Debora is a huge spammers!!!!

[Arthur Sherman]

i see it too, about 40 instances in maillog during 20 hours.
Different IP all.
Most were catched by MS.
If i'd get ~25,000 such spams a day, i'd consider filtering them at MTA,
everything that would stop the flood on the spot would be good.
Otherways, it is just a short-lasting workaround and a waste of time.


Best,

--
Arthur Sherman

+972-52-4878851
CPTeam 

 


  _____  

From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael S.
Sent: Sunday, November 12, 2006 11:24 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!



I did a grep on Debora in my logs and although that ip reveals the same ip
as what you have the rest are from all different ips so ip blocking wont do
it.

 


  _____  


From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: Sunday, November 12, 2006 3:53 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!

 

We're not seeing because I wasn't looking...

 

All fifteen from Deborah came from the one IP address 70.86.164.242, which
isn't yet in any RBL that I use.

 

Phil

 


  _____  


From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: Sunday, November 12, 2006 8:40 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!

 

Use an RBL such as cbl.abuseat.org in exim, if you can - that'll probably
get most of them.

 

We're not seeing any form the lovely debs here.

 

Phil

 


  _____  


From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael S.
Sent: Sunday, November 12, 2006 8:41 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!

 

As I mentioned, I want to catch them at smtp time and not after its been
received therefore it needs to be implamented in exim.conf and not sa. Why
accpt 25,000 debora spam messages and waste bandwidth accepting them when it
could be done up front?

 


  _____  


From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: Sunday, November 12, 2006 3:21 PM
To: 'MailScanner discussion'
Subject: RE: Debora is a huge spammers!!!!

 

Oh that it were so simple.

 

The current sa-updated 3.1.7 rules, various rules from www.rulesemporium.com
<http://www.rulesemporium.com/>  and the ImageInfo plugin
(http://www.rulesemporium.com/plugins.htm ) get most of them anyway, and
FuzzyOCR 3.4.2 (from http://fuzzyocr.own-hero.net/wiki/Downloads ) catches
many of what's left.

 

Cheers,

 

Phil

 


  _____  


From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael S.
Sent: Sunday, November 12, 2006 8:01 PM
To: mailscanner at lists.mailscanner.info
Subject: Debora is a huge spammers!!!!

 

The huge increase in stock spam that everyone is seeing is coming from the
username that is consistently the same. Has anyone noticed?

These are different variations of the username@

 

deborahpessanha at bridportleisure.com

deborasalsano at brokermart.com

deborahvw at brooksmetals.com

 

Etc. Notice the first 6 characters of every username being Debora?

 

 

Is there an exim rule that one can implement in exim.conf for example that
rejects all mail arriving from Debora??????@fakedomain.com?

 

Id rather do this at SMTP time instead of allows MS to kill it off as there
are thousands and the less MS has to work the better.

 

Thanks

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20061113/56ddcaa8/attachment.html