honeypot all but certain addresses
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6664
Printed Date: 05 February 2025 at 5:54pm
Topic: honeypot all but certain addresses
Posted By: hookjd
Subject: honeypot all but certain addresses
Date Posted: 01 May 2009 at 1:15pm
I have a client on my spamfilter install that receives an unbelievable amount of spam. Of the 51 domains I have in config, it probably is the culprit for 90% of my spam. Most of the spam is just flooding addresses like coa7023dl@domain.com (totally random addresses). therefore, I have switched their domain to using the "authorized TO Emails" whitelist so that only email to those addresses that are legit will be delivered.
But I'd also like to know if I can set it so that all other email (ie: email to non-active email addresses) will result in the IP being blocked via honeypot. How would I set this up? I don't want to guess and get it wrong. Thanks.
|
Replies:
Posted By: LogSat
Date Posted: 01 May 2009 at 5:25pm
Sorry hookjd, that is not possible - all that can happen is that emails sent to the addresses not in the "authorized TO emails" will cause the sender to be temporarily blocked by the blacklist IP cache filter (if the email attempts are occurring several times within a few minutes).
-------------
Roberto Franceschetti
http://www.logsat.com" rel="nofollow - LogSat Software
http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP
|
Posted By: hookjd
Date Posted: 01 May 2009 at 5:40pm
|
How about stopping the NDRs for the entire domain. Is that possible?
|
Posted By: LogSat
Date Posted: 01 May 2009 at 7:33pm
One of SpamFilter's strengths is actually the fact that NDRs will never be generated/sent by SpamFilter when spam emails are stopped. If a spammer, for example in your case, sends an email to a user not defined in the "Authorized TO" whitelist, SpamFilter will reject the email by outputting an SMTP error code during the SMTP session, along with a text line describing the reason the email was rejected. Per RFC, the **sender's mail server** must, at this point, generate an NDR to notify the sender of the non-delivery. It is thus the remote sender that will be creating and generating an email to the sender, not SpamFilter.
-------------
Roberto Franceschetti
http://www.logsat.com" rel="nofollow - LogSat Software
http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP
|
|