GFI mail security test |
Post Reply 
|
| Author | |
Benny 
Newbie 
Joined: 17 January 2006 Status: Offline Points: 24 |
 Post Options
 Thanks(0)
 Quote Reply
 Topic: GFI mail security testPosted: 09 February 2006 at 5:27pm |
|
Interesting. 02/09/06 15:05:06:847 -- (5376) Connection from: 69.20.55.130 - Originating country : United States |
|
 |
|
|
Desperado
Senior Member 
Joined: 27 January 2005 Location: United States Status: Offline Points: 1143 |
Post Options
Thanks(0)
Quote Reply
Posted: 09 February 2006 at 7:46pm |
|
What?
|
|
|
The Desperado
Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
|
|
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 09 February 2006 at 7:54pm |
|
Looks like gfi.com is either infected or is testing Benny's servers... They're sending however a vbs attachment:
[Found prohibited attachment: viewthis.jpg.vbs] and that is a very, very strange way of "testing"... ! The IP 69.20.55.130 really appears to be from gfi, as pinging gfiservers.gfi.com does indeed resolve to 69.20.55.130. Weird, or better put, interesting, as Benny said. |
|
|
|
|
Benny
Guest Group 
|
Post Options
Thanks(0)
Quote Reply
Posted: 09 February 2006 at 9:20pm |
|
They send over those files to test how secure your email system is. I would suggest all of you guys try it. It's interesting that Spamfilter ISP immediately thought it's a spammer and blocked all emails. :-) I added their email address into whitelist and 4 of them came into my mail box. that is not good. |
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 09 February 2006 at 10:42pm |
|
If you add them to a whitelist they will bypass all filtering rules and be delivered, which is exactly what the whitelist is for. The only exception is if the email contains a virus, and you're using our antivirus plugin. In this case, any viruses will be blocked regardless of the whitelists.
Another special case is the IP blacklist cache. As this filter disconnects the remote IP even before any content is sent, if a sender has sent spam before and is thus in the IP blacklist cache, any attempts to send emails from a whitelisted address will fail, as the connection will be dropped before the sender's address is provided. |
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.195 seconds.