CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

Blank Sender Filtering

 
Post new topic   Reply to topic       All -> FavForums -> Mailwasher - Troubleshooting / General [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
ppeier

Guest
IP: 205.238.*.*






PostPosted: Sun May 25, 2003 5:48 pm    Post subject: Blank Sender Filtering
Reply with quote

Rolling Eyes I am getting some Spam with a blank from Address
and MailWasher of course allows Delete but not Bounce since there is no return address.

I there a way to track these guys down and then flood them with their E-mail or is this something that the ISP has to take care of and block anonymous E-Mail at the Server?

Thanks

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16534

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Sun May 25, 2003 7:16 pm    Post subject:
Reply with quote

Yes, and I wish they would do so. These sorts of things need to be recognized as responsibitities inherent in the provision of ISP services. To make such responsibilities mandatory, legal penalties need to be put in place and enforced for ISPs which don't fullfill those obligations.

Back to top
View users profile Send private message
IP: 24.69.*.*

Guest






PostPosted: Sat May 31, 2003 1:50 am    Post subject: Re: Blank Sender Filtering
Reply with quote

ppeier wrote:
Rolling Eyes I am getting some Spam with a blank from Address
and MailWasher of course allows Delete but not Bounce since there is no return address.



Yes and you cannot auto-delete it either. Is there a way to auto delete any address from a blank return address as it is almost certainly spam. Question

Back to top
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10635

Premium

PostPosted: Sat May 31, 2003 2:18 am    Post subject:
Reply with quote

You could view full headers, copy the message to the clipboard and then go to spamcop.net and then paste into their reporting tool to ferret out the spammers.

I'd watch the flooding though, your ISP might get all soggy and hard to light if they report you back...


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
sighthound

Firetrust Host
Firetrust Host
Premium Member

Joined: Feb 04, 2003
Posts: 799

Firetrust Premium

PostPosted: Sat May 31, 2003 3:00 am    Post subject:
Reply with quote

No way to auto delete these emails, but you can set up a filter for them - you can then choose to "not display in list " if you want.
Filter for empty from field is:
You would use: The 'From field' does not contain RegExpr, and then place a full stop . in the next box.
Remember, the full stop . means any character, so we are making a rule that "from" line does not contain any character, meaning a blank "from" line.

Back to top
View users profile Send private message Visit posters website
gary

Lieutenant
Lieutenant
Premium Member

Joined: Dec 22, 2002
Posts: 260
Location: Dallas/Ft. Worth, USA
Premium

PostPosted: Sat May 31, 2003 5:51 am    Post subject:
Reply with quote

You can also use the following expression in the same manner as explained above:

[\w.-]+@([\w-]+\.)+[A-Z]{2,4}

It does a little more complete check, so that guys with badly formed addresses like "9@9.9" don't get through either (<- actual example from my blacklist.) You could probably write one with a tighter check for top-level domains, but I got lazy.

Back to top
View users profile Send private message
csalsa

Trooper
Trooper


Joined: May 27, 2003
Posts: 28
Location: Australia

PostPosted: Tue Jun 03, 2003 3:10 am    Post subject:
Reply with quote

You to filter using the regular expression on the 'The From Field'.

What about applying it to 'The return path' as well and apply when the regular expression matches either field?

Back to top
View users profile Send private message
gary

Lieutenant
Lieutenant
Premium Member

Joined: Dec 22, 2002
Posts: 260
Location: Dallas/Ft. Worth, USA
Premium

PostPosted: Tue Jun 03, 2003 3:26 am    Post subject:
Reply with quote

You can certainly do that, if it works for you. According to RFC 1123, mailers are supposed to record the Return-Path. However, I've found that in practice, it is often not provided, even in legitimate e-mails. Instead, it has to be assumed from the From field. As a result, I got way too many false positives.


_________________
Gary
Back to top
View users profile Send private message
IP: 24.69.*.*

Guest






PostPosted: Thu Jun 05, 2003 7:05 pm    Post subject:
Reply with quote

Thanks gary and sighthound for good advice. As long as these mails are marked as spam, it is just like auto deleting I suppose. Very Happy

Back to top
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Mailwasher - Troubleshooting / General All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer