North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Hijacked email

  • From: Richard Irving
  • Date: Wed Aug 20 11:42:42 2003

  Please people, of all the great feedback these joe jobbed
addresses are receiving, from the anti-virus software...

 it really wouldn't hurt to include the -=IP=- (and possibly headers)
of the system that contacted your server.....

 Rather than simply complain, it would allow us to track
down, and triangulate the -=real=- perp, an infected
M$ machine or two (million).

 Thanks in Advance for useful data !

  :D

JMHO.


Omachonu Ogali wrote:
For our Postfix viewers out there...

header_checks:
/^X-MailScanner: Found to be clean$/    REJECT You're infected, but you probably won't see this message anyway.

body_checks:
/X-MailScanner: Found to be clean/      REJECT Please, stop sending me bounces/infection notices for spoofed virus spam.

The last rule is kinda evil as it will block all mail with that line in
the body (both incoming and outgoing), so know what you're doing before
you blindly cut and paste.