All the Perl that's Practical to Extract and Report

I don't like spam

drhyde on 2004-04-13T11:43:52

Not even when served with spam spam spam spam spam spam spam spam eggs and spam.

So as well as using spamassassin, I now use a bunch of custom rules for weeding out spam from anti-virus authors and from various countries; I block something like 60 domains before procmail and spamassassin even get to see them (but only if the spamming host has rDNS); and just recently I started blocking hosts which lie in their HELO.

That last one is technically breaches some RFCs but fuck it, I don't care any more. It *works*.

What I really want to do is refuse connections based on the sender's netblock, populating my blocklist with ASes, cos then when a spamsource like comcast gets a new range, they'll remain blocked. Unfortunately, I don't run a fancy enough network to be speaking BGP, so does anyone have any clues how to do this? It would simplify matters no end.

eek

jhorwitz on 2004-04-13T14:27:43

Blocking entire netblocks can actually do more harm than good if it's not done correctly. If I have a small /28 network in one of my ISP's larger blocks, and some idiot with another network in the same block decides to start spamming, you have to make sure you block the idiot's network, and not the ISP's larger block. Otherwise, you could block me and plenty of other legitimate mail servers. As you said, you just might not care at this point, and I don't blame you.

Of course for things like cable modem blocks this is the way to go -- I'm really sick of spam from DHCP clients.

Re:eek

drhyde on 2004-04-13T14:47:29

I'd only do that for netblocks which are repetitive egregious spammers. In those cases, I consider the collateral damage to be a feature, not a bug. In any case, what I'd like to do is not refuse to accept mail, but refuse to even start talking SMTP with hosts in such blocks. Spamware and winfestations generally don't seem to be clever enough to handle that and so go on to their next victim. Real mail software on the other hand - even MS mail software - should interpret that as my server being down, and so fall back to using my secondary MX. Which will, of course, gladly forward their mail on to me.

For mail that does come via my secondary MX, it still has to get past spamassassin.