Debora is a huge spammers!!!!

[Michael S.]

Already using CBL. Iv seen it on 32 boxes, same Debora spam messages being
pumped inbound. Boxes are located all over the world not just in the USA so
this is a worldwide issue. Cant say its just one or two boxes. CBL doesn't
stop it.

 

  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: Sunday, November 12, 2006 3:40 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!

 

Use an RBL such as cbl.abuseat.org in exim, if you can - that'll probably
get most of them.

 

We're not seeing any form the lovely debs here.

 

Phil

 

  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael S.
Sent: Sunday, November 12, 2006 8:41 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!

 

As I mentioned, I want to catch them at smtp time and not after its been
received therefore it needs to be implamented in exim.conf and not sa. Why
accpt 25,000 debora spam messages and waste bandwidth accepting them when it
could be done up front?

 

  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: Sunday, November 12, 2006 3:21 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!

 

Oh that it were so simple.

 

The current sa-updated 3.1.7 rules, various rules from www.rulesemporium.com
<http://www.rulesemporium.com/>  and the ImageInfo plugin
(http://www.rulesemporium.com/plugins.htm ) get most of them anyway, and
FuzzyOCR 3.4.2 (from http://fuzzyocr.own-hero.net/wiki/Downloads ) catches
many of what's left.

 

Cheers,

 

Phil

 

  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael S.
Sent: Sunday, November 12, 2006 8:01 PM
To: mailscanner at lists.mailscanner.info
Subject: Debora is a huge spammers!!!!

 

The huge increase in stock spam that everyone is seeing is coming from the
username that is consistently the same. Has anyone noticed?

These are different variations of the username@

 

deborahpessanha at bridportleisure.com

deborasalsano at brokermart.com

deborahvw at brooksmetals.com

 

Etc. Notice the first 6 characters of every username being Debora?

 

 

Is there an exim rule that one can implement in exim.conf for example that
rejects all mail arriving from Debora??????@fakedomain.com?

 

Id rather do this at SMTP time instead of allows MS to kill it off as there
are thousands and the less MS has to work the better.

 

Thanks

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20061112/ace03442/attachment-0001.html