Spam Filter ISP Forums http://www.logsat.com/spamfilter/forums/ This is an XML content feed of; Spam Filter ISP Forums : Last 10 Posts Fri, 05 Sep 2008 17:29:22 +0000 Thu, 04 Sep 2008 14:24:27 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 9.06 30 www.logsat.com/spamfilter/forums/RSS_topic_feed.asp Spam Filter ISP Support : You've Received a Greeting eCard http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6549&PID=12370#12370 Author: Derk
Subject: You've Received a Greeting eCard
Posted: 04 September 2008 at 2:24pm

is anybody else finding that a message with the subject "you've received a greeting ecard" is slipping through?

I've tried adding keywords and a subject-only keyword entry and it still comes through.


-----Original Message-----
From: greetingcard.org [mailto:wtaggart@trinitycounty.org]
Sent: Thursday, September 04, 2008 6:53 AM
To: dear friend
Subject: You've received a greeting ecard

Good day.
You have received an eCard

To pick up your eCard, choose from any of the following options:
Click on the following link (or copy & paste it into your web browser):

http://summer-romance.de/e-card.exe

Your card will be aviailable for pick-up beginning for the next 30 days.
Please be sure to view your eCard before the days are up!

We hope you enjoy you eCard.

Thank You!

http://www.greetingcard.org



]]> Thu, 04 Sep 2008 14:24:27 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6549&PID=12370#12370 Spam Filter ISP Support : "Recycle" Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12369#12369 Author: LogSat
Subject: "Recycle" Spam
Posted: 03 September 2008 at 5:09pm

The SFDC filter that we introduced a few months ago does act on the emails content, rather than the IP as in the SFDB. With the SFDC, SpamFilter analyzes the body of the emails reported as spam, and creates a hash signature to identify emails with very *similar* content. This has is then uploaded in real-time to our SFDC server. From then on, things will work very similarly to the SFDB filter. Once we receive a number of different reports for the same hash, that hash (instead of the IP) will be blacklisted, and all incoming emails with similar hashes will be rejected.

This method is not nearly as effective as the SFDB filter (on average the SFDC filter will stop only 2%-4% as many emails as the SFDB, but if you receive about 100,000 emails/day, that still means 2,000-4,000 emails stopped by that filter.

As I mentioned before, it is very risky to stop emails at an enterprise level based on feedback sent from the end-users. We do however always listen to comments and requests, and this has been one of our oldest, still unsatisfied request. If we're able to come up with a way that will allow users to provide feedback for spam, and at the same time minimizing the risk of stopping valid emails being addressed to an enterprise, we'll definitely implement it.]]> Wed, 03 Sep 2008 17:09:03 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12369#12369 Spam Filter ISP Support : "Recycle" Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12368#12368 Author: jerbo128
Subject: "Recycle" Spam
Posted: 02 September 2008 at 9:04pm

I agree with Steve's idea that we should not look solely at the IP and would like to add:
 
I am not envisioning a system that will necessarily report to others, but just a way for my SFE installations to re-train themselves.  Any way for my users to report these emails in an automated way would be a plus over the manual sifting that we have to do now. 
 
It seems that these "missed" emails come in waves, often scattered over a several hour period.  If the earliest recipients of these messsages can make a difference for the rest of the users who have not yet received them - that would be a huge benefit.
]]> Tue, 02 Sep 2008 21:04:57 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12368#12368 Spam Filter ISP Support : "Recycle" Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12367#12367 Author: StevenJohns
Subject: "Recycle" Spam
Posted: 02 September 2008 at 6:16pm

Roberto,
 
I see what you are saying and I fully understand your wish to keep the SFDB atuomated and secure.
However, your response does seem to focussed only on blocking the IP of the sending server, rather than the email in question. We get a lot of emails which come form legitimate IP's where the content of the email if obviously spam. This kind of email should not be considered purely based on the ip that sent the email as it may have come from a server which hosts hundreds of domains.
Spammers are getting really educated about the ip's of their servers and we are seeing SF miss emails with obvious spam content.
I think you should be concentrating more on the content of the email rather than on the IP that it came from as your response seems to suggest.
 
A method of sending the spam email back to our own SF installation and retraining the basyan filters or the keyword filters would be a great idea.
 
If SF continues to focus soley on the IP of the sending server, then I can see it's effectiveness reducing over time, and that would be a real shame.
 
Steve.
 
]]> Tue, 02 Sep 2008 18:16:03 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12367#12367 Spam Filter ISP Support : "Recycle" Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12366#12366 Author: LogSat
Subject: "Recycle" Spam
Posted: 02 September 2008 at 6:01pm

We've always been resilient about allowing users to submit spam emails back to SpamFilter. This is because the process is too prone for errors. Users may not be able to forward back the *original* message, as for example Microsoft Outlook clients will completely change the email and preventing access to the real, original source (there is a plugin to do this... but doubtful the average user will have it).

To be successful, SpamFilter would have to keep a copy of *all* incoming email's headers, not just spam, so that they can later be referenced via some kind of unique ID to allow post-back. The benefit of this however is going to be limited due to the way the SFDB works. Our SFDB is updated in real-time by all SpamFilter's throughout the world, and we require multiple spam reports from each SpamFilter installation, within a short time-frame, before accepting an IP for possible inclusion in the SFDB from that specific installation. In addition, only if several different SpamFilter then in turn report the same IP, will finally the IP become blacklisted. This makes the process extremely reliable, and false positives are extremely, extremely rare, while at the same time allowing for semi-real-time reporting.
Having individual users report spam will not help much, as each "human" report will be a drop of water in a lake as far as contributing in reporting an IP to the SFDB.
Furthermore... the submission mechanism for the SFDB is kept automated, with encrypted submissions as to reduce the risk of "poisoning" the database with invalid and/or incorrect data. If we allowed an option to provide users with the ability to manually submit data to it, we would increase the danger of spammers abusing this method to upload invalid data to the SFDB, thus reducing its effectiveness.]]> Tue, 02 Sep 2008 18:01:10 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12366#12366 Spam Filter ISP Support : Queue Lifetime http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6548&PID=12365#12365 Author: LogSat
Subject: Queue Lifetime
Posted: 02 September 2008 at 5:50pm

By default SpamFilter will try every 60 minutes to deliver emails to your destination SMTP server if it is unavailable (this interval is configurable via the GUI). in addition, SpamFilter will retry to deliver emails by default for ever, until your server is back online. This latter setting (for ever) can be changed via the following parameter in the SpamFilter.ini file:

;Number of hours SpamFilter will retry to deliver messages in queue to your destination SMTP server if it was unreachable. Enter 0 to try forever until back online.
ExpireRetryQueueHours=0

As with most settings, there is no need to restart SpamFilter if making this change in the SpamFilter.ini file, the new value will be imported on the fly.]]> Tue, 02 Sep 2008 17:50:57 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6548&PID=12365#12365 Spam Filter ISP Support : Queue Lifetime http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6548&PID=12364#12364 Author: suchi
Subject: Queue Lifetime
Posted: 01 September 2008 at 8:44am

Can anyone help me to know about queue lifetime.
If  the destination SMTP server is down  and the mails destined for that server are in queue.
Then for how much time it is going to be in queue  ?? and after how much time ,the  sender will get a bounce back ???

Thanks in advance.....
]]> Mon, 01 Sep 2008 08:44:09 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6548&PID=12364#12364 Spam Filter ISP Support : Exception occurs on autowhitelisting http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6547&PID=12363#12363 Author: LogSat
Subject: Exception occurs on autowhitelisting
Posted: 30 August 2008 at 7:12pm

The issue was caused by the tables tblQuarantine and tblMsgs both missing their primary keys on the QuarID and the MsgID columns. Recreating the keys solved the problem.
The database is on the MS Access platform, and it's possible that the primary keys were removed when a "Compact & Repair" procedure was performed on the database.]]> Sat, 30 Aug 2008 19:12:03 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6547&PID=12363#12363 Spam Filter ISP Support : Exception occurs on autowhitelisting http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6547&PID=12362#12362 Author: LogSat
Subject: Exception occurs on autowhitelisting
Posted: 30 August 2008 at 11:20am

davemeister,

I'm very sorry, we just saw this posting. Not only we did not receive your direct email to support@logsat.com, but we did not even receive the email notifications that notify us of new forum posts relative to this specific posting. Very, very unusual coincidence.

I'll be sending you a PM shortly with the FTP details. Please zip us the logs for the entire day when this first happened, and also the previous day as well in case there were errors lingering earlier that lead to other issues later.

If you can please both send us an email and a PM us back when you uploaded the files, we'll be certain to receive your response.]]> Sat, 30 Aug 2008 11:20:46 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6547&PID=12362#12362 Spam Filter ISP Support : "Recycle" Spam http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12361#12361 Author: WebGuyz
Subject: "Recycle" Spam
Posted: 29 August 2008 at 11:07am

Good idea now that everything else is working smoothly. Wink]]> Fri, 29 Aug 2008 11:07:08 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6542&PID=12361#12361