Great.. Thanks.. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Sent: Friday, June 11, 2004 10:50 AM To: [EMAIL PROTECTED] Subject: Re: Possible Spam: RE: [Declude.JunkMail] NDR's
I'm working on creating one, a version of what we have, it's started at http://www.kendra.com/Support/PerUser_Gateway/index.htm, I'm trying to finish it today. Rich ----- Original Message ----- From: "Jeff Maze" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, June 11, 2004 8:42 AM Subject: RE: Possible Spam: RE: [Declude.JunkMail] NDR's > Was there a HOWTO you found online to do this? Wouldn't mind attempting > this when I get a chance.. > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Rich > Sent: Friday, June 11, 2004 10:33 AM > To: [EMAIL PROTECTED] > Subject: Re: Possible Spam: RE: [Declude.JunkMail] NDR's > > We've been getting upwards of 30k messages a day which are NDR's with our > domain name, but with a randomly generated username. We found that although > our mail server is more then capable of handling the volume, it was creating > a lot of lag with POP3 accounts when the server was being hammered with the > dang things. Seems this is getting to be the latest craze, spamming with > legit domain names attached to a random username. > > So what we did was to set up two BSD/Postfix boxes that filter based on a > list of our valid users which we update as needed. The incoming NDR's are > then trashed at the BSD/Postfix level and Imail and Declude don't have to > deal with them. This is kind of like Len Conrads Imgate, but it only checks > for a valid username before relaying the email into the Imail box. > > Rich > > > ----- Original Message ----- > From: "declude" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, June 11, 2004 4:05 AM > Subject: Possible Spam: RE: [Declude.JunkMail] NDR's > > > > Markus > > > > We are seeing 1 in 10 email's which are NDR's and are nothing to do with > the german-politic spam messages. > > > > Look's like we have a new problem, which is growing quickly. > > > > Scott I hope you can help on this one or anyone else... > > > > Kevin > > > > > > ---------- Original Message ---------------------------------- > > From: "Markus Gufler" <[EMAIL PROTECTED]> > > Reply-To: [EMAIL PROTECTED] > > Date: Fri, 11 Jun 2004 12:49:55 +0200 > > > > > > > >> We are seeing a lot of NDR's coming from ligit servers, with > > >> a spoofed user name, but a correct domain name. > > >> > > >> What would be the best way to deal with this ever growing problem. > > > > > >Yipiieee :-) > > >I'm not the only one having this problem. > > > > > >As I can see this are NDR's from current spam messages having forged but > > >real existing mailfrom addresses and a lot of random recipient names in > > >combination with valid domains. (german-politic spam messages send from > > >sober.g zombies) > > > > > >Markus > > > > > > > > >--- > > >[This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > > >--- > > >This E-mail came from the Declude.JunkMail mailing list. To > > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > >type "unsubscribe Declude.JunkMail". The archives can be found > > >at http://www.mail-archive.com. > > > > > > > > >[ PS. This email has been securely processed by Sorting Office ] > > > > > > > > > > > __________________________________________________________________ > > This email has been Processed using Sorting Office Email Services > > This email and any attachments are confidential to the intended > > recipient and may also be privileged. If you are not the intended > > recipient please delete it from your system and notify the sender. > > You should not copy it or use it for any purpose nor disclose or > > distribute its contents to any other person. > > > > Sorting Office Email Filter Solution > > Anti-Virus | Anti-Spam > > For kad.co.uk > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
