I guess I was too brief-
There were e-mails delivered between 5:15 and 5:33 - This "could not lock
message" should've just effected just that one e-mail. It shouldn't have
stopped Declude from being called for 15 minutes. Correct?
After a closer look at the logs, this was what I found - what coul
Running IMAIL 8.05
Declude Virus/JM 1.79 beta
Headers:
Received: from SMTP32-FWD by mail.prudentialrand.com
(SMTP32) id A043C; Wed, 5 May 2004 05:32:02
Received: from gurushy.com [207.226.69.162] by mail.prudentialrand.com
(SMTPD32-8.05) id A121AA0064; Wed, 05 May 2004 05:17:21 -0400
Co
Scott,
The site looks good, I like the look.
Marc
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [E
Thankfully declude is catching almost all of this, but I have my personal
filter set to add a subject and not DELETE. I'm getting 50-60 messages a
day for prescripts online - all from subscriber networks (most often
charter) and it just started about 3 or 4 days ago. I haven't run stats on
the se
Forgive my ignorance but how does this
work with security? What do you, or your users, authenticate on?
-Original
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William Baumbach
Sent: Wednesday, March 31, 2004
9:27 PM
To: [EMAIL PROTECTED]
Subject: Re:
Thanks again Scott.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Wednesday, March 31, 2004 08:58 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Subject filter failure?
>I was just wondering if there is anyway to catch this
I was just wondering if there is anyway to catch this, maybe declude is
decoding something? Should I leave out the "%"? I was just surprised not to
see this fail the filter test.
Also, what are the numbers in brackets after the tests now? [2-15-7800]
I have this in my filter file
SUBJECT 25
e: 07 3004 7900
fax: 07 3846 1220
email: [EMAIL PROTECTED]
http://www.toadshow.com.au
-
- Original Message -----
From: marc catuogno
To: [EMAIL PROTECTED]
Sent: Monday, March 29, 2004 9:32 AM
Subject: [Declude.JunkMail] FW: %RND_SUBJECTS (This w
drian
-
- Original Message -
From: "marc catuogno" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, March 29, 2004 12:47 PM
Subject: RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!)
This could work for me. I have Whitelist Auth on so
ts we can apply strict rules.
Adrian
-
ToadShow Pty Ltd
phone: 07 3004 7900
fax: 07 3846 1220
email: [EMAIL PROTECTED]
http://www.toadshow.com.au
-
- Original Message -----
From: marc catuogno
To: [
I just got this e-mail and I just feel
like someone is targeting my domain for a spam campaign. When I hit view
source, it only said “test”. Any suggestions on how to block this??
I’m surprised that DUL or DYNA didn’t catch this at all, looks like
it came in though a dynamic Comcast IP no
: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail]
Whitelist warning headers?
Where did you put
this? It sounds like it might do the trick.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno
Sent: Tuesday, March 16, 2004 9:10
AM
To: [EMAIL PROTECTED]
Subject
Title: Whitelist warning headers?
Something
like this:
XINHEADER X-Spam-Tests-Failed:
%TESTSFAILED% [%WEIGHT%]
Which puts this header in:
X-Spam-Tests-Failed: Whitelisted [0]
This works for me for anything whitelisted
through Declude.
Marc
-Original Messa
Postmaster"
<[EMAIL PROTECTED]>
Matt
marc catuogno wrote:
>Since upgrading to 8.05 and Declude 1.78i23 my objectionable language
filter
>is causing a postmaster loop. Because the original message was included
>with the "word". I'm not even sure why as the post
Since upgrading to 8.05 and Declude 1.78i23 my objectionable language filter
is causing a postmaster loop. Because the original message was included
with the "word". I'm not even sure why as the postmaster I even got the
notice, it usually just goes to the sender. Has anything been changed?
I've
Is there anything that can test for e-mail size? Often I have people
sending those damn pictures through Kodak and so on and they often get
caught by filters (gibberish, spam domains, and so on) these messages are
often over 75kb, so I was wondering if there was a way that I could add a
small nega
Administration of www.shadowcrew.com online store would like to thank you
for your purchase of Viagra tablets. Couple of words about our products and
services. Viagra is a prescription drug used to treat erection difficulties,
such as erectile dysfunction, which also refers to as an impotence. At t
I went to dnsreports and everything seems to be timing out.
Marc
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just sen
OOPPPSSS!
I'm sorry, I saw the e-mail and thought it was him. I had just got up and
it pissed me off. My apologies, I didn't thoroughly read the e-mail.
My bad- again, sorry.
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lis
Someone should bitch slap this piece of Sh*t! Selling a list to spam on an
anti-spam list. What a moron. Man this kinda stuff pisses me off.
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Monday, February 16, 2004 6:18 AM
To:
It's funny but when I do a search for "dictionary" on their site to see how
to configure black ice to guard against dictionary attacks or how it does I
get no results. Can any user of Black Ice point me in the right direction
here??
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAI
ames, and are quite spread out
in their IP addressing:
WOMC.net
WOMInfo.info
WOMInfo.net
WordOfMouthConnection.com
Word-of-Mouth.org
Andrew.
-Original Message-
From: marc catuogno [mailto:[EMAIL PROTECTED]
Sent: Sunday, February 01, 2004 10:26 AM
To: [EMAIL PROTECTED]
Subject: [Declude.Jun
How are people treating this? It looks almost legit and almost like a way
to harvest e-mail address though too
Received: from peter.wominfo.net [207.36.196.99] by mail.prudentialrand.com
with ESMTP
(SMTPD32-7.15) id A7523D900E2; Sun, 01 Feb 2004 05:39:14 -0500
Received: (from [EMAIL PROTE
Hey
I'm from JOISEY... The GHV MLS is just what the board here calls
itself. : )
Maybe
I can just offer all those AOL people who want to get listing info an e-mail
account, for a nominal fee of course...
-Original Message-From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
Thanks for the discussion. I have my webmaster trying to create an
alternate flyer directly from our website that will not include the URL of
the software that so many agents across the country use. That is the
problem, I have no control over what real-estate agents do with their
mailings from wi
I am the e-mail admin for a real-estate company. They have access to a
program that allows them to send real-estate info as a link through e-mail.
AOL is now filtering that URL:
554 TRANSACTION FAILED: (HVU:B1) The URL contained in your email to AOL
members has generated a high volume of complain
I would suggest ADAWARE or Spybot Search and destroy for the desktops. They
are both free and work well in conjunction. Spybot also has some blocking
features which I suppose could offer some protection if someone sent a link
through an e-mail to a common spyware download. I sent a broadcast to al
Received: from ameritech.net [68.72.160.189] by mail.prudentialrand.com
(SMTPD32-7.15) id A4E6AF20096; Sun, 18 Jan 2004 19:29:26 -0500
Received: from adsl-68-72-160-189.dsl.chcgil.ameritech.net
(adsl-68-72-160-189.dsl.chcgil.ameritech.net [68.72.160.189])
by ameritech.net (8.12.8p1/8.12
Just caught this one looking through the helds. I can only imagine how many
people would click through this and "open" whatever it is they are trying to
give you.
Received: from hvebm [62.194.139.167] by mail.prudentialrand.com
(SMTPD32-7.15) id AEB556A00A2; Mon, 19 Jan 2004 18:56:37 -0500
Fro
You mean “H this company is
using zombies”
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Kami Razvan
Sent: Tuesday, January 20, 2004
7:19 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail]
Interesting concept..
I guess this qualif
If your users could handle going to the web interface and adding people they
would like whitelisted to their address book there, all you would need do
then is add AUTOWHITELIST ON to your one global config file. This way
they could whitelist anyone's e-mail address that they wished. Next m
Recently a big old spammer forged or got access to the Habeas headers. Much
spam got through my system because I had the default setting to whitelist
Habeas. I'd use this with caution until they find this guy and hopefully
sue the crap out of him or hang him by his toenails.
-Original Messag
Here are the headers from a Symantec firewall appliance 200R that I have
e-mailing me logs. Just an FYI
Received: from SMTP32-FWD by mail.prudentialrand.com
(SMTP32) id A0334; Fri, 9 Jan 2004 07:53:09 -0500
Received: from Nexland [66.153.48.35] by mail.prudentialrand.com
(SMTPD32-7.
Isn't that "bounceonlyifyoumust"? I changed my to bounceifyoumust and the
log showed it as "not an action".
BTW, I only bounce from a list of people who insist on sending new
real-estate information to all of our offices after we have repeatedly asked
them to stop. Those and a newsletter from Hi
64.119.209.70
64.119.210.70
64.119.222.157
64.119.194.100
64.119.210.70
64.119.217.134
64.119.222.156
64.119.222.157
Out of about 40 held messages this morning these IP's were in about 10
of them. I'm going to add the following to a weighted (10) IP file s
X-Declude-Sender: [EMAIL PROTECTED] [64.4.10.85]
X-Declude-Spoolname: D48f900ac00427c71.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
for spam.
X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, NOLEGITCONTENT,
SPAMDOMAINS, FILTER, WEIGHT10, WEIGHT20, WEIGHT15 [21]
And I've told all my users not to follow links in e-mails that ask for
information like, SS# creditcard# etc. Also when you go to the site it only
has one cheesy looking graphic that says "capitol one" and no phone number
on the site that asks you to put in your credit info.
I agree, bad e-mail p
Actually I went to capitalone.com and when I hit login it took me to the
same site. Could it be official?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff
(Lists)
Sent: Friday, November 21, 2003 01:54 PM
To: [EMAIL PROTECTED]
Subject: [Declude
Wow, that one almost looks official and it is even https:\\
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of John Tolmachoff
(Lists)
Sent: Friday, November 21, 2003 01:54 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Capital One
Here is a "nice" decep
Wouldn't Whitelist Auth stop JMPro from testing outgoing mail?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matt Robertson
Sent: Thursday, November 20, 2003 10:36 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] @LINKED & IPLINKED v1.0.2 - Great
I'm tempted to block this as I'm not sure I like this kinda info in other
people's hands.
I'm updating my address book. Would you please take a moment to review your
contact information? Your updates help to keep me current, as well as other
people like me who already have your email address.
To
Title: Re: [Declude.JunkMail] Strange Anomaly
ï
I'm
just wondering can you have a normal anomaly???
Sorry-
I couldn't help it
-Original Message-From: Keith Johnson
[mailto:[EMAIL PROTECTED]On Behalf Of Keith
JohnsonSent: Monday, November 17, 2003 11:03 PMTo:
[EMAIL PRO
sday, November 12, 2003 2:18 AM
To: Marc Catuogno
Subject: Re[2]: [Declude.JunkMail] Originating IP -I'm confused, please
don't flame me...
> I just assumed that when mail came from my server...
"From your server" = "originating IP is your server's IP." This
PROTECTED] On Behalf Of Sanford
Whiteman
Sent: Wednesday, November 12, 2003 1:12 AM
To: Marc Catuogno
Subject: Re: [Declude.JunkMail] Originating IP -I'm confused, please
don't flame me...
> Why wouldn't they be getting the IP of my server once they
> authenticate?
Do
In an effort to catch spammers forging my domain, I've added my own
domain to a spamdomain test. Now all e-mails sent through outlook are
failing the test because the server is seeing them as coming from
whatever IP the user is connected to. Since they are mostly OPTONLINE
customers they are also f
I am running IMAIL 7.15 and Declude 1.75. I knew I had a big no-no in
my Global file; whitelist from prudentialrand.com. A spammer has now
been exploiting it. How can I get my users whitelisted so they can
communicate with each other without worrying about being filtered
without letting the spam
I hate to say this but what about using a bounce message? As the postmaster
you will get all the undeliverable from the spammers using any banned words
and legitimate mailers can contact you if they get an erroneous bounce
because and encoded attachment had a random convergence that resulted in a
in the global config file:
NOLEGITCONTENT nolegitcontent x x 0 -4
If you're asking me what it does I can only paraphrase Scott. It looks for
things that are uncommon in spam but common in legitimate e-mails so that it
can give it some negative weight.
Marc
-Original Mes
What is up with this? I just sent a test message to myself from AOL and I
got the same thing SPAMCOP BLOCKED, as if I didn't have enough trouble
getting AOL e-mail through, between the noabuse, no postmaster and
occasional BASE64 encoding. IS there a test that can give aol address a
nice negative
Received: from imo-d05.mx.aol.com [205.188.157.37] by
mail.prudentialrand.com with ESMTP
(SMTPD32-7.15) id A3811E61010A; Mon, 06 Oct 2003 14:25:05 -0400
Received: from [EMAIL PROTECTED]
by imo-d05.mx.aol.com (mail_out_v36_r1.1.) id e.48.230ffa47 (30960)
for <[EMAIL PROTECTED]>;
I guess I might add more weight to SAL, maybe reduce the negative weight of
IPNOTINMX to start.
I have some of the following in a filter file to add little weight, I don't
know if it is a great idea but it usually helps.
HEADERS 0 CONTAIN Bargains.net
HEADERS 0 CONTAIN Bargain.net
HEADERS 0 CONTA
I was happy to take it. Maybe this will let us know what configuration
actually works with 8.03 since Ipswitch won't put out a hardware
recommendation. I personally applaud your efforts. Thank you -
Sincerely,
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] B
Just my 2 cents:
Sometimes my word filters in declude junk mail would accidentally
trigger a junk mail test and add weight to an innocent attachment,
depending on how it was encoded.
Also, while I know that PDF's are generally small, is it possible that
the attachment exceeds the size allowed on
Nevermind... I see that what I assume was its message ID:
X-Streamsendid: 3+1+135073+10+lists.streamsend.com
Is not unique and doesn't follow the RFC recommendation.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno
Sent: Wedn
After looking up the code, and then looking at the RFC
http://www.faqs.org/rfcs/rfc2822.html (which I hope is the right place)
I can't figure out what is bogus about the following header. What is
wrong with it? Was it inserted by IMAIL after the fact? If it was how
could I tell? I'd like to work w
I know that AOL sucks... but unfortunately we get many e-mails from
them. It seems any attachment from AOL is base64 combine that with the
fact that they have no postmaster and no abuse so they are already at a
15 and my hold weight is 20. I just had an attachment trigger one of my
body filters (
I usually only see this when it is caught in my spam folder. Does this
type of warning ever appear in legit mail?
This is a multi-part message in MIME format.
If you are reading this text, you may want to consider changing to a
mail reader or gateway that understands
how to properly handle MIME
I'm not familiar with this test?
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble
Sent: Wednesday, September 10, 2003 10:27 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Strange Subject
Add the following tests and it get's even b
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Marc Catuogno
> Sent: Monday, September 01, 2003 1:38 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] A way to stop the Undeliverables from
sobig?
>
> I have a f
I have a few complaints from users about all the returned messages. Is
there any way to stop particular accounts from receiving all the
rejected messages (undeliverable, user not found, user mailbox full,
etc) that the sobig virus is generating?
---
[This E-mail scanned for viruses by Declude Viru
I have this line in my blacklist file
revealsystems.net spammed many
Yet an e-mail with the following headers keeps getting through:
X-RBL-Warning: WEIGHT25: Weight of 27 reaches or exceeds the limit of
25.
X-Declude-Sender: [EMAIL PROTECTED] [207.174.23.4]
X-Declude-Spoolname: D8d6f041e00b07343
It's a shame because I was catching a great deal more spam, but I may have
to back off on the weight of this test. This looks like a log file that one
guy has e-mailed from a D-link router. Why don't companies have this stuff
compliant. sigh
Received: from DI-604 [65.41.30.4] by mail.p
Scott-After reading your e-mail recommending that you can hold on bad
headers I tripled the weight. Although I really don't care much that this
was held right now if virus did really come through my server I would like
to get this. Any idea why a Webshield Alert would fail BADHEADERS? (if that
is
Scott,
Maybe you should e-mail them. This was the version # in the headers:
X-Mailer: Network Associates, Inc. Webshield SMTP, Version 4.5
And when I went to
http://www.networkassociates.com/us/downloads/evals/#McAfee
This looked like the latest version V4.5; McAfee WebShield SMTP MR1A v4.5
Is
Please forgive my ignorance here ~
I have noticed that when I send e-mail from outlook 2000 that the nat'ed IP
of my T1 provider shows up and it does not have a reverse DNS.
Date: Mon, 30 Jun 2003 16:55:52 -0400
Message-ID:
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-
Crud...
But the WHITELIST only does a complete match, right? so if I had "slug" as
the whitelist word, the word sluggish in the headers or body wouldn't count.
Right?
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Friday, June 27
Does Whitelist BODY "the secret code is 1234" work or does it have to be
anywhere?
TIA - Marc
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.
I know it has been said before but, "Scott you da man!"
Thank you, that works exactly as I need it to.
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Tuesday, May 27, 2003 06:52 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkM
I would like to use Junkmail to add something to the subject of any e-mail
sent to one e-mail address on my domain. Unfortunately I have my own domain
whitelisted so unless I remove that entry there doesn't seem to be a way to
have declude add a something to the subject, the whitelist seems to tak
It appears there WAS a damn space after the whitelist entry.
Duh -
Thanks Scott.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Monday, March 03, 2003 01:54 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] mail held despite wh
his in the entry in my GLOBAL.CFG file:
WHITELIST FROM @info.weightwatchers.com
This is a snippet from the e-mail that was held. I have a hold weight of
20.
X-Declude-Sender: [EMAIL PROTECTED] [216.73.90.161]
X-Declude-Spoolname: D51ea12ef00562fee.SMD
X-Note: This E-mail was scanned by Declude
Scott,
I don’t know if it is feasible (or maybe it is already
in place) to have separate junk mail files in the Imail\Declude directory like
$low$.junkmail, $mid$.junkmail, $high$.junkmail so that separate filtering
levels could be set for different individuals more easily. A blank text
Scott,
Thanks for the level of support you provide.
I'm part of the way there, it fails the test - but I don't think it is
getting the weight it should. It got the weight of 4 for failing the
filter test and the weight of 3 from the first line in the filter file
but not the weights from the res
Title: Message
Am I doing something wrong
here?
I sent an e-mail from my AOL
account to test the filters suggested by Kami, it contained the following in
the body:
To unsubscribe, click here
unsubscribe me
opt-in
UNSUBSCRIBE in the subject
line
This is what is in my
]
[mailto:[EMAIL PROTECTED] On
Behalf Of Marc Catuogno
Sent: Sunday, February 23, 2003
11:26 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Can
someone help me get this blocked?
These of e-mails have been flooding
my hold folder. I’m running Declude pro. I have a delete
weight of 40 and a
These of e-mails have been flooding my hold folder. I’m
running Declude pro. I have a delete weight of 40 and a hold weight of
30. All this spam has been right between. Is there something I can
add to either bump up this weight by about 7 or is there something unique in
here that I can
Thanks Scott,
In my zeal to get my global file updated I copied that line from the
latest global file. It appears that further down the file the same test
was defined. I missed it because it was grouped with most of the tests
that are commented out with a #.
Thanks again - Marc
-Original Me
This is what I’m getting in my Declude log:
02/07/2003 02:00:05
Warning: misconfiguration in following line in global.cfg file (ip4r is not an
ACTION)
02/07/2003 02:00:05 DSBL ip4r list.dsbl.org * 6 0
This
Thanks. I'll back track through the list to make sure I am getting able
to set up the features that I'm looking for.
Peace - Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, February 04, 2003 11:59 AM
To: [EMAIL PROTECT
Scott,
I’m feeling a bit ignorant so I’m hoping that
you can help. I usually try to keep up on the list and usually upgrade
declude.exe within 24 hours of its release. I see discussion of some of
the new features, the autowhitelist on, the comments test etc. I’ve
had declude pro junk
Let me first say that I'm a big fan of the Declude products and how they
have significantly reduced the amount of spam my end users receive. Let
me also qualify my next statement by saying that I'm not as
knowledgeable as I'd like to be about all the nuances of e-mail, DNS
etc. Sometimes I'm ske
I also only have TS access. But I had the host company put the I386
directory on separate partition so I can add and remove components.
Your host company should be able to do that, thereby allowing you to
remove and re-install windows components when needed. Good luck~
Marc
-Original Messa
The Domain rand1.com was functioning and able to send and receive mail.
I had one test user set up so deleting it and recreating it was no big
deal. Once I set it up as mail.rand.com and put the host alias
rand1.com the error disappeared. I'm glad it is working but it is
always nice to know why.
Message-
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Marc Catuogno
Sent: Sunday, December 29, 2002
2:25 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Error
in declude log
12/28/2002 00:58:39
Q3d8f050e00781ce7 Couldn't open software\Ipswitch\IMail\Domains\rand1
12/28/2002 00:58:39
Q3d8f050e00781ce7 Couldn't open software\Ipswitch\IMail\Domains\rand1 [2-2]
I just recently added the domain rand1 to my IMAIL. I just
noticed this entry showing up repeatedly in my delcude log, even though the
domain has no users
I think the dns for RAND1 could
Our domain got
hit over several days with different e-mails from addresses like
[EMAIL PROTECTED], or some
variant like [EMAIL PROTECTED] these addresses
are from the Xdeclude sender field in the headers. Is there a way (or will there be) a way
to add an address like this to a black list
I just think this is
funny - I increased helobogus, mailfrom and revdns to a weight of 7 and I have a
message subject marked as [SPAM] when it hits a weight of
20...
guess I should lower
two of them Any suggestions? Maybe I'll lower REVDNS by
2.
-RBL-Warning: HELOBOGUS: Domain decl
I've been using the
delete action on a blacklist test for Junkmail. I also have a few ip
ranges blocked. I was thinking that if anyone with any brains figured out
that they were blocked that maybe they would e-mail postmaster or abuse.
Should I have a separate junkmail file for one or bot
I just thought this might be of interest to the group:
Dear Optimum Online Subscriber,
In just a few days you'll notice something very different about your
Optimum Online Inbox - where's the spam?
That's right. The annoying clutter of unsolicited e-mail will just about
vanish from your inbox, t
I have a user that
was getting spamed to death. Thanks to Declude and some help from this
list, I have been monitoring her e-mails and blocking a few more X-declude
sender" and a few IP's everyday. Her account went from getting 80-125
spams a day to about 3-6 spams a day. I had also been u
Why was I filtered? I was trying to post a message that was "copied and
pasted" from an e-mail that I received from a friend who is on optimum
online. It didn't contain any adult words...
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf O
c:\imail\blockedmail.txt
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
a
Changed it to ipfile - lets see if that does it. I knew I was missing
something
Thanks - Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff
Sent: Tuesday, November 19, 2002 9:11 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail]
What am I doing wrong here?
This is the E-mail header:
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: OSSOFT: http://spamhaus.org/SBL/sbl.lasso?query=SBL5031
X-RBL-Warning: SPAMCOP: Blocked - see
http://spamcop.net/bl.shtml?64.49.243.105
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consist
flailing a deceased equine...
Crap. Running through the Imail log analyzer I found some of the host names
I was looking for preceded by "mail1" or some other name. I added these to
the kill list in the hopes that this is actually the "MAIL FROM in the SMTP
envelope" that is being reported. I als
Patrick,
Thanks. I found where that was #XSENDER OFF, took out the pound sign and
changed it to ON. Now if I can get the people who get spam to copy and
forward me the header info...
Marc
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Patrick Childers
Scott,
After reprinting the Junkmail manual I see why am only having partial
success. I have been using the "from" domains in the format
@emailoffers.com (occasionally using the format deals-central.com - to catch
10.dealscentral as well as 20.dealscentral). So I suppose since the "from"
and or "
I have one user who is getting absolutely hammered by spam. Last night I
went through her mailbox and added many of the domains that she was getting
spam from to my blacklist.txt file. The action have configured for that
test is delete. It currently works as I can scan through the log and find
e
Below is a second mailing that I received from these people, I posted the
first one to the IMAIL forum. They claim someone is "Joe-jobing" them, but
I do notice that on their explanation page they are still advertising their
services. That makes me suspicious.I've included the header and the
Is there anyway that a techno-phobic person can easily forward me the
headers from the spam they get so I can more easily adjust my blacklist? Or
is there a way in outlook 2000 for me to look more deeply into the e-mail
forwards to see the source?
Thanks - Marc
---
[This E-mail scanned for viru
101 - 200 of 200 matches
Mail list logo
