At 02:41 PM 9.20.2003 +0200, Kristian Koehntopp wrote: > >Hi! > >I have analyzed the latest Swen wave, and it seems that I >receive many mails from a very small set of machines. > >I am about to modify my spamd in a way that it maintains a list >(a dbm actually) of IP-numbers it received spam from as well as >the time_t the spam was being received. I also plan to build a >program that reads this dbm and generates a supplement for my >sendmails access list, containing all IPs that have spammed >within the last hour or so. > >What would I read in an email to get the IP number to add to the >block list? Should I go for the "From " (From<Space>) header, or >should I better look at the received headers (from ><somehost>[<someip> by <my machine>)? Does anyone here already >have code for such a thing? > >I am running 2.55 at this particular site. > >Kristian >
Research has led me to believe that the "envelope from" is the most reliable source of the actual sender. I am prepared to be corrected though.... and would like to be. Best regards, Jack L. Stone, Administrator Sage American http://www.sage-american.com [EMAIL PROTECTED] ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
