BLOCKING SPAM USING SENDERS NAME AND NOT USING THE DOMAIN NAME OR EMAIL ADDRESS
Hi Skunks, I have a guy spamming my network and every time i block the email address and IP address on my firewall he sends with a different address, domain and ip address. I would like to know if there is a way i can block such a person. -- Kind regards Peter Ngali, peterngali@gmail.com Mob: +254 722569981
Block senders name, won't he just change the senders' name? //Never underestimate the power of rocks. especially flying rocks. On Wed, Jul 10, 2013 at 9:41 AM, peter Ngali <peterngali@gmail.com> wrote:
Hi Skunks,
I have a guy spamming my network and every time i block the email address and IP address on my firewall he sends with a different address, domain and ip address.
I would like to know if there is a way i can block such a person.
-- Kind regards
Peter Ngali, peterngali@gmail.com Mob: +254 722569981
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
--
I don't understand how you manage to block an e-mail address on a firewall. How do you do it? I know there are applications that can read log files and do something with a match on a regexp, but I'm just curious how you do this in your situation. If you're using an SMTP engine, you can do what in Exim parlance we refer to as "sender callout"/verification. You can RTFM for your SMTP engine on how to do that. An even simpler way is to use greylisting with throttling. On 10 July 2013 09:41, peter Ngali <peterngali@gmail.com> wrote:
Hi Skunks,
I have a guy spamming my network and every time i block the email address and IP address on my firewall he sends with a different address, domain and ip address.
I would like to know if there is a way i can block such a person.
-- Kind regards
Peter Ngali, peterngali@gmail.com Mob: +254 722569981
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 "I can't hear you -- I'm using the scrambler."
Do you have a mail gateway/filter in-front of your real mail server? If you do, is it checking for: - SPF - you say he changes domains and the mails pass but that should not work if your server is checking for this - Valid helo (with fully qualified domain name) - PTR - you say he changes IPs and the mails pass but that should not work if your server is checking for this Also, you can mark messages as SPAM and drop them based on the content of the message and not only the sender. You can train your mail filter to look for specific words in the mail and drop the email if those words are in the content of the email. This is best done a mail filter that is in-front of the real mail server Kevin On Wed, Jul 10, 2013 at 10:03 AM, Odhiambo Washington <odhiambo@gmail.com>wrote:
I don't understand how you manage to block an e-mail address on a firewall. How do you do it? I know there are applications that can read log files and do something with a match on a regexp, but I'm just curious how you do this in your situation.
If you're using an SMTP engine, you can do what in Exim parlance we refer to as "sender callout"/verification. You can RTFM for your SMTP engine on how to do that.
An even simpler way is to use greylisting with throttling.
On 10 July 2013 09:41, peter Ngali <peterngali@gmail.com> wrote:
Hi Skunks,
I have a guy spamming my network and every time i block the email address and IP address on my firewall he sends with a different address, domain and ip address.
I would like to know if there is a way i can block such a person.
-- Kind regards
Peter Ngali, peterngali@gmail.com Mob: +254 722569981
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 "I can't hear you -- I'm using the scrambler."
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
Kevin, No I don't have a mail gateway in front of my mail server. I have resulted to marking them as spam though just to avoid them hitting the in box of the users for the time being. I will check on how i have configured - SPF , Valid helo (with fully qualified domain name) and PTR . On Wed, Jul 10, 2013 at 11:33 AM, Kevin G. Chege <kevin.chege@gmail.com>wrote:
Do you have a mail gateway/filter in-front of your real mail server? If you do, is it checking for:
- SPF - you say he changes domains and the mails pass but that should not work if your server is checking for this - Valid helo (with fully qualified domain name) - PTR - you say he changes IPs and the mails pass but that should not work if your server is checking for this
Also, you can mark messages as SPAM and drop them based on the content of the message and not only the sender. You can train your mail filter to look for specific words in the mail and drop the email if those words are in the content of the email. This is best done a mail filter that is in-front of the real mail server
Kevin
On Wed, Jul 10, 2013 at 10:03 AM, Odhiambo Washington <odhiambo@gmail.com>wrote:
I don't understand how you manage to block an e-mail address on a firewall. How do you do it? I know there are applications that can read log files and do something with a match on a regexp, but I'm just curious how you do this in your situation.
If you're using an SMTP engine, you can do what in Exim parlance we refer to as "sender callout"/verification. You can RTFM for your SMTP engine on how to do that.
An even simpler way is to use greylisting with throttling.
On 10 July 2013 09:41, peter Ngali <peterngali@gmail.com> wrote:
Hi Skunks,
I have a guy spamming my network and every time i block the email address and IP address on my firewall he sends with a different address, domain and ip address.
I would like to know if there is a way i can block such a person.
-- Kind regards
Peter Ngali, peterngali@gmail.com Mob: +254 722569981
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 "I can't hear you -- I'm using the scrambler."
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Kind regards Peter Ngali, peterngali@gmail.com Mob: +254 722569981
What SMTP engine do you use? On 10 July 2013 12:11, peter Ngali <peterngali@gmail.com> wrote:
Kevin, No I don't have a mail gateway in front of my mail server.
I have resulted to marking them as spam though just to avoid them hitting the in box of the users for the time being. I will check on how i have configured - SPF , Valid helo (with fully qualified domain name) and PTR .
On Wed, Jul 10, 2013 at 11:33 AM, Kevin G. Chege <kevin.chege@gmail.com>wrote:
Do you have a mail gateway/filter in-front of your real mail server? If you do, is it checking for:
- SPF - you say he changes domains and the mails pass but that should not work if your server is checking for this - Valid helo (with fully qualified domain name) - PTR - you say he changes IPs and the mails pass but that should not work if your server is checking for this
Also, you can mark messages as SPAM and drop them based on the content of the message and not only the sender. You can train your mail filter to look for specific words in the mail and drop the email if those words are in the content of the email. This is best done a mail filter that is in-front of the real mail server
Kevin
On Wed, Jul 10, 2013 at 10:03 AM, Odhiambo Washington <odhiambo@gmail.com
wrote:
I don't understand how you manage to block an e-mail address on a firewall. How do you do it? I know there are applications that can read log files and do something with a match on a regexp, but I'm just curious how you do this in your situation.
If you're using an SMTP engine, you can do what in Exim parlance we refer to as "sender callout"/verification. You can RTFM for your SMTP engine on how to do that.
An even simpler way is to use greylisting with throttling.
On 10 July 2013 09:41, peter Ngali <peterngali@gmail.com> wrote:
Hi Skunks,
I have a guy spamming my network and every time i block the email address and IP address on my firewall he sends with a different address, domain and ip address.
I would like to know if there is a way i can block such a person.
-- Kind regards
Peter Ngali, peterngali@gmail.com Mob: +254 722569981
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 "I can't hear you -- I'm using the scrambler."
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Kind regards
Peter Ngali, peterngali@gmail.com Mob: +254 722569981
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 "I can't hear you -- I'm using the scrambler."
Wash, Thanks for the advice. You can only block the IP of the mail server on the firewall and i don't use any application to read the log files. On Wed, Jul 10, 2013 at 10:03 AM, Odhiambo Washington <odhiambo@gmail.com>wrote:
I don't understand how you manage to block an e-mail address on a firewall. How do you do it? I know there are applications that can read log files and do something with a match on a regexp, but I'm just curious how you do this in your situation.
If you're using an SMTP engine, you can do what in Exim parlance we refer to as "sender callout"/verification. You can RTFM for your SMTP engine on how to do that.
An even simpler way is to use greylisting with throttling.
On 10 July 2013 09:41, peter Ngali <peterngali@gmail.com> wrote:
Hi Skunks,
I have a guy spamming my network and every time i block the email address and IP address on my firewall he sends with a different address, domain and ip address.
I would like to know if there is a way i can block such a person.
-- Kind regards
Peter Ngali, peterngali@gmail.com Mob: +254 722569981
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 "I can't hear you -- I'm using the scrambler."
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Kind regards Peter Ngali, peterngali@gmail.com Mob: +254 722569981
participants (4)
-
Kevin G. Chege -
MotoBaridi -
Odhiambo Washington -
peter Ngali