Hmmm, interesting concept Scott. Set up a bogus mail server that is a open
relay, post a question on lost of newgroups. When the spammers come in dump
the mail to /dev/null and harvest the IPs, Subjects, and From addresses for
populating a SPAM database. Cool :)
Phil
----- Original Message -----
From: "Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Saturday, March 03, 2001 9:23 PM
Subject: Re: [IMail Forum] question to Declude guys
> > Frankly, I thought that since we are not ISP, our servers will
> > never be compromised.
>
> A lot of people think that, until they get hit. What many spammers do is
once a mail server stops accepting their spam, they just take the next
E-mail address on the list, and try the mail servers for that domain. So if
anyone on your system receives any spam, there's a good chance a spammer
will find you some day.
>
> > At this moment I am running antispam relay that is a part of
> > Webshield SMTP antiviris. However, I would prefer to simply
> > filter the spam before it hits Webshield.
>
> I'm assuming that you are talking about outgoing spam (relaying), not
incoming spam.
>
> The spammer has chosen which IP address and port they are going to send
to. So, if you wanted IMail/Declude to deal with the spam, you would need
to have IMail/Declude "in front of" WebShield. But, if you do that, mail
will come directly to IMail and stay there, so WebShield would be out of the
picture.
>
> > Is it possible to incorporate Declude antispam into this chain,
> > and if yes, what whould be the best setup in terms of resource
> > usage and protection for mail server?
>
> Since you have WebShield already, and you seem to have it set up with some
anti-spam ability, I would ask what you are trying to accomplish with
Declude.
>
> As far as relaying goes, the best option is to have your server locked
down, so that it only allows relaying for people coming from trusted IP
addresses and/or using SMTP AUTH.
>
> Declude JunkMail Pro will allow you to run its spam tests against outgoing
E-mail, and let you block E-mail that fails the various tests. However, if
a spammer is coming from a "clean" IP address, there is a good chance that
they could still send lots of E-mail through your server.
>
> We are working on a "hijack detector" which will allow you to run an open
relay (almost) safely, by restricting the number of E-mails that can be sent
in a given timeframe. However, it will probably be at least a month before
that goes into beta. The current version will let you see the IP addresses
that are relaying, and how many E-mails have been relayed, which can help
you detect the attacks, but the current version doesn't take action on them
yet.
>
> Of course, if you are talking about incoming spam, that's a different
story, and Declude would be able to catch a lot of it, although it couldn't
be placed in front of WebShield (without purchasing an extra copy of IMail
as well). We're also working on a header analysis test that should catch
about 80%-90% of spam with very few false positives.
>
>
> --
> -Scott
>
> Declude: Anti-virus and Anti-spam solutions for IMail.
http://www.declude.com
> --
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
