RE: [Declude.JunkMail] Interesting Spam

ilto:[EMAIL PROTECTED] On Behalf Of Darin Cox > Sent: Thursday, September 06, 2007 6:58 PM > To: declude.junkmail@declude.com > Subject: Re: [Declude.JunkMail] Interesting Spam > > I use a command line tool from www.whoisview.com that works well for both > domains and IP blocks. > &g

RE: [Declude.JunkMail] Interesting Spam

t; Sent: Thursday, September 06, 2007 6:41 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Interesting Spam > > Well, the easy part is answering your question about the domains. > > Each of the payload domains was registered today, so whatever service > you

Re: [Declude.JunkMail] Interesting Spam

Darin. - Original Message - From: "Colbeck, Andrew" <[EMAIL PROTECTED]> To: Sent: Thursday, September 06, 2007 7:40 PM Subject: RE: [Declude.JunkMail] Interesting Spam Well, the easy part is answering your question about the domains. Each of the payload domains was

RE: [Declude.JunkMail] Interesting Spam

http://whois.domaintools.com/sdsdm.com Andrew. > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Dave Beckstrom > Sent: Thursday, September 06, 2007 3:07 PM > To: declude.junkmail@declude.com > Subject: [Declude.JunkMail] Interesting Sp

[Declude.JunkMail] Interesting Spam

We're getting a rash of spam that doesn't score high enough to be blocked. In the past I've looked up the domain owner of the site listed in the spam and been able to identify sometimes dozens of domains owned by the spammer, then I've put that list into a filter and blocked the domains before they

RE: [Declude.JunkMail] Interesting ORF stats

ki - Handy Networks LLC > Sent: Friday, December 15, 2006 9:48 AM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Interesting ORF stats > > Ditto! 95%+ with Alligate. > > -Jay > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[

RE: [Declude.JunkMail] Interesting ORF stats

Ditto! 95%+ with Alligate. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer Sent: Friday, December 15, 2006 9:42 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Interesting ORF stats Hi John, John T (Lists) wrote

Re: [Declude.JunkMail] Interesting ORF stats

Hi John, John T (Lists) wrote: I have 3 gateway servers running IIS with ORF. These are my MX records for all my domains. ORF has identified and blocked 71% of incoming email on my primary gateway. ORF has identified and blocked 81% of incoming email on my secondary gateway. I see the secondari

Re: [Declude.JunkMail] Interesting ORF stats

>>Goes to prove spammers are still trying the lowest priority MX record to >>get >>around spam filters. That is very true. I think the mindset is that folks don't have access to features like IPBYPASS and trust mail coming from their backup mail server by default. Darrell

[Declude.JunkMail] Interesting ORF stats

I have 3 gateway servers running IIS with ORF. These are my MX records for all my domains. ORF has identified and blocked 71% of incoming email on my primary gateway. ORF has identified and blocked 81% of incoming email on my secondary gateway. (Interesting in that my primary and secondary carry t

Re: [Declude.JunkMail] Interesting SMTP connection patterns

-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dave Beckstrom Sent: Thursday, October 12, 2006 7:38 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Interesting SMTP connection patterns Blackice runs perfect on Windows 2003 server.

RE: [Declude.JunkMail] Interesting SMTP connection patterns

> Sudowski - Handy Networks LLC > Sent: Thursday, October 12, 2006 8:46 PM > To: declude.junkmail@declude.com > Subject: RE: [Declude.JunkMail] Interesting SMTP connection patterns > > Well, it didn't run for us. We tried and it caused random BSOD and ISS > wo

RE: [Declude.JunkMail] Interesting SMTP connection patterns

om Subject: RE: [Declude.JunkMail] Interesting SMTP connection patterns Blackice runs perfect on Windows 2003 server. I posted the install instructions on this list a couple of weeks ago. Craig -- I believe some email servers will open a secondary connection as part of their spam checking. In that

RE: [Declude.JunkMail] Interesting SMTP connection patterns

m > Subject: Re: [Declude.JunkMail] Interesting SMTP connection patterns > > Dave, > > That is really not that uncommon. I see this with very aggressive spammers > who are trying to get the most spam through in the least amount of time and > have no disregard for crashing the server they

RE: [Declude.JunkMail] Interesting SMTP connection patterns

e.com > Subject: RE: [Declude.JunkMail] Interesting SMTP connection patterns > > Of course, BlackIce does not support Windows 2003. > > -Jay > > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Craig Edmonds >

RE: [Declude.JunkMail] Interesting SMTP connection patterns

Of course, BlackIce does not support Windows 2003. -Jay -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Craig Edmonds Sent: Thursday, October 12, 2006 3:51 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Interesting SMTP connection

RE: [Declude.JunkMail] Interesting SMTP connection patterns

ECTED] On Behalf Of Dave Beckstrom Sent: Thursday, October 12, 2006 11:24 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Interesting SMTP connection patterns Yesterday I took a snapshot of the SMTP connections active on our server. I then did a reverse IP to find out where they were

Re: [Declude.JunkMail] Interesting SMTP connection patterns

Dave, That is really not that uncommon. I see this with very aggressive spammers who are trying to get the most spam through in the least amount of time and have no disregard for crashing the server they are sending spam to... Darrell --- Check out ht

[Declude.JunkMail] Interesting SMTP connection patterns

Yesterday I took a snapshot of the SMTP connections active on our server. I then did a reverse IP to find out where they were from. Below are the results. You can see someone from Thailand had 5 SMTP connections active and Spain had 4. You can also see that only 3 of the IPS connected were for

[Declude.JunkMail] interesting ...

Interesting: http://www.declude.com/sppurchase.asp?cat=29 Service Providers are not allowed to take advantage of the Commtouch functionality due to strict license restrictions. The good news? Declude will offer you a FREE subscription to Message Sniffer. Message Sniffer ties into Declude

Re: [Declude.JunkMail] Interesting thought on some tests when a front end gateway is involved.

I think SPF worked correctly in your scenario, since SPF is based upon the envelope sender address and the delivering MTA (forwarding or originating). The problem here is that the wrong receiving MTA is doing the SPF check. |(A) Send MTA|>|(B) Rec MTA|>|(C) Rec MTA| SPF should be checked

[Declude.JunkMail] Interesting thought on some tests when a front end gateway is involved.

I sent an e-mail to a software vendor requesting answers to some questions. That message was rejected based on a SPF Fail. Yes, I have SPF records setup for my domains. So how did it fail, bad configuration on the recipient side. By reviewing the heads and the rejection notice, I found that my serv

Re: [Declude.JunkMail] Interesting spam footer

Just kids with more imagination than knowledge Sunday, September 18, 2005, 6:38:03 PM, Darin Cox <[EMAIL PROTECTED]> wrote: DC> DC> DC> Thought this was interesting... a spammer trying to use fear of DC> prosecution to stop people from reporting their email as spam. DC> DC>   DC> DC> T

Re: [Declude.JunkMail] Interesting spam footer

Original Message - From: Darin Cox To: Declude.JunkMail@declude.com Sent: Sunday, September 18, 2005 9:35 PM Subject: Re: [Declude.JunkMail] Interesting spam footer The site being advertised was www.ebay-laptop.com.  Silly really.  They're just asking for tro

Re: [Declude.JunkMail] Interesting spam footer

unday, September 18, 2005 8:54 PM Subject: Re: [Declude.JunkMail] Interesting spam footer OK, so I guess the point is the recipient has to prove that the message is spam? Sounds like "blame the victim"... And maybe the recipient has to buy what's being offered to avoid running af

Re: [Declude.JunkMail] Interesting spam footer

- Original Message - From: Darin Cox To: IMail_Forum@list.ipswitch.com ; Declude.JunkMail@declude.com Sent: Sunday, September 18, 2005 7:38 PM Subject: [Declude.JunkMail] Interesting spam footer Thought this was interesting... a spammer trying to use

RE: [Declude.JunkMail] Interesting spam footer

: IMail_Forum@list.ipswitch.com; Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Interesting spam footer Thought this was interesting... a spammer trying to use fear of prosecution to stop people from reporting their email as spam.   The spam was sent to a postmaster address never used for

[Declude.JunkMail] Interesting spam footer

Thought this was interesting... a spammer trying to use fear of prosecution to stop people from reporting their email as spam.   The spam was sent to a postmaster address never used for outgoing mail...   Darin.   =IMPORTANT INFORMATION CONCERNING THIS

RE: [Declude.JunkMail] Interesting Header from a bulk mailer

bject: [Declude.JunkMail] Interesting Header from a bulk mailer Saw this header today and thought it was mighty interesting.   X-Mailer: Spamsoft Spammer Bulk Mailer That's pretty brazen to advertise that you're a spammer in the headers... Darin.    

[Declude.JunkMail] Interesting Header from a bulk mailer

Saw this header today and thought it was mighty interesting.   X-Mailer: Spamsoft Spammer Bulk Mailer That's pretty brazen to advertise that you're a spammer in the headers... Darin.    

Re: [Declude.JunkMail] interesting

> See attached txt-file with the content of the original spam message. Can't front on that ASCII art! Wow, I might just have to let these go for old time's sake -- except that, of course, they're machine-generated. --Sandy Sanford Whiteman, Chief Technolo

[Declude.JunkMail] interesting

See attached txt-file with the content of the original spam message. At least there is even the contact link... Markus http://783ytbne.com/nw/?a=ddpTJhNKedKG&q=8zMTAxLWFhYW00MzI1NDc

Re: [Declude.JunkMail] Interesting tactic..

2005 4:09 PM Subject: Re: [Declude.JunkMail] Interesting tactic.. This sounds like an urban legend to me. Keep in mind that there was some news release a few weeks ago that indicated AOL was seeing dramatically less spam traffic. I think it is likely that AOL has succeeded in blocki

Re: [Declude.JunkMail] Interesting tactic..

934-3414 x20 (Business) Fax:    +1 201 934-9206 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Tuesday, January 11, 2005 07:00 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Interesting tactic..

RE: [Declude.JunkMail] Interesting tactic..

On Behalf Of MattSent: Tuesday, January 11, 2005 07:00 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Interesting tactic..Andy,Yes, there are many different laws that spammers break, most of which are not covered under CAN-SPAM.  CAN-SPAM does though preempt many state

Re[2]: [Declude.JunkMail] Interesting tactic..

> As far as I am concerned, if the From Address domain is not coming > from the MX for that domain, I don't want the mail. Really? So you HOLD a message on IPNOTINMX? I doubt it. MXs are _inbound_ mail exchangers. It's absurd to require that outbound mail come from MXs. Any mail

Re: [Declude.JunkMail] Interesting tactic..

Avenue, Suite 203 Upper Saddle River, NJ 07458-1846 Phone:  +1 201 934-3414 x20 (Business) Fax:    +1 201 934-9206 http://www.HM-Software.com/ -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Tuesday, January 11, 2005

RE: [Declude.JunkMail] Interesting tactic..

x20 (Business)Fax:    +1 201 934-9206http://www.HM-Software.com/ -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Tuesday, January 11, 2005 04:42 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Interesting tactic

Re: [Declude.JunkMail] Interesting tactic..

4:10 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Interesting tactic.. This sounds like an urban legend to me.  Keep in mind that there was some news release a few weeks ago that indicated AOL was seeing dramatically less spam traffic.  I think it is likely that AOL

Re: [Declude.JunkMail] Interesting tactic..

ect: Re: [Declude.JunkMail] Interesting tactic.. Yes, but Dennis Fisher is a senior editor at eWeek. Don't they have someone give these article the once over before printing them? - Original Message - From: "Matt" <[EMAIL PROTECTED]> To: Sent: Tuesday, January

Re: [Declude.JunkMail] Interesting tactic..

s for that spam run. Long term the spammer still can win that battle, but this is a great way to irritate someone on the other end for once. - Original Message - From: "Dan Geiser" <[EMAIL PROTECTED]> To: Sent: Tuesday, January 11, 2005 3:59 PM Subject: Re: [Declude.JunkM

Re: [Declude.JunkMail] Interesting tactic..

One area I have seen this used are the 'spamvertized domains' in the body of the message which would require a SURBL style test on the URL in the message body. Message headers, delivery, and MAILFROM are otherwise as valid as any other spam; sometimes quite authentic. - Original Message -

Re: [Declude.JunkMail] Interesting tactic..

Yes, but Dennis Fisher is a senior editor at eWeek. Don't they have someone give these article the once over before printing them? - Original Message - From: "Matt" <[EMAIL PROTECTED]> To: Sent: Tuesday, January 11, 2005 4:09 PM Subject: Re: [Declude.JunkMai

RE: [Declude.JunkMail] Interesting tactic..

ECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MattSent: Tuesday, January 11, 2005 04:10 PMTo: Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Interesting tactic..This sounds like an urban legend to me.  Keep in mind that there was some news release a few weeks ago that ind

Re: [Declude.JunkMail] Interesting tactic..

omain used in a spam mailing? And from a technical standpoint why would a distributed DNS system be overloaded by trying to lookup bogus domain names? - Original Message - From: "Kami Razvan" <[EMAIL PROTECTED]> To: Sent: Tuesday, January 11, 2005 2:50 PM Subject: [

Re: [Declude.JunkMail] Interesting tactic..

t why would a distributed DNS system be overloaded by trying to lookup bogus domain names? - Original Message - From: "Kami Razvan" <[EMAIL PROTECTED]> To: Sent: Tuesday, January 11, 2005 2:50 PM Subject: [Declude.JunkMail] Interesting tactic.. > <http://www.eweek.com

Re: [Declude.JunkMail] Interesting tactic..

> As far as the technique is concerned, it really seems silly -- I can't > see what benefit a spammer would have from doing this. I have never heard of this before but one would suppose the logic is the domains will not be listed anywhere - yet. So the mail gets delivered and then the domains go

Re: [Declude.JunkMail] Interesting tactic..

>"One troublesome technique finding favor with >spammers involves sending mass mailings in the >middle of the night from a domain that has not >yet been registered. After the mailings go out, >the spammer registers the domain early the >next morning." > >H Want to tick off some spammers? R

Re: [Declude.JunkMail] Interesting tactic..

On 11 Jan 2005 at 15:15, R. Scott Perry wrote: > As far as the technique is concerned, it really seems silly -- I can't > see what benefit a spammer would have from doing this. I have never heard of this before but one would suppose the logic is the domains will not be listed anywhere - yet. So t

Re: [Declude.JunkMail] Interesting tactic..

http://www.eweek.com/article2/0,1759,1749328,00.asp\ "One troublesome technique finding favor with spammers involves sending mass mailings in the middle of the night from a domain that has not yet been registered. After the mailings go out, t

[Declude.JunkMail] Interesting tactic..

http://www.eweek.com/article2/0,1759,1749328,00.asp\   "One troublesome technique finding favor with spammers involves sending mass mailings in the middle of the night from a domain that has not yet been registered. After the mailings go out, the spammer registers the domain early the next m

Re: [Declude.JunkMail] Interesting Spamming Technique

eiser [EMAIL PROTECTED] - Original Message - From: "Goran Jovanovic" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, November 18, 2004 1:49 PM Subject: RE: [Declude.JunkMail] Interesting Spamming Technique Hi Dan, What we do for out store and forward cust

Re: [Declude.JunkMail] Interesting Spamming Technique

Thursday, November 18, 2004 10:31 AM Subject: [Declude.JunkMail] Interesting Spamming Technique Hello, All, In addition to doing spam filtering for some of our IMail hosting customers we also do Store and Forward filtering for a few domains. In the past day or so I've had complaints

RE: [Declude.JunkMail] Interesting Spamming Technique

CTED] > Subject: [Declude.JunkMail] Interesting Spamming Technique > > Hello, All, > In addition to doing spam filtering for some of our IMail hosting > customers > we also do Store and Forward filtering for a few domains. In the past day > or so I've had complaints from Store

Re: [Declude.JunkMail] Interesting Spamming Technique

2004 7:32 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Interesting Spamming Technique Hello, All, In addition to doing spam filtering for some of our IMail hosting customers we also do Store and Forward filtering for a few domains. In the past day or so I've had complaints from Store a

Re: [Declude.JunkMail] Interesting Spamming Technique

I've seen about 4 different spammers, 3 zombie spammers/gangs and one static porn spammer, cache old MX records for indefinite periods of time. It appears that they load their machines with a table containing the IP of the domain in question, and they don't often refresh such records, and mayb

RE: [Declude.JunkMail] Interesting Spamming Technique

. Michael Jaworski [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Thursday, November 18, 2004 7:32 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Interesting Spamming Technique Hello, All, In addition to doing spam

[Declude.JunkMail] Interesting Spamming Technique

Hello, All, In addition to doing spam filtering for some of our IMail hosting customers we also do Store and Forward filtering for a few domains. In the past day or so I've had complaints from Store and Forward customers about an increase in spam. When I check the headers of the e-mail they are s

[Declude.JunkMail] Interesting Spam Article

Interesting Spam Article http://www.eweek.com/article2/0,1759,1608663,00.asp?kc=ewnws060904dtx1k0 700599 Samantha Bridges Communications Technician Macomb Intermediate School District 44001 Garfield Road Clinton Township MI 48038-1100 (586) 228-3300 [EMAIL PROTECTED] http://www.misd.net CONF

[Declude.JunkMail] Interesting spam..

Hi; Look at the following spam..   Kami == Hello, Thank you for registration on our board - http://www.carderportal.c=om   Your Login $ Password:Login: User129Password: IkS9s1c   In our site you will find:Spam Hosting - from 20$ per mounth.Fraud Hosting -

Re: [Declude.JunkMail] Interesting concept..

Marc, Would you share your filter? Save me some efforts! Thanks -Nick From: "Marc Hilliker" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: Re: [Declude.JunkMail] Interesting concept.. Date sent:

Re: [Declude.JunkMail] Interesting concept..

Sent: Tuesday, January 20, 2004 7:19 AM Subject: [Declude.JunkMail] Interesting concept.. I guess this qualifies as things that make you go h... http://www.mailserveruser.com/email_deployment.html Regards, Kami --- [This E-mail was scanned for viruses by Declude Virus (http://www.dec

Re: [Declude.JunkMail] Interesting concept..

email and it catches a good number daily. For more info see: http://www.spamhaus.org/SBL/sbl.lasso?query=SBL12495 - Marc - Original Message - From: Kami Razvan To: [EMAIL PROTECTED] Sent: Tuesday, January 20, 2004 7:19 AM Subject: [Declude.JunkMail] Interesting concept.. I guess

Re: [Declude.JunkMail] Interesting concept..

Throw the following in an ipfile filter and it should take care of the problem :) 63.254.68.0/22        Virtumundo/vmlocal.com/adknow-net.com (Spam House) [63.254.68.0 - 63.254.71.255]    01/17/2003 65.164.176.192/26    Virtumundo/vmlocal.com/adknow-net.com (Spam House) [65.164.176.192 - 65.16

[S85] RE: [Declude.JunkMail] Interesting concept..

  I've collected some information about this "concept": On http://www.virtualmda.com/services.htm is a "how it works" for their client called "VirtualMDA" This about the revenues for VirtualMDA users:"2.Payment. Upon completing the registration procedure, you will be given a uniqu

RE: [Declude.JunkMail] Interesting concept..

t: Tuesday, January 20, 2004 2:48 PMTo: [EMAIL PROTECTED]Subject: RE: [Declude.JunkMail] Interesting concept.. You mean “H this company is using zombies”   -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami RazvanSent: Tuesda

Re: [Declude.JunkMail] Interesting concept..

--- Original Message - From: Kami Razvan To: [EMAIL PROTECTED] Sent: Tuesday, January 20, 2004 7:19 AM Subject: [Declude.JunkMail] Interesting concept.. I guess this qualifies as things that make you go h... http://www.mailserveruser.com/email_deployment.html Regards, Kami --- [This E-

Re: [Declude.JunkMail] Interesting concept..

Levitsky, MCSE, CISSPSystem EngineerTime Inc. Information Technology[5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1] - Original Message - From: Kami Razvan To: [EMAIL PROTECTED] Sent: Tuesday, January 20, 2004 7:19 AM Subject: [Declude.JunkMail] Interesting

RE: [Declude.JunkMail] Interesting concept..

You mean “H this company is using zombies”   -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan Sent: Tuesday, January 20, 2004 7:19 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Interesting concept..   I guess this

[Declude.JunkMail] Interesting concept..

I guess this qualifies as things that make you go h...   http://www.mailserveruser.com/email_deployment.html     Regards, Kami

[Declude.JunkMail] Interesting.. Now PGP is used

Title: Interesting.. Now PGP is used Hi; Interesting spam… Now they are using PGP code … Just in case you are adding negative weight for PGP - something to keep in mind. Regards, Kami -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, your request for notification for the

RE: [Declude.JunkMail] Interesting.. indeed... long long long spam

"I've gotten two or three like this in the last couple days, but mine are getting tagged on with weight 21 or thereabouts.  I delete on weight20."   Yes in our case it was caught with a weight of 57.  We hold on 20 and delete on 60 so this one was almost deleted.   BUT -- the filters are

Re: [Declude.JunkMail] Interesting.. indeed... long long long spam

PM Subject: [Declude.JunkMail] Interesting.. indeed... long long long spam Hi..   Spammers are not as dumb as we think they are...   This spam we received...   This is a multi-part message in MIME format.   --=_NextPart_000_58469_01C389A3.18FD3DB0Content

[Declude.JunkMail] Interesting.. indeed... long long long spam

Hi..   Spammers are not as dumb as we think they are...   This spam we received...   This is a multi-part message in MIME format.   --=_NextPart_000_58469_01C389A3.18FD3DB0Content-Type: text/plain; charset="Windows-1252"Content-Transfer-Encoding: quoted-printable   Although there a

RE: [Declude.JunkMail] Interesting headers, but this message was still easily caught

3 11:25 AM To: '[EMAIL PROTECTED]' Subject: [Declude.JunkMail] Interesting headers, but this message was still easily caught Received: from 66.38.133.97 [200.252.69.131] by mail.bentall.com (SMTPD32-8.02) id A3E5113000F4; Wed, 17 Sep 2003 10:03:33 -0700 Received: from [73.250

[Declude.JunkMail] Interesting headers, but this message was still easily caught

Title: Message Received: from 66.38.133.97 [200.252.69.131] by mail.bentall.com  (SMTPD32-8.02) id A3E5113000F4; Wed, 17 Sep 2003 10:03:33 -0700Received: from [73.250.175.174]    by 66.38.133.97 with SMTP    for ; Wed, 17 Sep 2003 06:00:29 +Message-ID: <[EMAIL PROTECTED]>From:

[Declude.JunkMail] Interesting spam...

Title: Message Hi; I just saw a spam that I think we all need to block...   = Important notice We have just charged your credit card for money laundry service in amount of $234.65 (because you are either child pornography webmaster or deal with

RE: [Declude.JunkMail] Interesting spam...

gust 13, 2003 2:11 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Interesting spam... Hi; I just saw a spam that I think we all need to block... = Important notice We have just charged your credit card for money laundry service in am

Re: [Declude.JunkMail] Interesting spam...

Yes, I got one of those personally. Incredibly cheeky, but no doubt there are people dumb enough to fall for it. If there weren't, we wouldn't still be getting those Nigerian scams. Got one of those yesterday, too. Visited their web site (which offers English and Russian language versions) an

RE: [Declude.JunkMail] Interesting Log Entries

>>>So, your internal users are sending out spam with a score of over 150? I use Imail to store and forward email for another domain we use to provide email for some of our clients. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the D

RE: [Declude.JunkMail] Interesting Log Entries

So, your internal users are sending out spam with a score of over 150? > -Original Message- > From: Robert Forsyth > > >>guess would be that this is for outgoing E-mail, in the > >>\IMail\Declude\global.cfg file. > >> > > > Found it...forgot to check the Outbound rules in the GLOBAL. >

RE: [Declude.JunkMail] Interesting Log Entries

Although that is possible, it is also (MORE) likely he has someone in the recipient list whitelisted (like postmaster@) (or the email is from a whitelisted sender, but no as likely as the recipient). Karen > -Original Message- > From: R. Scott Perry > > > >Why two different action results

RE: [Declude.JunkMail] Interesting Log Entries

>>I would recommend using "LOGLEVEL HIGH" in the \IMail\Declude\global.cfg >>file. When doing so, Declude JunkMail will record in the log file which >>configuration file it is using. That will make it easier to see which >>config file has "WEIGHT150 IGNORE" (or no action listed for >>WEIGHT15

RE: [Declude.JunkMail] Interesting Log Entries

>>That's because Declude JunkMail is very flexible, and has per-user, >>per-domain, incoming, outgoing, and now even sender actions. So a single >>test may have many different actions. >> >>In this case, you have a configuration file with "WEIGHT150 BOUNCE", and >>another that either has "WEIGHT1

RE: [Declude.JunkMail] Interesting Log Entries

>>That's because Declude JunkMail is very flexible, and has per-user, >>per-domain, incoming, outgoing, and now even sender actions. So a single >>test may have many different actions. >> >>In this case, you have a configuration file with "WEIGHT150 BOUNCE", and >>another that either has "WEIGHT15

[Declude.JunkMail] Interesting Log Entries

07/22/2003 15:01:57 Q8a220d1a00b4cc34 Msg failed WEIGHT150 (Weight of 169 reaches or exceeds the limit of 150.). Action=IGNORE. WEIGHT 150 ACTION SHOULD BOUNCE...WHY DID IT IGNORE? TWO SECONDS LATER: 07/22/2003 15:01:59 Q8a2314af00a2d099 Msg failed WEIGHT150 (Weight of 193 reaches or exceeds the

Re: [Declude.JunkMail] Interesting Log Entries

07/22/2003 15:01:57 Q8a220d1a00b4cc34 Msg failed WEIGHT150 (Weight of 169 reaches or exceeds the limit of 150.). Action=IGNORE. WEIGHT 150 ACTION SHOULD BOUNCE...WHY DID IT IGNORE? TWO SECONDS LATER: 07/22/2003 15:01:59 Q8a2314af00a2d099 Msg failed WEIGHT150 (Weight of 193 reaches or exceeds the

Re: [Declude.JunkMail] interesting idea from a bulk marketer

lt;[EMAIL PROTECTED]> Sent: Friday, June 27, 2003 2:14 PM Subject: RE: [Declude.JunkMail] interesting idea from a bulk marketer Or is it a ploy to harvest more addresses? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -Origin

RE: [Declude.JunkMail] interesting idea from a bulk marketer

7, 2003 1:25 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] interesting idea from a bulk marketer > > Since yesterday I have been in contact with a very helpful mail admin. It > seems one of my users has an outside email address at bigfoot and was > forwarding all his

[Declude.JunkMail] interesting idea from a bulk marketer

Since yesterday I have been in contact with a very helpful mail admin. It seems one of my users has an outside email address at bigfoot and was forwarding all his email to our server from there. One opt-in list he is on was getting bounced. In the process of finding out that email sent directly to

[Declude.JunkMail] Interesting article on SPAM

Here is an interesting article on spam from the "legitimate" marketer's perspective. http://sanjose.bizjournals.com/sanjose/stories/2003/03/31/story4.html Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came

RE: [Declude.JunkMail] Interesting test results

| What we are doing is to track the 2000 (user configurable) | most recent spammer | IP addresses. The list is maintained as an MRU style list | (sorted with the | most recent at the top). If incoming messages reach a user | defined score, the | IP address of the spammer is added to the list.

RE: [Declude.JunkMail] Interesting test results

SP>That sounds like an excellent idea -- I'm going to investigate to see SP>whether this may be possible or not. Circumventing the DNS lookups would SP>be very useful. Mr. Obvious here... the same technique could be used in the negative to pass through frequent mail from *low* scoring servers. Th

RE: [Declude.JunkMail] Interesting test results

>>I was thinking that it would probably be a relatively simple matter to add >>such a test in a future version of declude. If an incoming message reached a >>certain weight, it could be added to a recent spammer list. This list could be >>checked along with other internal tests _before_ DNS tests a

Re: [Declude.JunkMail] Interesting test results

Here is what we found. After about 3 weeks of data collection, only about 1 in 400 incoming spams is identified by a DNS lookup, and NOT on the list of the 2000 most recent spammers. That is quite impressive. I was thinking that it would probably be a relatively simple matter to add such a test i

[Declude.JunkMail] Interesting test results

Hi Scott and all, We added a test to SpamManager that has produced some really interesting results. What we are doing is to track the 2000 (user configurable) most recent spammer IP addresses. The list is maintained as an MRU style list (sorted with the most recent at the top). If incoming messa

Re: [Declude.JunkMail] Interesting Question

n it passes, which is when it has an effect on weight. > > Chuck Frolick > ArgoNet, Inc. > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of David Delbridge > Sent: Tuesday, February 25, 2003 3:14 PM > To: [EMAIL PROTE

RE: [Declude.JunkMail] Interesting Question

Not when it passes, which is when it has an effect on weight. Chuck Frolick ArgoNet, Inc. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Delbridge Sent: Tuesday, February 25, 2003 3:14 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail

Re: [Declude.JunkMail] Interesting Question

Shows up in MY %FAILEDTESTS% just fine: X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [802c]. X-RBL-Warning: HELOBOGUS: Domain S1001EXM01.macromedia.com has no MX or A records. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 63.109.193.64 with no reverse

Re: [Declude.JunkMail] Interesting Question

Since IPNOTINMX only has use when it passes, there is no way to add a header using WARN, and it doesn't show up in %FAILEDTESTS% (obviously), so the problem is, it adjusts the weight but unless you go to the log file, you don't know for shure it did. Is there a way to make it show up in the heade

  1   2   >