> -----Original Message-----
> From: Oliver Schulze L. [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, August 17, 2006 2:24 PM
> To: users@spamassassin.apache.org
> Subject: Dealing with spam bots and dialup/dsl spammers
>
>
> HI,
> I'm getting a very high Spam volume lately.
> I noticed that the most common source of spam are dial-up and
> A/DSL users.
>
> I wonder if there is a test that I can raise the score, when
> an IP/hostname
> send me and email and that IP/hostname is not a MX server for
> that domain.
>
Well most of these are better to deal with at the MTA level. Use an RBL. But I have this older rule for SA I still use today:
Mind the wordwrap!
header MY_DSL Received =~ /\.atlantabroadband\.com|customer|ppp|poole?s?|modem|cable|node|adsl|dial|dsl|client|(insight|tampabay|maine|nyc|nc|cinci)\.rr\.com|vc\.shawcable\.net|se\.client..?\.attbi\.com|\.(east|west)\.verizon\.net|(nj|sc)\.comcast\.net|\.dis.net|\.charter.com|metropolis\-inter\.com/i
describe MY_DSL Contains likely dsl address in header
score MY_DSL 3.0
Thanks,
Chris Santerre
SysAdmin and Spamfighter
www.rulesemporium.com
www.uribl.com
