Last week a lot of SPAM messages

Forum for things that doesn't really have anything to do with hMailServer. Such as php.ini, beer, etc etc.
Greta
Senior user
Senior user
Posts: 257
Joined: 2007-01-02 13:23
Contact:

Last week a lot of SPAM messages

Postby Greta » 2010-09-17 10:33

The last week I receive a lot of SPAM. Only e-mail message with only on URL in it. I use ClamAV0.96.2 with ClamSup 1.3.0, DNS blacklists and SURBL.

Anyone any idea how I can block this e-mails?

^DooM^
Site Admin
Posts: 13853
Joined: 2005-07-29 16:18
Location: UK

Re: Last week a lot of SPAM messages

Postby ^DooM^ » 2010-09-17 11:26

I have been getting these quite frequently too myself. If you are any good at scripting you could always check to see if body only contains an url and if it does, delete it.
If at first you don't succeed, bomb disposal probably isn't for you! ヅ

User avatar
dzekas
Senior user
Senior user
Posts: 2486
Joined: 2005-10-13 21:28
Location: Lithuania

Re: Last week a lot of SPAM messages

Postby dzekas » 2010-09-17 12:15

Greta wrote:The last week I receive a lot of SPAM. Only e-mail message with only on URL in it. I use ClamAV0.96.2 with ClamSup 1.3.0, DNS blacklists and SURBL.

Anyone any idea how I can block this e-mails?

Sender (server's IP address) is always the same or random? Is it listed in some RBL?
From: address is the same, random or your own?

Greta
Senior user
Senior user
Posts: 257
Joined: 2007-01-02 13:23
Contact:

Re: Last week a lot of SPAM messages

Postby Greta » 2010-09-17 16:45

Sender (server's IP address) is always random. And from address display name is random and e-mail address is my own.

I have already try to make a script that check if the body contains one line and begins with http://. But I’m not very good at vb scripts. So it didn’t work…

User avatar
dzekas
Senior user
Senior user
Posts: 2486
Joined: 2005-10-13 21:28
Location: Lithuania

Re: Last week a lot of SPAM messages

Postby dzekas » 2010-09-17 16:49

Greta wrote:Sender (server's IP address) is always random. And from address display name is random and e-mail address is my own.

Could you name at least one or two servers that send those emails or test their IP addresses in http://www.blacklistalert.org yourself.

Legit emails can contain only site url. You talk with somebody, they ask about that funny video on youtube and you send them url to that video. If you want to filter such emails, get email client with Bayes filtering support and train it.

Greta
Senior user
Senior user
Posts: 257
Joined: 2007-01-02 13:23
Contact:

Re: Last week a lot of SPAM messages

Postby Greta » 2010-09-17 16:54

a view IP addresses:

188.41.83.37
188.54.84.210
213.191.224.174
151.51.56.255
62.159.109.4

User avatar
dzekas
Senior user
Senior user
Posts: 2486
Joined: 2005-10-13 21:28
Location: Lithuania

Re: Last week a lot of SPAM messages

Postby dzekas » 2010-09-17 17:00

bl.spamcop.net - listed
cbl.abuseat.org - listed
uceprotect level1, level-2 and level3 - listed
zen.spamhaus.org - some are already listed. others should be listed when spamhaus.org syncs with cbl.

Check your current RBL configuration.
Enable greylisting in case those spams slipped in before being listed on RBL.

Greta
Senior user
Senior user
Posts: 257
Joined: 2007-01-02 13:23
Contact:

Re: Last week a lot of SPAM messages

Postby Greta » 2010-09-17 17:50

Thanks, I have add two blacklist where the on. See if this helps.

User avatar
dzekas
Senior user
Senior user
Posts: 2486
Joined: 2005-10-13 21:28
Location: Lithuania

Re: Last week a lot of SPAM messages

Postby dzekas » 2010-09-17 18:19

Greta wrote:Thanks, I have add two blacklist where the on. See if this helps.

If you add uceprotect, learn how this rbl works. This rbl is automatic and higher levels have higher rate of false positives.

Greta
Senior user
Senior user
Posts: 257
Joined: 2007-01-02 13:23
Contact:

Re: Last week a lot of SPAM messages

Postby Greta » 2010-09-23 10:04

Ok, thanks for mention


Return to “Off-topic discussions”



Who is online

Users browsing this forum: No registered users and 1 guest