Did You Block the Latest Spam Wave?

November 19, 2007

The latest spam wave is so easy to block with IMF Tune that we were surprised to receive so many support requests. Here is a sample of the SPAM email.

These emails typically have a subject of the type "November 77% OFF". However this subject is not fixed and blocking it based on subject keywords is not a good idea.

Another characteristic is the fact that these emails often spoof the From address. This causes a problem if at the IMF Tune configuration we whitelist our own domain. In that case we end up with many whitelisted spam emails of this type. Indeed whitelisting our own domain is always a bad idea. Spoofing is a very common spammer trick and such whitelist entries greatly waken filtering.

So what is the best way to block these emails? Taking a closer look at the From header, we easily identify a keyword to block. All we need is a Simple SCL Rule against the From header to block the word Viagra. Here are the configuration steps:

1. Open Configuration | SCL Rules | Simple

2. If not enabled, tick the checkbox at the top. At this point you may want to delete the rules created by the installation for demo purposes that don't apply to your organization.

3. Click Add and configure the rule as follows:

   Header/SMTP Command:
   From

   Match Type:
   contains

   Operation Type:
   set value to

   SCL Change:
   Blacklisted

   Expression to Match:
   Viagra

4. Save Changes.