Thanks for the asn tip! There is even a dns service that offers the asn
lookup. This is what I found, maybe there are more.
[@]$ dig +short -t txt 80.53.103.176.origin.asn.cymru.com
"48031 | 176.103.48.0/20 | UA | ripencc | 2011-12-09"
-----Original Message-----
To: users@spamassassin.apache.org
Subject: Re: mark emails as being spam originating from an ip range
owner
Hello,
On Tue, Sep 29, 2020 at 10:49:36AM +0200
> How can I mark emails as being spam originating from an ip range owned
> by xserver.ua?
>
> % Abuse contact for '176.103.48.0 - 176.103.63.255' is
I' not sure if blacklist_from accepts IP addresses or CIDR ranges, but
if it does:
blacklist_from 176.103.48.0/20
Or consider using ASN plugin:
https://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Plugin_ASN.html
and then adding a rule that penalises everything from ASN 48031:
header LOCAL_SPAMMY_ASN_XSERVER X-ASN =~ /\b48031\b/
score LOCAL_SPAMMY_ASN_XSERVER 5.0
describe LOCAL_SPAMMY_ASN_XSERVER Too much spam from xserver.ua
(AS48031)
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
