Fwd: The Spamhaus CSS list
ms-list at alexb.ch
Fri Oct 2 15:48:48 IST 2009
On 10/2/2009 4:38 PM, Julian Field wrote:
> Here is one you might all be interested in (with thanks to Tony Finch):
> Spamhaus have announced a new blacklist aimed specifically at showshoe
> spammers. "Snowshoe" is a technique where spammers use large numbers of
> superficially legitimate hosts that each send a small quantitiy of spam,
> in an attempt to spread the spam load and keep each host below the radar.
> The new CSS list is a component of the SBL (and therefore also the sbl-xbl
> and ZEN lists) so many setups will use it automatically.
> However note that SpamAssassin will not, since its current rules do not
> recognise a 127.0.0.3 result from the ZEN blacklist. You can add the
> following to your local.cf to treat CSS matches as equivalent to other SBL
> header RCVD_IN_SBL eval:check_rbl_sub('zen', '127.0.0.')
I'd suggest using the rule below instead of modifying stock SBL rule.
header RCVD_IN_CSS eval:check_rbl_sub('zen', 'zen.spamhaus.org.',
describe RCVD_IN_CSS Received via a relay in Spamhaus CSS
tflags RCVD_IN_CSS net
score RCVD_IN_CSS 1.0
That way you can score it differently according to your need.
Watch out for line breaks in the rule after mailing.
More information about the MailScanner