RE: [Declude.JunkMail] From:
Oohh oohh I think I know this one!! (courtesy of someone on this list) You have to be careful, it blocks legit people who forget to put subjects to so just comment out subject like I have done. IN C:\IMAIL\Declude\$default$.junkmail === MISCFILTERS HOLD C:\IMAIL\SPOOL\SPAM\MISC-SPAM IN C:\IMAIL\Declude\global.cfg === MISCFILTERS filter C:\IMAIL\Declude\Filters\misc-filters.txt x 0 0 IN C:\IMAIL\Declude\Filters\misc-filters.txt == #misc filters #with blank subject and blank from HEADERS 30 NOTCONTAINS from: #HEADERS 30 NOTCONTAINS subject: Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli Sent: Thursday, October 12, 2006 6:26 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] From: Is there a filer to block these. From: Fred --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] From:
MAILFROM 0 IS I wouldn't do it though. Mailfrom the generally signifies delivery failure notices and such. For me mail from is 90% ham, 10% spam this month. - Original Message - From: Frederick Samarelli [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, October 12, 2006 11:25 AM Subject: [Declude.JunkMail] From: Is there a filer to block these. From: Fred --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FROM Actions
That's life as they say. You can set up the filter to be very efficient by placing a line at the top of the filter to prequalify it and save processing. ALLRECIPS END NOTCONTAINS @cutomerdomain.com Matt David Sullivan wrote: I've got a pretty simple need, but having trouble figuring out how to accomplish this. I have one domain that wants to put a specific text string in the subject line of all messages coming from a list of sender domains. In other words if a message is coming to example.com from domain1.com, domain2.com, domain3.com, etc, then I need to put xyz in the subject line. I thought the best way to accomplish this was with a filter file and an associated SUBJECT action but all I see in filter file parameters is MAILFROM not FROM. And, I hate to scan every single message with filters for this one tiny domain. Any suggestions? -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FROM Actions
Yes. David Sullivan wrote: M That's life as they say. You can set up the filter to be very efficient M by placing a line at the top of the filter to prequalify it and save M processing. M ALLRECIPS END NOTCONTAINS @cutomerdomain.com Then the rest of my lines would look like this: MAILFROM 0 CONTAINS @senderdomain1.com MAILFROM 0 CONTAINS @senderdomain2.com MAILFROM 0 CONTAINS @senderdomain3.com -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] From Declude Sender..
Can there be a filter that shows the sender and the reply to address are different? That isn't currently possible, but something that we will look into adding. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] From File Filter Not Being Triggered With Messages That Have Many Recipients
Scott, I will attempt to reproduce the original problem with the large amount of recipients with debug on. However, while going through the logs with debug on, I noticed other fromfilters not triggering with valid addresses. In this case there is a reverseweightlow fromfilter that has the @aol.com address in the file. The sender is from @aol.com but there was no match form the filter. Here is a snippet of the log in the attached text file. Darrell Darrell LaRock Systems Analyst Gannett Television 716-849-2272 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Wednesday, June 11, 2003 2:58 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] From File Filter Not Being Triggered With Messages That Have Many Recipients I have a from filter that contains email addresses. When this filter is triggered it will routeto another email address. When I test this with one recipient it works. However, I am having an issue when mail that comes in that has many recipients (30+) the email addresses from the filter is not being detected. I am using version 1.70 of declude. Scott I am emailing directly to you snippets of the log and config files for a gander. Would there be any chance of trying to reproduce this with the debug mode on (LOGLEVEL DEBUG in the \IMail\Declude\global.cfg file temporarily)? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. filterlog.zip Description: Zip compressed data
RE: [Declude.JunkMail] From File Filter Not Being TriggeredWith Messages That Have Many Recipients
However, while going through the logs with debug on, I noticed other fromfilters not triggering with valid addresses. In this case there is a reverseweightlow fromfilter that has the @aol.com address in the file. The sender is from @aol.com but there was no match form the filter. Isn't that the same user and same test that was having the problem before (when there were lots of recipients)? Could you E-mail me your \IMail\Declude\global.cfg file and the file used with the reverseweightlow test, so I can try to reproduce the problem here? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] From File Filter Not Being Triggered With Messages That Have Many Recipients
The config files were sent to your [EMAIL PROTECTED] account. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, June 12, 2003 9:28 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] From File Filter Not Being Triggered With Messages That Have Many Recipients However, while going through the logs with debug on, I noticed other fromfilters not triggering with valid addresses. In this case there is a reverseweightlow fromfilter that has the @aol.com address in the file. The sender is from @aol.com but there was no match form the filter. Isn't that the same user and same test that was having the problem before (when there were lots of recipients)? Could you E-mail me your \IMail\Declude\global.cfg file and the file used with the reverseweightlow test, so I can try to reproduce the problem here? -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] From File Filter Not Being TriggeredWith Messages That Have Many Recipients
The config files were sent to your [EMAIL PROTECTED] account. Wow, this was a tricky one. It turns out that there was a problem where the first line of a fromfile blacklist might not work properly if multiple fromfile blacklists were used. There is an interim release v1.70i11 at http://www.declude.com/release/170i/declude.exe that fixes this issue. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] From File Filter Not Being Triggered With Messages That Have Many Recipients
Scott, Looks like it fixed it. Darrell -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Thursday, June 12, 2003 10:25 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] From File Filter Not Being Triggered With Messages That Have Many Recipients The config files were sent to your [EMAIL PROTECTED] account. Wow, this was a tricky one. It turns out that there was a problem where the first line of a fromfile blacklist might not work properly if multiple fromfile blacklists were used. There is an interim release v1.70i11 at http://www.declude.com/release/170i/declude.exe that fixes this issue. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FROM Sent from - detecting?
Would it be of any benefit if we could have a test that could indicate if the FROM address is different from that of the SEND FROM that Declude detects? A lot of SPAM comes from emails that the MAILFROM address is different from the SEND FROM that Declude identifies. This does sound like a good test. Although it would have some false positives (like the mailing lists, as you mentioned, as well as people whose mail clients may use a From: of [EMAIL PROTECTED] but have a return address of [EMAIL PROTECTED]), but it would probably catch quite a bit of spam. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] from name test
Hi Greg, Our free tool SPAMCHK (www.riedmann.it/spamchk) makes already some of this tests: SenderWithCode=6 SenderWithCodeMaybe=3 DigitsForCode=8 DigitsForCodeMaybe=4 With this parameters you can give 3 points for from-adresses with more then 4 digits and 6 points for senders with more then 8 digits. Feel free to change the digit number and the points you want to give. Additional there is a test that searches for unreadable sequences of consonants in the from-adress: ConsUnreadable=4 ConsUnreadableMaybe=3 SenderUnreadable=2 SenderUnreadableMaybe=1 FreqConsSequences=sch,ch,ck,nk,ng,nt,nd,rnst This will give 1 point if there are at least 3 following consonants and 2 points if there are at least 4 following consonants. You can specify frequent used consonants that wouldn't count for this test. All of the from-adresses you've listed will recieve at least 6 points from SPAMCHK. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] from name test
I was wondering if Declude would consider adding a test that looks for long or strange from names before the @ in the from address of a message. It would be used as a weighted test. It might help push some e-mails into the delete weight range. Here are some examples of strange from addresses - perf-errors.5332.190355.27764420.501.0.1@ b.LuckyDeals.0-13eeb71-7071.acsworld.net.-pizza@ tdm-errors.900041841.190499.962054006.009.0.2@ b-165677082-2612_-402086880@ cid=2-uid=28916792-mid=400--@ b.server1.c-142d04a-35b0.acsworld.com.-hlr77@ FWIW, there are many mailing list programs that will send out mail this way as well (typically with the recipient's address appearing somehow as part of the username, such as list-return-735-user=example.com@. So a test that was able to detect the long/strange usernames would likely also catch mailing lists (which as it is already tend to have high weights). -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] from name test
Greg, Is there a tutorial on what all these tests mean??? SenderWithCode=6 SenderWithCodeMaybe=3 DigitsForCode=8 DigitsForCodeMaybe=4 Its nice to assign a weight but I am unsure what all the different mean in the config file... Thanks, Adam -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Markus Gufler Sent: Wednesday, April 02, 2003 9:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] from name test Hi Greg, Our free tool SPAMCHK (www.riedmann.it/spamchk) makes already some of this tests: SenderWithCode=6 SenderWithCodeMaybe=3 DigitsForCode=8 DigitsForCodeMaybe=4 With this parameters you can give 3 points for from-adresses with more then 4 digits and 6 points for senders with more then 8 digits. Feel free to change the digit number and the points you want to give. Additional there is a test that searches for unreadable sequences of consonants in the from-adress: ConsUnreadable=4 ConsUnreadableMaybe=3 SenderUnreadable=2 SenderUnreadableMaybe=1 FreqConsSequences=sch,ch,ck,nk,ng,nt,nd,rnst This will give 1 point if there are at least 3 following consonants and 2 points if there are at least 4 following consonants. You can specify frequent used consonants that wouldn't count for this test. All of the from-adresses you've listed will recieve at least 6 points from SPAMCHK. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FROM?
Kami, How about, instead of of HEADERS CONTAINSFantasy Toon you make it HEADERS CONTAINSFrom: Fantasy Toon Dan On Tuesday, December 31, 2002 12:17, Kami Razvan [EMAIL PROTECTED] wrote: Message Hi; Anyway other than using the HEADERS filter type to read the name of a TO field? From: Fantasy Toon [EMAIL PROTECTED] We are getting a bunch of SPAM from these folks with different eMails but the same name. I was wondering if we can read the Fantasy Toon without using HEADERS? Happy New Year... Regards, Kami --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
