RE: Getting abused by backscatter spam

2011-03-22 Thread Driessen
On Behalf Of Simon > > Received: from localhost (localhost [127.0.0.1]) by > mail-in2.{ourdomain}.net (Postfix) with ESMTP id 038A71278B for > ; Mon, 21 Mar 2011 16:21:11 +1300 (NZDT) > X-Virus-Scanned: Debian amavisd-new at mail-in2.{ourdomain}.net > Received: from mail-in2.{ourdomain}.net ([127.

Re: Getting abused by backscatter spam

2011-03-22 Thread Simon
On Wed, Mar 23, 2011 at 11:56 AM, mouss wrote: > 1) nothing in your sample shows that you use postfix. > if using postfix, why is Return-Path in the middle of headers? > > 2) given the return-path you show, this is not backscatter. maybe you > meant envelope sender forgery? > > 3)  93.85.177.92 i

Re: Getting abused by backscatter spam

2011-03-22 Thread mouss
Le 22/03/2011 05:38, Simon a écrit : > Hi There, > > We are using postfix on debian lenny. Everything is mysql backed and > we are using amavisd-new (spamassassin with daily updates from > saupdates.openprotect.com and updates.spamassassin.org & clam-av), > postfix-policy greylisting and postfix-p

Re: Getting abused by backscatter spam

2011-03-22 Thread Robert Schetterer
Am 22.03.2011 05:38, schrieb Simon: > Hi There, > > We are using postfix on debian lenny. Everything is mysql backed and > we are using amavisd-new (spamassassin with daily updates from > saupdates.openprotect.com and updates.spamassassin.org & clam-av), > postfix-policy greylisting and postfix-po

Getting abused by backscatter spam

2011-03-21 Thread Simon
Hi There, We are using postfix on debian lenny. Everything is mysql backed and we are using amavisd-new (spamassassin with daily updates from saupdates.openprotect.com and updates.spamassassin.org & clam-av), postfix-policy greylisting and postfix-policyd-spf-python. All updates applied. But we a