I received a forwarded email with these headers today. Don't know which
spam filter product generated them, but they look like some neat tests:
* 0.3 NO_REAL_NAME From: does not include a real name
* 0.9 FROM_ENDS_IN_NUMS From: ends in numbers
* 0.6 US_DOLLARS_3 BODY: Mentions million
I can't say that I am overwhelmed with the effectiveness of the MTLDB test
thus far. Every single email I have seen come through my server with the
MTLDB test triggered on it has been a false positive - in fact, it seems
that "user not found" automated messages originating from the mail servers
And there is one other thing that seems to be
missed...
Declude is not a simple thing to implement and configure. Those of us
running it are more than capable of adding a line to our config files and
deciding how to weight it/configure it/otherwise implement it. We don't
NEED a "click OK to insta
ed this
idiotic move.
Matt
Scott MacLean wrote:
Does anyone know how to expedite
getting removed from AOL/Netscape/Compuserve's IP spam list? I have no
idea how we got there, but they have been blocking mail from every domain
on my server for almost two weeks now. I can guarantee we've
Does anyone know how to expedite getting removed from
AOL/Netscape/Compuserve's IP spam list? I have no idea how we got there,
but they have been blocking mail from every domain on my server for
almost two weeks now. I can guarantee we've never sent any spam their
way, or any way, for that matter.
d seem to
require. Am I correct in assuming that you can still secure things
by way of SMTP AUTH without needing to accept every message coming into
that port? And more importantly, would you be willing to
share your fine work :)
Matt
Scott MacLean wrote:
This may be a crutch solution, but
it i
This may be a crutch solution, but it is what we have
implemented, and our customers seem to like it.
I wrote a small port redirection program that runs on the mail server. It
listens on a specific port number, and when it receives a connection,
opens a connection on the mail server on port 25, an
I've had BIND 4, 8 and 9 running on my IMail 6, 7 and
8, both master and slave, for years, with no problems ever. Well...no
problems relating to the interaction of IMail and DNS. :)
At 11:33 AM 12/12/2003, Burzin Sumariwalla wrote:
I thought it was a no-no to have
DNS running on your Imail server
Some interesting results based on the poll TuCows sent to
its resellers:
http://icann.org/correspondence/noss-to-twomey-03oct03.htm
ave to close
and reopen a file.
Darrell
Check Out DLAnalyzer a comprehensive reporting tool for
Declude Junkmail Logs -
http://www.dlanalyzer.com
Scott MacLean writes:
Try UltraEdit www.ultraedit.com - you can open/search any size file because you can se
. . and that's at LOGLEVEL =
LOW.
Glenn Z.
- Original Message -
From: Scott MacLean
To:
[EMAIL PROTECTED]
Sent: Monday, September 29, 2003 10:59 AM
Subject: Re: [Declude.JunkMail] Log to syslog option
Try UltraEdit www.ultraedit.com - you can open/search any size file because y
Try UltraEdit
www.ultraedit.com
- you can open/search any size file because you can set it to not load the file into memory. Simple, and it's by far the best text/hex/anything editor I've ever used. I use it to open and search through my daily server logs which are sometimes 20-30 megs in size.
A
At 06:50 PM 09/26/2003, Pete McNeil wrote:
At 02:30 PM 9/26/2003 -0700, you
wrote:
> I've said it before, I'll say
it again. It's time to leverage the power
> of the network agianst abuse on that same network.
Pete,
You are preaching to the choir ;)
When will it be ready?
Pedaling as fast as I can
It wouldn't make sense to repeatedly download what was
essentially the same list with small changes. It would make much more
sense to have one large file to download once, followed by a distribution
of small "diff" files to apply to the main file, containing any
additions/deletions since the previ
At 05:10 PM 09/25/2003, Matthew Bramble wrote:
Scott MacLean wrote:
*sigh* you're right again, Scott.
Still doesn't explain why it's not catching my previous wordfilter lines.
I'm going to watch this one some more.
Keep checking your math for the other message :
At 04:35 PM 9/25/2003, R. Scott Perry wrote:
No
HTML comments at all.
Are you running Declude JunkMail Pro ("\IMail\Declude -diag"
from a command prompt will show you which version you are running)?
Are you positive there are no HTML comments (can you see HTML codes in
other E-mails that use HTML
At 04:03 PM 9/25/2003, R. Scott Perry wrote:
Are there any spaces/tabs after
"MPCM" on that line? Does the line end properly (if it is
the last line in the file, and you use Notepad, can the cursor go to the
line below it)?
The lines are fine - no spaces/tabs, and they are in the middle of the
fi
I am getting TONS of this crap on my server. All kinds of
different messages, all with the little "MPCM" blurb at the
top. I set up two filters in my Wordfilter test to catch it:
BODY 10 CONTAINS mpcmffa.com
BODY 10 CONTAINS MPCM
However, it is not catching it - in fact, the only wordfilter entry
ns of Declude JunkMail before 1.75 that
whitelisting would not work properly on longer return addresses such as
this. We haven't had any such reports with 1.75, so if you aren't
on 1.75, I would recommend upgrading to it.
I'm definitely running 1.75.
_______
91.57.182]
X-Note: This E-mail was sent from nova.sparklist.com ([216.91.57.182]).
X-Failed-Spam-Test: BLACKLIST, WORDFILTER, NOLEGITCONTENT, WEIGHT15
X-RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 338337210
Status: U
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
-
age -
From: "Scott MacLean" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, July 27, 2003 9:45 PM
Subject: [Declude.JunkMail] Massive flood of uncaught spam
> Starting Friday night, most of the users of the various domains on
my
> server have been complain
do you see in your log file, are there any errors being
reported?
Bill
- Original Message -
From: "Scott MacLean" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, July 27, 2003 9:45 PM
Subject: [Declude.JunkMail] Massive flood of uncaught spam
> Starting
have done is sidestepping my Declude setup.
Is anyone else seeing this?
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail ma
he Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
http://www.mail-archive.com.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
pointing
to the wrong place.
> What address were
you sending email to?
On your main webpage it shows [EMAIL PROTECTED] but it is really
linked to [EMAIL PROTECTED] ... and that bounces user
unknown.
Thanks, got that fixed now.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ
cribe Declude.JunkMail". The archives can be
found
at
http://www.mail-archive.com.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
messages fail wordfilter, showing line 294, however
the contents of my wordfilter file's line 294 appears nowhere in the
message. Just in case, I checked lines 293 and 295 as well, with no luck.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[T
l down.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "
st send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Vir
lude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
250.86] RCPT TO:
<[EMAIL PROTECTED]>
20030227 091017 127.0.0.1 SMTPD (01650418) [217.81.250.86] ERR
domain.com invalid user <[EMAIL PROTECTED]
Any ideas what I can do about this? Is there anything I can do?
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
htt
ROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be
found
at
http://www.mail-archive.com.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
ype "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-
Now that we have the Comments tag, I now find spam with tons of these
peppered throughout:
Not really comments, as they are functional, but they're put randomly
throughout the email. Functional, but pointless. Any ideas?
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 91
omfile.txt
ListURL=http://www.anotherfile.com/whatever.txt
This allows using other lists in addition to Tom's.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This
ile.com/whatever.txt
This allows using other lists in addition to Tom's.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
cribe Declude.JunkMail". The archives can be
found
at
http://www.mail-archive.com.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
es can be
found
at
http://www.mail-archive.com.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
archives can be
found
at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
e found
at http://www.mail-archive.com.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, jus
e that the wordfilter, when looking at HTML source
messages, can be made to disregard HTML comments, as above?
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
kely to be spam.
_M
]-Original Message-
]From: [EMAIL PROTECTED]
][mailto:[EMAIL PROTECTED]]On
Behalf Of Scott MacLean
]Sent: Wednesday, September 25, 2002 8:10 AM
]To: [EMAIL PROTECTED]
]Subject: [Declude.JunkMail] Wordfilter in BASE64?
]
]
]I just saw an email that *should* have been caug
I just saw an email that *should* have been caught several times over with
various "BODY CONTAINS" filters, but wasn't - instead, it caught BASE64.
Does Declude decode the BASE64 body and then apply the wordfilter? Because
it seems like it might not.
______
and download your free trial version of HiMailer.
To unsubscribe
from our broadcast, please click here "REMOVE".
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail". The archives can be found
>at http://www.mail-archive.com.
__
m all...
PS: I hope you don't
mind if I download it and post it
on our web site.
http://www.imagefxonline.net/apps/delog
That is as soon as I get a chance. Perhaps Scott
will
do the same.
Of course, go right ahead.
_______
Scott MacLean
[EMAIL PRO
ibe Declude.JunkMail". The archives can be
found
at
http://www.mail-archive.com.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
de.com)]
>
>---
>
>This E-mail came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail". You can E-mail
>[EMAIL PROTECTED] for assistance. You can visit our web
>site at http:/
RCPT-TO: <[EMAIL PROTECTED]>
X-UIDL: 321930475
Status: U
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.
rning, misconfiguration in 10; expecting action
Any clue what I should be looking for?
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came fro
tatus!Click here now for FULL FREE details!
© 2002 All rights reserved.
Unsubscribe
X-RBL-Warning: OSSRC: [1] netpalace, see http://spews.org/ask.cgi?S919 X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?65.172.10.207 X-RBL-Warning: WEIGHT10: Weight of 20 reaches or exceeds th
came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail". You can E-mail
>[EMAIL PROTECTED] for assistance. You can visit our web
>site at http://www.declude.com .
_
lude.com)]
>
>---
>
>This E-mail came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail". You can E-mail
>[EMAIL PROTECTED] for assistance. You can visit our web
>site at http://www.dec
o your server to send
mail even
> if their port 25 is blocked by their ISP.
What was the program, and will it do the same for port 80? ie: web
messaging
-- Timm Jasper
-- Systems Administrator
-- TQCi Internet
-- 301-863-6121
_______
Scott MacLean
[EMAIL PROT
om the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at
http://www.declude.com
.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
D], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at
http://www.declude.com
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
ail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at
http://www.declude.com
.
___
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
eb
site at
http://www.declude.com
.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
our web
site at http://www.declude.com .
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
eb
site at
http://www.declude.com
.
_______
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
63 matches
Mail list logo
