MailScanner to detect same sender with multiple incoming email

[Alex Neuman]

Probably not. You may have to implement a rule using milter-sender or
similar tools.
[image: logo]
*Alex Neuman van der Hans* *Producer/Host**, Vida Digital*
+1 (440) 253-9789 <+1+(440)+253-9789> | +507 6781-9505 <+507+6781-9505> |
Panama |alex at vidadigital.com.pa | vidadigital.com.pa/
<https://mailtrack.io/trace/link/6d93d0f9fd85f8182408c621adbea1714eabe93c?url=http%3A%2F%2Fvidadigital.com.pa%2F&userId=2636895&signature=4a9377a1fcef9ef7>

Skype:alexneuman
<https://mailtrack.io/trace/link/e695afa85ee0c4170aac2e55b7906da3acaf0326?url=https%3A%2F%2Fwebapp.wisestamp.com%2Fsig_iframe%3Forigin%3Dmac-mail%26signature_id%3D5234486814965760%26t%3D0.5662234535507977%23&userId=2636895&signature=a20e7f314b8f7c6f>
 | wiseintro.co/alexneuman
<https://mailtrack.io/trace/link/83955116e94c4c95be4f79f1456fd7e1322421a8?url=http%3A%2F%2Fwiseintro.co%2Falexneuman&userId=2636895&signature=0cee64d378bc22da>

<https://mailtrack.io/trace/link/43d5bdcc5baeaf6334c673c3f26602ada23fc41a?url=http%3A%2F%2Ffacebook.com%2Fvidadigital&userId=2636895&signature=f8bdf43ced6e23ab>
<https://mailtrack.io/trace/link/99181635a1ea098db6a51eafda53e4beab94e4ee?url=http%3A%2F%2Fpa.linkedin.com%2Fin%2Falexneuman&userId=2636895&signature=992a8674f1478d5e>
<https://mailtrack.io/trace/link/a4d583331434cea491f481bae9a8c8010c913b6b?url=http%3A%2F%2Ftwitter.com%2Falexneuman&userId=2636895&signature=c8daab5f62d07b04>
<https://mailtrack.io/trace/link/bf770a2847f67ac835ea05dec59f7014f1f6cddc?url=http%3A%2F%2Fpinterest.com%2Fvidadigital&userId=2636895&signature=4a2a52b675e5362b>
<https://mailtrack.io/trace/link/dc8ff75aea9f31aaf2178ba051c94af58e13ed70?url=http%3A%2F%2Fyoutube.com%2Fvidadigital%3Fsub_confirmation%3D1&userId=2636895&signature=0e2660fe79cbdaa6>
<https://mailtrack.io/trace/link/725b75029c5a8ab2e69d5680dbb6624955faf26e?url=http%3A%2F%2Finstagram.com%2Fvidadigital&userId=2636895&signature=8bf52022c418e35d>
<https://mailtrack.io/trace/link/eaf848801d570153847072f8ca1a1392a300c5a0?url=http%3A%2F%2Famazon.com%2F%3Ftag%3Dvidadigi-20&userId=2636895&signature=8a014408afc45312>
<https://mailtrack.io/trace/link/87b67ca033052bce4c4ece3040d988f655693e96?url=http%3A%2F%2Fskype%3Aalexneuman%2F%3Fcall%26topic%3DSignature&userId=2636895&signature=cf13a5b2dff2b0b6>
<https://mailtrack.io/trace/link/ac7e8bf03485b901b82cc5d9a947f059e78199b5?url=http%3A%2F%2Fapi.whatsapp.com%2Fsend%3Fphone%3D50767819505&userId=2636895&signature=0403175a9024ec89>
<https://mailtrack.io/trace/link/bf015edc1534fb81e466e31ce423c7eadfd53536?url=http%3A%2F%2Fwiseintro.co%2Falexneuman&userId=2636895&signature=cf3ee7ca0fab1229>


On Wed, Aug 11, 2021 at 12:29 PM Muhammad Hazwan Bin Abdul Rahman <
mhdhazwan at sains.com.my> wrote:

> I have a mail server that configured with mailscanner and spamaassassin.
> Lately, I have received a kind of bot attack of email which the sender
> send an email to multiple recipient( >100) in a short time.
>
> One of my rule in spamassassin is to detect any sender in which is
> sending to more then 20 person as high scoring spam value.
> However, since the attack is a private 1 to 1 mail but many recipient
> (im assuming the attacker using some kind of script), my rule cant hit
> that behavior.
>
> Im asking is there any other way in trying to catch this style of attack
> using mailscanner and spamassassin?
>
> Using Centos 7 as my OS.
>
> Thanks
>
> --
> Regards,
> Hazwan
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> <https://mailtrack.io/trace/link/7da342fe5e9daeeddced71149651fc4e4b5baa8f?url=http%3A%2F%2Flists.mailscanner.info%2Fmailman%2Flistinfo%2Fmailscanner&userId=2636895&signature=b9d4ffab8ed1efb1>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20210811/c2a04666/attachment.html>