Re: [SAtalk] USER IN WHITELIST spammer scam

Ryan Moore Thu, 14 Aug 2003 17:59:07 -0700

We get alot (well, used to) of spam that has forged from/return-path headers. Whitelisting like that isn't really the most effective really. One thing you could do is that if you have a DNSRBL system setup for internal use is that you could add the smtp servers that your users use to that DNSRBL and define another rbl test in your local.cf file that checks that zone and give any hits from that test a negative score, like the BONDED_SENDERS test.

Ryan Moore
----------
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net

Greg Webster wrote:

Thanks, it is. What I'm wondering now is how the local user's address is
in the Return-Path header. Unless the spammer is forging the Return-Path
header (making it the same as the recipient), in which case we can't
really trust the Return-Path header at all for whitelisting.

Greg

On Thu, 14 Aug 2003 15:10:13 -0400: Matt Kettler skribon:

At 10:58 AM 8/14/2003 -0700, Greg Webster wrote:

'[EMAIL PROTECTED]' is not in our whitelist, and neither is '[EMAIL PROTECTED]'
or any variant.

It appears that there is a problem with the USER_IN_WHITELIST regexp
to me, but I may be mistaken. I can't think of any other way that
this would have made it through. Help?

is [EMAIL PROTECTED] in your whitelist_from?

If so, then the rule properly matched the Return-Path header.

-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] USER IN WHITELIST spammer scam

Reply via email to