No,
that email address is not valid. Those emails have been easily held over
on my system.
You
can certainly block that bogus MAILFROM but since the bad guys will continue to
change it as they hatch new spoofs, why not split out your SPAMDOMAINS into
groups that are likely to be abused, and weight those high enough to meet your
HOLD weight?
Andrew
8)
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kami Razvan
Sent: Sunday, April 10, 2005 12:38 PM
To: [email protected]
Subject: [Declude.Virus] Windows Update!Hi;In the past hour I have seen several emails caught as spam but the weight still not high enough to be deleted with subject: Urgent Windows Update.As everyone (?) knows this is the recent attempt to install a worm on the visitor's computer- there is a link to the Express install and no attachments.The link is an IP address.I think ClamAV detects such behavior but it is not catching it yet and I just checked the update.I think for now I created a filter that if the email is from Microsoft and there is an IP address in the body for the email to be blocked.This one email came from [EMAIL PROTECTED] - I really don't think that is a valid MS address. Anyone knows if this is a valid address? May be it is worthwhile to block it for now.This week MS will be releasing some major updates and from what I read this scam was about to be released today.. so it is starting at least one our system.Regards,Kami
