Removing Spammers from Reports

[Pig712]

Hi all,

I have a persistent spammer ([email protected]) attacking my NAS as shown in the attached screenshot. While I have successfully prevented the spam is getting through, they are still showing up in the MailPlus Daily Report (refer screenshot).

I was hoping there was way to stop their activity being reported on so that the report would essentially show me new attacks that I have not yet dealt with properly. My fear with the current setup is that new spamming issues will just get lost in the "noise" created by this one particularly troublesome spammer that appears to be circumventing the Blacklists.

Any ideas on what to do, or alternative methods to be kept informed on new spam issues, are appreciated.

Thanks.

/P

 

[WST16]

Hi,

Try to use the firewall to block the IP addresses, hopefully they’re few. An alternative is to block Italy if you don’t care for any email from there
Edit: unless you’re in Italy then I don’t think you want to do that (block the whole country)

Add the rule at the top of the firewall list. Should be before your email rules.

 

[WST16]

One more thing…
I see that you’re using “reject”. You might want to consider “discard” instead. Some say that using “reject” only enforces your mail server’s existence to the spammers and might actually lead to your mail server being added to some black lists as a spammer.

Just a thought.

 

[Pig712]

Hi,

Try to use the firewall to block the IP addresses, hopefully they’re few. An alternative is to block Italy if you don’t care for any email from there
Edit: unless you’re in Italy then I don’t think you want to do that (block the whole country)

Add the rule at the top of the firewall list. Should be before your email rules.

Thanks for your reply @WST16.

Unfortunately the buggers are hitting me from a gazillion IP addresses as shown in the attached. The only consistent thing is the recognition of sender as "[email protected]" (and also recipient as the same, so clearly something dodgy going on there). Refer screenshot attached. I have blacklisted that address within MailPlus with action to discard not reject (refer attached screenshot). The spam attempts keep coming despite all these actions and the sender being marked as spam by some DNSBL's.

I seem to be out of tricks bar endlessly adding their IP addresses to my blacklists (which I thought was the job of the DSNBLs). My noob brain on this stuff cannot join the dots why I am fighting so hard to deal with this when there is "allegedly" so much infrastructure to deal with the clear spammers like this.

 

[Pig712]

One more thing…
I see that you’re using “reject”. You might want to consider “discard” instead. Some say that using “reject” only enforces your mail server’s existence to the spammers and might actually lead to your mail server being added to some black lists as a spammer.

Just a thought.

Yep, already doing this. They haven't given up though unfortunately

 

[WST16]

Yes, sorry. Just noticed that they come from different geolocations (not just Italy). I’m using mail (not mail plus) and I “discard” some spammers mail. To the best of my knowledge there’s no other way (in mail at least don’t know about mail plus). I’ve managed to block a few via the firewall. But that’s not applicable in your case (and some of mine too).

I think what you’re looking for is a “reject or discard and do not report” option.

 

[WST16]

Take a look at this. It might help.

Edit: Downloading the list was accessible before. Now it requires “supporting” the provider

IP Block List – Marius Hosting

IP block list for your Synology NAS. This list will be updated every day and stop SSH attackers.

mariushosting.com

 

[Pig712]

Yes, sorry. Just noticed that they come from different geolocations (not just Italy). I’m using mail (not mail plus) and I “discard” some spammers mail. To the best of my knowledge there’s no other way (in mail at least don’t know about mail plus). I’ve managed to block a few via the firewall. But that’s not applicable in your case (and some of mine too).

I think what you’re looking for is a “reject or discard and do not report” option.

Yep, that's exactly what I want, the point being that if spammers impact my reporting then in a sense they win. I will suggest this "feature" to my friends at Synology.

 

[Pig712]

Take a look at this. It might help.

Edit: Downloading the list was accessible before. Now it requires “supporting” the provider

IP Block List – Marius Hosting

IP block list for your Synology NAS. This list will be updated every day and stop SSH attackers.

mariushosting.com

I had seen this somewhere before and didn't pay much attention. MIght be worth looking into a bit deeper. I don't mind supporting the provider as long as I can keep the shirt on my back . Thanks for your suggestion!