Sent: Friday, September 19, 2003 1:09
PM
Subject: RE: [Declude.JunkMail] blocking
spam faked as coming from local a ddress
I should
add:
If you want to
go the extra mile and say:
MAILFROM 20
ENDSWITH wcnet.net
Then you'll
find that works great against spammers who fake their mailfrom address so it
looks your own name (or say, [EMAIL PROTECTED] while trying to
send to you!), but:
You'll also
find that it works "great" to also block mailing lists, news
subscriptions, and greeting cards that use the name of the destination
mailbox as the mailfrom. One example is the sabre.com travel service,
and another is pretty well any newspaper where somebody can read an article
and forward it somebody.
So, although it
looks like a great idea, to implement will take a lot of work on your part to
look for false positives (preferably ahead of time). And your
counterweight section will be different from mine, and his, and hers over
there...
Andrew
8)
How do I reliably block this kind of
thing? Can my own domain be added to the SpamDomains list? I've
replaced the recipient address with [local-user] in the headers below, but
it was the same valid local user account on all parameters.
138.89.104.227 is not one of my IPs.
Glenn Z.
Received: from wcnet.net [138.89.104.227] by wcnet.net
with ESMTP (SMTPD32-7.15) id 04542B014C; Thu, 18 Sep 2003 23:04:21
-0500
Received: from kennedy-henry [192.168.1.101] by wcnet.net with
MailMXPro2(2195.5631); Fri, 19 Sep 2003 00:04:20 -0400
Message-ID:
<[EMAIL PROTECTED]>
From: "jenna henny" <[EMAIL PROTECTED]>
To:
<[local-user]@wcnet.net>
Subject: Spam (10) - Don't
wait for rates to climb back up
Date: Fri, 19 Sep 2003 00:04:20
-0400
MIME-Version: 1.0
Content-Type: text/html;
charset="ISO-8859-1"
X-Priority: 3
X-Mailer: mailer
Return-Path:
[local-user]@wcnet.netAbuse2-Tracking:
<Z2xlbm5jbXpAd2NuZXQubmV0>
X-Declude-Sender: [local-user]@wcnet.net [138.89.104.227]
X-Declude-Spoolname:
D8045042b014c3731.SMD
X-Note-In: This E-mail was scanned on MAIL1 by
Declude JunkMail for evidence of spam.
X-Spam-Tests-Failed-In: SPAMCOP,
IPNOTINMX, SNIFFER, WEIGHT10
X-Note-In: Total spam weight of this E-mail
is 13.
X-Note-In: This E-mail was sent from
pool-138-89-104-227.mad.east.verizon.net ([138.89.104.227])
X-Note-In:
SMTP Real From: [local-user]@wcnet.netX-RCPT-TO: <[local-user]@wcnet.net>
Status: R
X-Mozilla-Status: 0000
X-Mozilla-Status2:
00000000
X-UIDL: 8400
