Is it only me or is there a wave of spam in the last days ? I mean, for months SpamAssassin performed well, filtering well spam mail. But in the last days I've been receiving in my box thousands of mails with subject like this:

From: Marlene Bonilla
Subject: Marlene wrote

Or....


From: Alison Conway
Subject: it me Alison

I found that the ImageInfo plugin knocked it down a bit... some are still slipping through due to the close proximity to the cutoff (I have my settings set to 5, and it's flagging them in the 4.5-5.5 range).
This ruleset in the ImageInfo.cf file really knocked out the "Me again" rules:And this rule list seems to be nailing most of the debora (blahblah wrote: subjects):andWith cPanel/Exim, I know there is a piece of code that Chirpy posted on the cPanel board that will set a deny rule on an IP after X sends to non-existant email addresses (brute forcing the mailserver), but I don't have a link handy. Shouldn't be too hard to find, but between that, and the above clips, I'm seeing a lot more *****SPAM***** and a lot less untagged trash showing up.
Now if only I could get my customers to actually enable mail filters to remove the spam, instead of letting their boxes fill up and start bouncing back. *sigh*

....We called it! NSLT is RISE on huge volume. We
hope you took a position early and are smiling right
now. If you didn't, don't worry. The big spike is
expected also on Wednesday, November 22nd. Get in now!....

Yep, I have the same.
Find a spamer and send it to the dentist with some broken teeth... a soft dream

The above mentioned wave of spam once again started up this morning 11/26/06 at 11:55 AM EST, and I am receiving about 4 per minute.

Note! The image filtering no longer applies because there aren't any images associated with this new attack. The e-mail addresses are also becoming more randomized as only some begin with "debora____@___.com", while others are of now of no rhyme or reason, yippee. The IP's are still coming from hundeds of locales all over the world, so blacklisting is pretty useless as of this point.

With that said, I have managed to snag 100% of them to this point, as I've applied MCP rules when the old wave started on Nov 22. My MCP rules flag anything with subject "(space) wrote:", so no matter what bogus name they use in front of that, it gets canned. I suggest many of you do the same if you can.

Below is the full text of every message I've received this morning. Under this message is always a random snippet from a news story, such as Michael Richards, the Russian Poisoning, etc.

Yes, we've noticed this too, over the last couple of days. We've been working the past week to cut down on the spam coming through and have reduced it greatly. But now, a new wave of junk coming through like this.

If you or anyone else know how to filter this or a good spam rule to caught this spam, would be much appreciated.

TIA,
Mickalo

Mine are all being flagged and stopped still... even being given a pretty substancial spam score, so there are several rules that are catching it.
Here's the clip from my maillog... hopefully the rulesets that it lists will help give you a place to start, or at least an idea on how they are being tagged:

Same here, to all of my boxes and all domains too! It's getting crazy. Customers are complaining, etc.

Greylist them ..... and you'll see the difference

How can I greylist them?

Here: http://forums.ev1servers.net/showthread.ph...hlight=graylist

I used in the past the gray-milter, but recently I've tested the next one to be more effective due to the SPF checks and other nice features.

http://hcpnet.free.fr/milter-greylist/http...ilter-greylist/

With the miltelistr-grey active and two non aggressive RBLs rules in sendmail I have stopped completely the spamd daemon and I receive no spam.

I warn: Before proceeding with greylisting, be sure to read ALL the documentation on it... this includes warnings about which major email services will not try again (Yahoo Groups, gmail, and some AOL servers are at the top of the list). Also, some find that php mail() messages will not reach you if you have greylisting installed.
I can confirm that a well-trained bayes database, and a good set of rules from rules emporium (as well as rules_du_jour) is very effective at knocking the spam down to the nonexistant level, and at the same time assures that no messages are forever lost due to older mailservers or mailservers that retry beyond the timeout period set by greylisting.
Out of 868 spam messages I have received to my personal email in the past 48 hours, 2 have managed to slip past the filters... and they didn't even fit the above profile of "so-and-so Wrote" or the debora messages. Those ones have been knocked down 100%.

Hi

I too have a lot of problem with these waves of spam, so much that I had to disable spamassassin on my 2 Dual Xeon 3.2 boxes because the load was like 10+ and queue started growing like crazy.

And the worse is that most of those messages got a hit of 0.1 to 1.0, some even marked as HAM...

Greylisting here gave me a lot of headache with small enterprises running their own mail system as some of them have problems sending the mail again after the first temporary failure. And explaining that the problem was their server was no good for my customers, as they dont understand that and its easier for them to go to a server that does not greylist and their mail reaches its destination.

One solution I found was recompile qmail with the Plesk patches and the qmail-dnsbl patch, blocking agressively ips listed in 5 or 6 rbls and giving autenticated users permission to send mails even if their ips are listed in the rbl.

That, combined with spamassassin, helped me reduce the amount of spams that i received per day from about 100 to about 10 or 15, using 5.0 hits required in my spamd config.

Ragefast

Do you have more details about what you did here? Your solution sounds like it may be appealing.

-Jay

I would send him a PM or "email" via the board to get his attention, that is if your case is urgent.

Good luck.

Hi Mark,

I installed graymilter because spam is make me crazy, is working fine, but I don't find where is the white list in case I need to add someone manually.

Please, does you know where is it?

Thank you in advance,

JFrech

I'm sure another forum member does. I'm just not familiar with graymilter and am not sure where its resources are kept.

If I'm right, I think you're looking for some type of whitelist, which if it is standard with graymilter, should be downloadable somewhere from their site.


I'm sorry I can't help. It's always a pleasure, JF.

Thank you Mark. It's my pleasure too.

I found another Grey Milter that is better organized and you can customize all the options in it.

http://linux.softpedia.com/progDownload/Gr...nload-7609.html

This doesn't have problems with yahoo, google, aol etc.

JFrech

I can definately give greylisting the thumbs up. We use Postfix + postgrey. Our already reduced spam rates have now been reduced by a further 95%.

Simply amazing. Well worth the mail delivery performance implications.

Is too early to give a complete opinion about this grey list, but yesterday, after I installed it, the spam stops more than 95%, and I have not still installed the SPFlist of this same project.

Also, my load average completely went down: load average: 0.32, 0.23, 0.22

JFrech