From Bob Bergey, received 21/9/01, 3:43 pm -0400 (GMT):
> At 6:17 PM +0100 9/21/01, Steve Linford wrote:
>
>>If it's the domain they use at 'MAIL FROM' (the Return-Address), and
>>they're using an address like "[EMAIL PROTECTED]" then you do this:
>>
>>spambag.com = error
>
> Terrific ... I had tried <spambag.com>=error and that didn't work,
> but I think I understand now that it would have only worked if
> "spambag.com" was listed in the address being spammed *before* the @
> symbol, correct? I'll try it without the brackets. And I assume
> spambag.com=spamtrap would work, too, right?
No spambag.com=spamtrap won't do anything, the spamtrap function
works on the RCPT TO address. Say you're getting spam to various
dprint.com addresses, and some of them don't actually exist (say
"[EMAIL PROTECTED]"), then you put this in the router:
<[EMAIL PROTECTED]> = spamtrap
The next time a spammer tries to deliver junk for multiple users at
your domain, including for [EMAIL PROTECTED], SIMS will reject the whole
connection because the spamtrap is tripped during the connection.
Here's a SIMS log sample showing a spammer trying to deliver to 2 of
my real addresses as well as one of my spamtraps
"<[EMAIL PROTECTED]>", connection was 15:46:25 4
SMTP-693([202.130.235.228])
SMTP-693 Input Line: EHLO hjzdb.\r
SMTP-693 Input Line: MAIL From:<[EMAIL PROTECTED]>\r
SMTP-693 Sending 250 <[EMAIL PROTECTED]> sender accepted\r\n
SMTP-693 Input Line: RCPT To:<[EMAIL PROTECTED]>\r
ROUTER aliased to spamtrap
SMTP-693 Sending 250 <[EMAIL PROTECTED]> recipient accepted\r\n
SMTP-693 SPAM? address <[EMAIL PROTECTED]> is a SpamTrap address
SMTP-693 Input Line: RCPT To:<[EMAIL PROTECTED]>\r
SMTP-693 Sending 250 <[EMAIL PROTECTED]> recipient accepted\r\n
SMTP-693 Input Line: RCPT To:<[EMAIL PROTECTED]>\r
SMTP-693 Sending 250 <[EMAIL PROTECTED]> recipient accepted\r\n
SMTP-693 Input Line: DATA\r
SMTP-693 Sending 593 We do not accept spam.\r\n
From a text search in SIMS logs for 2001 that feature has saved me
1,353 spams this year alone.
--
Steve Linford
Ultradesign Xtreme Network
http://www.uxn.com
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
