RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email
Although a range of IP's can be used in filters it is not so in this case as we are looking for a string rather than an IP address as such. Another way to achieve the same result would be to add a unique outbound header eg. XOUTHEADER X-AUTH: Yes Then In the FILTER-BACKSCATTER BODYEND CONTAINSX-AUTH: Yes David Barker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dean Lawrence Sent: Wednesday, April 30, 2008 5:46 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email Dave, Is there a way to specify a range of IPs in the backscatter filter? My server has about 50 IPs and it would be nice not to have to enter all of them. 8- ) Thanks, Dean On Tue, Apr 22, 2008 at 1:06 PM, David Barker [EMAIL PROTECTED] wrote: FILTER-NOSENDER is used to see if it is an automated message/response from a server. If the message triggers FILTER-NOSENDER we then go onto use FILTER-BACKSCATTER to score on phrases within the content. Also in the FILTER-BACKSCATTER there is a condition that if your server IP is found in the body of the bounced message we can assume the original message was from your server and therefore the FILTER-BACKSCATTER should not be run this is to help reduce false positives. -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email
Dave, Is there a way to specify a range of IPs in the backscatter filter? My server has about 50 IPs and it would be nice not to have to enter all of them. 8- ) Thanks, Dean On Tue, Apr 22, 2008 at 1:06 PM, David Barker [EMAIL PROTECTED] wrote: FILTER-NOSENDER is used to see if it is an automated message/response from a server. If the message triggers FILTER-NOSENDER we then go onto use FILTER-BACKSCATTER to score on phrases within the content. Also in the FILTER-BACKSCATTER there is a condition that if your server IP is found in the body of the bounced message we can assume the original message was from your server and therefore the FILTER-BACKSCATTER should not be run this is to help reduce false positives. -- __ Dean Lawrence, CIO/Partner Internet Data Technology 888.GET.IDT1 ext. 701 * fax: 888.438.4381 http://www.idatatech.com/ Corporate Internet Development and Marketing Specialists --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email
Don't know if Declude (or anyone) can help, but we are seeing a L O T of bounce-backs that show that the SPAMMERS are using valid postmaster@domain (that we host) as their FROM address and send the SPAM out thru Post Offices other than ours. When the SPAM goes to a non-existant address, it bounces back to the valid postmaster@domain on my Server. We are getting 5,000 - 10,000 of these bounces per day.. Any suggestions? Thanks very much Ferrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email
This is known as backscatter you can read about it here. http://www.spamresource.com/2007/02/backscatter-what-is-it-how-do-i-stop-it. html If you go to the Declude My Account home page you will find a link to download a zip file which contains 2 filters you can use against backscatter. Download these and extract them to your \declude\filters folder and then call the filters from your global.cfg to be aggressive score the FILTER-NOSENDER with 10 or more points. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard Sent: Tuesday, April 22, 2008 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email Importance: High Don't know if Declude (or anyone) can help, but we are seeing a L O T of bounce-backs that show that the SPAMMERS are using valid postmaster@ mailto:[EMAIL PROTECTED] domain (that we host) as their FROM address and send the SPAM out thru Post Offices other than ours. When the SPAM goes to a non-existant address, it bounces back to the valid postmaster@ mailto:[EMAIL PROTECTED] domain on my Server. We are getting 5,000 - 10,000 of these bounces per day.. Any suggestions? Thanks very much Ferrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email
Hi Ferrell, Its called backscatter. I had to post some info about it on my site for my own clients. Feel free to copy it. http://www.123marbella.net/kb.html#6 I am currently looking at alligate gateway in order to add some added protection to my mail network. However, declude does have a filter for this and i did install it and no one has really complained since then so it may have worked. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard Sent: 22 April 2008 17:22 To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email Importance: High Don't know if Declude (or anyone) can help, but we are seeing a L O T of bounce-backs that show that the SPAMMERS are using valid postmaster@ mailto:[EMAIL PROTECTED] domain (that we host) as their FROM address and send the SPAM out thru Post Offices other than ours. When the SPAM goes to a non-existant address, it bounces back to the valid postmaster@ mailto:[EMAIL PROTECTED] domain on my Server. We are getting 5,000 - 10,000 of these bounces per day.. Any suggestions? Thanks very much Ferrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email
David, I have Junkmail Pro... can I use the NOSENDER filter? If so, where can I find it? Thanks, E. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, April 22, 2008 11:32 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email This is known as backscatter you can read about it here. http://www.spamresource.com/2007/02/backscatter-what-is-it-how-do-i-stop-it. html If you go to the Declude My Account home page you will find a link to download a zip file which contains 2 filters you can use against backscatter. Download these and extract them to your \declude\filters folder and then call the filters from your global.cfg to be aggressive score the FILTER-NOSENDER with 10 or more points. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard Sent: Tuesday, April 22, 2008 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email Importance: High Don't know if Declude (or anyone) can help, but we are seeing a L O T of bounce-backs that show that the SPAMMERS are using valid postmaster@ mailto:[EMAIL PROTECTED] domain (that we host) as their FROM address and send the SPAM out thru Post Offices other than ours. When the SPAM goes to a non-existant address, it bounces back to the valid postmaster@ mailto:[EMAIL PROTECTED] domain on my Server. We are getting 5,000 - 10,000 of these bounces per day.. Any suggestions? Thanks very much Ferrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email
David, I never added your backscatter, should I do it. What does it do exactly. Stephan _ De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de David Barker Envoyé : 22 avril, 2008 11:32 À : declude.junkmail@declude.com Objet : RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email This is known as backscatter you can read about it here. http://www.spamresource.com/2007/02/backscatter-what-is-it-how-do-i-stop-it. html If you go to the Declude My Account home page you will find a link to download a zip file which contains 2 filters you can use against backscatter. Download these and extract them to your \declude\filters folder and then call the filters from your global.cfg to be aggressive score the FILTER-NOSENDER with 10 or more points. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard Sent: Tuesday, April 22, 2008 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email Importance: High Don't know if Declude (or anyone) can help, but we are seeing a L O T of bounce-backs that show that the SPAMMERS are using valid postmaster@ mailto:[EMAIL PROTECTED] domain (that we host) as their FROM address and send the SPAM out thru Post Offices other than ours. When the SPAM goes to a non-existant address, it bounces back to the valid postmaster@ mailto:[EMAIL PROTECTED] domain on my Server. We are getting 5,000 - 10,000 of these bounces per day.. Any suggestions? Thanks very much Ferrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email
FILTER-NOSENDER is used to see if it is an automated message/response from a server. If the message triggers FILTER-NOSENDER we then go onto use FILTER-BACKSCATTER to score on phrases within the content. Also in the FILTER-BACKSCATTER there is a condition that if your server IP is found in the body of the bounced message we can assume the original message was from your server and therefore the FILTER-BACKSCATTER should not be run this is to help reduce false positives. David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stephan Chayer Sent: Tuesday, April 22, 2008 12:52 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email David, I never added your backscatter, should I do it. What does it do exactly. Stephan _ De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de David Barker Envoyé : 22 avril, 2008 11:32 À : declude.junkmail@declude.com Objet : RE: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email This is known as backscatter you can read about it here. http://www.spamresource.com/2007/02/backscatter-what-is-it-how-do-i-stop-it. html If you go to the Declude My Account home page you will find a link to download a zip file which contains 2 filters you can use against backscatter. Download these and extract them to your \declude\filters folder and then call the filters from your global.cfg to be aggressive score the FILTER-NOSENDER with 10 or more points. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ferrell Ard Sent: Tuesday, April 22, 2008 11:22 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] SPAMMERS using postmaster@domain in their FROM email Importance: High Don't know if Declude (or anyone) can help, but we are seeing a L O T of bounce-backs that show that the SPAMMERS are using valid postmaster@ mailto:[EMAIL PROTECTED] domain (that we host) as their FROM address and send the SPAM out thru Post Offices other than ours. When the SPAM goes to a non-existant address, it bounces back to the valid postmaster@ mailto:[EMAIL PROTECTED] domain on my Server. We are getting 5,000 - 10,000 of these bounces per day.. Any suggestions? Thanks very much Ferrell --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
