FILTER-NOSENDER is used to see if it is an automated message/response from a server. If the message triggers FILTER-NOSENDER we then go onto use FILTER-BACKSCATTER to score on phrases within the content. Also in the FILTER-BACKSCATTER there is a condition that if your server IP is found in the body of the bounced message we can assume the original message was from your server and therefore the FILTER-BACKSCATTER should not be run this is to help reduce false positives.
David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stephan Chayer Sent: Tuesday, April 22, 2008 12:52 PM To: [email protected] Subject: RE: [Declude.JunkMail] SPAMMERS using "postmaster@<domain>" in their FROM email David, I never added your backscatter, should I do it. What does it do exactly. Stephan _____ De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de David Barker Envoyé : 22 avril, 2008 11:32 À : [email protected] Objet : RE: [Declude.JunkMail] SPAMMERS using "postmaster@<domain>" in their FROM email This is known as backscatter you can read about it here. http://www.spamresource.com/2007/02/backscatter-what-is-it-how-do-i-stop-it. html If you go to the Declude My Account home page you will find a link to download a zip file which contains 2 filters you can use against backscatter. Download these and extract them to your \declude\filters folder and then call the filters from your global.cfg to be aggressive score the FILTER-NOSENDER with 10 or more points. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard Sent: Tuesday, April 22, 2008 11:22 AM To: [email protected] Subject: Re: [Declude.JunkMail] SPAMMERS using "postmaster@<domain>" in their FROM email Importance: High Don't know if Declude (or anyone) can help, but we are seeing a L O T of bounce-backs that show that the SPAMMERS are using valid postmaster@ <mailto:[EMAIL PROTECTED]> <domain> (that we host) as their FROM address and send the SPAM out thru Post Offices other than ours. When the SPAM goes to a non-existant address, it bounces back to the valid postmaster@ <mailto:[EMAIL PROTECTED]> <domain> on my Server. We are getting 5,000 - 10,000 of these bounces per day.. Any suggestions? Thanks very much Ferrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
