Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Spammers Getting Smarter - Using My Own IP
  FAQ FAQ  Forum Search   Register Register  Login Login

Spammers Getting Smarter - Using My Own IP

 Post Reply Post Reply
Author
Lee View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Lee Quote  Post ReplyReply Direct Link To This Post Topic: Spammers Getting Smarter - Using My Own IP
    Posted: 31 March 2003 at 12:00am

I noticed that I have received a few new spams lately that are making it through Spamfilter and the MAPs lookup.

They are doing this by taking my own IP address and putting it in the message header and sending email to Spamfilter as if it is coming from my domain.

The question is what would happen if I block my own IP address, would this work in stopping this practice ? Or would this kill my own email ?

Lee

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 31 March 2003 at 12:00am

When SpamFilter performs a MAPS lookup, it is checking the IP that is making the connection with your SMTP server, it is *not* checking the email headers. Even if spammers do place it in the headers, that is not interfering with the MAPS lookup. Placing your own IP in a blacklist won't help either, since the IP blacklist also only checks the physical IP making the connection.

Back to Top
Lee View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Lee Quote  Post ReplyReply Direct Link To This Post Posted: 31 March 2003 at 12:00am

Does it look like they are spoofing my IP then ?

The xxx.xx.x is my ip and mydomain.com is where they are putting my domain name.

================================================== Received: from ns [198.xxx.xx.x] by MYDOMAIN.com with ESMTP (SMTPD32-6.00) id A104B88D0266; Mon, 31 Mar 2003 14:03:32 -0500 Received: from 207.190.245.171 by 198.xxx.xx.x Mon, 31 Mar 2003 14:03:30 -0500 Received: from smtp0943.mail.yahoo.com ([195.146.212.215]) by omnify-exchange.OMNIFYSOFT.COM with Microsoft SMTPSVC(5.0.2195.2966); Mon, 31 Mar 2003 13:51:21 -0500 Date: Mon, 31 Mar 2003 13:58:12 -0500 From: "Paul" <7eat@aol.com> =================================================

Thanks for your help,

Lee

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 31 March 2003 at 12:00am

Lee,

I do not see the headers SpamFilter adds in this email. Has it been received by SpamFilter or did it go directly to your SMTP server?

Roberto

Back to Top
Lee View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Lee Quote  Post ReplyReply Direct Link To This Post Posted: 31 March 2003 at 12:00am

It's in there I just took it out to clean up the post so it would be easier to read.

It came directly into Spamfilter not my internal mail server.

Lee

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.027 seconds.