RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer
I find that interesting that the major ISP's fail those kinds of tests. Anyone have any idea's on why they wouldn't have those addresses setup? Dl -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker | Netsmith Inc Sent: Friday, July 26, 2002 4:27 PM To: '[EMAIL PROTECTED]' Subject: RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer That is about average, over 50% of our inbound mail fails at least one test (more like 70%)... This is where the weighing system comes into play. Tests like no postmaster and no abuse fail every message from systems like aol.com, msn.com, earhtlink.net, etc,etc... So they will appear as SPAM in your logfiles. You need to use the weighing system / edit your $default$.junkmail and your global.cfg to meet your needs. There is no cut/dry solution to spam, I have definitely learned monitoring this list that everybody has a different solution that fits their setup. The great thing about declude/sniffer is their flexibility, great mailing lists and frequent updates. (ex: we completely disabled the no postmaster/no abuse tests in our system, they are just too inefficient for our setup, but in other setups they are very useful ) -Original Message- From: Jim Rooth [mailto:[EMAIL PROTECTED]] Sent: Friday, July 26, 2002 3:18 PM To: [EMAIL PROTECTED] Subject: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer I must be doing something wrong! I looked at the confirm log and I have caught almost half of the 20,000 emails as spam. I have poured through the logs though and have only found four obviously legitimate emails that should not have been caught. I fixed that with the myfilter file. Either I am doing it wrong or the program is great. I suspect the latter... Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jeff Kratka Sent: Friday, July 26, 2002 3:08 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude and Sniffer Just curious. How many people are using both Declude Junk Mail and the sniffer add-on and has it made a difference if yes. I have been completely pummeled with Spam and am looking for more options. Thanks. Jeff * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer
Jim, my filter file is rather large (almost 1600 entries and growing). I don't know if it is appropriate to post to the list, but I will send you a copy off-line, if you like. Bill -Original Message- From: Jim Rooth [mailto:[EMAIL PROTECTED]] Sent: Sunday, July 28, 2002 12:59 PM To: [EMAIL PROTECTED] Subject: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer I would be interested in seeing what some of you have as myfilter.txt list. I have been adding to mine and find it is a time consuming experience to say the least. One that has been paying for itself though. Being inexperienced in this endeavor, though, I realize I may be going into overkill. What say you? Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Todd Ryan Sent: Sunday, July 28, 2002 2:27 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude and Sniffer Jeff, I just purchased Message Sniffer this past week. Before that, I ran the trial version for 30 days and then produced some statistics to prove to myself and my boss that it was worth buying. What it boiled down to was that I was catching 12.5% more definite spam with Message Sniffer than without it. A couple things that are worth mentioning... By definite spam, I'm being very conservative. I don't consider anything that has a legitimate unsubscribe method to be spam. Many would disagree. We're a higher education institution so free speech is a very important factor. So you may find it even more effective than I do because it will also block some of the newsletters that we as mail administrators find to be at the top of the spam scale. I was using the demo for 30 days so that means no updates. Using it with frequent updates will probably produce even better results. Also, I have some very tweaked JunkMail weights and rules. I only use Message Sniffer only in the weighting system. It blocks some things that I don't consider junkmail like newsletters from emazing.com and beliefnet.com. So if a message ONLY fails sniffer, I don't bounce it. It has to fail one or two other tests. Hope this helps. For me, I expect a 12%-15% increase in accuracy and that is worth it. I now have what I think is a VERY accurate weighting system. I've only had two instances in about 6 months where a remote postmaster said their mail was bouncing. In both cases they were legitimate companies sending work-related things, but they both were listed in one of the open relay databases so the filters worked correctly. --Todd. - Original Message - From: Jeff Kratka [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 26, 2002 4:08 PM Subject: [Declude.JunkMail] Declude and Sniffer Just curious. How many people are using both Declude Junk Mail and the sniffer add-on and has it made a difference if yes. I have been completely pummeled with Spam and am looking for more options. Thanks. Jeff * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit
RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer
I would appreciate it...trying to make sure that I am going in the right direction Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bill Landry Sent: Sunday, July 28, 2002 3:07 PM To: '[EMAIL PROTECTED]' Subject: RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer Jim, my filter file is rather large (almost 1600 entries and growing). I don't know if it is appropriate to post to the list, but I will send you a copy off-line, if you like. Bill -Original Message- From: Jim Rooth [mailto:[EMAIL PROTECTED]] Sent: Sunday, July 28, 2002 12:59 PM To: [EMAIL PROTECTED] Subject: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer I would be interested in seeing what some of you have as myfilter.txt list. I have been adding to mine and find it is a time consuming experience to say the least. One that has been paying for itself though. Being inexperienced in this endeavor, though, I realize I may be going into overkill. What say you? Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Todd Ryan Sent: Sunday, July 28, 2002 2:27 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Declude and Sniffer Jeff, I just purchased Message Sniffer this past week. Before that, I ran the trial version for 30 days and then produced some statistics to prove to myself and my boss that it was worth buying. What it boiled down to was that I was catching 12.5% more definite spam with Message Sniffer than without it. A couple things that are worth mentioning... By definite spam, I'm being very conservative. I don't consider anything that has a legitimate unsubscribe method to be spam. Many would disagree. We're a higher education institution so free speech is a very important factor. So you may find it even more effective than I do because it will also block some of the newsletters that we as mail administrators find to be at the top of the spam scale. I was using the demo for 30 days so that means no updates. Using it with frequent updates will probably produce even better results. Also, I have some very tweaked JunkMail weights and rules. I only use Message Sniffer only in the weighting system. It blocks some things that I don't consider junkmail like newsletters from emazing.com and beliefnet.com. So if a message ONLY fails sniffer, I don't bounce it. It has to fail one or two other tests. Hope this helps. For me, I expect a 12%-15% increase in accuracy and that is worth it. I now have what I think is a VERY accurate weighting system. I've only had two instances in about 6 months where a remote postmaster said their mail was bouncing. In both cases they were legitimate companies sending work-related things, but they both were listed in one of the open relay databases so the filters worked correctly. --Todd. - Original Message - From: Jeff Kratka [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, July 26, 2002 4:08 PM Subject: [Declude.JunkMail] Declude and Sniffer Just curious. How many people are using both Declude Junk Mail and the sniffer add-on and has it made a difference if yes. I have been completely pummeled with Spam and am looking for more options. Thanks. Jeff * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This e-mail was scanned for viruses
RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer
Most of my failures come from my myfile.txt file. I wrote down key phrases or words for a week or two and it seems to kill most of them. Got my first one today since we setup JunkMail four weeks ago! It came through clean as a whistle...I will look forward to setting up phrases in the body of the email. That will kill those that are smart enough to circumvent the system. I have my bounce set at 20 but all my key words and phrases set at ten. That way no one word or phrase will kill the email. Seems to be working...now if I could just get ATT to get off the blacklist so Kithrup and dorkface and those others would go away. I do 90% of my work from home and use ATT cable to access with. Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tom Baker | Netsmith Inc Sent: Friday, July 26, 2002 3:27 PM To: '[EMAIL PROTECTED]' Subject: RE: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer That is about average, over 50% of our inbound mail fails at least one test (more like 70%)... This is where the weighing system comes into play. Tests like no postmaster and no abuse fail every message from systems like aol.com, msn.com, earhtlink.net, etc,etc... So they will appear as SPAM in your logfiles. You need to use the weighing system / edit your $default$.junkmail and your global.cfg to meet your needs. There is no cut/dry solution to spam, I have definitely learned monitoring this list that everybody has a different solution that fits their setup. The great thing about declude/sniffer is their flexibility, great mailing lists and frequent updates. (ex: we completely disabled the no postmaster/no abuse tests in our system, they are just too inefficient for our setup, but in other setups they are very useful ) -Original Message- From: Jim Rooth [mailto:[EMAIL PROTECTED]] Sent: Friday, July 26, 2002 3:18 PM To: [EMAIL PROTECTED] Subject: KITHRUP:RE: [Declude.JunkMail] Declude and Sniffer I must be doing something wrong! I looked at the confirm log and I have caught almost half of the 20,000 emails as spam. I have poured through the logs though and have only found four obviously legitimate emails that should not have been caught. I fixed that with the myfilter file. Either I am doing it wrong or the program is great. I suspect the latter... Jim Rooth Klotron, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jeff Kratka Sent: Friday, July 26, 2002 3:08 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Declude and Sniffer Just curious. How many people are using both Declude Junk Mail and the sniffer add-on and has it made a difference if yes. I have been completely pummeled with Spam and am looking for more options. Thanks. Jeff * TymeWyse Internet P.O.Box 84 - 583 N. Main St., Canyonville, OR 97417 tel/fax: (541) 839-6027 - [EMAIL PROTECTED] * --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com . --- --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.377 / Virus Database: 211 - Release Date: 7/15/2002 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
