I think your problem is that the block by domains is looking at the FROM address (the probably forged "hotmail.com" in this case) and not at the host that actually sent you the e-mail message. What you probably want to do is click the "Specify By Host" button (instead of Message Filtering) and put that IP address in there as a host you're going to reject mail from.
Better be sure you don't get any legitimate mail from that host, of course. :) Aloha, -Ben- Ben M. Schorr, MVP-Outlook, CNA, MCPx3 Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com > -----Original Message----- > From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 25, 2002 1:59 PM > To: Exchange Discussions > Subject: RE: Message Filtering > > > Andy, > > Based on one of the headers in a previous spam, I typed in > "@210.73.88.134" (without the quotes of course) and > stopped/started my IMS. > > I received another one on Thursday morning. Below is the > partial header...this is the first received line in the header: > > Received: from zhongxin (210.73.88.134 [210.73.88.134]) by > calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange > Internet Mail Service Version 5.5.2653.13) > id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 > Reply-To: [EMAIL PROTECTED] > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > > -----Original Message----- > From: Andy David [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 25, 2002 3:33 PM > To: Exchange Discussions > Subject: RE: Message Filtering > > > Just curious, what exactly did you type in? > > > > -----Original Message----- > From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 25, 2002 4:59 PM > To: Exchange Discussions > Subject: RE: Message Filtering > > > I told you I would let you know if this works or not...looks > like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A > couple of days ago, I saw another spam roll through that had > this same originating IP in the Internet Headers > section...and yes, I stopped/started the IMS after making the change. > > Jim Blunt > > -----Original Message----- > From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 11, 2002 9:59 AM > To: Exchange Discussions > Subject: RE: Message Filtering > > > Cool...thanks Andy. I figured it probably would, but I > wasn't sure. I will let you know in the next couple of days > if it actually works. > > Jim > > -----Original Message----- > From: Andy David [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 11, 2002 9:47 AM > To: Exchange Discussions > Subject: RE: Message Filtering > > > Havent done it, but I would say yes. > > -----Original Message----- > From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 11, 2002 12:46 PM > To: Exchange Discussions > Subject: Message Filtering > > > Ok...this is kind of a screwy question, but I'm going to ask > it anyway. > > In the Exchange Admin under Site -> Configuration -> > Connections -> IMS -> Connections Tab -> Message Filtering... > 1.) You can block e-mail from individuals by adding their > e-mail address to this list and stopping/starting the IMS. > 2.) You can block e-mail from entire domains by adding > @domain.com to the list and stopping/starting the IMS. > > Q: Can you also block e-mail from an IP address by adding > @xxx.xxx.xxx.xxx? > > TIA, > > Jim Blunt > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > -------------------------------------------------------------- > -------------- > -- > The information contained in this email message is privileged > and confidential information intended only for the use of the > individual or entity to whom it is addressed. If the reader > of this message is not the intended recipient, you are hereby > notified that any dissemination, distribution or copy of this > message is strictly prohibited. If you have received this > email in error, please immediately notify Veronis Suhler > Stevenson by telephone (212)935-4990, fax (212)381-8168, or email > ([EMAIL PROTECTED]) and delete the message. Thank you. > > ============================================================== > ============== > == > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > -------------------------------------------------------------- > -------------- > -- > The information contained in this email message is privileged > and confidential information intended only for the use of the > individual or entity to whom it is addressed. If the reader > of this message is not the intended recipient, you are hereby > notified that any dissemination, distribution or copy of this > message is strictly prohibited. If you have received this > email in error, please immediately notify Veronis Suhler > Stevenson by telephone (212)935-4990, fax (212)381-8168, or email > ([EMAIL PROTECTED]) and delete the message. Thank you. > > ============================================================== > ============== > == > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
