Thanks Byron, so it's not just me. Looking at the time stamps it all went quiet after midday but it had started up around 3am - so I'm guessing the net sending this out is based over the pond. When they took Rustock down the first thing I suspected was that my Internet connection had gone south on me!
I've added .xls to the "not permitted in" list recently to stop the asian speak fishing spam which has been popping up regularly for a while ever since we started selling into China. We run Spamassasin and Kaspersky on everything coming in - Kaspersky is really a backup, SA does the heavy lifting. Regards, Edmund Cramp -- Motion Lab Systems, Inc. 15045 Old Hammond Highway, Baton Rouge, LA 70816 USA Tel: +1 (225) 272-7364 | Fax: +1 (225) 272-7336 Web: http://www.motion-labs.com > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Byron Como > Sent: Wednesday, August 17, 2011 3:40 PM > To: [email protected] > Subject: Re: [brlug-general] Botnet building? > > Everybody is having problems. > > http://it.slashdot.org/story/11/08/17/1712257/Malicious-Spam-Spikes-To-Epic-Level > > On 8/17/2011 2:17 PM, Joey Kelly wrote: > > On Wednesday 17 August 2011 10:09, Mark A. Lappin wrote: > > > >> about 60% of inbound > >> messages are blocked for attachment violations > > Well, right. I block all attachments that have no business > being sent > > via email, using amavis. If I didn't run my own SMTP server, I'd be > > blocking them with procmail. > > > > Here's my list: > > > > > qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp > |hlp|hta| > > inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst| > > ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs| > > wmf|wsc|wsf|wsh)$'ix, # banned ext - long > > > > > > I also do greylisting and filter though spamassassin, and > use RBLs and > > a few postfix tricks. In the past I also scanned all > surviving mail with Clamav. > > > > > _______________________________________________ > General mailing list > [email protected] > http://brlug.net/mailman/listinfo/general_brlug.net > _______________________________________________ General mailing list [email protected] http://brlug.net/mailman/listinfo/general_brlug.net
