong to has begun failing the Spamcop 
test. I've whitelisted the domain, but it's got me wondering...is Spamcop 
a reliable source of spam, or would I do better by downgrading their 
weight. Currently I have Spamcop fails set to label subject as Spam 
regardless of the weight (the weight is 9).
Usually, it's very reliable -- but certainly not completely reliable.

The two main issues are [1] They will list a server when even a single spam 
report has occurred, and [2] In the case of lists, some people may decide 
that it is spam even if they did sign up for it.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Spamcop as reliable source?

[David Sullivan]

DM> Any (subjective  ) suggestions?

I've seen spamcop get way to aggressive over the past 6 months.  They
used to be pretty accurate.  We were listed for a while because our
domain name was in an MX record (for backup store and forward) for a
client ISP who had 1 user get reported to spamcop.

We've reduced our spamcop weight to just under our WARN weight so a
message has to fail something other than just spamcop to get a WARN.

-David

-- 
Best regards,
 Davidmailto:[EMAIL PROTECTED]

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] Spamcop as reliable source?

[Dale McDiarmid]

Hello...

Lately a reputable Listserv I belong to has begun failing the Spamcop test. 
I've whitelisted the domain, but it's got me wondering...is Spamcop a 
reliable source of spam, or would I do better by downgrading their weight. 
Currently I have Spamcop fails set to label subject as Spam regardless of 
the weight (the weight is 9).

Any (subjective  ) suggestions?

Thx,
D.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] spamcop?

[R. Scott Perry]

We're using our internet provider's DNS server.  It seems to work, but I 
don't know how to test it for the types of queries declude uses.

nslookup works fine.
Does nslookup work fine using the DNS servers listed in the OS, or are you 
using "set server=192.0.2.53" (entering the IP of the first DNS server in 
the IMail SMTP settings)?  You need to use the "set server=" command to get 
nslookup to use a specific DNS server (which appears to be the problem here 
-- it seems that one or more DNS servers are working, but others are not).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] spamcop?

[David Fletcher]

We're using our internet provider's DNS server.  It seems to work, but I don't know 
how to test it for the types of queries declude uses.

nslookup works fine.


--
David FletcherInfoTech International, LLC.
(904)338-9234 (904)721-1253 fax
http://www.ITI-InfoTech.com

Any event, once it has occurred, can be made to appear inevitable by a competent 
historian.




-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED]
Sent: Monday, July 07, 2003 1:26 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] spamcop?



>Debug gives me these lines:
>
>07/07/2003 13:10:54 Qa9930eca013e736e Test 1-SPAMCOP didn't get a response.
>07/07/2003 13:10:54 Qa9930eca013e736e Test 2-JAPAN didn't get a response.
>07/07/2003 13:10:54 Qa9930eca013e736e Test 3-MONKEYFORMMAIL didn't get a 
>response.
>07/07/2003 13:10:54 Qa9930eca013e736e Test 4-MONKEYPROXIES didn't get a 
>response.

Ah, that helps.

Is the first DNS server that is listed in your IMail SMTP settings working 
properly?

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] spamcop?

[R. Scott Perry]

Debug gives me these lines:

07/07/2003 13:10:54 Qa9930eca013e736e Test 1-SPAMCOP didn't get a response.
07/07/2003 13:10:54 Qa9930eca013e736e Test 2-JAPAN didn't get a response.
07/07/2003 13:10:54 Qa9930eca013e736e Test 3-MONKEYFORMMAIL didn't get a 
response.
07/07/2003 13:10:54 Qa9930eca013e736e Test 4-MONKEYPROXIES didn't get a 
response.
Ah, that helps.

Is the first DNS server that is listed in your IMail SMTP settings working 
properly?

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] spamcop?

[R. Scott Perry]

Good call, Scott. I don't think any of these tests are showing up right
now.  I'm going to bump up the logging and take a better look.
If none of them are showing up, did you make any major changes recently 
(such as adding a gateway in front of your IMail server)?  I'm guessing 
that Declude isn't seeing the IP address of the remote mailserver.  If you 
send the Received: headers from an incoming E-mail, along with the HOP, 
HOPHIGH, and IPBYPASS settings from your \IMail\Declude\global.cfg file, I 
can probably determine what is happening.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] spamcop?

[David Fletcher]

More info:
Debug gives me these lines:

07/07/2003 13:10:54 Qa9930eca013e736e Test 1-SPAMCOP didn't get a
response.
07/07/2003 13:10:54 Qa9930eca013e736e Test 2-JAPAN didn't get a
response.
07/07/2003 13:10:54 Qa9930eca013e736e Test 3-MONKEYFORMMAIL didn't get a
response.
07/07/2003 13:10:54 Qa9930eca013e736e Test 4-MONKEYPROXIES didn't get a
response.

-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED] 
Sent: Monday, July 07, 2003 12:39 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] spamcop?



>Has spamcop stopped working?  I'm not seeing any reference to it in my 
>logs now (set to mid) or headers.

It still seems to be working fine from here (see 
http://www.declude.com/spamtrap.htm ).

Could you post the longer line that begins with "SPAMCOP" from your 
\IMail\Declude\global.cfg file?  Are E-mails failing other IP-based spam
tests?

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] spamcop?

[David Fletcher]

Good call, Scott. I don't think any of these tests are showing up right
now.  I'm going to bump up the logging and take a better look.


OSSRC   ip4rrelays.osirusoft.com127.0.0.4
16  0
SPAMCOP ip4rbl.spamcop.net  127.0.0.2
16  0
JAPAN   ip4rjapan.blackholes.us 127.0.0.2
18  0
MONKEYFORMMAIL  ip4rformmail.relays.monkeys.com *
16  0
MONKEYPROXIES   ip4rproxies.relays.monkeys.com  *
16  0

-Original Message-
From: R. Scott Perry [mailto:[EMAIL PROTECTED] 
Sent: Monday, July 07, 2003 12:39 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] spamcop?



>Has spamcop stopped working?  I'm not seeing any reference to it in my 
>logs now (set to mid) or headers.

It still seems to be working fine from here (see 
http://www.declude.com/spamtrap.htm ).

Could you post the longer line that begins with "SPAMCOP" from your 
\IMail\Declude\global.cfg file?  Are E-mails failing other IP-based spam
tests?

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.