Home All Groups Group Topic Archive Search About

Spam blocking help needed

Author
16 Dec 2008 7:09 PM
Clayton Sutton
Hey everyone,

We are running Exch. 2003 ent. w/sp2 in a cluster with two FEs on Windows
2003 sp2.

I need to know if there is a way to stop people from replying to emails.

Example:  Being that we are a Univ. we get a lot of "Phishing" email come
acrossing our servers trying to get people to give their usernames and
passwords.  We would like to be able to put the "Reply" address in some kind
of block list that would not allow anyone to reply to that address.

Anyone know of a way to do that?

TIA,


Clayton

Author
16 Dec 2008 7:28 PM
Missy Koslosky
The best option would be to filter out the spam/phish before it reaches the
users. I'd look at a gateway that can filter mail before it hits your
environment - Forefront (from MSFT), Barracuda, something along those lines.

Missy

Show quoteHide quote
"Clayton Sutton" <n***@none.com> wrote in message
news:%23lA%23eH7XJHA.5020@TK2MSFTNGP03.phx.gbl...
> Hey everyone,
>
> We are running Exch. 2003 ent. w/sp2 in a cluster with two FEs on Windows
> 2003 sp2.
>
> I need to know if there is a way to stop people from replying to emails.
>
> Example:  Being that we are a Univ. we get a lot of "Phishing" email come
> acrossing our servers trying to get people to give their usernames and
> passwords.  We would like to be able to put the "Reply" address in some
> kind of block list that would not allow anyone to reply to that address.
>
> Anyone know of a way to do that?
>
> TIA,
>
>
> Clayton
>
Author
16 Dec 2008 7:49 PM
Clayton Sutton
We have a Barracuda.  But a lot still gets through.


Clayton



Show quoteHide quote
"Missy Koslosky" <missy@DONTSPAMMEmvps.org> wrote in message
news:%23OTyaR7XJHA.6036@TK2MSFTNGP05.phx.gbl...
> The best option would be to filter out the spam/phish before it reaches
> the users. I'd look at a gateway that can filter mail before it hits your
> environment - Forefront (from MSFT), Barracuda, something along those
> lines.
>
> Missy
>
> "Clayton Sutton" <n***@none.com> wrote in message
> news:%23lA%23eH7XJHA.5020@TK2MSFTNGP03.phx.gbl...
>> Hey everyone,
>>
>> We are running Exch. 2003 ent. w/sp2 in a cluster with two FEs on Windows
>> 2003 sp2.
>>
>> I need to know if there is a way to stop people from replying to emails.
>>
>> Example:  Being that we are a Univ. we get a lot of "Phishing" email come
>> acrossing our servers trying to get people to give their usernames and
>> passwords.  We would like to be able to put the "Reply" address in some
>> kind of block list that would not allow anyone to reply to that address.
>>
>> Anyone know of a way to do that?
>>
>> TIA,
>>
>>
>> Clayton
>>
>
Author
16 Dec 2008 8:12 PM
Clayton Sutton
Hey Missy,

Thanks for the tip!  I just called Barracuda and they said we *can* do it
through the Barracuda if we send our outbound emails through the Barracuda
(which we don't).

Anyone else have any other ideas?


TIA,


Clayton



Show quoteHide quote
"Clayton Sutton" <n***@none.com> wrote in message
news:erGvxd7XJHA.1324@TK2MSFTNGP04.phx.gbl...
> We have a Barracuda.  But a lot still gets through.
>
>
> Clayton
>
>
>
> "Missy Koslosky" <missy@DONTSPAMMEmvps.org> wrote in message
> news:%23OTyaR7XJHA.6036@TK2MSFTNGP05.phx.gbl...
>> The best option would be to filter out the spam/phish before it reaches
>> the users. I'd look at a gateway that can filter mail before it hits your
>> environment - Forefront (from MSFT), Barracuda, something along those
>> lines.
>>
>> Missy
>>
>> "Clayton Sutton" <n***@none.com> wrote in message
>> news:%23lA%23eH7XJHA.5020@TK2MSFTNGP03.phx.gbl...
>>> Hey everyone,
>>>
>>> We are running Exch. 2003 ent. w/sp2 in a cluster with two FEs on
>>> Windows 2003 sp2.
>>>
>>> I need to know if there is a way to stop people from replying to emails.
>>>
>>> Example:  Being that we are a Univ. we get a lot of "Phishing" email
>>> come acrossing our servers trying to get people to give their usernames
>>> and passwords.  We would like to be able to put the "Reply" address in
>>> some kind of block list that would not allow anyone to reply to that
>>> address.
>>>
>>> Anyone know of a way to do that?
>>>
>>> TIA,
>>>
>>>
>>> Clayton
>>>
>>
>
>
Author
16 Dec 2008 8:43 PM
John Oliver, Jr. [MVP]
That is going to be your best solution since you already have an investment
in the Barracuda.

--
John Oliver, Jr
MCSE, MCT, CCNA
Exchange MVP 2009
Microsoft Certified Partner


Show quoteHide quote
"Clayton Sutton" <n***@none.com> wrote in message
news:erpLfq7XJHA.256@TK2MSFTNGP06.phx.gbl...
> Hey Missy,
>
> Thanks for the tip!  I just called Barracuda and they said we *can* do it
> through the Barracuda if we send our outbound emails through the Barracuda
> (which we don't).
>
> Anyone else have any other ideas?
>
>
> TIA,
>
>
> Clayton
>
>
>
> "Clayton Sutton" <n***@none.com> wrote in message
> news:erGvxd7XJHA.1324@TK2MSFTNGP04.phx.gbl...
>> We have a Barracuda.  But a lot still gets through.
>>
>>
>> Clayton
>>
>>
>>
>> "Missy Koslosky" <missy@DONTSPAMMEmvps.org> wrote in message
>> news:%23OTyaR7XJHA.6036@TK2MSFTNGP05.phx.gbl...
>>> The best option would be to filter out the spam/phish before it reaches
>>> the users. I'd look at a gateway that can filter mail before it hits
>>> your environment - Forefront (from MSFT), Barracuda, something along
>>> those lines.
>>>
>>> Missy
>>>
>>> "Clayton Sutton" <n***@none.com> wrote in message
>>> news:%23lA%23eH7XJHA.5020@TK2MSFTNGP03.phx.gbl...
>>>> Hey everyone,
>>>>
>>>> We are running Exch. 2003 ent. w/sp2 in a cluster with two FEs on
>>>> Windows 2003 sp2.
>>>>
>>>> I need to know if there is a way to stop people from replying to
>>>> emails.
>>>>
>>>> Example:  Being that we are a Univ. we get a lot of "Phishing" email
>>>> come acrossing our servers trying to get people to give their usernames
>>>> and passwords.  We would like to be able to put the "Reply" address in
>>>> some kind of block list that would not allow anyone to reply to that
>>>> address.
>>>>
>>>> Anyone know of a way to do that?
>>>>
>>>> TIA,
>>>>
>>>>
>>>> Clayton
>>>>
>>>
>>
>>
>
>
Author
17 Dec 2008 12:42 AM
Rich Matheisen [MVP]
Show quote Hide quote
On Tue, 16 Dec 2008 13:09:49 -0600, "Clayton Sutton" <n***@none.com>
wrote:

>We are running Exch. 2003 ent. w/sp2 in a cluster with two FEs on Windows
>2003 sp2.
>
>I need to know if there is a way to stop people from replying to emails.
>
>Example:  Being that we are a Univ. we get a lot of "Phishing" email come
>acrossing our servers trying to get people to give their usernames and
>passwords.  We would like to be able to put the "Reply" address in some kind
>of block list that would not allow anyone to reply to that address.
>
>Anyone know of a way to do that?

Most phishing mail doesn't depend on getting a reply through email.
They usually include a clickable link in the message that takes the
user to a compromised web site where the data are collected and,
sometimes, nice packeges of malware are deposited on the dupe's
machine. OTOH, lots of "419" mail depends on email replies (see
http://www.419eater.com).

The way to deal with this is to use a URIBL on inbound mail that
checks the domain names in the links against a database of known
spam/phishing/whatever domains. On the outbound side you want to
filter your outbound web traffic and prevent it from reaching the
compromiseds sites.
---
Rich Matheisen
MCSE+I, Exchange MVP