Potential use for custom SPAM action ?

[UxBoD]

Hmmm, Very true Ken. As we have the sareport then perhaps check whether the IP address appears on other RBLs that the admin has defined. If it does, and it matches the MailScanner.conf setting "Spam Lists To Reach High Score" then commit the IP.  Hopefully that would be safer.

Regards,

--[ UxBoD ]--
// PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: C759 8F52 1D17 B3C5 5854  36BD 1FB1 B02F 5DB5 687B
// Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
// Phone: +44 845 869 2749 SIP Phone: uxbod at sip.splatnix.net

----- Original Message -----
From: "Ken A" <ka at pacific.net>
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Sent: Monday, July 30, 2007 9:53:46 PM (GMT) Europe/London
Subject: Re: Potential use for custom SPAM action ?

UxBoD wrote:
> Have been thinking what I could use this for and have this idea.
> Using
the idea from
http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:rbls:all:your_own_onemore&s=rbl
how about if a certain SA score is achieved then it would write into a
MySQL table the IP, time, delta seconds since last seen and count. If
count > n times then write into the RBL the IP.
> 
> What do you think ?
> 

Simple is Good! But there are always those IPs that are shared and 
deliver lots of mail(at least there are here!), so be sure to build some 
whitelisting ability - by cidr blocks is best. Or, instead of output to 
an rbl, you could generate iptables (DROP) rules to cost the spammer a 
bit more. Might be nice to have an option for either rbldnsd or iptables 
formatted output. :-)

Ken


> Regards,
> 
> --[ UxBoD ]--
> // PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
> // Fingerprint: C759 8F52 1D17 B3C5 5854  36BD 1FB1 B02F 5DB5 687B
> // Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
> // Phone: +44 845 869 2749 SIP Phone: uxbod at sip.splatnix.net
> 
> 


-- 
Ken Anderson
Pacific.Net
-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.