What is this? Just ordinary SPAM?

[Pat_ironport]

In the last 3 days we got many mails with just one textline as body (no 'subject', no 'To:')

%RANDFILE[./bodies/tb/tb_plain.txt,./bodies/tb/tb_html.txt,./bodies/ol/ol_html.txt]

The sender is displayed as (non-existing) internal user "tooc@ourcompany.com"

In the mail-header I can see this:

Received: from 189.26.70.70.adsl.gvt.net.br (189.26.70.70.adsl.gvt.net.br [189.26.70.70])
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Ahp3ALnz40cKSgK3/2dsb2JhbACCKYV3gS6GJCQaPpdPgSw

Is this just ordinary SPAM?
What do you do against such unwantend Mails? (Do you use additional rules to make some further checks?)

[Doc_ironport]

Looks like someone has screwed up their spam sending programs...

This is always going to be a hard type of message to catch, because whilst it probably is spam, it's also just an error message - no actual spam content!

Even so, the best action to take it to send it on to us so that we can update our rules to block further messages - both for you and all other customers. Forward the message as an attachment to spam@access.ironport.com, or if you're using the Outlook you can get the plug-in from the support site which gives you a "report spam" button.

I wouldn't recommend writing your own rules to block spam unless it's a very "local" issue - it's almost always going to be best to leave it up to our spam rule writers to do it for you, but obviously we need to see the message first.

[Pat_ironport]

You (IronPort) got a copy of such a mail 1 minute after the first occurence in my Outlook-Inbox. :wink:

I wouldn't recommend writing your own rules to block spam unless it's a very "local" issue

You are right. But in the meantime, I have to explain this (and the not needed reaction) to many of my co-workers. 8)