procmail
[Top] [All Lists]

Re: Spammer-slammer algorithm

1997-10-22 17:10:57
On Wed, 22 Oct 1997, Walter Dnes wrote:

    I've seen a few lists on the web where people valiantly try
to come up with lists of all the wierd domain names that the
spammers use.  It's a losing battle.  Just like slimy viruses
<snip>

Too true... I try to keep my local spam domains list up-to-date, but right
now it's got over 2400 (!) domains on it, and it seems to grow every time
I update.

Here's an idea I came up with today:

The spammers can keep getting new domains, sure, but almost all the spam
domains are served by a collection of what, maybe 20 nameservers.  How
about checking the NS record of the domains on any incoming mail?  If the
NS record is one of the spammer nameservers, /dev/null it.

In effect, the above concept would automagically maintain a list of spam
domains.

I'm no expert at writing Procmail recipes, so I don't even know if this is
possible internal to procmail, but I know it can be done with something
like Perl.

--
Andrew O. Smith - aos(_at_)insync(_dot_)net    | "Reality is that which, when 
you stop
Sysadmin, Insync Internet Services  |  believing in it, doesn't go away."
BOFH, Wielder of the sacred LART    |           -- Philip K. Dick

<Prev in Thread] Current Thread [Next in Thread>