Hi -
Well this is what I do on these -
Right off I put the ip space in my ipfile_suspicious_networks
65.175.2.0/24 Viper Hosting
If I keep getting spam from then then they go to the ipfile_networks
which I score higher.
Same for an entry into ipfile_suspicious_hosts
I then I would accumulate these to develop a pattern that I can us to
punish them without false positives. For me its hard to determine how
best to act until I have at least a small sample to work with. The "New
Account" is a tipoff but that alone will not help - something else is
generally in every email that as a combo you should able to wack the
emails with.
Not much help but best I can do Sunday eve :)
-Nick
IMail Admin wrote:
Hi,
For the last few weeks, we've seen an explotion of spam mail with the
from line as "New Account". The subject and text vary. Some messages
get caught by our threshold and dumped, but many do not. Sniffer
seems to spot these pretty effectively, but not always and we don't
take action on just one test, even one as good as Sniffer. Any
suggestions?
Ben
BC Web
Here is the source of one such message:
Received: from 52.opnletters.com [65.175.2.52] by bcw4.bcwebhost.net
with ESMTP
(SMTPD32-7.15) id A25813CE00F4; Sun, 09 Oct 2005 14:57:44 -0700
Received: (from [EMAIL PROTECTED])
by 52.opnletters.com (8.8.8/8.8.8) id OAA44895;
Sun, 9 Oct 2005 14:45:45 -0700 (PDT)
Date: Sun, 9 Oct 2005 14:59:51 -0700 (PDT)
Message-Id: <[EMAIL PROTECTED]>
From: New Account <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Get A Free Ringtone [EMAIL PROTECTED]
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-RBL-Warning: SNIFFER: Message failed SNIFFER: 60.
X-Declude-Sender:
[EMAIL PROTECTED]
[65.175.2.52]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com)
for spam.
X-Spam-Tests-Failed: SNIFFER [4]
X-Note: This E-mail was sent from 52.opnletters.com ([65.175.2.52]).
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 428897057
Get the Newest Ring Tones!
Download Top Hits to your Cell Phone!
http://52.opnletters.com/m/l?3xp-e38u-1-aox4-f417
<a href="http://52.opnletters.com/m/l?3xp-e38u-2-aox4-f417";>Get the
latest Ringtones, wallpapers, Screensavers, and more! Top ring tones
include, "Wait" by Ying Yang Twins. First download is FREE!</a>
You need to visit this link. Take your Pick!
http://52.opnletters.com/m/l?3xp-e38u-3-aox4-f417
To unsubscribe, from this Advertisement go to:
http://52.opnletters.com/remove?r.NewAccounts.0-6037852-730b.bcwebhost.net.-ben?r
or, send a blank message to:
mailto:[EMAIL PROTECTED]
New Account List
1333 W 120th Ave. Suite 101
Westminster, Colorado 80234
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
