192.168.1.1 is my ASSP box
192.168.1.2 is my Exchange Server
In the 1st line of this first set of headers it look to me like the spammer is
spoofing 192.168.1.1 as tightprofitforus.com:
Received: from tightprofitforus.com (192.168.1.1) by exchange.internal
(192.168.1.2) with Microsoft SMTP Server id 8.1.340.0; Thu, 19 Mar 2009
07:13:22 -0600
Received: from tightprofitforus.com ([67.130.83.92] helo=tightprofitforus.com)
by ASSP.nospam; 19 Mar 2009 07:14:17 -0600
Received: by tightprofitforus.com (Postfix) with SMTP id 3194951D860 for
<[email protected]>; Thu, 19 Mar 2009 09:13:22 -0400 (EDT)
Subject: BarNone has sent U a Special Car-Loan-Certificate!
From: BarNone Car Loan <[email protected]>
Reply-To: <[email protected]>
To: <[email protected]>
X-Mailer: Alife12
Content-Type: text/html; charset="us-ascii"
Content-Disposition: inline
Message-ID: <[email protected]>
Date: Thu, 19 Mar 2009 09:13:22 -0400
X-Assp-Delay: [email protected] not delayed (auto accepted);
19 Mar 2009 07:14:17 -0600
X-Assp-Message&IP-Score: 10 (PTR missing)
X-Assp-Received-SPF: none ip=67.130.83.92 [email protected]
helo=tightprofitforus.com
X-Assp-Envelope-From: [email protected]
X-Assp-Intended-For: [email protected]
MIME-Version: 1.0
Return-Path: [email protected]
And here it look to me like the spammer is spoofing 192.168.1.1 as
gibbaheinemanns.com:
Received: from gibbaheinemanns.com (192.168.1.1) by exchange.internal
(192.168.1.2) with Microsoft SMTP Server id 8.1.340.0; Thu, 19 Mar 2009
07:28:23 -0600
Received: from gibbaheinemanns.com ([209.170.71.162] helo=gibbaheinemanns.com)
by ASSP.nospam; 19 Mar 2009 07:29:17 -0600
Received: by gibbaheinemanns.com (Postfix) with SMTP id 26C5E1F95A1 for
<[email protected]>; Thu, 19 Mar 2009 09:08:42 -0400 (EDT)
Subject: Hurry - $700.00 Advance Could be deposited Overnight
From: Easy Online Approval <[email protected]>
Reply-To: <[email protected]>
To: <[email protected]>
X-Mailer: SlomoV2.3
Content-Type: text/html; charset="us-ascii"
Content-Disposition: inline
Message-ID: <[email protected]>
Date: Thu, 19 Mar 2009 09:08:42 -0400
X-Assp-Delay: [email protected] was delayed before 19m 49s;
19 Mar 2009 07:29:18 -0600
X-Assp-Message-Score: 10 (Foreign Country SE - Maxfiber Light, LLC)
X-Assp-Message&IP-Score: 10 (PTR missing)
X-Assp-Received-SPF: none ip=209.170.71.162 [email protected]
helo=gibbaheinemanns.com
X-Assp-Envelope-From: [email protected]
X-Assp-Intended-For: [email protected]
MIME-Version: 1.0
Return-Path: [email protected]
I am running ASSP v1.4.3.1.3 with DoNoSpoofing checked and DoNoValidLocalSender
set to block.
Not really comprehending the ramifications (and preferring not to turn on a
feature that defaults to off without that knowledge), I wonder if turning on
DoLocalSenderDomain and/or DoLocalSenderAddress and/or ldLDAP would stop these.
Can anyone suggest a good solution?
Thanks,
Alex
------------------------------------------------------------------------------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based development
software that enables intelligent coding and step-through debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user
