I believe the hmtl decoding already takes care of the second example. As for the
first, I've had great success targeting spoofing directly:
BODY0 CONTAINShttp://7&#
BODY0 CONTAINShttp://8&#
BODY0 CONTAINShttp://9&#
BODY0 CONTAINS
I really like that idea. Right now I'm using Imail 8's URL filtering but I
would move my filters over to Declude if I could filter on a BODYURL. I
catch dozens of emails each day with the URL filter on Imail 8 and it does
similar cleanup before applying the filter.
-Josh
- Original Message --
Hi Scott,
Have you considered the following?
Since the goal of every spammer is to get the reader to visit their website (or call a
phone number, or send a fax), every spam always has a target which very often is a URL.
Although in 90% of the cases it is easy to add this to a word filter, I am
I have it routeto a folder in my account like [EMAIL PROTECTED]
and if you do that, and sort the mailbox by subject you'll see many spam
have the same subject. Submit 100 of those a week to spamcop.net and we'll
start doing some good damage to the spammers. Even if you don't filter using
spamcop.n
You are doing the right thing :)
I wish i could do it also .
I have in my junkmail file:
weight20 delete
#weight20 routeto [EMAIL PROTECTED]
I amis changing the # from 2nd line to 1st to see what going on
SO i change it, do a save and rechange it ,do a save it take 2 second max
to do that.
i
- Original Message -
From: "Rifat Levis" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 25, 2003 5:07 PM
Subject: Re: [Declude.JunkMail] Fw: - Resolution of Suspected AUP
Violation -(INFLOW:36688) ([SpamCop id:347295673])
> ABOUT http://www.blackholes.us
>
> As long as i
You will be suprised to my response.
I can not do a very strict blocking ,because this mail server serve the
dial-up customers.
I have only 2 line ,here is the 2 line
HELO 20 contains OMMO.NET
HELO 20 contains 212.64.200.32
these 2 line is direct delete ,
OMMO.net is used as helo msg from the b
Thanks Scott ... I take your advice
Doris
- Original Message -
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 25, 2003 11:22 AM
Subject: Re: [Declude.JunkMail] Blacklist file
>
> >That being the case I seem to have a problem ... I have blocked
ABOUT http://www.blackholes.us
As long as it is not a dynamic blocking site , it does not mean anything .
Blocking big ranges of ip address , will do a lot of harm ,if the abuse
address of the ISP take in consideration
every abuse report, why blocking the whole ip ranges.
Take a look at the TXT f
If an email that fails a rule and or filters set for whatever weight if
the junkmail file is set to ignore will the message weight increase upon
each failure?
Yes. For any test in Declude JunkMail (including filters), the weight will
be added to any E-mail that fails the test, even if the acti
Great.
That is straight forward
Thank you
Harry Vanderzand
inTown Internet & Computer Services
11 Belmont Ave. W.
Kitchener, ON
N2M 1L2
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of R.
> Scott Perry
> Sent: Friday, July 25, 2003 4:37 PM
>
any ideas on this from anyone?
I want to know if I can filter the html source code the same way the body,
headers etc., can be filtered.
That way when the e-mail just consists of a clickable image then I could
check for offending spam web sites in the html source code
The Declude JunkMail fil
Title: Message
any
ideas on this from anyone?
I want
to know if I can filter the html source code the same way the body, headers
etc., can be filtered.
That
way when the e-mail just consists of a clickable image then I could check
for offending spam web sites in the html source code
Title: FILTERS
If an email that fails a rule and or filters set for whatever weight if the junkmail file is set to ignore will the message weight increase upon each failure?
A thanks so much, do you know if the PRO version of the declude
software allows for more than 200 entries?
The 200 entry limit applies to all versions. However, v1.75 does allow a
new WHITELISTFILE option that allows for unlimited whitelist entries in a
separate file (if you search the arc
in the header it appears that the whitelist is being skipped over
completely somehow
If you check your log file, you'll see what the problem is. :)
[for the benefit of others: the global.cfg file can hold a maximum of 200
whitelist entries]
-
A thanks so much, do
you know if the PRO version of the declude software allows for more than 200
entries? Thanks again, much appreciated!
Mike
- Original Message -
From:
R. Scott
Perry
To: [EMAIL PROTECTED]
Sent: Friday, July 25, 2003 11:44
AM
Subject:
Yes. If you are referring to Global config file WHITELIST entries, if you exceed the
max number(depends on version) then you will experience inconsistent results. Use the
Whitelist file instead, as it is apparently unlimited.
-Original Message-
From: Mike Robbins [mailto:[EMAIL PROT
in the header it appears
that the whitelist is being skipped over completely
somehow
here is a
header:
Received: from
sto01smx002.homestore.com [209.74.97.91] by pride.russlyon.com with
ESMTP (SMTPD32-7.15) id AFC8D1BA00F6; Fri, 25 Jul 2003 09:50:16
-0700Received: from sto01htp016 (un
Has this happened to anyone where the WHITELIST stops working and your
spamtrap catches messages from domains or IPs that are listed on the WHITELIST?
Could you show the WHITELIST entries, and the X-Declude-Sender: headers of
E-mails that didn't get whitelisted?
That being the case I seem to have a problem ... I have blocked
211.158.49.39/24 as
211.158.49.39/24 (FYI, it's better to write it as "211.158.49.0/24",
setting the non-significant numbers to 0) is the range from 211.158.49.0
through 211.158.49.255. But:
211.158.43.177
211.158.49.39
211.158.40
That being the case I seem to have a problem ... I have blocked
211.158.49.39/24 as
211.158.43.177 211.158.49.39 211.158.40.36 211.158.92.125 211.158.85.160 and
other 211.158 ip's are flooding my mail server so I decided to block the
class C for a few days to attempt to stop this ... it doesn't se
Title: Message
Ah, I do see why
you've moved the ip4r tests to IMail. I do remember that earlier
discussion of ip4r efficiency, but I didn't give it my full attention (I was
slogging through the backlog that came in while I was on vacation...) I had
concluded that the decision to move ip4r
I am running the standard version of declude ... is there a limit on the
number of IP that can be in the blacklist text file?
There is no limit to the number of IPs in the blacklist file.
And am I correct that to block an entire class C address I add the
/24 to the end of the IP address .
Title: Message
Has this happened to anyone
where the WHITELIST stops working and your spamtrap catches messages from
domains or IPs that are listed on the WHITELIST?
Thanks
Rifat, since you have the Pro version of JunkMail, how much text filtering
do you do? Kami and I both do quite a bit...
I just counted, and in various separate text filter files, i have 3500 BODY
tests.
Andrew.
-Original Message-
From: Rifat Levis [mailto:[EMAIL PROTECTED]
Sent: Thursd
I am running the standard version of declude ... is
there a limit on the number of IP that can be in the blacklist text
file?
And am I correct that to block an entire class C address
I add the /24 to the end of the IP address ...
TIA
Doris
In my eagerness I found
http://www.blackholes.us
Such a cool blackhole list.
-Josh
- Original Message -
From: "Joshua Levitsky" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 25, 2003 12:27 PM
Subject: [Declude.JunkMail] Fw: - Resolution of Suspected AUP
Violation -(INF
Try adding mydomain.com to your spamdomain text file -- since the
originating IP is not in your domain, it will fail (this stopped all of
these at our site, as we add enough on this one text to hold (but not
delete). For internal IP's, if htey don't resolve to your domain name, add
another test th
You can use inflow.blackholes.us if you want to block their entire
network (you can also view all of Inflow's IP blocks on the
blackholes.us site http://www.blackholes.us/zones/isp/inflow.txt)
http://www.blackholes.us
- Mike
-Original Message-
From: Joshua Levitsky [mailto:[EMAIL PROTECT
Title: Message
On the
subject of disk systems and performance, I'de like to offer our experience to
the original poster.
Our
IMAIL server is Dual P3 1.13GHz w/ 1GB RAM.
We
used to run SCSI raid5, but for some reason it was changed to RAID1 ATA100
drives (partitiond, but a single pair for ev
Has anyone else here gotten these bull responses from Inflow? Anyone know
Brett Pollard's email because I'd really like to tell him about all the
great products I'd like to sell him so he can fully understand what spam is.
If anyone knows all the segments Inflow owns off-hand please pass them on a
Title: Message
Hi
John:
I totally agree
with you... RAID 5 is best suited for that purpose.
The only reason we
have it as such is simply because of redundancy. The best for mailboxes is
RAID 0+1. RAID 5 gives us the ease of adding more storage and more
redundancy.
But You are
right
I would also suggest expanding your FAQ to lower the rate of the same
questions that keep on recurring on the list every week.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Friday, July 25, 2003 4:53 PM
To: [EMAIL PROTECTED]
Subject:
Title: Message
Morning Kami.
Hate to differ, but I disagree, as I am
sure others will, on using RAID 5 for mail boxes. The mail boxes are heavy Read
AND Write. RAID 5 will slow performance in heavy write usage. RAID 5 is best
and shines the greatest in mainly Read situations, like dat
Title: Message
with
html many are just putting an image in the e-mail. If I can filter on the
underlying url then I could stop these kinds of spam.
Or is
there another way?
Harry Vanderzand inTown Internet & Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2
-Original M
I will appreciate , if anybody can post a msg
as soon as the new manuals are available.
I am cheking time to time ,after the realease of 1.75.
We're working on it. :) Hopefully, we'll have them ready on Monday.
-Scott
---
Declude JunkMail: The
I will appreciate , if anybody can post a msg
as soon as the new manuals are available.
I am cheking time to time ,after the realease of 1.75.
Would like to see the new tests such as SPAMDOMAINS in the
manual.
Regards
Rifat Levis
---
[This E-mail was scanned for viruses by Declude Virus (htt
Title: Nachricht
Harry
What
do you want to filter out?
Markus
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harry VanderzandSent: Friday, July 25, 2003
2:55 PMTo: [EMAIL PROTECTED]Subject:
[Declude.JunkMail] filter HTML source
Title: Message
Is
there a way to filter the HTML source code of an e-mail. If there is then
I can filter out more.
thanks
Harry Vanderzand inTown Internet & Computer Services 11 Belmont Ave. W.Kitchener, ONN2M 1L2
Title: Message
Hi
Andrew:
The X-IMAIL that
you asked about has to do with the weights that we assign to each
test.
We are doing the
IP4r tests in IMail and adding headers. Declude filter for these tests in
the header has weights assigned to each test.
1: To start
with: IMail kil
Title: Message
Mark:
I might have
missed it in case you mentioned it.
What is your drive
configuration? I believe that also can make a lot of
difference.
It is best to have
your spool directory separate from your mailboxes. Our configuration is as
follows:
1: RAID
0+1: OS & App
42 matches
Mail list logo
