Glen , In fact 212.64.200.32 is my server ip address. Many spammers try to fool your mail server using as hello your mail server ip address. Every mail server start talking as follow HELO(EHLO) myhostname.com But many spammers use HELO(EHLO) 212.64.200.32 212.64.200.32 is my server ip address. The remote mail server name can not be my ip address :) This is a spammer trick which can work with very old mail servers. Thats why i am deleting every mail which contains HELO(EHLO) 212.64.200.32
I am cacthing more than 20% of spam like this. And be sure this %100 spam. I have never seen a mail server using the remote mail server name. Rifat Levis ----- Original Message ----- From: "Glenn Brooks" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, July 11, 2003 4:50 AM Subject: Re: [Declude.JunkMail] Lost One Account - Help Please > >Write in the atlasfilter.txt >helo 20 contains ommo.net >helo 20 contains 212.64.200.32 I will adjust mine to match this and give it a try Can I use the following for IPs helo 20 contains 212.64.200.0/24 to cover more IP addresses? Thanks for the suggestions... gb --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
