Hello,

I've been having a rough time lately with spamming, mostly from
repeatative sources and my methods are traditional enough for them to
keep on coming.

They probably own the DNS and technical contact domains above them to
be ignored by them, or they're well compansated.

I'm a SpamCop subscriber and was also dependent on SamSpade, though
it's lately being pressed on by ARIN.

I need to be able to locate e-mail hosts, web hosts and DNS hosts for
the target domain and those above him just in case someone is putting
a loop in place.

A reference to a ProcMail recipe that returns the above digest or a
web site would be nice.

If all else fails, explain to me how that is probbaly or likely done
and I'll get the tool done on my own.

Thank you! >:-)

PS: I've been looking for complete MX mail traffic spam protection
outsourcing, if you've got leads as well, please by all means!

PS2: Pardon the low amount, depending on the reply, the tip will tip
up the scales a bit, though not much. ;-)

/Lizardnation

---

Request for Question Clarification by samrolken-ga on 17 Nov 2002 23:02 PST

What operating systems are you running? Do you have access to a Linux
or other UNIX-type server?

---

Clarification of Question by lizardnation-ga on 18 Nov 2002 03:53 PST

Hello,

Yes, a Linux RedHat server on the net.

/Lizardnation

I manage a mail server for about a dozen different domains, and to
fight the problem of spam, I installed a little utility called
"spamassassin". What spamassassin does is that it checks a message for
any of a plethora of signs that the message is spam, and that the
message is not spam. For each of these signs, it assigns the message a
score, and beyond a certain score, the message is considered spam.

The list of tests it performs is here:
http://www.spamassassin.org/tests.html.

There are many different ways you can use SpamAssassin. It integrates
with all popular mail servers, both commercial and open source.
Instructions for doing this can be found at
http://www.spamassassin.org/.

If you tend to check your email through POP3, then you don't even need
to set up SpamAssassin to work with your mail server. There exists a
simple, Perl-based proxy that will perform the spam scanning at POP3
time. In addition, it can be configured to scan mail on any server,
for any client. If you set up one of these POP3 Spam-scanning proxies
on any machine, you can check any mail in any POP3 mailbox on the
Internet with any client, simply using your spam scanning service as a
proxy.

The original version of this proxy server is here:
http://mcd.perlmonk.org/pop3proxy/.

This version is aimed towards Windows users. I made the code
compatible with Linux, and posted it here:
http://samk.org/pop3proxy.pl

You can download this script, and put it in the /usr/bin/ directory on
your linux machine. Then, edit it to reflect your particular mail
servers. In the file, you will see something like this:

my %hostmap = (
    9110 => 'localhost:110',
    9111 => 'mail.suespammers.org:110',
);

This maps ports on the proxy to hosts on the Internet. With this one,
for example, I can configure my POP3 mail client to connect to
proxyhost.myhost.com, which happens to be where I run this proxy
server. I have my mail client connect on port 9111. Then I can just
check my mail as if I were connected to mail.suespammers.org on port
110.

Then, just add a command to invoke this service on startup (usually by
putting the command at the end of /etc/rc.d/rc.local, but you should
check your distribution's documentation) and you're set to go. Spam is
filtered.

---

Clarification of Answer by samrolken-ga on 18 Nov 2002 10:33 PST

Make the URL for my version of the script http://samk.org/pop3proxy.txt .

Thank you Samrolken,

Covered my needs and I have picked up a few MX based services, one of
which is Bright Mail and eDox whom provide the software on an ASP
basis due to its cost.

Hello Lizardnation
try these cheap and cheerful solutions from
Mail Filters
http://www.mail-filters.com
or 
Dansie
http://www.dansie.net/spam_net.html
Both server side implementations, Dansie has an online demo at:
http://www.dansie.net/cgi-bin/filters.pl?login
(log on is 'demo') and if you click the 'edit filters' it shows you
what can be achieved, and you should be able to block out names of
mailservers, email addresses, and other details such as keywords in
the subject or body before it reaches any POP box.
There is also an outsourced mailservice but I can't remember the name
at the moment!
It involves them hosting your domain name on their MX records and they
have a useful white list and black list feature, which requires the
sender to confirm delivery (one time only) so if it’s spam from a fake
email address it won’t be delivered.
regards
lot-ga