Yeah I'll post more information later. Although the emails look likes viruses, containing .cpl files and .com files (which I'm blocking).
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Samuel J Stanaitis Sent: Tuesday, May 11, 2004 10:54 AM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Spoof Problem Just curious as to the nature of these emails, are the actual SPAM or do they look more like a virus? If it's a SPAM, you could find out who owns the IP Block that the messages are coming from, then complain. If they look more like viruses, it could most likely be the home computer of someone in your company, or one of your customers caught a virus and is pumping out emails negligently. Once you identify the IP, same thing, find out who owns the IP block and complain... Some headers and log snippits will help too. Sam -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Glenn Bullion Sent: Tuesday, May 11, 2004 10:30 AM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Spoof Problem Sorry I wasn't more clear. Was in a hurry typing and left out details. Many of my users now are receiving emails from other users inside the company (which of course the original user didn't send). It has their email address listed as the From, but they never sent it. Checking out the logs, the majority of the volume pickup lately seems to be coming from one address in the outside world. This address lists an internal user as the From (how they know this is unknown. Email harvesting programs? I'm new in this area). I blocked out the IP address in the SMTP control access, as well as adding the Verify EHLO and Reverse DNS lookup in the AntiSpam settings. I was just wondering if there were more steps to take. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Tuesday, May 11, 2004 10:21 AM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Spoof Problem >There is an IP address out there that is constantly sending us spoof mail, >and the volume has picked up. What do you mean by "spoof mail"? About 99+% of spammers send E-mail using spoofed return addresses. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
