Index: [Article Count Order] [Thread]

Date:  Tue, 30 Dec 2008 14:42:40 -0600
From:  "Gerald Waugh" <gwaugh (at mark) frontstreetnetworks.com>
Subject:  [coba-e:14578] Re: spam sent using my email address
To:  <coba-e (at mark) bluequartz.org>
Message-Id:  <011f01c96abf$2c071810$6401a8c0@systemax>
In-Reply-To:  <8236034.271230668626473.JavaMail.root (at mark) z01.pfinders.com>
X-Mail-Count: 14578

Herb Rubin wrote Tuesday, December 30, 2008 2:24 PM
> 
> Do you have an SPF record setup for you domain?
> Is that DSL circuit on Verizon's network allowed to send email as you?
> 

Yes, have SPF.
The email's originate from many different url/ips
many .ru, .tw, .jp
They are coming in from all over the world.

I did add many to the mail access files on all there servers, seems to
help
but my access file is getting to be huge!

Gerald


> ----- Original Message -----
> From: "Lucas Peyatt" <bq.ohiointernet (at mark) gmail.com>
> To: coba-e (at mark) bluequartz.org
> Sent: Tuesday, December 30, 2008 12:11:09 PM (GMT-0800) 
> America/Los_Angeles
> Subject: [coba-e:14576] Re: spam sent using my email address
> 
> Hello Everyone,
> 
> I have the same issue as well, I see it was sent from 
> Verizon, you may want to file a abuse complaint with them 
> also. Your email address is in your white list, you should 
> remove that and it will start scoring higher.
> 
> What is needed is something that says if the sender is me and 
> not from server x.x.x.x score 5 or something. I am not sure 
> how this could be accomplished though.
> 
> Lucas Peyatt
> Ohio Web Hosting & Development
> www.ohiointernet.net
> 614.441.8169
> 
> -----Original Message-----
> From: Gerald Waugh [mailto:gwaugh (at mark) frontstreetnetworks.com] 
> Sent: Tuesday, December 30, 2008 2:54 PM
> To: coba-e (at mark) bluequartz.org
> Subject: [coba-e:14575] spam sent using my email address
> 
> Hi Blues, and a happy New Year
> 
> I am getting hundreds of spam using my return address.
> We have three servers running, and one (fsn2) is only backup 
> email/dns server and the spams seem to be coming from all three.
> 
> Subject varies, but most are for the sex drugs
> I put a few hundred in the access file, but it's getting to 
> be overwelming.
> 
> How can i stop this?
> 
> Typical header looks like this;
> 
> Return-Path: <gwaugh (at mark) frontstreetnetworks.com>
> Received: from fsn2.frontstreetnetworks.net 
> (fsn2.frontstreetnetworks.net [208.67.252.136])
> 	by fsn3.frontstreetnetwork.net (8.13.1/8.13.1) with 
> ESMTP id mBPM4eUD019535
> 	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256
> verify=NO)
> 	for <gwaugh (at mark) frontstreetnetworks.com>; Thu, 25 Dec 2008 
> 16:04:46 -0600
> From: Gerald Waugh <gwaugh (at mark) frontstreetnetworks.com>
> Received: from pool-71-160-32-23.lsanca.dsl-w.verizon.net
> (pool-71-160-32-23.lsanca.dsl-w.verizon.net [71.160.32.23])
> 	by fsn2.frontstreetnetworks.net 
> (8.13.4/8.13.4/Debian-3) with SMTP id mBPL3KUj012937
> 	for <gwaugh (at mark) frontstreetnetworks.com>; Thu, 25 Dec 2008 
> 15:03:23 -0600
> Date: Thu, 25 Dec 2008 15:03:21 -0600
> Message-Id: <200812252103.mBPL3KUj012937 (at mark) fsn2.frontstreetnetworks.net>
> To: <gwaugh (at mark) frontstreetnetworks.com>
> Subject: **Message you sent blocked by our bulk email filter**
> MIME-Version: 1.0
> Importance: High
> Content-Type: text/html
> X-Spam-Status: No, score=-81.9 required=5.0 tests=ANY_BOUNCE_MESSAGE,
> 	
> CRBOUNCE_MESSAGE,DCC_CHECK,DIGEST_MULTIPLE,HTML_IMAGE_ONLY_04,
> HTML_MESSA
> GE,
> 	
> HTML_SHORT_LINK_IMG_1,MIME_HTML_ONLY,PYZOR_CHECK,URIBL_AB_SURB
> L,URIBL_BL
> ACK,
> 	URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_RHS_DOB,USER_IN_WHITELIST
> autolearn=no
> 	version=3.2.4, No
> X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on
> 	fsn3.frontstreetnetwork.net
> X-fsn3.frontstreetnetwork.net-MailScanner-Information: Please 
> contact the ISP for more information
> X-MailScanner-ID: mBPM4eUD019535
> X-fsn3.frontstreetnetwork.net-MailScanner: Found to be clean
> X-fsn3.frontstreetnetwork.net-MailScanner-From:
> gwaugh (at mark) frontstreetnetworks.com
> 
> -
> Gerald Waugh
> http://frontstreetnetworks.com
> Front Street Networks - RaQware
> 4604 Fern Ave
> Shreveport, LA 71105-3118
> United States of America
> Phone: +1 318-670-8312
> Cell: +1 318-401-0428
> 
> 
> 
> 
> -- 
> Herb Rubin
> Pathfinders Software
> http://www.pfinders.com
>