Edge 2007 - Free flowing spam...
-
26 April 2012 19:12
I have a single user who has been getting a lot of spam. I have been forwarding them off to spamcop and have done just about everything I can to slow it down. I think I heard a term, "Snow Shoing", used to describe the approach that is bing used. Regardless, I have my sender confidence set at 2 and this guy still gets spam. Even more interestingly, one of the spam he sent to me is scl = 7. Also, from what I understand, any blocked mail that is above the set threshold is supposed to show up in the block list. Nothing there???
I am beside myself on this one.
... spam reports from spamcop on this round. He gets hit twice a day like clockwork from unique up / domain combos that have valid spf, sender id, the whole nine (mostly) or apparently assuming edge spam prevention features even work. If you have any ideas let me know. I have a call in to the support team on another issue but I will ask them to have a look if the opportunity presents itself.
SpamCop is now ready to process your spam.
Use links to finish spam reporting (members use cookie-login please!):
http://www.spamcop.net/sc?id=z5313927045zfb6d0ec1600a673e7ff2f8fdf842b5d1z
http://www.spamcop.net/sc?id=z5313927046z2249dd2f441965d3814a9b44621c9a65z
http://www.spamcop.net/sc?id=z5313927047z27bc335fd82b231741a4530c1da00dc3z
http://www.spamcop.net/sc?id=z5313927048zf629d9304691feebe3d3eabd24ac5c5dz
http://www.spamcop.net/sc?id=z5313927050zecb0d568d995a91283c6b6110910346dz
http://www.spamcop.net/sc?id=z5313927051z40c8b1fd7099a02f5419b812b57fdaa8z
http://www.spamcop.net/sc?id=z5313927053zc0c0a1e5e30f918a4d9d0d791676e9d0z
http://www.spamcop.net/sc?id=z5313927055z4ebcbb57f2b01cd337959ba92edaf445z
http://www.spamcop.net/sc?id=z5313927056ze118b1610813f3ebf54f722add5f8a2az
http://www.spamcop.net/sc?id=z5313927058zb2f9d1038d540a34bc28fcd01dbbc480z
http://www.spamcop.net/sc?id=z5313927060z235ce3d798f9dadb2a1031a8ee0f1b0cz
http://www.spamcop.net/sc?id=z5313927062zdf00f15eaa04d43cb118ada1dad09637z
http://www.spamcop.net/sc?id=z5313927064z363762363037a1016906c5756d671e2az
http://www.spamcop.net/sc?id=z5313927065zf2faca2c50efe2449ed19e37f4bc14bdz
Semua Balasan
-
27 April 2012 8:35Moderator
I have my sender confidence set at 2 and this guy still gets spam. Even more interestingly, one of the spam he sent to me is scl = 7. Also, from what I understand, any blocked mail that is above the set threshold is supposed to show up in the block list. Nothing there???
Hi Diederich,
When the Content Filter agent processes a message, it assigns a spam confidence level (SCL) rating to the message. The SCL rating is a number between 0 and 9. You can configurate Content Filter to Reject message >=7 directly: Content Filtering->Properties->Action
Instead of relying on Sender Reputation to move suspicious sender to IP block list by SRL(sender confidence set at 2), you can add the sender to IP Block List & Sender Filtering to test.
For more information about Sender Reputation, please see:
http://technet.microsoft.com/en-us/library/bb124512(v=exchg.80).aspx
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
Frank Wang
TechNet Community Support
- Ditandai sebagai Jawaban oleh Frank.WangModerator 03 Mei 2012 1:55
-
27 April 2012 16:20
The Sender Reputation Threshold and the SCL Thresholds are not the same thing.
If you are receving emails with SCL=7 in your inbox, my guess is that the Content Filter is not properly configured. At least most users relying on the Content Filter are blocking emails with such a high SCL rating.
I think you need to better understnad how the Content Filter works and this is a good starting point:
Video - Getting Started with the Exchange 2007 Content Filter
http://www.exchangeinbox.com/article.aspx?i=135The Exchange 2007 Content Filter Agent
http://www.exchangeinbox.com/article.aspx?i=104IMF Tune - Anti-spam extending the Exchange 2003, 2007, 2010 IMF/Content Filter - http://www.windeveloper.com/imftune/
- Ditandai sebagai Jawaban oleh Frank.WangModerator 03 Mei 2012 1:55
-
02 Mei 2012 2:34Moderator