RE: Spam with subscriber's 'from' address

Hi

I have had the same problem. However in my case I want to be able to "spoof"
the list. I send HTML newsletters to the list from FrontPage -> Outlook ->
Hotmail -> mailist@my_domain. In other words I send from a hotmail address
with a return/reply to set to the only allowed address!

This information mismatch may also be in the X-Sender information by the
way! Have a look at the spammers header and they may have the X-Sender set
to the
real domain. It is probably a quick and dirty to redirect at that point
although I think many people use this method to send mail to a list!!

In my case it is a newsletter so after it happened the first time it was
easier to shut the list down after posting the newsletter than to hack the
rcfiles for check/filter for a match between hotmail/reply to address.

By the way I have modified my procfiles to remove all the X-Sender
information
which got me into a lot of strife with Hotmail recently. Because the
X-Sender was still in the header and out of 35,000 emails I had a few "not
happy Jon's" hotmail killed off my Premium account for a while!

Email me if you want the modified file which allows you to post to the list
from a non subscribed address but remove where the post came from. Sort of
allows people to do exactly what you are complaining about but it is useful
sometimes :-) 

jon

Prof Jon Jenkins MLC 
Parliament House
Macquarie Street Sydney NSW 2000
Sydney Office Ph/Fax 02-9230-2752/2205
Nth Coast Office Ph/Fax 02-6676-2947/1543
Mob 0429178817
[email protected]
www.trac.org.au
 

> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of 
> Charlie Summers
> Sent: Saturday, 3 June 2006 1:10 AM
> To: Harshal; SmartList
> Subject: Re:Spam with subscriber's 'from' address
> 
> At 10:25 AM -0400 6/2/06, Harshal is rumored to have typed:
> 
> > Any suggestions on how to handle this problem?
> 
>    Filter out that user's address (explaining to him the 
> problem, of course)
> into your private mailbox*; if it continues with different subscribed
> addresses, it's likely a manual spam by an existing 
> subscriber. Your only
> option there is to 1) moderate the list, and 2) report every 
> spam to the
> upstreams until it becomes too much of a hassle for the 
> spammer to continue.
> 
>          Charlie
> 
> 
> 
> * There are a bazillion ways of writing procmail recipies to 
> allow the "real"
> user to post while the clone cannot, but it assumes a 
> familiarity with email
> header fields and procmail. In my case, for example, you 
> could check for my
> address _and_ my mail server in the header fields; if mail 
> with my address
> isn't delivered by 69.93.98.146, redirect away from the list 
> to your private
> mailbox.
> 
> 
> 
> _______________________________________________
> Smartlist mailing list
> [email protected]
> http://MailMan.RWTH-Aachen.DE/mailman/listinfo/smartlist
> 
>