Coming from everywhere

[James R. Stevens]

We've been looking at the origin or the NDR for a week now. They are coming from many MTA's on the Internet. None of our users are sending the original -email or even know anyone at the claimed domains.
We believe this is some type of spam attack used by altering the return receipt within the header causing the bounce to penetrate MailScanner to our users. (A more experienced Mail Admin can explain this technique better)

So the question is how to drop/filter the incorrect NDR's?

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Matt Kettler
Sent: Friday, April 20, 2007 10:59 AM
To: MailScanner discussion
Subject: Re: Coming from everywhere

James R. Stevens wrote:
> Have we already addressed these ‘Failure notice’ , ‘Undeliverable’
> –mails that are coming from everywhere. It seems to be more and more
> users are seeing these messages getting through. Some 100 per day.
> 
>  
> 
> Anyone else seeing these things?  Different subjects etc..

http://www.google.com/search?hl=en&q=backscatter+email&btnG=Search
-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.