Best way to block fake "Your Order Has Been Placed" emails that refer to "Norton LifeLock"? RSS Back to forum
@arch.willingham:
Hello arch.willingham,
I am afraid we will need more information than this to assist you with the spam problem. Could you send us (to ) the following for analysis, please?
- A short description of your system setup (e.g. Server OS, Exchange version, front-end/secondary mail server relaying emails to ORF, etc.)
- The configuration file called orfent.ini (*and the orfcs.ini and orfcs.remote.ini files if they exist). It can be found in the ORF program directory (default: C:\ProgramData\ORF Fusion).
- The ORF log files from the last 3-5 days. These have .log extensions (e.g. orfee-2022-02-12.log, … orfee-2022-02-15.log) and can be found on the configured ORF logging path (ORF Administration Tool: System > Log > ORF Text Log – Configure > Settings tab).
- A few spam samples that have made it through ORF, saved in a .eml or .msg format.
Thank you.
We are getting tons of these. The return address is ""
In the header you see this:
Message-ID: <03f7e424-44607-00147873084375@desktop-ukjs7pj>
Reply-To: "Norton Store #625878" <>
From: "Norton Store #625878" <>
To:
Subject: Your Order Has Been Placed
Date: Tue, 15 Feb 2022 18:52:50 +0530
MIME-Version: 1.0
Content-Type: text/html
X-Priority: 3
Any ideas?
Thanks!