E-Mail and Xfinity Connect Help

[doplar]

I am receiving spam from Romania and Russia. I have tried setting up all kinds of filters to catch it but nothing is working. Has anyone had any success in blocking these types of emails?

[CCCarole]

Do you have your spam filter enabled?

[doplar]

I am using comcast.net, vista, windows mail, and chrome or firefox. I have set up filters in my comcast.net account using .ro for Romania and .ru for Russia and some of the prefix numbers of the IP addresses in the headers. Their is nothing in the headers that is consistent for the the filter to latch onto except for the info I put into my filters. I have the filters set to read the header and set to contain the above info. My windows mail catches it as spam using the block international tab where I have selected Russia and Romania but it still makes it to my PC. Would like to stop it at my comcast.net account level. Otherwise I think it shows the spammers that it is an active email.

[LowRanger]

You need to answer CCCarole's question.

The neat part about domains and even IP addresses is that both are pretty easy to spoof.  That being the case, you need to use a tool that goes beyond domains and IP addresses and Comcast's answer to that comes in the form of Spam Filtering.  It isn't very good, but it is what they offer.

If you have Spam Filtering on, you've done pretty much all you can on the Comcast side.  There are some third-party Spam solutions thay may help once the e-mails get on a computer.

[doplar]

Spam filters are enabled. Using comcast connect. Everything else I have answered. Doesn't appear to be a solution at the comcast inbox level. Just didn't know if someone had found a filter set up that was working.

[LowRanger]

Since you have Spam Filtering enabled, the only other thing you can do is make sure you report the Spam messages as Spam.  You must be logged in to Xfinity Connect to do this.

I'm not sure what Comcast does with the reports (whether they are automatically blacklisted or they actually initiate some research).

[doplar]

Thanks, Was reporting it to missed spam@comcast and usgov site. Probably go back back to doing that. Thanks again

[LowRanger]

In order to train your Spam Filter, it is probably necessary to report the message as Spam through Xfinity Connect.

Then again, lots of things work (or don't work) in unusual ways.

[steve-baker]

---

doplar wrote:

...

My windows mail catches it as spam using the block international tab where I have selected Russia and Romania but it still makes it to my PC. Would like to stop it at my comcast.net account level. Otherwise I think it shows the spammers that it is an active email.

---

There's nothing you can do to affect what the spammer thinks of your email address, filter rules don't kick in until after the Comcast server has accepted the email. You could accomplish what you want to do by using Mailwasher and the DNS based lists run by countries.nerd.dk. Mailwasher is an app that sits between your email client and the server and can check blocklists, among other things. You just have to configure your email client to connect to Mailwasher rather than the mailserver, and configure Mailwasher to check these lists:

ru.countries.nerd.dk

ro.countries.nerd.dk

[steve-baker]

---

LowRanger wrote:

The neat part about domains and even IP addresses is that both are pretty easy to spoof.

---

Actually, it's very difficult to spoof an IP address in a TCP connection. In the context of spam it's safe to say that it's impossible for a spammer to spoof his IP address.

[LowRanger]

---

steve-baker wrote:

---

LowRanger wrote:

The neat part about domains and even IP addresses is that both are pretty easy to spoof.

---

Actually, it's very difficult to spoof an IP address in a TCP connection. In the context of spam it's safe to say that it's impossible for a spammer to spoof his IP address.

---

You need to get out more.  IP spoofing is relativey easy and widely used at many levels.

I've had someone poking away at my firewall's SMTP ports for two weeks now and their IP address changes with each contact.  I believe it is the same person as each successive entry represents the next name in a dictionary-based attack.

http://66.14.166.45/sf_whitepapers/tcpip/IP%20Spoofing%20-%20An%20Introduction.pdf

http://untraceableman.blogspot.com/2009/01/how-to-spoof-your-ip-address-and-how-it.html

[doplar]

Well guys thanks. Got a little educated on the matter. Some have acquired bogus IP addresses. Also reported to the IP provider. Seemed to have helped a little. But I am pretty sure they just acquired a new one.

[steve-baker]

---

LowRanger wrote:

---

steve-baker wrote:

---

LowRanger wrote:

The neat part about domains and even IP addresses is that both are pretty easy to spoof.

---

Actually, it's very difficult to spoof an IP address in a TCP connection. In the context of spam it's safe to say that it's impossible for a spammer to spoof his IP address.

---

You need to get out more.  IP spoofing is relativey easy and widely used at many levels.

I've had someone poking away at my firewall's SMTP ports for two weeks now and their IP address changes with each contact.  I believe it is the same person as each successive entry represents the next name in a dictionary-based attack.

Spambots are like that. Some will try the same email address over and over from different hosts if the email is refused. It's not about IP spoofing.

http://66.14.166.45/sf_whitepapers/tcpip/IP%20Spoofing%20-%20An%20Introduction.pdf

That's so 80s. Modern TCP/IP implementations don't have predictable Initial Sequence Numbers, so you have to guess. The odds of any particular guess being correct are about 4 billion to 1.

http://untraceableman.blogspot.com/2009/01/how-to-spoof-your-ip-address-and-how-it.html

Using a proxy and IP spoofing aren't the same thing.

---

[BruceW]

---

LowRanger wrote: The neat part about domains and even IP addresses is that both are pretty easy to spoof. ...

---

steve-baker wrote: Actually, it's very difficult to spoof an IP address in a TCP connection....

---

 You're both right? In the sense that it's easy for a spammer to hide the IP address he used to send a message (by having it re-mailed, for example), but essentially impossible to spoof the IP address that finally delivers the message to the destination mail server.