I am running Declude 1.79 and Imail 8.05, I have autowhitelist on and
whitelist auth. This user (Bernie Cohen) had himself in his address book
and it looks like the spammer had the from e-mail to be bernie's e-mail
address. I thought it was difficult to fake the "x-declude sender"?
I like the autowhitelist feature because it gives my users the ability to
receive jokes and other e-mails that may otherwise be filtered by adding
friends and so on to their address books.
Should I advise all my users NOT to have themselves in the address book to
prevent spammers from exploiting this feature? Is there anything else that
I can do?
DECLUDE LOG:
06/04/2004 14:05:16 Qb9d22cdb01326288 Skipping4 E-mail from
[EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED]
06/04/2004 14:05:16 Qb9d22cdb01326288 Skipping4 E-mail from
[EMAIL PROTECTED]; whitelisted [EMAIL PROTECTED]
IMAIL LOG:
06:04 14:05 SMTPD(2CDB0132) [69.14.41.135]
D:\IMail\spool\Db9d22cdb01326288.SMD 10188
06:04 14:05 SMTPD(2CDB0132) performing antispam checks
HEADERS:
Received: from SMTP32-FWD by mail.prudentialrand.com
(SMTP32) id A06583D2D; Fri, 4 Jun 2004 14:05:17 -0400
Received: from d14-69-135-41.try.wideopenwest.com [69.14.41.135] by
mail.prudentialrand.com
(SMTPD32-8.05) id A9D22CDB0132; Fri, 04 Jun 2004 14:05:06 -0400
X-Message-Info: G010J836ZEU98eoBqnK02XKX34ePtyaP755
Received: from [54.89.60.212] by
[EMAIL PROTECTED] via HTTP; Fri, 04 Jun
2004 21:53:29 +0300
Date: Fri, 04 Jun 2004 12:51:29 -0600
Message-ID: <[EMAIL PROTECTED]@prudentialrand.com>
Reply-To: "Jason Morton" <[EMAIL PROTECTED]>
From: "Jason Morton" <[EMAIL PROTECTED]>
To: "Bernie.cohen" <[EMAIL PROTECTED]>
Subject: Re:Soma,valium,xanax,etc shipped overnight
Date: Fri, 04 Jun 2004 14:50:29 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--907020264053734"
X-Declude-Sender: [EMAIL PROTECTED] [69.14.41.135]
X-Declude-Spoolname: Db9d22cdb01326288.SMD
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: Whitelisted [0]
X-Country-Chain:
X-Note: This E-mail was sent from d14-69-135-41.try.wideopenwest.com
([69.14.41.135]).
X-IMAIL-SPAM-HTML-FEATURES: (Image Tag)
X-RCPT-TO: [EMAIL PROTECTED]>
Status: U
X-UIDL: 378182572
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
