Clever. Was the mail from: line really just an unqualified MAILER DAEMON
when it reached you? I would think it would have been qualified when it
went through earthlink's mailer. Anyway, if you are using the exim
filter, shouldn't
$h_X-Mailer contains "Mailcast"
match it?
Unfortunately if the mail makes it to filter then it's bounced rather
than refused and very few of these are ever replyable. I'd like to see
the accept line from your mainlog message on this one to see if there is
something matchable for a reject.
On Sat, Aug 09/97, John Bolding <john@???> wrote:
> Any SPAM experts out there who can tell me how to use our
> beloved exim to fight this particular SPAM?
>
> Exim settings:
> qualify_recipient = firstbase.com
> sender_verify
> sender_verify_fixup
> sender_verify_log_details
> sender_verify_reject
>
> Comments:
> we use an extensive filter mechanism looking for certain addresses
> and patterns, and then bounce the spam to the sender and postmaster.
>
> this spam used MAILER-DAEMON which evaluated to MAILER-DAEMON@???.
> the real From: line had a company name and phone number in it.
> I can block this spam via message body content, but then there is
> no place to bounce email back to.
>
> the other recourse is to use sender_net_reject, but we do have
> valid email contacts inside this domain, and this total IP block
> would be a last resort.
>
> any other options anyone can point me towards?
>
>
> >From MAILER-DAEMON Fri Aug 08 09:32:18 1997
> >Return-path: <>
> >Received: from germany.it.earthlink.net [204.250.46.123]
> > by shibumi.firstbase.com with esmtp (Exim 1.62 #9)
> > id 0wwry3-0007AB-00; Fri, 8 Aug 1997 09:32:47 -0700
> >Received: from .- (1Cust73.max10.san-diego.ca.ms.uu.net [153.34.216.73])
> > by germany.it.earthlink.net (8.8.5/8.8.5) with SMTP id JAA15015
> > for <john@???>; Fri, 8 Aug 1997 09:34:31 -0700 (PDT)
> >Message-Id: <199708081634.JAA15015@???>
> >Date: Fri, 08 Aug 1997 09:30:35 -0700
> >From: (Contact XXXXXXXXXXXXXXXXXXXXXXXXXXX)
> >Sender: (Contact XXXXXXXXXXXXXXXXXXXXXXXXXXX)
> >Subject: Boost your traffic to firstbase.com...
> >To: john@???
> >X-Mailer: <Mailcast, version 1.0>
> >MIME-Version: 1.0
> >Content-Type: multipart/mixed; boundary="----=_NextPart_000_01BC4F39.FACCFEC0"
> >Content-Transfer-Encoding: 7bit
> >Status: RO
> >Content-Length: 944
--
Artificial Intelligence stands no chance against Natural Stupidity.
GAT d- -p+(--) c++++ l++ u++ t- m--- W--- !v
b+++ e* s-/+ n-(?) h++ f+g+ w+++ y*
