serge wrote:
thanks matt
let me see if i finally understand
this
To and CC are in the headers but not
BCC
the recepient can be either in To,
CC, or BCC, and therefore may nit be in the header
when you say address used in smtp
connection, you mean the recepient address, wh
thanks matt
let me see if i finally understand
this
To and CC are in the headers but not
BCC
the recepient can be either in To, CC, or BCC, and
therefore may nit be in the header
when you say address used in smtp connection, you
mean the recepient address, which is what we find in the Q.smd
Serge,
The headers will only contain To and CC addresses, and with spam the
RCPT To is often different. If you want to test the To and CC
addresses then you should use a HEADERS search. If you want to test
the RCPT To addresses which are used during the SMTP connection, you
would use either
are there no way to set a junkmail filter to test for receipients ?
Something like
headers 0 contains [EMAIL PROTECTED]
TIA
- Original Message -
From: "Pete McNeil" <[EMAIL PROTECTED]>
To: "Jeff Kratka" <[EMAIL PROTECTED]>
Sent: Thursday, July 22, 2004 6:59 PM
Subject: Re: [Declude.Jun
Scott...
HOP is "0", no HOPHIGH. IPBYPASS 192.168.1.50 which is my backup spooler.
Complete "Received:" headers below:
Received: from smtp.fidnet.com [216.229.64.74] by mail.csimo.com
(SMTPD32-8.12) id AD2B20D0070; Thu, 22 Jul 2004 16:10:03 -0500
Received: (qmail 13061 invoked by uid 20954);
I just tried to do a telnet session with this server and it requires
SMTP AUTH. My feeling here is that there are enough Earthlink
customers out there that someone could quite easily generate lists of
hundreds of valid usernames and passwords from an AUTH attack on a
server such as this, and t
I have forwarded several spam emails to [EMAIL PROTECTED] but the only response
I get back is that the email did not originate from their network.
Its really annoying that they don't give a
shit.
I would have blocked them if it had not been for
one of my clients needing email from that se
I've had a couple of reports that my messages were failing SPF. I sent a
message to myself via a loop and am totally confused at the message header.
The message was actually sent from my computer on private IP 192.168.1.177
to my IMail server at 216.229.87.4. For some reason Declude reports t
Can someone help me with the header of this message.
I think this came from earthlink.net mail server.
According to earthlink abuse they can't do anything about this type of
spam since it did not originate from their network.
We get porn spam from this segement all the time.
You can always trust
Correction:
Should read "If we want to block all zips, but we want to NOT send an
'attachment blocked' message if the zip is an EZIP, can this be
accomplished with SKIPIFEXT EZIP?"
Correct.
-Scott
---
Declude JunkMail: The advanced anti-spam solut
This is still the 1.79i8 interim that is listed on your site and it's not
the one that handles the SKIPIFEXT exception.
Thanks for pointing this out -- I'll get that updated.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail
so this
WEIGHT10SUBJECT [Spam]
WEIGHT10HEADER [This E-mail is likely to be spam; see
http://www.example.com/spam for details]
will put a subject line and a header ?
No. You can't have multiple actions per test -- to do what you want, you
would need to create a new test, such as
> Earthlink has for some reason been forwarding spam through this
> server for some time. I'm not sure what the setup is, but it's
> a legitimate Earthlink server and the E-mail originates from a
> spam zombie.
> I have thought about IPBYPASS'ing this server in order to capture
> the real sourc
I've had a couple of reports that my messages were
failing SPF. I sent a message to myself via a loop and am totally confused
at the message header.
The message was actually sent from my computer on
private IP 192.168.1.177 to my IMail server at 216.229.87.4. For some
reason Declude r
Earthlink has for some reason been forwarding spam through this server
for some time. I'm not sure what the setup is, but it's a legitimate
Earthlink server and the E-mail originates from a spam zombie.
I have thought about IPBYPASS'ing this server in order to capture the
real source, but I h
On Thursday, July 22, 2004, 2:29:39 PM, Jeff wrote:
JK> I would like to monitor both incoming and outgoing mail from 1 particular
JK> e-mail address on my domain. What would be the easiest/simplest way of doing
JK> it without the persons knowledge.
Use the 'copy mail to' feature in IMail and the
Correction:
Should read "If we want to block all zips, but we want to NOT send an
'attachment blocked' message if the zip is an EZIP, can this be
accomplished with SKIPIFEXT EZIP?"
Sorry for the confusion.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Beha
Imail copyall account and Imail rules for that account deleting all but to
and from that address.
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Jeff Kratka
> Sent: Thurs
I would like to monitor both incoming and outgoing mail from 1 particular
e-mail address on my domain. What would be the easiest/simplest way of doing
it without the persons knowledge.
Jeff Kratka
TymeWyse Internet
P.O.Box 84 - 110 Ecklund St., Can
If we want to block all zips, but we want to only send an 'attachment
blocked' message if the zip is an EZIP, can this be accomplished with
SKIPIFEXT EZIP?
Problem seems to be that if you have BANEXT ZIP and BANEXT EZIP, Declude
still only sees them as zip and not EZIP, and flags them as such a
dig -x
;; ANSWER SECTION:
102.252.235.68.in-addr.arpa. 86286 IN PTR
68-235-252-102.atlsfl.adelphia.net.
dig -x 207.217.120.149
;; ANSWER SECTION:
149.120.217.207.in-addr.arpa. 86400 IN PTR
asmtp-a063f33.pas.sa.earthlink.net.
Seems it indicate so.
Rod
--
i360 Support wrote:
>Can som
Scott,
This is still the 1.79i8 interim that is listed on your site and it's
not the one that handles the SKIPIFEXT exception.
Matt
R. Scott Perry wrote:
Is there a line I can add to not send this email message that fail EZIP?
With the latest interim (http://www.declude.com/version/interim), y
> > I just took a Eicar virus message and performed the following
> experiments:
> >
> > 1) Move the Q*.SMD and D*.SMD file to the spool directory.
> >Result: Message delivered to my Inbox.
> >
> > 2) Move the Q*.SMD to overflow and the D*.SMD file to the spool
> directory.
> >Result: M
Can someone help me with the header of this
message.
I think this came from earthlink.net mail
server.
According to earthlink abuse they can't do anything
about this type of spam since it did not originate from their
network.
We get porn spam from this segement all the
time.
Rec
>
> The original poster wanted to know how to get a message rescanned
> by Declude
> (Virus and JunkMail).
>
> I just took a Eicar virus message and performed the following experiments:
>
> 1) Move the Q*.SMD and D*.SMD file to the spool directory.
>Result: Message delivered to my Inbox.
>
> 2
> > > > I have a message that was held as spam a couple days ago
> > > and I want to
> > > > switch to logging mode to determine what in the words
> > > filter it matched,
> > > and
> > > > what the badheaders code was (didn't have warn for
> > > badheaders on this
> > > > domain).
> > > >
> > > >
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of R.
> Scott Perry
> Sent: 21. juli 2004 13:00
> To: [EMAIL PROTECTED]
> Subject: Re: [Declude.JunkMail] Tagging a mail if its weighted as spam
>
>
> >I know it's possible to do this in subject line
Is there a line I can add to not send this email message that fail EZIP?
With the latest interim (http://www.declude.com/version/interim), you can
add a line "SKIPIFEXT EZIP" to the bannotify.eml file.
-Scott
---
Declude JunkMail: The advanced a
28 matches
Mail list logo
