<HTML>
<HEAD>
<TITLE>Re: Problem with SPam, some SPAM going through filter.</TITLE>
</HEAD>
<BODY>
<FONT SIZE="4"><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>I had lots of these recently one day some 200+ reached our CEO! Ouch. Anyway look up Watermarking and “joe-job” attacks. In the MailScanner.conf try adding this feature and pushing all your mail out via your mailscanner gateway so then you know that any NDR messages have originated from yourself.<BR>
<BR>
M<BR>
<BR>
# Do you want to add a watermark to each email message?<BR>
# Setting this enables delivery error messages to be identified as yours<BR>
# so you want to see them. Delivery error messages without valid watermarks<BR>
# are treated as spam (or whatever you set below), as you probably don't<BR>
# want to see them. Spammers can send vast quantities of spam claiming to<BR>
# come from you so that you get all the delivery errors (known as a "joe-job"<BR>
# attack).<BR>
# This can also be the filename of a ruleset.<BR>
Add Watermark = yes<BR>
<BR>
<BR>
On 30/07/2008 09:40, "Ali Jawad" <alijawad1@gmail.com> wrote:<BR>
<BR>
</SPAN></FONT></FONT><BLOCKQUOTE><FONT SIZE="4"><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'> Hi <BR>
I am running Mailscanner/Mailwatch I am facing the following problem. A lot of emails are passing through my incoming spam filter camouflaged as NDR. Stating subject such as "Message Could Not Be Delivered" and "User not available". I clearly know this is spam because I closely monitor outgoing emails and all is fine there.<BR>
What can I do so that those emails are marked as Spam correctly instead of reaching Outlook as System Administrator messages. Their scores are almost always below 2.<BR>
<BR>
Some of the originating email servers are :<BR>
<BR>
map.ttn.ru <a href="http://map.ttn.ru/"><http://map.ttn.ru/></a> <BR>
relay.tpn.ru <a href="http://relay.tpn.ru/"><http://relay.tpn.ru/></a> <BR>
earth.sysprog.spb.ru <a href="http://earth.sysprog.spb.ru/"><http://earth.sysprog.spb.ru/></a> <BR>
mail.couo.ru <a href="http://mail.couo.ru/"><http://mail.couo.ru/></a> <BR>
mint.ldsoft.ru <a href="http://mint.ldsoft.ru/"><http://mint.ldsoft.ru/></a> <BR>
<BR>
Can I block those server ?<BR>
<BR>
Thanks<BR>
<BR>
<HR ALIGN=CENTER SIZE="3" WIDTH="95%"><BR>
</SPAN></FONT></FONT></BLOCKQUOTE>
</BODY>
</HTML>