Messaging Gateway

HI,

We are using Symantec Mail Security 5.0.We have the SPA license as well for symantec premium Antispam. But we are getting lot of spam ,like every user is getting around 50 emails everyday of the below nature. The spam email has the below behaviour:

Subject :

Your order

Order Status

Delivery Status Notification (Failure)

Body : its an html email with a picture in it and have an hyperlink on it.

I have tried to create a rule which checks for this url (hyperlink in the body) but the url is always changing.

Pls advise and it seems , its a worldwide spamming issue.Is their any fix or update for this , with which the symantec mail security will block it directly , without creating any customized rule

Thanks Harry

Hello Harry,

It sounds like you are running into what has been called "backscatter" email. Unfortunately you are correct in that this is a fairly wide spread issue right now. Symantec is continuing to try to implement new ways to combat this type of spam. We do have rules in place to block these, but just like you are running in to, these attacks frequently change and so new rules have to be created.

We have had a few discussions on this forum on how to combat this type of spam aside from the the automatically downloaded rule sets. For the version you are running it would take custom configuration to be able to gain some effectiveness against them.

Backscatter Thread 1

Backscatter Thread 2

In our next version of the Symantec Brightmail Gateway we are going to implement BATV to help with blocking backscatter emails. So we will gain even more effectiveness at that time.

As always, please submit these per the current submission guidelines.

Thanks!

Tom