Print Page | Close Window

Header Detail checking

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=3392
Printed Date: 02 May 2025 at 10:36am


Topic: Header Detail checking
Posted By: Guests
Subject: Header Detail checking
Date Posted: 07 April 2004 at 2:06pm

Can anyone tell me if a filter can be set to check specific header detail information, and then take or not take appropriate action on the message?

 

thx


Replies:
Posted By: bpogue99
Date Posted: 07 April 2004 at 4:14pm

Most of the header information is handled by different blacklists. I say most, not all of it is.

Received is handled by the Domain/IP blacklist.

From is handled by Domain/IP and Email From blacklists.

To/Subject have obvious blacklists.

So what's left is probably "MIME-Version" or "Content-" and some special ones. I'm not sure those would be good indicators of spam though.

Is this what you were looking for?

bill

Posted By: Guests
Date Posted: 07 April 2004 at 4:43pm

Hi Bill thanks for the quick reply.  Hmm..  kind of what I want to be able to is reject message's based upon the sending host name.  for instance. comcast.net uses the following for it's clients symbolics.

00a-a1-00.ne.client.comcast.net

These symbolics should not be able to send mail, they should be using smtp.comcast.net. Many of the ISPs are now encoding the clients this way to help email admins and ISPs deter home users from sending smtp directly.  This is what spammers or smtp hi-jackers use to send spam.

so if I could say write a script to say something like the following:

If header is = Received:*client.comcast.net* then action is to reject

Communigate pro offers this and it's very handy.  When I tested communigate pro with this feature, it eliminated almost all of the spam I receive.

let me know what you think?

 

 

 

 

 

Posted By: Guests
Date Posted: 07 April 2004 at 8:52pm

Jerry,
Have you tried putting   *client.comcast.net   in the from domain black list ? This should catch them.

g

Posted By: Guests
Date Posted: 07 April 2004 at 9:54pm

No, but I will give it a go.

 

Thanks for the help.

Posted By: Guests
Date Posted: 07 April 2004 at 10:11pm

George, tried it but it didn't work.  Keep in mind this is a field that is a hidden header field.

It is normally the field in the head that has the smtp server address.

Oh well, it was good try.

thx

 

Posted By: LogSat
Date Posted: 07 April 2004 at 10:38pm

Jerry,

Currently the only header against which keyword searches can be performed is the "Subject". We had in the past included all headers, but that caused too many false positives to be picked up because of the "strange" coding some headers have.

Adding a selected type of headers only, as the "Received:" ones, is not a bad idea. I've added it to the wish list, and will be implemented soon.

Roberto F.
LogSat Software

Posted By: Desperado
Date Posted: 10 April 2004 at 4:02am

If the IP that is the last server to "touch" your server is from a Comcast customer, rather that from a Comcast SMTP server then the *.client.Comcast.net will work in the blocked domains list.  In fact I use the following with very reasonable results:

(.+\.(client|dhcp|adsl)\..+\.(net|com|biz|org))

This tells SpamFilter to block messages that arrive directly from client machines if their provider has the "Polite" RDNS set up on their IP.  As an example, all our residential customers have RDNS that looks like the following: bg1-12.bernardc.adsl.mags.net.

The RegEx above will block this forcing the customer to mail through our SMTP server as he is supposed to.  For our "real" customers, RDNS looks like  gateway.asappromo.com. and therefore it would not get blocked by a filter like the one above.  The problem is that not all ISP's do this but most of the "brand name" ones do.

I am sure that a better expression could be put together but I slapped this one in when we started getting a rash of client based Spam ... mainly from Comcast and charter.

I am not sure how this will show up in the posting but ... below are examples of blocked messages:

3   http://spamman.mags.net/VirtAdmin/VirtResolveSpam.asp?QuarID=12752722&MsgID=9669039" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - Text OR http://spamman.mags.net/VirtAdmin/VirtResolveSpamAsHTML.asp?QuarID=12752722&MsgID=9669039" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - HTML    lab@easinc.com andersee@12-214-205-90.client.mchsi.com boost your seox life 4/8/2004 9:22:16 AM Domain is in local blacklist file 521 The domain this message was mailed from, (12-214-205-90.client.mchsi.com) is Blacklisted. Please contact the administrator for (12-214-205-90.client.mchsi.com). mx01
4   http://spamman.mags.net/VirtAdmin/VirtResolveSpam.asp?QuarID=12745296&MsgID=9663397" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - Text OR http://spamman.mags.net/VirtAdmin/VirtResolveSpamAsHTML.asp?QuarID=12745296&MsgID=9663397" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - HTML    ferris@mags.net kkreamer@12-202-231-173.client.insightBB.com boost your sefx life 4/8/2004 5:54:21 AM Domain is in local blacklist file 521 The domain this message was mailed from, (12-202-231-173.client.insightBB.com) is Blacklisted. Please contact the administrator for (12-202-231-173.client.insightBB.com). Razor

And, here is one of the headers:

 Received: from 12.214.205.90 by 66.181.192.97 (LogSat Software SMTP Server) Thu, 8 Apr 2004 09:22:16 -0400
Date: Fri, 09 Apr 2004 05:22:44 +0000
From: andersee@12-214-205-90.client.mchsi.com
To: Lab <lab@easinc.com>
References: <KCG764J415G7855J@easinc.com>
In-Reply-To: <KCG764J415G7855J@easinc.com>
Message-ID: <FEKDK3DK5CFGIKHE@12-214-205-90.client.mchsi.com>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 8bit
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <andersee@12-214-205-90.client.mchsi.com>
Subject: SPAM: boost your seox life

Hope this posts OK and does someone some good.

Regards,

Dan S.


Print Page | Close Window