What I did was to focus on the subject lines used. Most of them were handled by five different statements. I have since deleted these rules or I would send them to you. Tim
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Daniel Armstrong Sent: Tuesday, November 09, 2004 4:33 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Spammer forges 'from' address Hi Tim, We thought about that, but I wasn't sure how to create rules that would specifically catch NDAs. I'm sure that most of the messages come from 'administrator' or 'postmaster' - a rule with those variables might stop a lot of the messages. Did you discover any rules that worked particularly well? Thanks, Daniel > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:IMail_Forum- > [EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] > Sent: Tuesday, November 09, 2004 2:24 PM > To: [EMAIL PROTECTED] > Subject: RE: [IMail Forum] Spammer forges 'from' address > > What we ended up doing for one user was to setup inbound rules to move > the messages to a junk folder. It took about 2 weeks before it cleared > up. But he was getting up to 1800 a day. > > Tim > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Daniel > Armstrong > Sent: Tuesday, November 09, 2004 2:36 PM > To: [EMAIL PROTECTED] > Subject: [IMail Forum] Spammer forges 'from' address > > Hi, > > We have an occasional problem whereby one of our user's e-mail address > is > used as the 'from' address by a spammer and all of the non-delivery > notices > are sent to the forged 'from' address. Normally this problem is resolved > as > quickly as it starts, but we have one particular instance of this > problem > that has been happening for about 10 days (the user is getting about 100 > NDRs a day). > > Is there anything we can do about this other than wait for it to stop > (if > the user does not want to change e-mail addresses)? > > Is there anything that we are doing as the mail host provider that might > be > causing this problem (or is it just bad luck)? We don't publish any user > information, and we counsel our users not to publish their e-mail > address if > they don't want a lot of unsolicited e-mail. > > Thanks for your advice. > > Daniel > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
