Debora is a huge spammers!!!!

[Randal, Phil]

Use an RBL such as cbl.abuseat.org in exim, if you can - that'll
probably get most of them.

 

We're not seeing any form the lovely debs here.

 

Phil

 

  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael
S.
Sent: Sunday, November 12, 2006 8:41 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!

 

As I mentioned, I want to catch them at smtp time and not after its been
received therefore it needs to be implamented in exim.conf and not sa.
Why accpt 25,000 debora spam messages and waste bandwidth accepting them
when it could be done up front?

 

  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: Sunday, November 12, 2006 3:21 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!

 

Oh that it were so simple.

 

The current sa-updated 3.1.7 rules, various rules from
www.rulesemporium.com <http://www.rulesemporium.com/>  and the ImageInfo
plugin (http://www.rulesemporium.com/plugins.htm
<http://www.rulesemporium.com/plugins.htm>  ) get most of them anyway,
and FuzzyOCR 3.4.2 (from http://fuzzyocr.own-hero.net/wiki/Downloads
<http://fuzzyocr.own-hero.net/wiki/Downloads>  ) catches many of what's
left.

 

Cheers,

 

Phil

 

  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael
S.
Sent: Sunday, November 12, 2006 8:01 PM
To: mailscanner at lists.mailscanner.info
Subject: Debora is a huge spammers!!!!

 

The huge increase in stock spam that everyone is seeing is coming from
the username that is consistently the same. Has anyone noticed?

These are different variations of the username@

 

deborahpessanha at bridportleisure.com
<mailto:deborahpessanha at bridportleisure.com> 

deborasalsano at brokermart.com <mailto:deborasalsano at brokermart.com> 

deborahvw at brooksmetals.com <mailto:deborahvw at brooksmetals.com> 

 

Etc. Notice the first 6 characters of every username being Debora?

 

 

Is there an exim rule that one can implement in exim.conf for example
that rejects all mail arriving from Debora??????@fakedomain.com
<mailto:Debora??????@fakedomain.com> ?

 

Id rather do this at SMTP time instead of allows MS to kill it off as
there are thousands and the less MS has to work the better.

 

Thanks

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20061112/f1d29032/attachment.html