This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Snowshoe Spam Campaigning

Hi,

I'm currently using the Sophos Virtual Email Appliance for email filtering. As of late, we have had terrible luck with a lot of SPAM getting through. We've identified this SPAM as snowshoe.

My question is the following. Can you please provide your experience with SPAM, specifically with snowshoe SPAM? Are those of you using the UTM product seeing a lot of SPAM coming through your filter?

Just for comparison, I'm seeing about 100 SPAM messages coming through our filter (From Oprah, to Slim down, to Mortgage rates, to Russian women)

I'm trying to gauge whether I should be switching to the UTM product, or another vendor altogether.

Thanks!

This thread was automatically locked due to age.

0 MentalMickey over 9 years ago
I'd like to help, but we've not seen any snow shoe, oprah messages over here.

However, we have had a lot of success with the anti-spam side of the UTM.

SMTP last 24 hours [ 5164 messages delivered. 3519 messages blocked (40%) ]
Malware quarantined/rejected: 2 SPF rejects: 7
Spam quarantined/rejected: 331 RBL rejects: 774
Blacklist rejects: 109 BATV rejects: 32
Address Verification rejects: 0 RDNS/HELO rejects: 2264

We sometimes see 0 day spam hit a few boxes and then be blocked within an hour.
Cancel
Vote Up 0 Vote Down

Cancel
0 jparocua over 9 years ago in reply to MentalMickey

Thanks for sharing that information. Sounds like this is worthwhile.
Cancel
Vote Up 0 Vote Down

Cancel
0 jacobholm over 9 years ago in reply to jparocua

hi,

We are having the same issue as jparocua. Lot of SPAM coming since we have update our SG210 UTM to 9.305-4. I think that RBL is not working also.
Here our stats:
SMTP last 24 hours [ 6631 messages delivered. 637 messages blocked (8%) ]

Malware quarantined/rejected: 1 SPF rejects: 5
Spam quarantined/rejected: 0 RBL rejects: 0
Blacklist rejects: 0 BATV rejects: 226
Address Verification rejects: 405 RDNS/HELO rejects: 0

If you see the percentage of block is very low... we are use to have arround 50% or more.

Any proposal to have the function working back correctly will be appreciate!
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago
Hi, jparocua and jacobhelm, and welcome to the User BB!

Those problems look like misconfigurations to me.  Here are the recent results of an audit of the UTM at one site:

Delivered          17.9%
Rejected           78.6%
Quarantined         1.2%
Rejected Spam       2.3%
Bounced             0.0%

Cheers - Bob
Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel