Debora is a huge spammers!!!!

[Michael S.]

Where did you add these rules and what do they look like?

The debora*.* spam is such a huge problem at the moment!! They must be
pumping out millions of these spam messages.

Anyone have Exim rules to stop this? I would like to add it to exim to kill
it at smtp time instead of waiting for it too get to mailscanner.

Thanks

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of mikea
Sent: Wednesday, November 15, 2006 10:32 AM
To: MailScanner discussion
Subject: Re: Debora is a huge spammers!!!!

On Tue, Nov 14, 2006 at 10:31:50AM -0000, Randal, Phil wrote:
> Not here they weren't.
> 
> A simple grep leads to double-counting (because I run milter-greylist),
> but my point still stands.  Was handled well by my setup without any
> additional response needed.

I've found that a lot of the "debora" spam, as well as a fair amount 
of other spam, matches /6c822ecf/ in one or more of Message-ID and 
Content-ID headers. I have yet to see a false positive. It's just as
good as the /From: akstc.*@/ signature, which is nailing a bunch even
now. 

If you run milter-regex, it's trivial to build rules for these. 

-- 
Mike Andrews, W5EGO
mikea at mikea.ath.cx
Tired old sysadmin 
-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!