Hi;
You are right... This actually is the first time this has happened. Our
weighing system is such that a score of 100+ is assigned to our Spam
trap accounts. In almost 1 year this is the first time I am faced with
this... Never thought a legitimate eMail could trigger so many traps.
Of
My latest incident with spamcop -
A client has an Order Confirmation auto-responder.
To get the message you have to send an e-mail to the auto-responder.
The auto-responder is not on our server - only the web site.
The auto-responder message was reported to spamcop.
We think it was
Folks,
I'm a relatively new user of JunkMail. I've recently seem several emails
fail the following combinations of tests yet not trip the Weight10 test:
NOPOSTMASTER, BASE64 and ROUTING
HELOBOGUS, REVDNS
BADHEADERS, SPAMHEADERS
Anyone else have similar experiences...what could I do (if
I'm a relatively new user of JunkMail. I've recently seem several emails
fail the following combinations of tests yet not trip the Weight10 test:
NOPOSTMASTER, BASE64 and ROUTING
HELOBOGUS, REVDNS
BADHEADERS, SPAMHEADERS
Anyone else have similar experiences...what could I do (if anything)
In the headers. No whitelists, no weight changes. I've included the headers
below. Also, attached is the global.cfg file
The problem here is that the weight of the E-mail isn't greater than
10. The line:
IPNOTINMX ipnotinmx x x 0 -4
will give an E-mail
Scott,
In the headers. No whitelists, no weight changes. I've included the headers
below. Also, attached is the global.cfg file
Thanks for your help, Steve
Received: from bellsouth.net [200.168.14.67] by mail.tmlp.com
(SMTPD32-7.06) id ACE418F100DA; Wed, 04 Dec 2002 05:45:56 -0500
Received:
Is there a way to change the location of HOLD messages from the default?
No, there isn't, but that is something we are planning to change.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail
That is a bummer, I'm using xcopy to backup files from one computer to
another, and the hold directly can have as many as 3000 messages over the
weekend (which is big plug for the effectiveness of declude)
thanks, andy
- Original Message -
From: R. Scott Perry [EMAIL PROTECTED]
To:
Perhaps someone can shed some light on this. I've got junkMail running using
a weight system. If an email gets a weight of less that 18 it is passed on
to the receipient. Today however, I'm getting legit emails from a particular
client that is being caught and forwarded to my catchall account as
I use the ROUTETO command and I view them through web messaging. Should I
view them another way?
Since I have been using the ROUTETO command, can I somehow forward the
message to the intended recipient without the user realizing I monitored it?
If I were to start using the HOLD command, how
I use the ROUTETO command and I view them through web messaging. Should I
view them another way?
That's up to you -- using the ROUTETO action, they are treated as regular
E-mail, and the methods of handling them are based solely on the type of
mail client you are using.
Since I have been
An excellent article for mail admins...
http://rr.sans.org/email/spam_battle.php
---
[This E-mail scanned for viruses by Declude/McAfee]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
Title: Black list domain
Good question, I was seeing the same
thing,but I don't believe wildcards work here. Hope I'm wrong.
Scott?
Paul
- Original Message -
From:
Harry Vanderzand
To: [EMAIL PROTECTED]
Sent: Wednesday, December 04, 2002 5:11
PM
Subject:
Good question, I was seeing the same thing, but I don't believe wildcards
work here. Hope I'm wrong. Scott?
No, it isn't possible to use wildcards. However, given how many people
have been requesting more comprehensive filtering abilities, it's something
that we may work on.
Since we have to use Sniffer as a weighted test and these are only failing
the Sniffer test, how can I safely block these greetings?
We have too high of a volume to hold email as it would take a full time
staff person to just search the rejects, so we are forced to delete.
Sheldon
Sheldon
An excellent article for mail admins...
http://rr.sans.org/email/spam_battle.php
Thanks!!!
I now have a new tagline signiture...
Sheldon
Sheldon Koehler, Owner/Partnerhttp://www.tenforward.com
Ten Forward Communications 360-457-9023
Nationwide access, neighborhood
Sniffer version 2 is out now. Scumware rules have a special symbol 62.
You could look for that specific result code and treat it specially.
Currently all other spam rules are coded to the generic group with a
symbol of 63.
That should make it simpler.
Hope this helps,
_M
| -Original
Sniffer version 2 is out now. Scumware rules have a special symbol 62.
You could look for that specific result code and treat it specially.
Currently all other spam rules are coded to the generic group with a
symbol of 63.
Is this still in beta? I will have to take a closer look at it
How can we catch symbol 62 differently? V2 is configured as 'nonzero',
meaning that all return codes other than zero are logged and treated alike
by Declude.
- Original Message -
From: Madscientist [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Filtering E-Greetings
Sniffer version
Scott should back me up or correct me on this. I think that you can
configure multiple test lines using Message Sniffer where each line looks
for a specific return value instead of nonzero. Something like the
following...
SNIFFERSPAM external 63
SNIFFERSCUM external 62
Note the 63 and
20 matches
Mail list logo
