Glenn,
I look up the HELO strings in the LOG*.TXT files. Most of the time you can
match on "IS" for the IP address, instead of CONTAINS, but it does depend on
the string. Some of the ones trying to relay thru us recently is
"http://monoin.com";, another is www.xyz34.uk.co.sg. So, it depends on w
Sorry, I didn't mean to imply that whitelisting my IP had anything to do
with the HELO. And, yes, we do block spoofing at the router. At least one or
two people in the past, however, have seemed to have problems with spam
attacks that were resolved by removing their own IP's from whitelists.
There
up).
Karen
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Karen D. Oland
> Sent: Friday, July 11, 2003 3:24 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Lost One Account - Help Please
>
>
> I just hope you don'
- Original Message -
From: "Karen D. Oland" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 11, 2003 12:28 PM
Subject: RE: [Declude.JunkMail] Lost One Account - Help Please
> I've seen connects that used our IP address as their HELO/EHLO
used by
spammers (usually cable or dial-up).
Karen
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Karen D. Oland
> Sent: Friday, July 11, 2003 3:24 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Lost One Account - Help P
I've seen connects that used our IP address as their HELO/EHLO strings.
Same for using our domain name (none were able to deliver their mail, most
were relay attempts).
Interesting list. I may add it, after reviewing some of the mailfrom
characters (I see more and more "bad" mailfroms, most so the
I just hope you don't include either of the below (since that range includes
are very valid email server and probably a few more).
Use the single address of your own server (since the problem is people
pretending to be YOU, not ME (I hope)).
Karen
> -Original Message-
> From: Glenn Brook
: [Declude.JunkMail] Lost One Account - Help Please
> - Original Message -
> From: "Karen D. Oland" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Friday, July 11, 2003 9:12 AM
> Subject: RE: [Declude.JunkMail] Lost One Account - Help Plea
- Original Message -
From: "Karen D. Oland" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 11, 2003 9:12 AM
Subject: RE: [Declude.JunkMail] Lost One Account - Help Please
> Make sure you DO NOT whitelist your own domain, ip address, the
A couple of questionswhen testing for an IP address, if I want to
filter a block of address what is the correct way to write this:
HELO 20 CONTAINS 216.111.26.
OR CAN
HELO 15 CONTAINS 216.111.26.0/24
You would need to use "HELO 20 CONTAINS 216.111.26." (for the filters,
Declude JunkMail n
Thanks ... good advice
A couple of questionswhen testing for an IP address, if I want to
filter a block of address what is the correct way to write this:
HELO 20 CONTAINS 216.111.26.
OR CAN
HELO 15 CONTAINS 216.111.26.0/24
Also is there a size limit with declude for the .txt files use
We originally used IMAIL's rules. They simply quit working when the text
file gets "too big" -- an arbitrary, undocumented size (and tech support had
no suggestions or work-arounds, just "too bad"). We did try multiple files,
but had to keep adding new files each week. In declude, we break up fi
Make sure you DO NOT whitelist your own domain, ip address, the postmaster
or abuse email addresses. Most of our "ignore" results for spam came when
one or more of these was whitelisted (especially postmaster or abuse -- real
mails never seem to have problems going there, but any spam that cc's th
k) to catch it.
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Glenn Brooks
> Sent: Thursday, July 10, 2003 5:53 PM
> To: [EMAIL PROTECTED]
> Subject: [Declude.JunkMail] Lost One Account - Help Please
>
>
> I hate to continue to
If you use "LOGLEVEL MID", the log file will show which configuration
file is used.
I turned on the mid level and here is one of the entries that failed,
looks like it is coming tthrough my domain, my domain is the only one that
is using the blacklist filter:
Sorry, my mistake. It should hav
Re: [Declude.JunkMail] Lost One Account - Help Please
>
>Write in the atlasfilter.txt
>helo 20 contains ommo.net
>helo 20 contains 212.64.200.32
I will adjust mine to match this and give it a try
Can I use the following for IPs
helo 20 contains 212.64.200.0/24
to cover more IP addr
server using the remote mail server name.
Rifat Levis
- Original Message -
From: "Glenn Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 11, 2003 4:50 AM
Subject: Re: [Declude.JunkMail] Lost One Account - Help Please
>
>Write in
If you use "LOGLEVEL MID", the log file will show which configuration file
is used.
I turned on the mid level and here is one of the entries that failed, looks
like it is coming tthrough my domain, my domain is the only one that is
using the blacklist filter:
07/10/2003 21:01:45 Q1a7d8d1800b
Write in the atlasfilter.txt
helo 20 contains ommo.net
helo 20 contains 212.64.200.32
I will adjust mine to match this and give it a try
Can I use the following for IPs
helo 20 contains 212.64.200.0/24
to cover more IP addresses?
Thanks for the suggestions...
gb
---
[This E-mail was scanned
I will have to watch for thisthe thing I noticed last night and today
was the following in the declude log files, but am not sure they were for
these exact emails, but I have this continually in the declude log files.
07/10/2003 20:11:42 Q0eb9c314012eb215 Msg failed BLACKLISTIP ( This is a
Then in my junkmail file I have the following line of code:
BLACKLISTDOMAIN DELETE
The questions here include:
[1] Is that junkmail file the one being used for E-mail to the domain in
question (IE do you have any per-user or per-domain configurations)?
Yes this file is used for the dom
In the Global.cfg file I have a line of code like thes:
BLACKLISTDOMAIN filter E:\IMail\Declude\domainblacklist.txt x 20 0:
I do not have any other line of code associated with this test in the
globla.cfg file.
That will add a weight of 20 to any E-mail that meets the criteria of the
filter, b
vis
- Original Message -
From: "Glenn Brooks" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, July 11, 2003 3:53 AM
Subject: [Declude.JunkMail] Lost One Account - Help Please
I hate to continue to ask for assistance for the same problem, but I just
can not figur
I hate to continue to ask for assistance for the same problem, but I just
can not figure it out.
I lost a 300.00/month hosting account today due to continued spam getting
through.
Here is what I have: I have multiple domains. Only a couple run with their
own directory within the Declude directo
24 matches
Mail list logo
