Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Spammers using SpamFilter to send Spam
  FAQ FAQ  Forum Search   Register Register  Login Login

Spammers using SpamFilter to send Spam

 Post Reply Post Reply
Author
ITI Computers View Drop Down
Newbie
Newbie


Joined: 12 June 2008
Status: Offline
Points: 12
Post Options Post Options   Thanks (0) Thanks(0)   Quote ITI Computers Quote  Post ReplyReply Direct Link To This Post Topic: Spammers using SpamFilter to send Spam
    Posted: 26 July 2010 at 10:03am
Hello,
 
I discovered on Friday that Spammers are using the SpamFilter program to send out their Spam. I did not know that was possible. We talked to our Host Provider RackSpace and they showed us how it is being done, the following is from their Technician...
 
"What's happening is spammers are connecting to the spam filter on the 67.192.242.2 IP address. They send a message to a bogus recipient on the aps2000.com domain, and set the Reply-To address in the headers to whoever they want to send spam to. I was able to test and exploit this once I figured out what was going on.

When the spam filter tries to deliver to Imail, it gets an error that the user is invalid. The spam filter then sends an error message to the Reply-To address, using "Webmaster" <webmaster@iticomputers.com> as it's from address. Because Imail allows relay from 192.168.100.199, it sends this error message out.

It essentially is backscatter spam, but the wrinkle is Imail isn't sending backscatter, the problem is the way your spam filter handles errors.

In order to solve this issue, you need to configure your spam filter not to send an error message when a user doesn't exist."
 
Please advise on how we can configure SpamFilter to prevent this.
We are using Version 4.0.1.785
 
Thanks,
Bill Turner
 

 
ITI Computers
Web Design and Hosting
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 26 July 2010 at 9:23pm
Bill,

SpamFilter v4.2.4.830 that was released a few months ago has the following feature, which is exactly what you're looking for: 

/ New to VersionNumber = '4.2.4.830';
{TODO -cNew To avoid backscatter, if an incoming email passes all filtering rules, but cannot be forwarded (ex. mailbox full, non-existent user), SpamFilter maintains open the incoming remote connection until it can verify with the destination server that the email can be delivered. If not, a 5xx error is output forcing the remote server to generate the NDR, rather than having SpamFilter send an NDR notification email}

With versions of SpamFilter prior to v4.2, a very effective way to both eliminate the backscatter and to at the same time reduce spam, is to implement the "Authorized TO" whitelist in SpamFilter. If you provide SpamFilter a list with all the valid email users on your system, SpamFilter will immediately reject any attempt to deliver emails to non-existent users. This causes an immediate disconnect of the spammer, without any NDRs (non-deliverable receipt emails) being generated.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
ITI Computers View Drop Down
Newbie
Newbie


Joined: 12 June 2008
Status: Offline
Points: 12
Post Options Post Options   Thanks (0) Thanks(0)   Quote ITI Computers Quote  Post ReplyReply Direct Link To This Post Posted: 27 July 2010 at 9:10am
Thanks for the reply.
Adding our users to the "Authorized To" list is not a viable option, as we have 100's of domains and 1000's of users. And more being added all the time, which we do not control.
 
I upgraded our SF program yesterday to the newest version on the site, SpamFilter ISP (v4.1.2.812), I did not see a link to the 4.2.4.830 version. Is it stable? And can you provide a link to it either here or to my email?
ITI Computers
Web Design and Hosting
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.047 seconds.