Need some help stopping this spam . . .

[Julian Field]

MailScanner doesn't use the addresses that happen to be in the From: or To:
headers, so blacklisting myhandwriting.com won't have any effect.
MailScanner uses the envelope addresses. Fortunately your mail system is
configured to put the envelope sender address in the "Return-path:" header
so you have it readily available. What you want to do is
From:   sendtheinfo.com   yes

At 15:37 19/02/2004, you wrote:
>I need some help stopping this spam - It's driving me nuts!!
>
>Here is the header:
>
>Return-path: <system at sendtheinfo.com>
>Received: from ww11.co.jefferson.co.us [206.247.49.30]
>         by gc6.jefferson.co.us; Thu, 19 Feb 2004 07:17:58 -0700
>Received: from mail214.autocontactor.com (mail214.autocontactor.com
>[66.70.75.214])
>         by ww11.co.jefferson.co.us (8.12.8/8.12.8) with SMTP id
>i1JEHrxB005133
>         for <postmaster at co.jefferson.co.us>; Thu, 19 Feb 2004 07:17:54
>-0700
>XMailer: StrongMail 1.13.37
>XMailing-Id: 00000::00000::00000::00000::0::356005
>X-Destination-ID: postmaster at co.jefferson.co.us
>X-VirtualServer: Default,mail214.autocontactor.com, 66.70.75.214
>Message-ID: <1077199880.356006 at sendtheinfo.com>
>To: "Jane Doe" <postmaster at co.jefferson.co.us>
>Message-ID: <136090-220042419142721687 at mail80.autocontactor.com>
>Reply-To: ws at myhandwriting.com
>From: "Bart" <ws at myhandwriting.com>
>x-1scdbg: mc:brt:15639:165598:1512600
>X-SentTo: "Jane Doe" <postmaster at co.jefferson.co.us>
>Subject: LIVE from Sydney, your VIP invite to tomorrow's tele-class
>Date: Thu, 19 Feb 2004 09:27:21 -0500
>MIME-Version: 1.0
>Content-type: text/plain; charset=iso-8859-1
>X-JeffCo-MailScanner-Information: Please contact the Help Desk for more
>information
>X-JeffCo-MailScanner: Found to be clean
>X-JeffCo-MailScanner-SpamCheck: not spam, SpamAssassin (score=2.993,
>         required 4, CLICK_BELOW 0.00, EXCUSE_14 0.15, LINES_OF_YELLING
>0.01,
>         ONE_TIME 0.53, ONE_TIME_MAILING 2.30)
>X-JeffCo-MailScanner-SpamScore: 2
>
>
>
>I've got autocontactor.com blacklisted in the spam.blacklist.rules
>file:
>
>From: <Tab> /autocontactor.com/ <Tab> yes
>From: <Tab> /ws at myhandwriting.com/ <Tab> yes
>From: <Tab> /myhandwriting.com/ <Tab> yes
>
>
>And I've got spam.assassin.prefs.conf configured to stop it also:
>
>header  HANDWRITING_SPAM        From =~ /Bart Baggett, Handwriting
>University/
>score   HANDWRITING_SPAM        5.0
>header  HANDWRITING_SPAM        From =~ /Bart, Handwriting
>University.com/
>score   HANDWRITING_SPAM        5.0
>header  HANDWRITING_SPAM        From =~ /Handwriting University/
>score   HANDWRITING_SPAM        5.0
>header  HANDWRITING_SPAM        From =~ /ws at myhandwriting.com/
>score   HANDWRITING_SPAM        5.0
>header  HANDWRITING_SPAM        To =~ /"Jane Doe"
>\<postmaster at co.jefferson.co.us\>/
>score   HANDWRITING_SPAM        5.0
>header  HANDWRITING_SPAM        X-SentTo =~ /"Jane Doe"
>\<postmaster at co.jefferson.co.us\>/
>score   HANDWRITING_SPAM        5.0
>header  HANDWRITING_SPAM        X-VirtualServer =~ /autocontactor.com/
>score   HANDWRITING_SPAM        5.0
>
>
>Why is this not working?
>
>Thanks for any help
>
>Jeff

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654