You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Tom Kinghorn <th...@gmail.com> on 2012/01/27 08:02:32 UTC

MSN again

Good morning List.

Has anyone noticed a mass increase of spam mails from the hotmail.com 
servers?

In the last hour, these are our top 10 incoming senders.

<mr...@msn.com>
<mr...@msn.com>
<mr...@msn.com>
<mr...@msn.com>
<mr...@msn.com>
<mr...@msn.com>
<mr...@msn.com>
<mr...@msn.com>
<mr...@msn.com>
<mr...@msn.com>

Does anyone have any idea how to block this?
Message content appears random, so nothing is really effective in 
blocking the messages.

I have tried a regex rule to match the sender address but the sender 
address is random.

Thanks
Tom

Re: MSN again

Posted by Robert Schetterer <ro...@schetterer.org>.
Am 27.01.2012 08:31, schrieb Tom Kinghorn:
> On 27/01/2012 09:25, Robert Schetterer wrote:
>> if you are with postfix
>> and these are the problem senders
>> as short workaround make a sender reject table
> Hi Robert
> 
> I have a regex sender reject table but the sender addresses are random.
> the localpart changes constantly
> 
> here is my list so far
> 
> /^wegoood[0-9]{1,3}@msn\.com$/  REJECT    MSN SPAMMER
> /^ukbcc[0-9]{1,3}@msn\.com$/  REJECT    MSN SPAMMER
> /^ant2dadd[0-9]{1,3}@msn\.com$/  REJECT    MSN SPAMMER
> /^verifynoteletter[0-9]{1,3}@msn\.com$/  REJECT MSN SPAMMER
> /^ukinter[0-9]{1,3}@msn\.com$/  REJECT MSN SPAMMER
> /^a1tdad[0-9]{1,3}@msn\.com$/  REJECT MSN SPAMMER
> /^josephmorgan_[0-9]{1,3}@msn\.com$/  REJECT MSN SPAMMER
> /^joseph_[0-9]{1,3}@msn\.com$/  REJECT MSN SPAMMER
> /^morgan_[0-9]{1,3}@msn\.com$/  REJECT MSN SPAMMER
> 
> thx
> Tom

Hi Tom, its heavy to block
hacked legal accounts from big mailers
a few days ago i had this from yahoo,aol
so i rejected that domains in total
this might not work at your side.
contacting these big mailers has no access
in the most cases but you might try
ask i.e on the postfix list, so others solved the case
allready ( but give strong details about spam and your conf )

you have to do more analysis at your logs
is spam relly comming from hotmail/msn servers
are there always going to to the same recipients
( block msn only for them )
why does spamassassin not mark them etc

perhaps try using clamav milter with sanesecurity antispam sigs
blocks a lot here

paste some example spam mail elsewhere to help create
a matching spamassassin rule
-- 
Best Regards

MfG Robert Schetterer

Germany/Munich/Bavaria

Re: MSN again

Posted by Robert Schetterer <ro...@schetterer.org>.
Am 27.01.2012 08:02, schrieb Tom Kinghorn:
> Good morning List.
> 
> Has anyone noticed a mass increase of spam mails from the hotmail.com
> servers?
> 
> In the last hour, these are our top 10 incoming senders.
> 
> <mr...@msn.com>
> <mr...@msn.com>
> <mr...@msn.com>
> <mr...@msn.com>
> <mr...@msn.com>
> <mr...@msn.com>
> <mr...@msn.com>
> <mr...@msn.com>
> <mr...@msn.com>
> <mr...@msn.com>
> 
> Does anyone have any idea how to block this?
> Message content appears random, so nothing is really effective in
> blocking the messages.
> 
> I have tried a regex rule to match the sender address but the sender
> address is random.
> 
> Thanks
> Tom

if you are with postfix
and these are the problem senders
as short workaround make a sender reject table

-- 
Best Regards

MfG Robert Schetterer

Germany/Munich/Bavaria