On Wed, 2009-11-25 at 17:34 +0000, Ned Slider wrote:
> Aaron Wolfe wrote:
> > On Wed, Nov 25, 2009 at 12:04 PM, Ned Slider <n...@unixmail.co.uk> wrote:
> >> R-Elists wrote:
> >>>
> >>> on a much more important note, can those on the list that have a good
> >>> handle
> >>> on better filtering spam and/or UCE from Constant please share your SA
> >>> info
> >>> on that please?
> >>>
> >> Here's mine:
> >>
> >> uri LOCAL_URI_C_CONTACT m{constantcontact\.com\b}
> >> score LOCAL_URI_C_CONTACT 12
> >> describe LOCAL_URI_C_CONTACT contains link to constant contact
> >> [dot] com
> >>
> >> Got fed up with these clowns a long time ago so I hammer anything from them
> >> on sight.
> >
> > That score is a bit extreme, but I've also found that a small positive
> > score is appropriate for constantcrap mail.
> >
> > -Aaron
> >
>
> Indeed, and I wouldn't advocate anyone following *my* scoring, just
> posted the rule as an example of one way to whack this particular mole :)
>
> I chose the high score to counteract any dns whitelists or AWL negative
> scoring etc that may otherwise rescue their crap from being marked as
> spam on my system. If there's anything I particularly want I can
> whitelist it, but the default action here is to tag and quarantine all
> mail from Constant Contact. The high score probably also reflects my
> level of frustration with them at the time I wrote the rule!
I don't think that's harsh at all Ned. I have a different solution:
#CHEETAH (EXPERIAN)
iptables -A FIREWALL -s 66.165.100.0/24 -j DROP
#CONSTANT CONTACT
iptables -A FIREWALL -s 63.251.0.0/16 -j DROP
iptables -A FIREWALL -s 66.151.234.144/28 -j DROP
iptables -A FIREWALL -s 208.75.120.0/22 -j DROP
#dotmailer offenders
iptables -A FIREWALL -s 80.87.10.0/30 -j DROP
iptables -A FIREWALL -s 80.87.10.4/31 -j DROP
iptables -A FIREWALL -s 80.87.10.6/32 -j DROP
Any more ranges most welcome :-)
