Wizard IT Products

Hi

We're getting tons of spam allegedly from worldofwarcraft - but they all come from the same range of IPs: 65.55.111.xxx

Instead of having to add in each possibility from 65.55.111.0 - 65.55.111.255 is there a way of stopping everything from 65.55.111. onwards? I've tried using the wildcard *, and just leaving out the last set of digits, but to no avail

That class C network contains Hotmail, the large free email provider. As a result, you may want to avoid blocking them. Instead, you may want to consider using a content filter in addition to MagicSpam. Several of our customers have had success with SpamAssassin in particular. And if you're using SpamAssassin in conjunction with MagicSpam, you get both IP Reputation protection (MagicSpam) and custom content filtering that you can fine-tune to your own needs (SpamAssassin).

Ok thanks for the advice. I've moved away from Spamassassin as it just wasn't good enough. You had to set the threshod so low to get it to work, that you lost a lot of good mails.

The only ones that seem to be beating magicpam, are the ones I mention that say they're from xxxxx@blizzard.com - all with subject lines about worldofwarcraft.

I keep adding the senders email to the blacklist e.g. noreply@blizzard.com but they still get through. Obviously that's only a spoofed address and when you view the raw source you get a random hotmail address, but I can't understand why magicspam can't look at a spoofed address and kill that as well?

I think it would also be good to have a blacklist of words in the subject line - so in this case 'warcraft' or the obvious ones like viagra etc...

I notice that the warcraft emails seem to be between 65.55.111.75 - 65.55.111.95 - can I add a shortened range like that?

MagicSpam does not do content filtering, so filtering based on a spoofed address is not currently possible with MagicSpam. Instead, MagicSpam provides a set of blocklists and SMTP policies that can be used to greatly reduce the amount of spam that enters your system.

MagicSpam does not currently support the entering of IP ranges to the blacklist. It's easy to set too broad of a range and end up blocking more IP addresses than you intended.

And as for SpamAssassin catching emails that it shouldn't have, you can always lower the score for a given rule. Some of our customers have had to do so because their users were sending emails that triggered the rules far too often and marked the messages as spam. Once the lowered the score of some of the more common rules their users triggered, the issue went away.