Robert Grosshandler wrote:
Sounds like a spam headline, doesn't it?
Anyway, we're getting obvious spam, but we're not able to weight it
enough to block it. Any tests you might suggest. The following came
to us BCC'd, I believe. Nothing about it was appropriate for us.
snip/
I would add country weight as well. There used to be examples that work. I
actually weight yahoo.com.XX as well.
At 01:20 PM 2/10/2009 -0500, Pete McNeil wrote:
Robert Grosshandler wrote:
Sounds like a spam headline, doesnt it?
Anyway, were getting obvious spam, but were
Todd,
There are 600,426,974,379,824,381,952 ways to spell Viagra
(http://www.americanscientist.org/issues/pub/how-many-ways-can-you-spell-v1gra/3)
and likewise a similar number of ways to obfuscate other words with 6
letters.
It is a better to target other aspects of the message and even
Good point, Matt. Thanks!
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt
Sent: Wednesday, October 29, 2008 1:07 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Help with Regex
Todd,
There are 600,426,974,379,824,381,952
We have experienced the same issue - as of 1.30pm friday our declude just
stopped working; all attempts to restart it are not working - we've
rebooted, re-installed, etc.
We did just renew our SA with declude at 12.30pm yesterday; I'm wondering if
that has anything to do with it.
Declude -
: Saturday, September 29, 2007 9:24 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
We have experienced the same issue - as of 1.30pm friday our declude just
stopped working; all attempts to restart it are not working - we've
rebooted, re-installed, etc.
We did just renew our
A.
Technical Support Director
Global Web Solutions, Inc.
804-442-5300
globalweb.net
- Original Message -
From: Randy Armbrecht [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Saturday, September 29, 2007 9:24 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
We have
]
To: declude.junkmail@declude.com
Sent: Saturday, September 29, 2007 9:24 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
We have experienced the same issue - as of 1.30pm friday our declude just
stopped working; all attempts to restart it are not working - we've
rebooted, re-installed
: Re: [Declude.JunkMail] HELP, Declude stoped functioning
We have experienced the same issue - as of 1.30pm friday our declude
just stopped working; all attempts to restart it are not working -
we've rebooted, re-installed, etc.
We did just renew our SA with declude at 12.30pm yesterday; I'm
- Original Message -
From: Randy Armbrecht [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Saturday, September 29, 2007 9:59 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
apologixe for false alarm; after re-install of earlier version (4.3.46) I
saw messages
Director
Global Web Solutions, Inc.
804-442-5300
globalweb.net
- Original Message -
From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Saturday, September 29, 2007 10:10 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
Randy
Global Web Solutions, Inc.
804-442-5300
globalweb.net
- Original Message -
From: Randy Armbrecht [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Saturday, September 29, 2007 9:59 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
apologixe for false
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
just another update - decludeproc process is running (showing in task
manager) but at 0% CPU; system sees it but nothing is firing it
off...very
strange. continuing to look into it further
@declude.com
Sent: Saturday, September 29, 2007 10:10 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
Randy,
Is the decludeproc service started?
Also, in the declude folder to you have a diags text file?
Darrell
--
Check out http
]
To: declude.junkmail@declude.com
Sent: Saturday, September 29, 2007 11:30 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
You will need to contact Declude at this point. There is nothing we can
do to help you out since the key is showing as expired thus is will not
process
Sent: Saturday, September 29, 2007 9:24 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
We have experienced the same issue - as of 1.30pm friday our
declude just stopped working; all attempts to restart it are not
working - we've rebooted, re-installed, etc.
We did just
globalweb.net
- Original Message -
From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Saturday, September 29, 2007 11:30 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
You will need to contact Declude at this point
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
Randy,
Is the decludeproc service started?
Also, in the declude folder to you have a diags text file?
Darrell
--
Check out http://www.invariantsystems.com for utilities for Declude,
Imail, mxGuard
@declude.com
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
does declude monitor this list off hours? we are receiving complaints by
the minute from our customers and I cannot wait until Monday morning for
someone to find my emails to support and voice mails
: Saturday, September 29, 2007 4:12 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] HELP, Declude stoped functioning
I would at least temporally disable Declude until you can get a hold of
support. At least you can get mail flowing.
-Original Message-
From: [EMAIL
Sent: Saturday, September 29, 2007 4:11 PM
Subject: RE: [Declude.JunkMail] HELP, Declude stoped functioning
I would at least temporally disable Declude until you can get a hold of
support. At least you can get mail flowing.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL
]
To: declude.junkmail@declude.com
Sent: Saturday, September 29, 2007 4:53 PM
Subject: RE: [Declude.JunkMail] HELP, Declude stoped functioning
I believe they have instructions for urgent support, e.g.
[EMAIL PROTECTED] (not sure if I remember it right). I would definitely
call and leave a message for support
Director
Global Web Solutions, Inc.
804-442-5300
globalweb.net
- Original Message -
From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Saturday, September 29, 2007 11:30 AM
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
: Re: [Declude.JunkMail] HELP, Declude stoped functioning
Randy.. this is Linda from Declude. What is your phone number? We are closed
today, but i will call you to help.
If you have any further questions, please do not hesitate to contact me
either by email or call Toll free 1-866-332-5833 Ext
From: Linda Pagillo [EMAIL PROTECTED]
Sent: Saturday, September 29, 2007 6:24 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] HELP, Declude stoped functioning
Randy.. this is Linda from Declude. What is your phone number? We are closed
today, but i will call you to help.
If you
I suggest that you always use a different source IP and sender domain
name when contacting the admin for a blacklist, because they often
filter their own mail with their blacklist, so they won't see your plea.
Stupid, but true.
Andrew.
From: [EMAIL
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] HELP with tqmcube.com
I suggest that you always use a different source IP and sender domain name when
contacting the admin for a blacklist, because they often filter their own mail
with their blacklist, so they won't see your plea
BlankIs there really a space in the logs or is that just a formatting issue?
philippe @ malivsion.com
Darrell
Check out http://www.invariantsystems.com for utilities for Declude And Imail.
IMail/Declude Overflow Queue
Is the example the same as the original?? Malivision is misspelled, missing
an i.
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge
Sent: Monday, February 26, 2007 7:32 PM
To: declude.junkmail@declude.com; Imail_Forum@list.ipswitch.com
Subject: [Declude.JunkMail] Help:
Blank
i added the spaces to prevent harvesting
should have mentioned this
sorry
- Original Message -
From: Darrell ([EMAIL PROTECTED])
To: declude.junkmail@declude.com
Sent: Tuesday, February 27, 2007 3:46 AM
Subject: Re: [Declude.JunkMail] Help: Domain not found
BlankDUH !!!
I read this several time and didn't catch it.
I think it is time for me to retire.
Thanks
- Original Message -
From: Michael Jaworski
To: declude.junkmail@declude.com
Sent: Tuesday, February 27, 2007 4:00 AM
Subject: RE: [Declude.JunkMail] Help: Domain
At least for the night.
John T
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Serge
Sent: Monday, February 26, 2007 8:19 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Help: Domain not found
DUH !!!
I read this several time
utility!).
Thanks!
Todd
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin
Cox
Sent: Tuesday, November 07, 2006 6:19 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Help with Configuration
Unless, as some prefer, you want to mark
What I do is send those grey ones to HOLD and then use fpReview to directly
view them and take appropriate action. Much faster and easier than using a
mailbox.
John T
eServices For You
Life is a succession of lessons which must be lived to be understood.
Ralph Waldo Emerson (1802-1882)
Look at using weightrange instead of weight to define your weighted tests. It
simplifies the weighting and makes it clear on what will happen to the message.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Todd Richards
Sent: Tuesday,
Is it because when it reaches WEIGHT19 and does the ROUTETO [EMAIL PROTECTED],
the message is delivered? Then when it tries to perform the action of WEIGHT32
the message is already gone?
Does Declude allow for multiple instances of the same action where subsequent
actions are performed, or
: Tuesday, November 07, 2006 3:34 PM
To: declude.junkmail@declude.com
Subject: re: [Declude.JunkMail] Help with Configuration
Is it because when it reaches WEIGHT19 and does the ROUTETO
[EMAIL PROTECTED], the message is delivered? Then when it tries to perform
the action of WEIGHT32 the message
: [Declude.JunkMail] Help with Configuration
What I do is send those grey ones to HOLD and then use fpReview to directly
view them and take appropriate action. Much faster and easier than using a
mailbox.
John T
eServices For You
Life is a succession of lessons which must be lived to be understood.
Ralph
: [Declude.JunkMail] Help with Configuration
Look at using weightrange instead of weight to define your weighted tests.
It simplifies the weighting and makes it clear on what will happen to the
message.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
: [Declude.JunkMail] Help with Configuration
Look at using "weightrange" instead of weight to define your weighted tests.
It simplifies the weighting and makes it clear on what will happen to the
message.
Kevin Bilbee
-Original Message-
From: [EMAIL PROTECTED] [mai
Of
Todd Richards
Sent: Tuesday, November 07, 2006 2:50 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Help with Configuration
Thanks Kevin. This is what I was wondering about, so I will look into
how
to implement.
Todd
-Original Message-
From: [EMAIL
, November 07, 2006 2:58 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Help with Configuration
Look at using weightrange instead of weight to define your weighted tests.
It simplifies the weighting and makes it clear on what will happen to the
message.
Kevin Bilbee
-Original
: Tuesday, November 07, 2006 3:13 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Help with Configuration
Todd Richards wrote:
Thanks Kevin. This is what I was wondering about, so I will look into howto implement.
something like this:
WEIGHTRANGE.SPAM.LOW
weightrange x
not have actually been sent from that mail
client.
Darin.
- Original Message -
From: Serge
To: declude.junkmail@declude.com
Sent: Friday, September 22, 2006 1:43 AM
Subject: Re: [Declude.JunkMail] Help: Delivery failures
For those of you who can read headers better than
me, here
For those of you who can read headers better than
me, here is a more interesting one
this time, we have some ips, "Received: from
217.170.144.6 (HELO mail.cefib.com)" can be valid, but
1- there is no traces in my logs of sending this
message
2- second part of the header says cwmagic.com
] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Friday, March 31, 2006 5:39
PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail]
HELP - outlook meeting invitations arell not coming through properly. Please
See below - Iam using imail 8.15 - declude 2.0.6
Best to do both
Go into your virus.cfg and comment out the FOOTER
lines.
David B
www.declude.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Howard Smith
(N.O.R.A.D.)Sent: Friday, March 31, 2006 5:09 PMTo:
Declude.JunkMail@declude.comCc: [EMAIL PROTECTED]Subject:
[Declude.JunkMail]
There is a switch in declude.cfg for Declude
3.0.5.21 and up that may help:
# Some customers had issues related to Outlook
meeting requests appearing as text only. # The default for this directive is
OFF. INVITEFIX ON
- Original Message -
From:
Howard Smith
(N.O.R.A.D.)
Best to do both if you have the
declude.cfg
David B
www.declude.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott
FisherSent: Friday, March 31, 2006 5:28 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] HELP -
outlook meeting invitations arell
Hi Dave,
Look at this thread:
http://www.mail-archive.com/declude.junkmail@declude.com/msg27075.html
Erik
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom
Sent: Monday, January 16, 2006 4:03 PM
To: Declude.JunkMail@declude.com
Subject:
There is probably some html coding before that line.
- Original Message -
From: Dave Beckstrom [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, January 16, 2006 9:02 AM
Subject: [Declude.JunkMail] Help with filter
I received a spam email, which was an HTML email with
Fisher
Sent: Monday, January 16, 2006 10:36 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help with filter
There is probably some html coding before that line.
- Original Message -
From: Dave Beckstrom [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent
email being coded like that.
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Erik
Sent: Monday, January 16, 2006 9:10 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Help with filter
Hi Dave,
Look at this thread
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom
Sent: Monday, January 16, 2006 6:23 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Help with filter
Hi Erik,
Thanks for turning me on to that thread. There was some good
] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Erik
Sent: Monday, January 16, 2006 12:01 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Help with filter
Yes, that spam campaign keeps changing subjects.
Unfortunately, if you filter only on the CID tag; you will filter some
. ;-)
-Erik
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom
Sent: Monday, January 16, 2006 7:12 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Help with filter
Erik,
I thought that the beginswith meant that we
]
[mailto:[EMAIL PROTECTED] On Behalf Of Erik
Sent: Monday, January 16, 2006 10:33 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Help with filter
Yes, you are correct with the use of BEGINSWITH.
This campaign is and has been lately using html code before
the CID tag
Mark,
At a minimum I would move to version 1.82.
This includes the fix for the broken SPAMHEADER test which may be part of
the problem.
Barry
www.declude.com
(978) 499-2933
Declude Inc.
65 Parker Street
Suite 5
Newburyport, MA 01950
-Original Message-
From: [EMAIL PROTECTED]
Another user had the same problem you are mentions a couple of weeks back -
http://www.mail-archive.com/declude.junkmail@declude.com/msg26103.html
The user kept running declude.exe until it worked.
Darrell
Check out
Did you check that declude.exe is the mail transport for imail? Just
replace smtp32.exe with declude.exe. You will need to stop/start imail. I
had that problem too with declude's error message. I just ran it a few
times and it just went away on it's own.
Then, check the headers of a test
Fisher
Sent: Friday, September 16, 2005 5:30 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help in creating a Filter
I don't have the order... But I believe filters are done last after External
comments.
If David's monitoring the list,
I think a list of what order the tests
Thanks David. It's good to have you monitoring the list.
- Original Message -
From: David Barker [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, September 19, 2005 10:26 AM
Subject: RE: [Declude.JunkMail] Help in creating a Filter
Scott,
I agree, unfortunately I do
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Help in creating a Filter
It would be nice if there was a directive that forced the tests to run as
they are in the order of which the appear in the CONFIG file. I know this
may/would be a performance decrease but it would give end users
Wow, that would be great! :-)
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Barker
Sent: Monday, September 19, 2005 9:38 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Help in creating a Filter
Erik,
I have also asked
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of MattSent: Saturday, September 17, 2005 4:10
PMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Help in creating a
FilterErik,Flexibility is a nice thing, but this
isn't really practical
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Saturday, September 17, 2005 4:10 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help in creating a Filter
Erik,
Flexibility is a nice thing
in
version 1.62 in November 2002.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Friday, September 16, 2005 3:30 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help in creating a Filter
I don't have the order
, September 17, 2005 2:05 PM
Subject: RE: [Declude.JunkMail] Help in creating a Filter
From our testing of our new external program, you are right. The external
program is being called before our combo filter is being triggered.
And the %COUNTRYCHAIN% variable is blank. So this variable
]
[mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher
Sent: Saturday, September 17, 2005 2:23 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help in creating a Filter
I believe the order is: IP4R RHSBL, Declude Internal, spamdomains,
Extermal, Fromfile, IPFile, Filter
Within
Erik wrote:
If Declude could confirm the order of how/which tests are run, it would be
nice to know.
I agree.
The archives may help but as I recall Scott [former of Declude] was
nebulous in what the order is. The only thing for sure was filters ran
last in the order listed in global.cfg
]
[mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer
Sent: Saturday, September 17, 2005 3:23 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help in creating a Filter
Erik wrote:
If Declude could confirm the order of how/which tests are run, it would
be nice to know.
I
decrease but it would give end users control of
external tests.
Erik
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Nick Hayer
Sent: Saturday, September 17, 2005 3:23 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help in creating
One more comment. The country processing won't occur unless you have the
all_list.dat file in the declude folder.
- Original Message -
From: Erik [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Saturday, September 17, 2005 3:42 PM
Subject: RE: [Declude.JunkMail] Help
:08 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help in creating a Filter
One more comment. The country processing won't occur unless you have the
all_list.dat file in the declude folder.
- Original Message -
From: Erik [EMAIL PROTECTED]
To: Declude.JunkMail
I think this would do it in two filters:
filter 1:
SKIPIFWEIGHT 100
TESTSFAILED END NOTCONTAINS MN-COMBO
COUNTRIES 100 NOTCONTAINS US
filter 2:
SKIPIFWEIGHT 100
TESTSFAILED END NOTCONTAINS MN-COMBO
TESTSFAILED END CONTAINS filter1
COUNTRIES END STARTSWITH US
COUNTRIES 100 CONTAINS US
I'd be
12:57 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help in creating a Filter
I think this would do it in two filters:
filter 1:
SKIPIFWEIGHT 100
TESTSFAILED END NOTCONTAINS MN-COMBO
COUNTRIES 100 NOTCONTAINS US
filter 2:
SKIPIFWEIGHT 100
TESTSFAILED END NOTCONTAINS MN
I don't believe so.
I think you have COUNTRY and COUNTRIES.
COUNTRY is the last counry in the country chain.
- Original Message -
From: Erik [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 16, 2005 2:07 PM
Subject: RE: [Declude.JunkMail] Help in creating
Just to second this - I have seen a large amount of customers also farm out
filtering to companies like big fish which scan the mail in oversea's
countries.
Darrell
Check out http://www.invariantsystems.com for utilities
]
[mailto:[EMAIL PROTECTED] On Behalf Of Darrell
([EMAIL PROTECTED])
Sent: Friday, September 16, 2005 2:31 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help in creating a Filter
Just to second this - I have seen a large amount of customers also farm out
filtering to companies
Does anyone know (Darrell); if the %COUNTRYCHAIN% can be passed to an
external program? I've thought of developing an EXE that does this final
scan after MN-COMBO is tested.
It should be - at this point any variable I have messed with has been
passable to an external test.
Darrell
---
]
To: Declude.JunkMail@declude.com
Sent: Friday, September 16, 2005 3:44 PM
Subject: RE: [Declude.JunkMail] Help in creating a Filter
We've been monitoring the MN-COMBO test (multiple tests failed) for the past
2 months.
Most are failing INV-URIBL and SNIFFER; but some only failing one of them
(either SNIFFER or INV
:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help
with Whitelisting
Because the mail is from
@mssupport.microsoft.com, but you're not whitelisting
@mssupport.microsoft.com, you're whitelisting
.mssupport.microsoft.com.
Darin.
- Original Message
upport.microsoft.com
@mssupport.microsoft.com
Darin.
- Original Message -
From: Agid, Corby
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 12:02 PM
Subject: RE: [Declude.JunkMail] Help with Whitelisting
Wouldn't mywhitelist entryalso whitelist all
senders from .msssupport.m
n CoxSent: Tuesday, August 30, 2005 9:10
AMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Help with Whitelisting
Almost. Your entry would match anything
that ends with ".mssupport.microsoft.com", but since "@mssupport.microsoft.com" does
not con
right-hand-side match, but the lack of a description makes it a FAQ on this
mailing list.
Andrew 8)
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Agid,
CorbySent: Tuesday, August 30, 2005 12:28 PMTo:
Declude.JunkMail@declude.comSubject: RE: [Declude.Junk
To: Declude.JunkMail@declude.com
Sent: Tuesday, August 30, 2005 3:28 PM
Subject: RE: [Declude.JunkMail] Help with Whitelisting
That's what I would have thought, but the manual is a
bit confusing. Here's from the manual:
=
"The
D:\{MAILSERVER}\Declude\mywhitelist.txt file would then contain e
thought MS would have reverse DNS set properly.
Thanks for your help.
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Darin
Cox
Sent: Tuesday, August 30, 2005 1:02 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Help
Title: Help with Whitelisting
ha!
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
MattSent: Tuesday, August 30, 2005 1:45 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help
with Whitelisting
Microsoft outsourced much of their support
Title: Help with Whitelisting
Great, thanks Matt.
Now I've got Cat Scratch Fever!
Andrew 8)
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
MattSent: Tuesday, August 30, 2005 1:45 PMTo:
Declude.JunkMail@declude.comSubject: Re: [Declude.JunkMail] Help
Hi,
The mail supposedly took the following route:
- cousinssubs.com (mail.cousinssubs.com [216.43.194.27])
- YahooBB218116092015.bbtec.net (Postfix)([218.116.92.15])
- mx4.uniserve.ca ([216.113.192.45])
We can assume that the first receive header is legit:
Received: from mx4.uniserve.ca
Received: from mx4.uniserve.ca ([216.113.192.45]) by mail-host.uniserve.ca...
Received: from yahoobb218116092015.bbtec.net ([218.116.92.15]) by...
Received: from cousinssubs.com (mail.cousinssubs.com [216.43.194.27]) by...
The uniserve.ca references are the servers of the guy who complained. The
: [Declude.JunkMail] Help investigating abuse complaint
Received: from mx4.uniserve.ca ([216.113.192.45]) by mail-
host.uniserve.ca...
Received: from yahoobb218116092015.bbtec.net ([218.116.92.15]) by...
Received: from cousinssubs.com (mail.cousinssubs.com [216.43.194.27])
by...
The uniserve.ca
20041013 062659 127.0.0.1 SMTPD (02f3ecee00c465f4)
[208.7.179.200] connect 208.7.179.200 port 4767
20041013 062659 127.0.0.1 SMTPD (02f3ecee00c465f4)
[208.7.179.200] EHLO mx3.mailpure.com
20041013 062659 127.0.0.1 SMTPD (02f3ecee00c465f4)
session id numbers, but that is
not the case
i wonder why
- Original Message -
From: Scot Desort [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Saturday, September 04, 2004 3:11 AM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
search for treated as local in your
You are missing a line. What does connect line show, which is the line
before the MAIL FROM?
John Tolmachoff
Engineer/Consultant/Owner
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of serge
Sent: Friday, September
Tolmachoff (Lists) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, September 03, 2004 11:47 PM
Subject: RE: [Declude.JunkMail] HELP, I'm beiing hijacked
You are missing a line. What does connect line show, which is the line
before the MAIL FROM?
John Tolmachoff
Engineer/Consultant/Owner
And
Imail.
IMail/Declude Overflow Queue Monitoring, MRTG Integration, and Log Parsers.
- Original Message -
From: serge [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Friday, September 03, 2004 8:26 PM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
20040903 104237 127.0.0.1
-
From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Saturday, September 04, 2004 1:33 AM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
Is it possible they guessed a users account/password and are using SMTP
Auth
to relay through your system?
Darrell
PROTECTED]
Sent: Saturday, September 04, 2004 1:33 AM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
Is it possible they guessed a users account/password and are using SMTP
Auth
to relay through your system?
Darrell
, September 04, 2004 3:11 AM
Subject: Re: [Declude.JunkMail] HELP, I'm beiing hijacked
search for treated as local in your IMAIL log. Try to find a line
with that text, that also contains the same SMTPD session ID of
11AF0190
--
Scot
On Sat, 4 Sep 2004 02:21:10 -, serge [EMAIL PROTECTED] wrote
1 - 100 of 200 matches
Mail list logo
