Re: Spam abuse report plugin

[decoder]

Eddy Beliveau wrote:

----- Message d'origine ----- De : "Michael Scheidell" <[EMAIL PROTECTED]> À : "ram" <[EMAIL PROTECTED]>; "spamassassin-users" <users@spamassassin.apache.org>

Envoyé : 27 mars 2008 10:04
Objet : Re: Spam abuse report plugin

From: ram <[EMAIL PROTECTED]>
Date: Thu, 27 Mar 2008 15:36:04 +0530
To: spamassassin-users <users@spamassassin.apache.org>
Subject: Spam abuse report plugin

I get a lot of spam on my servers which get detected by SA though are
generated by innocent mail servers.


using these accounts and send spam. By the time the administrator
realizes the server has sent 1000's of spam

We see a lot of mail users have insanely simple passwords , spammers are

So you would spam the abuse@ account '-)

If spamassassin had an option to send abuse report to servers
automatically and send mails to abuse@<server-admin> the moment the
first sure spam comes in the admin could be warned before much damage

particular id

has been done. Obviously we limit to only 1 or 2 reports in an hour to a

Best is to set up something to use 'spamassassin -r' (report) feature.
Set up a SpamCop account, put that information in local.cf.

a complain email.

If you have DCC and RAZOR, it will also submit the information to those
databases.

NOTE: YOU DO NOT WANT TO AUTOMATICALLY SEND REPORTS AS THIS _WILL_ SPAM
INNOCENT, FORGED DOMAINS ADDING TO THE BACKSCATTER PROBLEMS.

SpamCop will scan the emails for uri's add them to uri blacklists, add the server to spamcop blacklists, track down the responsible isp, and pre-format

Hi!

This subject is very interesting



Is there a tool which can do this for me ?


and that tool can prepare abuse complaint automagically.

Does that beast exist ?

I received many spams daily and have to manually analyse headers or email content to be able to send abuse report I imagine some web form (unix/windows) in which I can put a cut/paste of original email (including headers)

There is a very basic problem with that. You normally report abuse for domains or IPs, however, you do not know the originating IP in most cases, because you cannot trust headers. There might be innocent relays (freemailers for example) in the middle, and you cannot simply pick the first hop, thatone might be forged by spammers. So already determining a sure source address is something that can hardly be automatised.

Best regards,


Chris

Thanks,
Eddy

smime.p7s
Description: S/MIME Cryptographic Signature