Re: That aaaspam thing [was: Read the reports before you trade]

[Christopher Faylor <cgf-no-personal-reply-please at cygwin dot com>]

On Wed, Feb 09, 2005 at 02:31:51PM -0000, Dave Korn wrote:
>>-----Original Message-----
>>From: cygwin-owner On Behalf Of Richard
>>Sent: 08 February 2005 14:50
>>To: cygwin
>>Subject: Read the reports before you trade
>>
>>Test message 
>
>
>  Say, cgf, how does the aaaspam address work?  Does it block the sender by
>email address or does it block by sender's IP?  If I was to see some asshole
>preparing to spam the list like this and I were to send fakemail with the same
>From: addy, would that pre-emptively block them?

It just blocks by from and sender.

By the time you see it in the cygwin list, it's likely already blocked
thanks to the spammer sending email to some other honeypot.  FWIW, when
I see something like this I:

block the the specific email

then, block a pattern representing the email address if I can -- in this case
"usacablenews"

then, if I think this address is not likely ever to be used by a valid message
sender, I force the "always spam" bit on.

then, I look in the message for keywords that look spammy.

then, I teach spamassassin that the message was spam.

>  Oh, btw, here comes that terrible mailer misconfiguration problem of mine.  Oh
>no, not again.....
>
>
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>Richard@usacablenews.com
>
>
>  Heh.  Domain doesn't even have an MX yet, but should he try and set one up
>hopefully he won't find the incoming responses amongst the spam........

DaveK, you repeated that Richard@usacablenews.com many times?  Do you realize
that if you repeat an address like richard@usacablenews.com in a message like
this then it is possible that Richard@usacablenews.com might, himself, end
up getting a lot of spam due to spam scrapers pulling the Richard@usacablenews.com
name out of the archive?

This probably just slipped your mind.

Apologies to Richard@usacablenews.com in advance for DaveK's minor screwup.

cgf