Print Page | Close Window

Filtering mail relayed through open proxies

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=296
Printed Date: 12 February 2025 at 10:01pm


Topic: Filtering mail relayed through open proxies
Posted By: Guests
Subject: Filtering mail relayed through open proxies
Date Posted: 18 April 2003 at 3:45pm

Am I correct in that the IP filter only looks at the last connection and not at all the IP's in the header?

As junk mail is often relayed thorugh several proxies and often through notorious regions like China or Korea, I would like to filter all email passing through these regions.

Am I correct in thinking that including keyword filter entries such as

[202.

[218.2.

[218.3.

and so on would do this?

 




Replies:
Posted By: LogSat
Date Posted: 18 April 2003 at 11:29pm

Yes, you are correct. The reverse DNS and MAPS tests are performed on the actual IP initiating the connection to SpamFilter. Addresses in the headers are ignored in all checks, as they can be easily forged and thus are unreliable.

You are also correct in your possible use of keywords. We have purposely designed the keyword tests so that the smtp headers are checked for keywords, so you can set them up as you wish to filter out msgs based on the headers.

Roberto Franceschetti
LogSat Software



Posted By: Guests
Date Posted: 22 April 2003 at 12:46pm

As forged IP addresses in the header are usually an indication of someone trying to conceal the source of the email, wouldn't forged IP's in the header be a good indicator of spam?

Basically I think it would be a good idea if the software would scan ALL the IP address's in a header.  If a spammer sends mail through several legit servers, through a blacklisted server, and then a legit server with an open relay that has now been blacklisted yet, I would bet it's spam and I would like to filter them.

I think this would be very useful.




Print Page | Close Window