Joseph Brennan wrote:
I looked at our spam reports (spam that was not rejected). It looks to
me like the biggest target to go for is mail supposedly from The Bat!
direct to your MX. Most of the supposed The Bat! spam matches, and it
is very low scoring.
Yes - I just saw that too - like Outlook, "The Bat!" is a MUA and
shouldn't be making direct connections to other SMTP servers.
Most of our reported spam supposedly from Outlook has a faked Received
header at the bottom, making it look as if the real origin is the next
hop, as if it was the smtp server.
Yeah - it is true that all the spammers have to do is add a good faked
Received: header to bypass any work done in this area. However, there
are obviously still some stupid spammers out there ;-)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
