| View previous topic :: View next topic |
| Author |
Message |
ppeier
Guest IP: 205.238.*.*
|
Posted: Sun May 25, 2003 5:48 pm Post subject: Blank Sender Filtering |
|
|
I am getting some Spam with a blank from Address
and MailWasher of course allows Delete but not Bounce since there is no return address.
I there a way to track these guys down and then flood them with their E-mail or is this something that the ISP has to take care of and block anonymous E-Mail at the Server?
Thanks
|
|
| Back to top |
|
 |
Ikeb
Special Response Team Forums Admin
 Joined: Apr 20, 2003 Posts: 16534
|
Posted: Sun May 25, 2003 7:16 pm Post subject: |
|
|
Yes, and I wish they would do so. These sorts of things need to be recognized as responsibitities inherent in the provision of ISP services. To make such responsibilities mandatory, legal penalties need to be put in place and enforced for ISPs which don't fullfill those obligations.
|
|
| Back to top |
|
 |
IP: 24.69.*.*
Guest
|
|
| Back to top |
|
 |
stan_qaz
Premium Member
 Joined: Mar 31, 2003 Posts: 10635
|
Posted: Sat May 31, 2003 2:18 am Post subject: |
|
|
You could view full headers, copy the message to the clipboard and then go to spamcop.net and then paste into their reporting tool to ferret out the spammers.
I'd watch the flooding though, your ISP might get all soggy and hard to light if they report you back... _________________ Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
|
|
| Back to top |
|
 |
sighthound
Firetrust Host
 Premium Member
 Joined: Feb 04, 2003 Posts: 799
|
Posted: Sat May 31, 2003 3:00 am Post subject: |
|
|
No way to auto delete these emails, but you can set up a filter for them - you can then choose to "not display in list " if you want.
Filter for empty from field is:
You would use: The 'From field' does not contain RegExpr, and then place a full stop . in the next box.
Remember, the full stop . means any character, so we are making a rule that "from" line does not contain any character, meaning a blank "from" line.
|
|
| Back to top |
|
 |
gary
Lieutenant
 Premium Member
 Joined: Dec 22, 2002 Posts: 260 Location: Dallas/Ft. Worth, USA
|
Posted: Sat May 31, 2003 5:51 am Post subject: |
|
|
You can also use the following expression in the same manner as explained above:
[\w.-]+@([\w-]+\.)+[A-Z]{2,4}
It does a little more complete check, so that guys with badly formed addresses like "9@9.9" don't get through either (<- actual example from my blacklist.) You could probably write one with a tighter check for top-level domains, but I got lazy.
|
|
| Back to top |
|
 |
csalsa
Trooper

 Joined: May 27, 2003 Posts: 28 Location: Australia
|
Posted: Tue Jun 03, 2003 3:10 am Post subject: |
|
|
You to filter using the regular expression on the 'The From Field'.
What about applying it to 'The return path' as well and apply when the regular expression matches either field?
|
|
| Back to top |
|
 |
gary
Lieutenant
 Premium Member
 Joined: Dec 22, 2002 Posts: 260 Location: Dallas/Ft. Worth, USA
|
Posted: Tue Jun 03, 2003 3:26 am Post subject: |
|
|
You can certainly do that, if it works for you. According to RFC 1123, mailers are supposed to record the Return-Path. However, I've found that in practice, it is often not provided, even in legitimate e-mails. Instead, it has to be assumed from the From field. As a result, I got way too many false positives. _________________ Gary
|
|
| Back to top |
|
 |
IP: 24.69.*.*
Guest
|
Posted: Thu Jun 05, 2003 7:05 pm Post subject: |
|
|
Thanks gary and sighthound for good advice. As long as these mails are marked as spam, it is just like auto deleting I suppose. 
|
|
| Back to top |
|
 |
|
|