Its still not going to work. That particular filter only works on the From header entry, which is not the problem. You're trying to filter a relay machine using from address.
Same place in the IMC, but rather than using Message Filter, select "Specify By Host" and add that IP address, then set it to reject connections. Probably have to bounce the IMC afterwords. Roger ------------------------------------------------------ Roger D. Seielstad - MCSE Sr. Systems Administrator Peregrine Systems Atlanta, GA > -----Original Message----- > From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 25, 2002 6:59 PM > To: Exchange Discussions > Subject: RE: Message Filtering > > > Andy, > > Based on one of the headers in a previous spam, I typed in > "@210.73.88.134" (without the quotes of course) and > stopped/started my IMS. > > I received another one on Thursday morning. Below is the > partial header...this is the first received line in the header: > > Received: from zhongxin (210.73.88.134 [210.73.88.134]) by > calmedntsbs.calmedeqpt.com with SMTP (Microsoft Exchange > Internet Mail Service Version 5.5.2653.13) > id FA85TJSL; Thu, 21 Feb 2002 17:06:16 -0800 > Reply-To: [EMAIL PROTECTED] > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > > -----Original Message----- > From: Andy David [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 25, 2002 3:33 PM > To: Exchange Discussions > Subject: RE: Message Filtering > > > Just curious, what exactly did you type in? > > > > -----Original Message----- > From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 25, 2002 4:59 PM > To: Exchange Discussions > Subject: RE: Message Filtering > > > I told you I would let you know if this works or not...looks > like it doesn't. I blocked @xxx.xxx.xxx.xxx on 2/11/02. A > couple of days ago, I saw another spam roll through that had > this same originating IP in the Internet Headers > section...and yes, I stopped/started the IMS after making the change. > > Jim Blunt > > -----Original Message----- > From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 11, 2002 9:59 AM > To: Exchange Discussions > Subject: RE: Message Filtering > > > Cool...thanks Andy. I figured it probably would, but I > wasn't sure. I will let you know in the next couple of days > if it actually works. > > Jim > > -----Original Message----- > From: Andy David [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 11, 2002 9:47 AM > To: Exchange Discussions > Subject: RE: Message Filtering > > > Havent done it, but I would say yes. > > -----Original Message----- > From: Blunt, James H (Jim) [mailto:[EMAIL PROTECTED]] > Sent: Monday, February 11, 2002 12:46 PM > To: Exchange Discussions > Subject: Message Filtering > > > Ok...this is kind of a screwy question, but I'm going to ask > it anyway. > > In the Exchange Admin under Site -> Configuration -> > Connections -> IMS -> Connections Tab -> Message Filtering... > 1.) You can block e-mail from individuals by adding their > e-mail address to this list and stopping/starting the IMS. > 2.) You can block e-mail from entire domains by adding > @domain.com to the list and stopping/starting the IMS. > > Q: Can you also block e-mail from an IP address by adding > @xxx.xxx.xxx.xxx? > > TIA, > > Jim Blunt > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > -------------------------------------------------------------- > -------------- > -- > The information contained in this email message is privileged > and confidential information intended only for the use of the > individual or entity to whom it is addressed. If the reader > of this message is not the intended recipient, you are hereby > notified that any dissemination, distribution or copy of this > message is strictly prohibited. If you have received this > email in error, please immediately notify Veronis Suhler > Stevenson by telephone (212)935-4990, fax (212)381-8168, or email > ([EMAIL PROTECTED]) and delete the message. Thank you. > > ============================================================== > ============== > == > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > -------------------------------------------------------------- > -------------- > -- > The information contained in this email message is privileged > and confidential information intended only for the use of the > individual or entity to whom it is addressed. If the reader > of this message is not the intended recipient, you are hereby > notified that any dissemination, distribution or copy of this > message is strictly prohibited. If you have received this > email in error, please immediately notify Veronis Suhler > Stevenson by telephone (212)935-4990, fax (212)381-8168, or email > ([EMAIL PROTECTED]) and delete the message. Thank you. > > ============================================================== > ============== > == > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
