RE: Block a SMTP recipient address
- From: "Talley, Scott" <stalley@xxxxxxxxxxxxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Mon, 8 Sep 2003 12:41:08 -0500
You can bet that most (if not all) of your spoofed/virused messages are
coming from the same source. What I did is look up the IP Address of the
sender - if you use Outlook, just right-click on the message (without
opening it) select Options and look in the header info for the sender's IP
address in brackets [www.xxx.yyy.zzz]. Then create an IP Packet Filter at
the ISA Server blocking all access from that address.
In a few days, you will probably get a call from someone you know asking why
they can't send you mail anymore. After assuring that they have cleaned up
their virus problem, delete the Rule and monitor closely.
Thank you,
Scott Talley
IT Manager, The Combined Group
e> stalley@xxxxxxxxxxxxxxxxx
p> 469.892.4000 x829
f> 469.221.6900
-----Original Message-----
From: Joe Leek [mailto:joe@xxxxxxx]
Sent: Monday, September 08, 2003 11:50 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Block a SMTP recipient address
http://www.ISAserver.org
All the senders are spoofed, so I guess I don't know how to block them.
The only common things are the virus and the recipient at my domain.
joe
__________________________________________
Joseph H Leek
JHL Mail Marketing, Inc.
3100 Borham Avenue
Stevens Point WI 54481-5094
Phone: 715.341.0581 x 11
Fax: 715.341.9645
Email: joe@xxxxxxx
-----Original Message-----
From: Bakari Allen [mailto:ballen@xxxxxxxxx]
Sent: Monday, September 08, 2003 11:40 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Block a SMTP recipient address
http://www.ISAserver.org
Another suggestion is to block the IP address in the SMTP server. If you
are using Exchange, add it to the list of blocked servers in ESM.
Bakari Allen
bakari.allen@xxxxxxxxx
-----Original Message-----
From: Joe Leek [mailto:joe@xxxxxxx]
Sent: Monday, September 08, 2003 11:11 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Block a SMTP recipient address
http://www.ISAserver.org
I am getting an email a minute for an address that does not exist on my
network. It has a virus attached. The senders address changes with
each email. It is being quarantined but is using unnecessary resources.
Is there any way to block an inbound address using ISA? I can see how
to block a sender but not a recipient.
TIA
joe
__________________________________________
Joseph H Leek
JHL Mail Marketing, Inc.
3100 Borham Avenue
Stevens Point WI 54481-5094
Phone: 715.341.0581 x 11
Fax: 715.341.9645
Email: joe@xxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
bakari.allen@xxxxxxxxx
To unsubscribe send a blank email to
$subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
joe@xxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
stalley@xxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
