Fwd: The Spamhaus CSS list

[Alex Broens]

On 10/2/2009 4:38 PM, Julian Field wrote:
> Here is one you might all be interested in (with thanks to Tony Finch):
> 
> Spamhaus have announced a new blacklist aimed specifically at showshoe
> spammers. "Snowshoe" is a technique where spammers use large numbers of
> superficially legitimate hosts that each send a small quantitiy of spam,
> in an attempt to spread the spam load and keep each host below the radar.
> 
> The new CSS list is a component of the SBL (and therefore also the sbl-xbl
> and ZEN lists) so many setups will use it automatically.
> 
> http://www.spamhaus.org/news.lasso?article=646
> 
> However note that SpamAssassin will not, since its current rules do not
> recognise a 127.0.0.3 result from the ZEN blacklist. You can add the
> following to your local.cf to treat CSS matches as equivalent to other SBL
> matches.
> 
> header RCVD_IN_SBL eval:check_rbl_sub('zen', '127.0.0.[23]')


I'd suggest using the rule  below instead of modifying stock SBL rule.

header RCVD_IN_CSS eval:check_rbl_sub('zen', 'zen.spamhaus.org.', 
'127.0.0.3')
describe RCVD_IN_CSS Received via a relay in Spamhaus CSS
tflags RCVD_IN_CSS net
#reuse  RCVD_IN_CSS
score   RCVD_IN_CSS             1.0

That way you can score it differently according to your need.

Watch out for line breaks in the rule after mailing.

Alex