spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "richard@buzzhost.co.uk" <rich...@buzzhost.co.uk>
Subject Re: well, isnt that special...
Date Wed, 25 Nov 2009 17:55:11 GMT
On Wed, 2009-11-25 at 17:34 +0000, Ned Slider wrote:
> Aaron Wolfe wrote:
> > On Wed, Nov 25, 2009 at 12:04 PM, Ned Slider <ned@unixmail.co.uk> wrote:
> >> R-Elists wrote:
> >>>
> >>> on a much more important note, can those on the list that have a good
> >>> handle
> >>> on better filtering spam and/or UCE from Constant please share your SA
> >>> info
> >>> on that please?
> >>>
> >> Here's mine:
> >>
> >> uri             LOCAL_URI_C_CONTACT     m{constantcontact\.com\b}
> >> score           LOCAL_URI_C_CONTACT     12
> >> describe        LOCAL_URI_C_CONTACT     contains link to constant contact
> >> [dot] com
> >>
> >> Got fed up with these clowns a long time ago so I hammer anything from them
> >> on sight.
> > 
> > That score is a bit extreme, but I've also found that a small positive
> > score is appropriate for constantcrap mail.
> > 
> > -Aaron
> > 
> 
> Indeed, and I wouldn't advocate anyone following *my* scoring, just 
> posted the rule as an example of one way to whack this particular mole :)
> 
> I chose the high score to counteract any dns whitelists or AWL negative 
> scoring etc that may otherwise rescue their crap from being marked as 
> spam on my system. If there's anything I particularly want I can 
> whitelist it, but the default action here is to tag and quarantine all 
> mail from Constant Contact. The high score probably also reflects my 
> level of frustration with them at the time I wrote the rule!

I don't think that's harsh at all Ned. I have a different solution:

#CHEETAH (EXPERIAN)
iptables -A FIREWALL -s 66.165.100.0/24 -j DROP
#CONSTANT CONTACT
iptables -A FIREWALL -s 63.251.0.0/16 -j DROP
iptables -A FIREWALL -s 66.151.234.144/28 -j DROP
iptables -A FIREWALL -s 208.75.120.0/22 -j DROP
#dotmailer offenders
iptables -A FIREWALL -s 80.87.10.0/30 -j DROP
iptables -A FIREWALL -s 80.87.10.4/31 -j DROP
iptables -A FIREWALL -s 80.87.10.6/32 -j DROP

Any more ranges most welcome :-)


Mime
View raw message