Mailing List CGatePro@mail.stalker.com Message #95621
From: Tobias Göller <tobias@brabbel.ch>
Subject: Re: Spam Queue
Date: Sun, 20 Jul 2008 00:59:46 +0200
To: CommuniGate Pro Discussions <CGatePro@mail.stalker.com>
X-Mailer: Apple Mail (2.928.1)

One question: Is there only one IP Address the Mails are originating or are those deliberately changing IPs?

CU
Tobias

On 18.07.2008, at 23:15, Aaron Willems wrote:

I'm dealing with a DOA attack. It's deliberate. As soon as I made the rule,
the person changed the spam from "MAILER-DAEMON" to "Undelivered Mail
Returned to Sender" with me as the sender. I wonder what my end user did. He
must have really made someone angry.

-- Aaron Willems
Systems Administrator
Lieberman Productions
455 9th St.
San Francisco, Ca 94103
415-955-0855


From: Christopher Bort <cbort@homesmagazine.com>
Reply-To: CommuniGate Pro Discussions <CGatePro@mail.stalker.com>
Date: Fri, 18 Jul 2008 12:13:29 -0700
To: CommuniGate Pro Discussions <CGatePro@mail.stalker.com>
Subject: Re: Spam Queue

On 07/18/08 11:56, aaron@lieberman.com (Aaron Willems) wrote:

I have an update, which should clarify my question. I worked with tech
support and determined that one person is getting what's called a
Scatter attack, or possibly a DOA attack. This one person is getting a
MAILER-DAEMON email in their inbox every minute. Is there a way to
write a script for this individual that would reject all emails from
MAILER-DAEMON?

Isn't that throwing the baby out with the bath water? Legitimate
bounce messages will also be from MAILER-DAEMON and you should
want to receive them. In any case, if you really want to do
this, I don't think you'd need a script. You should be able to
use a rule like

  Sender  is  MAILER-DAEMON@*

  Discard

or an RFC822 Receiver Banned Header Line like

  From: <MAILER-DAEMON@*>

[neither is tested, season to taste]

If you were using SpamAssassin, I'd recommend enabling the
VBounce plug-in. It's been effective on my installation to keep
backscatter out of my users' boxes while letting real bounces
through. I have no idea if SpamCatcher has anything similar.

From: Aaron Willems <aaron@lieberman.com>
Reply-To: CommuniGate Pro Discussions <CGatePro@mail.stalker.com>
Date: Fri, 18 Jul 2008 09:52:42 -0700
To: CommuniGate Pro Discussions <CGatePro@mail.stalker.com>
Subject: Spam Queue

Good Morning,

This morning, two of my users seems to be getting a Spam bomb, they
were getting hundreds of Spam emails in the Queue. I turned off Spam
Catcher, and nuked the queue. This released the queue for everyone
else, and mail is now flowing. Has anyone had experiences with this
before? I'm going to leave SpamCatcher off for a while, and monitor
things.  This is new to me, so any advice would be helpful.

-- Christopher Bort
Homes Magazine
email: <cbort@homesmagazine.com>
website: <http://www.homesmagazine.com/>
FAX: 775-284-1298
Phone: 775-284-1294x18

Real Estate Advertising/ Web Products/ Digital Printing Services

Serving: Wine Country Napa & Sonoma County, Marin County, San
Francisco Bay
Area, Santa Cruz County, Monterey County , San Luis Obispo
County & Santa
Barbara County, North Lake Tahoe & Truckee & South Lake Tahoe


#############################################################
This message is sent to you because you are subscribed to
 the mailing list <CGatePro@mail.stalker.com>.
To unsubscribe, E-mail to: <CGatePro-off@mail.stalker.com>
To switch to the DIGEST mode, E-mail to <CGatePro-digest@mail.stalker.com>
To switch to the INDEX mode, E-mail to <CGatePro-index@mail.stalker.com>
Send administrative queries to  <CGatePro-request@mail.stalker.com>



#############################################################
This message is sent to you because you are subscribed to
 the mailing list <CGatePro@mail.stalker.com>.
To unsubscribe, E-mail to: <CGatePro-off@mail.stalker.com>
To switch to the DIGEST mode, E-mail to <CGatePro-digest@mail.stalker.com>
To switch to the INDEX mode, E-mail to <CGatePro-index@mail.stalker.com>
Send administrative queries to  <CGatePro-request@mail.stalker.com>

Subscribe (FEED) Subscribe (DIGEST) Subscribe (INDEX) Unsubscribe Mail to Listmaster