"Postfix program at host... " style garbage

General discussion about PopTray. You love it? You hate it? Talk about it here.

Moderators: KY Dave, jojobear99, Rdsok

Post Reply
Peter2
Still here
Posts: 11
Joined: Wed Jun 22, 2005 11:14 am

"Postfix program at host... " style garbage

Post by Peter2 » Mon Sep 15, 2008 4:29 pm

I keep getting this kind of spam, over 4000 of them came on yesterday alone.

"This is the Postfix program at host hknpx4.hknet.com.
I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below."


The 'host' name is different in every message. It also resembles the format that my ISP uses in their own e-mail failure messages.

Now I found that there is one good identification, lower in the message body. All these spam messages have this kind of line:

From: "Tag Replica" <peter2@smailspot.com>
From: "Amazing Watches" <peter2@smailspot.com>
From: "Tag Heuer Watches" <peter2@smailspot.com>
From: "Rolex Replica" <peter2@smailspot.com>
From: "Rolex Replica" <peter2@smailspot.com

There is always a fake sender name like "Tag Replica" , "Amazing Watches" etc. followed by my own, real e-mail address like "peter2@smailspot.com".

I currently have over 200 filters in Poptray, but I am not familiar with more complicated Regular Expression rules.

So, has anyone an idea how to build a rule that would identify those garbage messages for later deletion? Thanks for any suggestions.
Peter2

User avatar
Rdsok
PopTray Family
Posts: 1350
Joined: Fri Mar 19, 2004 11:36 pm
Location: Norman, Oklahoma USA
Contact:

Post by Rdsok » Tue Sep 16, 2008 3:24 am

I'm not sure if you just posted a real email address or if that was just a fake one you used as an example... if it is a real one... edit your post and place a fake email address in unless you like getting spam .... spammers harvest email address's posted in public such as on forums etc.

As for you question... its a tough one... look at the headers and see if there was something in common that is unrelated to your email addy and ISP info to see if you can build a rule from that.

Peter2
Still here
Posts: 11
Joined: Wed Jun 22, 2005 11:14 am

Post by Peter2 » Tue Sep 16, 2008 10:47 am

Rdsok wrote:I'm not sure if you just posted a real email address or if that was just a fake one you used as an example...
No worries, e-mail address was a fake one :)
Rdsok wrote: As for you question... its a tough one... look at the headers and see if there was something in common that is unrelated to your email addy and ISP info to see if you can build a rule from that.
I regularly use PackRat. Currently PackRat only downloads everything as a safe copy before PopTray deletes spams from the server. As far as I know there is no Delete from server operation available in PackRat.
If there were such a feature, I could change the PackRat (Delphi code) to make the spam-filtering work according to the rule I found and described in my earlier post.

Compared to PackRat code that I have already modified, I found the Delphi code in PopTray to be quite more demanding and sophisticated. It would take several days or weeks to get acquainted first with Indy tools and then with PopTray functionality :D

So, if anyone has any hints about using the "Delete from server" feature in Delphi in code level either in PopTray or in PackRat, that would be for a big help.
Peter2

Post Reply

Who is online

Users browsing this forum: No registered users and 5 guests