Feature Request

[Jeff A. Earickson]

On Wed, 11 Apr 2007, Jay Chandler wrote:

> Date: Wed, 11 Apr 2007 16:11:36 -0700
> From: Jay Chandler <chandler.lists at chapman.edu>
> Reply-To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> Subject: Feature Request
> 
> Recently had a user account become compromised and start spewing spam.
>
> Is there any functionality within MailScanner that can alert me once one user 
> sends more than a predefined number of messages in a given time period?  If 
> not, I'd dearly love to see this implemented...

This might not be quite what you are looking for, but check out the IPBlock
feature of MailScanner.  You can set it up to block email from a certain
IP after a set amount per hour, configurable by CIDR netblocks.  I use 
IPBlock for both external large IP netblocks (eg, APNIC) and for netblocks
in our own class-B domain.  For instance, I have the allowed number of
messages per hour coming out of our public wireless subnets cranked down
to a low number.  I don't want some spambot from god-knows-where coming
into one of these wireless subnets and then spewing.   They get 20 messages
out then get shut down automagically.   Scan the list archives for IPBlock.

Jeff Earickson
Colby College