On Aug 17, 2006, at 11:38, Chris Santerre wrote:
> -----Original Message-----
> From: Oliver Schulze L. [mailto:[EMAIL PROTECTED]
> Sent: Thursday, August 17, 2006 2:24 PM
> To: users@spamassassin.apache.org
> Subject: Dealing with spam bots and dialup/dsl spammers
>
>
> HI,
> I'm getting a very high Spam volume lately.
> I noticed that the most common source of spam are dial-up and
> A/DSL users.
>
> I wonder if there is a test that I can raise the score, when
> an IP/hostname
> send me and email and that IP/hostname is not a MX server for
> that domain.
>
Well most of these are better to deal with at the MTA level. Use an
RBL. But I have this older rule for SA I still use today:
Mind the wordwrap!
header MY_DSL Received =~
/\.atlantabroadband\.com|customer|ppp|poole?s?
|modem|cable|node|adsl|dial|dsl|client|(insight|tampabay|maine|nyc|nc|c
inci)\.rr\.com|vc\.shawcable\.net|se\.client..?
\.attbi\.com|\.(east|west)\.verizon\.net|(nj|sc)\.comcast\.net|\.dis.ne
t|\.charter.com|metropolis\-inter\.com/i
describe MY_DSL Contains likely dsl address in header
score MY_DSL 3.0
Is there a way to make that trigger only on the _first_ (most recent)
received header?
