If you would like a more efficient test that uses the HELO that declude finds and will take into account your IPBYPASS settings.
http://www.ssc-isp.net/HoldAnalyzer/containsip.aspx It requires the .net framework 1.1 to be installed ont he mail server. Total unique messages scanned: 19432 CIP-FullMatch : 1660 CIP-LeadingTextMatch : 269 CIP-OnlyIp : 2632 CIP-TrailingTextMatch: 2 CIP-WellFormed : 4 These are my stats for last week using this test. Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Darin Cox > Sent: Monday, September 13, 2004 5:34 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] My IP appearing in HELO string > > > Bud Durland created a Declude plugin just for this... try it out from > http://bud.thedurlands.com/. > > Thanks, Bud! > > Darin. > > > ----- Original Message ----- > From: "Jeff Pereira" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, September 13, 2004 7:03 AM > Subject: [Declude.JunkMail] My IP appearing in HELO string > > > Hi - > > In looking at a number of spam messages, I am frequently seeing the > below header item where the IP listed is the IP address of my Imail > server. > > X-RBL-Warning: HELOBOGUS: Domain 123.123.123.123 has no MX or A records > [0301] > > Obviously, this is a spammer's trick. > > How would I detect this ? > > Would the following work: > > HELO contains 123.123.123.123 > > Thank you. > > Jeff > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
