spoofing with a twist.

[chuntmd_ironport]

Having a short domain name is a pain but keeps me employeed ;)

So a spammer is sending email FROM: abc@fbr.com TO: abc@fbr.com

I also get legit email like from the Washington Post, when you email yourself a link/article both the FROM and TO are the same.

Is there a good way of handling this?

Chris

[ecsherwo_ironport]

I handle these with a message filter that checks for domain of sender and recipient being the same and then checks the SBRS score, if the domains match and the score is negative I quarentine the message.