UpdateChannels.txt

Use this forum for discussions about SpamAssassin and anti-spam in general.
Post Reply
fmail
Normal user
Normal user
Posts: 159
Joined: 2009-01-02 18:21
Location: Denmark, Aarhus

UpdateChannels.txt

Post by fmail » 2019-03-23 18:15

Hi

What do you in the file? Not mush in my file, all are so old...

User avatar
SorenR
Senior user
Senior user
Posts: 3184
Joined: 2006-08-21 15:38
Location: Denmark

Re: UpdateChannels.txt

Post by SorenR » 2019-03-23 18:40

"updates.spamassassin.org"

Min SpamAssassin er en blanding af 3.4.0 og 3.4.2. Serveren kører på Windows Server 2003 og OS understøtter ikke 3.4.2.

Derimod fungerer min SpamAssassin træning helt fænomenalt!
https://www.hmailserver.com/forum/viewt ... p?p=164777
SørenR.

“With age comes wisdom, but sometimes age comes alone.”
- Oscar Wilde

fmail
Normal user
Normal user
Posts: 159
Joined: 2009-01-02 18:21
Location: Denmark, Aarhus

Re: UpdateChannels.txt

Post by fmail » 2019-03-23 19:11

Same in my file and a few line more, but all entry are real old, look like no one do maintenance on this anymore?
I also do spam/nospam training from users mail, but still SA let spam mail pass.

This last days been Mailserver maintenance day.

User avatar
SorenR
Senior user
Senior user
Posts: 3184
Joined: 2006-08-21 15:38
Location: Denmark

Re: UpdateChannels.txt

Post by SorenR » 2019-03-23 19:21

Well, you need to block as a minimum the "Static SPAM":

1: SnowShoe SPAM

2: LashBack SPAM

3: All domains ending in .icu (I have a thing going with the registrar of icu domains at the moment)

4: These domains; rememberbeherenow.com, 3dmeditation.com, luckydaeon.com, danzamor.com, kalosive.com, ssdspace.com, downpic.com, retpem.com, genpip.com, leinno.com, makze.com

When I look at my Eventhandlers.vbs I am surprised ANY mail is allowed throu, but we do receive all valid emails :mrgreen:
SørenR.

“With age comes wisdom, but sometimes age comes alone.”
- Oscar Wilde

fmail
Normal user
Normal user
Posts: 159
Joined: 2009-01-02 18:21
Location: Denmark, Aarhus

Re: UpdateChannels.txt

Post by fmail » 2019-03-23 23:08

hmmm may i kindly ask, how to do you first 2 step?

I think your step 3 and 4 is done in a blacklist file .cf like this:
blacklist_from @rememberbeherenow.com
blacklist_from *.icu

Right?

User avatar
SorenR
Senior user
Senior user
Posts: 3184
Joined: 2006-08-21 15:38
Location: Denmark

Re: UpdateChannels.txt

Post by SorenR » 2019-03-23 23:53

RBL...

SnowShoe:
RBL: zen.spamhaus.org
Return code: 127.0.0.3
Score: 1.000.000.000 ;-)

LashBack:
RBL: ubl.unsubscore.com
Return code: 127.0.0.2
Score: 1.000.000.000 ;-)

Script (EventHandlers.vbs)...

Code: Select all

Function isLashBack(strIP) : isLashBack = False
   Dim a, strLookup
   a = Split(strIP, ".")
   With CreateObject("DNSLibrary.DNSResolver")
      strLookup = .DNSLookup(a(3) & "." & a(2) & "." & a(1) & "." & a(0) & ".ubl.unsubscore.com")
   End With
   If (InStr(1, strLookup, "127.0.0.2", 1) > 0) Then isLashBack = True
End Function

Function isSnowShoe(strIP) : isSnowShoe = False
   Dim a, strLookup
   a = Split(strIP, ".")
   With CreateObject("DNSLibrary.DNSResolver")
      strLookup = .DNSLookup(a(3) & "." & a(2) & "." & a(1) & "." & a(0) & ".zen.spamhaus.org")
   End With
   If (InStr(1, strLookup, "127.0.0.3", 1) > 0) Then isSnowShoe = True
End Function

Sub OnClientConnect(oClient)
   '
   '   LashBack SPAM detection
   '
   If isLashBack(oClient.IPAddress) Then
      Result.Value = 1
      Exit Sub
   End If
   '
   '   SnowShoe SPAM detection
   '
   If isSnowShoe(oClient.IPAddress) Then
      Result.Value = 1
      Exit Sub
   End If
End Sub
DNSLibrary.DNSResolver can be found here.
SørenR.

“With age comes wisdom, but sometimes age comes alone.”
- Oscar Wilde

User avatar
SorenR
Senior user
Senior user
Posts: 3184
Joined: 2006-08-21 15:38
Location: Denmark

Re: UpdateChannels.txt

Post by SorenR » 2019-03-24 00:02

fmail wrote:
2019-03-23 23:08
hmmm may i kindly ask, how to do you first 2 step?

I think your step 3 and 4 is done in a blacklist file .cf like this:
blacklist_from @rememberbeherenow.com
blacklist_from *.icu

Right?
Oh, if only you knew... My Eventhandlers.vbs is currently 1428 lines and all criteria for Reject/Black/White-lists are in a 178 lines XML file.

The story begins here --> https://www.hmailserver.com/forum/viewt ... 20&t=33602
The XML handling has matured somewhat so I will be posting a new codebase soon.
SørenR.

“With age comes wisdom, but sometimes age comes alone.”
- Oscar Wilde

User avatar
mattg
Moderator
Moderator
Posts: 20123
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: UpdateChannels.txt

Post by mattg » 2019-03-24 03:36

SorenR wrote:
2019-03-24 00:02
Oh, if only you knew... My Eventhandlers.vbs is currently 1428 lines ...
Mine is currently 2658 lines...Don't know if that's good or bad though - probably getting to the point of being too big.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
jimimaseye
Moderator
Moderator
Posts: 8125
Joined: 2011-09-08 17:48

Re: UpdateChannels.txt

Post by jimimaseye » 2019-03-25 09:50

mattg wrote:
2019-03-24 03:36
SorenR wrote:
2019-03-24 00:02
Oh, if only you knew... My Eventhandlers.vbs is currently 1428 lines ...
Mine is currently 2658 lines...Don't know if that's good or bad though - probably getting to the point of being too big.
Remember that the eventhandlers script is loaded in to memory every time on each and every message that reaches your mail server either by SMTP or external download. Something to consider if you run a really busy server.
HMS 5.6.6 B2383 on Win Server 2008 R2 Foundation, + 5.6.7-B2415 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

Post Reply