From: Sheldon T. Hall (pftandem.artell.net)
Date: Fri Dec 01 2006 - 23:25:44 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Quoth mouss ...
> Jorey Bump wrote:
> > Carlos Eduardo R. L. de Miranda wrote:
> >
> >> Our server is receiving lots of spam messages from servers
> >> with Russian domain.
> >> I would like to block every message from Russian domains.
> >
> > If you must block by country, use an RBL:
> >
> > http://countries.nerd.dk/
> >
> > However, I find such RBLs more useful in a scoring system.
> > Here's what
> > I do in my SpamAssassin local.cf (watch the wrap):
> >
> > # first discover country code of origin using a TXT lookup
> > header RCVD_COUNTRIES eval:check_rbl_txt('nerd-zz',
> > 'zz.countries.nerd.dk.')
> > describe RCVD_COUNTRIES Received from countries.nerd.dk
> > tflags RCVD_COUNTRIES net
> > # All countries get a point by default
> > score RCVD_COUNTRIES 1.0
>
> Instead of querying a DNSBL:
>
>
> loadplugin Mail::SpamAssassin::Plugin::RelayCountry
>
> header COUNTRY_US X-Relay-Countries=~/\bUS\b/
> describe COUNTRY_US Relayed via United States
> score COUNTRY_US 0.01

Simpler still, and requiring less horsepower ... get the country IP
assignments from http://completewhois.com in a form suitable for use with
your firewall, and block port 25 (or everthing) to packets coming from those
address blocks. This isn't perfect, but if applied selectively, it really,
really cuts down on the crap.

I don't see a lot of spam delivered by servers at Russian domains, although
I see a lot of spam with forged Russian "from" addresses.

-Shel

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]