> But even though all these defenses have been put up, some spam still
> gets through.
>
> Thats why I want this the spamtrap thing. As an addendum to my other
> spam deterrents. But what you said makes perfect sense. Is there a way
> then to block the actual sending IP address?
I'm doing this right now with the swen virus. I don't intend on this being
permenant, but from what it seems, it is. I have over 800 email addresses
listed in a blacklist that is automatically updated.
I realize I could be blocking legit mail, but then again, I have only a
handful of email addresses I generally communicate, and if on the list, keep
me in the CC and I'll get it either way, if I don't get 2 copyies, I'll know
something needs to be fixed.
deny message = I don't want your virus
condition = ${if match{${lc:$h_from:}}{microsoft|message service|ms technical|security assistance|ms public|ms corporation|network delivery|ms net email|ms network|internet security|network security|technet|ms customer|inet service|security support|public assistance|ms net|program security|security center|ms security|network email|net mail|ms email|inet email|commercial client|public services|security section|technical assistance|customer assistance|" *" *<}{yes}{no}}
condition = ${run{/bin/sh -c \"/bin/echo $sender_address >> /etc/exim4/virus_senders\"} {yes} {yes}}
Just to give you an idea.
If you instead use SQL (i'm beginning to think I need or rather want SQL),
you can change the last to:
condition = ${lookup mysql{INSERT INTO sometable VALUES ($sender_address)}{yes}{yes}}
I use double yes's so that the lookup never fails (I hope anyway).
change $sender_address to $sender_hostaddress (or whatever it is, not
looking at spec) if you want IP.
--
Lab tests show that use of micro$oft causes cancer in lab animals
