IMF Tune v6.1 - Forefront Protection 2010 for Exchange Support
Did You Block the Latest Spam Wave?
November 19, 2007
The latest spam wave is so easy to block with IMF Tune that we were surprised to receive so many support requests. Here is a sample of the SPAM email.
These emails typically have a subject of the type "November 77% OFF". However this subject is not fixed and blocking it based on subject keywords is not a good idea.
Another characteristic is the fact that these emails often spoof the From address. This causes a problem if at the IMF Tune configuration we whitelist our own domain. In that case we end up with many whitelisted spam emails of this type. Indeed whitelisting our own domain is always a bad idea. Spoofing is a very common spammer trick and such whitelist entries greatly waken filtering.
So what is the best way to block these emails? Taking a closer look at the From header, we easily identify a keyword to block. All we need is a Simple SCL Rule against the From header to block the word Viagra. Here are the configuration steps: