>One option would be to have IMGate ( http://imgate.meiway.com ) sitting in
>front of the IMail server, handling this a bit more gracefully.
That ip is a DUL
http://www.mail-abuse.org/cgi-bin/lookup?216.53.218.171
All those msgs would have been rejected at IMGate, none would have been
seen by Imail
Here�s a piece of today�s report for the latest ISP I�ve just set up with
IMGate:
Grand Totals
------------
messages
21219 received
24409 delivered
223 forwarded
510 deferred (2968 deferrals)
806 bounced
4841 rejected
281696k bytes received
308232k bytes delivered
7118 senders
1902 sending hosts/domains
5910 recipients
982 recipient hosts/domains
Per-Hour Traffic Summary
time received delivered deferred bounced rejected
--------------------------------------------------------------------
0000-0100 1369 1460 67 59 340
0100-0200 1293 1378 222 49 245
0200-0300 1207 1281 206 63 312
0300-0400 1166 1465 203 40 315
0400-0500 1124 1187 141 51 284
0500-0600 1061 1112 209 61 229
0600-0700 1116 1519 255 60 376
0700-0800 1193 1280 212 41 284
0800-0900 1431 1496 73 43 318
0900-1000 1392 1513 214 42 318
1000-1100 1501 1495 188 48 301
1100-1200 1527 2087 219 49 280
1200-1300 1466 1772 169 35 352
1300-1400 1566 2104 241 50 308
1400-1500 1812 1925 243 84 281
1500-1600 995 1335 106 31 298
1600-1700 0 0 0 0 0
1700-1800 0 0 0 0 0
1800-1900 0 0 0 0 0
1900-2000 0 0 0 0 0
A 20% to 25% rejection rate is about average.
Here�s the section for header and body filtering using regular expressions,
notice a few viruses caught without a virus scanner:
body
7 Content-Type: application/octet-stream; name="dwarf4you.exe"
4 Content-Type: application/octet-stream; name="joke.exe"
4 Content-Type: application/octet-stream; name="midgets.scr"
3 Content-Type: application/octet-stream; name="DSSSIG.EXE"
3 Content-Type: application/octet-stream; name="sexy virgin.scr"
3 ?name="logos.exe"
2 ?name="news_doc.scr"
2 ?name="vmailvid.EXE"
2 Content-Type: image/gif; name="IEXPLORE.EXE"
2 Content-Type: application/octet-stream; name="IE4UINIT.EXE"
2 Content-Type: image/gif; name="DSSSIG.EXE"
2 Content-Type: application/octet-stream; name="116.00.exe"
1 ?name="Card.pif"
1 ?name="SULFNBK.EXE"
1 ?name="README.TXT.pif"
1 ?name="mso380.exe"
1 ?name="dpchameleon_install.exe"
1 Content-Type: application/octet-stream; name="AWADPR32.EXE"
1 Content-Type: application/octet-stream; name="LOADWC.EXE"
1 ?name="special_vacation_sh.exe"
1 Content-Type: application/octet-stream; name="IEXPLORE.EXE"
1 Content-Type: application/octet-stream; name="Mp3Decode.exe"
1 ?name="May Newsletter.exe"
1 Content-Type: application/octet-stream; name="REGSVR32.EXE"
1 ?name="logos2.exe"
1 ?name="lmscans.exe"
1 ?name="3D Wormhole.scr"
1 ?name="Sorry_about_yesterday.DOC.pif"
1 Content-Type: application/octet-stream; name="CDDAE2.exe"
1 ?name="Pics.ZIP.scr"
1 ?name="Sulfnbk.exe"
1 ?name="logos1.exe"
1 Content-Type: application/octet-stream; name="REDIR32.EXE"
header
9 Subject: [atlalist] warning--HOAX! previous URGENT virus
aler...
5 Subject: Virus Alert
5 Subject: FW: URGENT VIRUS ALERT
2 From: DustyC <[EMAIL PROTECTED]>
2 Subject: Virus Alert - REALLY
2 Subject: Fw: Virus Alert
2 Subject: Virus alert I had this read before June 1
2 Subject: Fw: Virus alert, please read before June 1
1 Subject: [AyeoneEmbroideryClub] VIRUS ALERT
1 From: [EMAIL PROTECTED]
1 Subject: Re: Match.com - You've Got Mail: well....
1 Subject: Fwd: new virus alert
1 FROM: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 From: "K4 Global Publishing" <[EMAIL PROTECTED]>,
1 Subject: virus alert
1 Subject: Fw: [Fwd: Fwd: jokes and such]
1 Subject: Fw: Virus alert; I found this one, I've emailed
you;...
1 Subject: filmscanners: Re: [DS] virus alert ?
1 Subject: RE: URGENT Virus Alert This is not a hoax !
1 FROM: [EMAIL PROTECTED]
1 From: Natasha44 <[EMAIL PROTECTED]>
1 Subject: VIRUS ALERT
1 FROM: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 Subject: Re: Virus alert, please read before June 1
1 Subject: Virus Alert!!!!!!!! from Lp
1 Subject: READ THIS FIRST BEFORE MY OTHER E-MAIL Fw: Virus
1 From: "Zonia J. Heath" <[EMAIL PROTECTED]>
1 From: <[EMAIL PROTECTED]>
1 From: Rebecca49 <[EMAIL PROTECTED]>
1 FROM: [EMAIL PROTECTED]
1 Subject: RE: URGENT VIRUS ALERT
1 Subject: [triple_s_embroidery] Re: virus alert
1 From: [EMAIL PROTECTED]
1 Subject: [triple_s_embroidery] virus alert
1 From: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 Subject: IMPORTANT VIRUS ALERT!!!!!!
1 Subject: Fwd: URGENT VIRUS ALERT MESSAGE.....READ IT! Teresa
1 Subject: Re: Virus Alert - REALLY
1 Subject: Re: Virus Alert!!!!!!!! from Lp -- HOAX!!!!
1 FROM: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 Subject: Virus alert/worst ever according to CNN (fwd)
1 From: [EMAIL PROTECTED]
1 From: [EMAIL PROTECTED]
1 Subject: RE: Virus Alert
1 FROM: [EMAIL PROTECTED]
1 From: <[EMAIL PROTECTED]>
1 From: "K4 Global Publishing" <[EMAIL PROTECTED]>,
1 Subject: Legit Virus Alert!!!!!!
Len
http://MenAndMice.com/DNS-training
http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
