Subj : Dropbox/Onedrive/CLOUD
To   : deon
From : vorlon
Date : Wed Jul 13 2022 11:49:09

Hi deon,

 > Be great to setup a honeypot email or two - do you know how to do
 > that? IE: Advertise an email address that spammers pick and use -
 > which automatically results in spam training? (Since no real person
 > ever would use that email.)

I've not done it. But there might be a post on the support fourm on how
to do it. (Just can't remember).

There's a few things that can be tweeked under the hood.

ie: /etc/mail/spamassassin/country.cf
---cut---
ifplugin Mail::SpamAssassin::Plugin::RelayCountry

header   COUNTRY_RELAY_AE X-Relay-Countries =~ /AE/
describe COUNTRY_RELAY_AE Relayed through United Arab Emirates
score    COUNTRY_RELAY_AE 7.5
add_header all Relay-Country _COUNTRY_RELAY_AE_

header   COUNTRY_RELAY_AF X-Relay-Countries =~ /AF/
describe COUNTRY_RELAY_AF Relayed through Afghanistan
score    COUNTRY_RELAY_AF 7.5
add_header all Relay-Country _COUNTRY_RELAY_AF_
---cut---

spam.lists.conf seams to get overwritten every now and again, so I've got
a cronjob copying my (Bigger) list back...

/etc/MailScanner/spam.lists.conf
---cut---
BARRACUDA b.barracudacentral.org
SPAMCOP   bl.spamcop.net
ABUSEAT   cbl.abuseat.org
SPAMHAUS  zen.spamhaus.org
---cut---

 > If I put in a IPv6 CIDR, opendkim cannot restart.
 > 
 > Internally, all my systems get an address from my fd00:368::/48 that I
 > use. So any outgoing mail would come from that CIDR - but it rejects
 > it with no relaying. I have to use the IPv4 address :(

Perhaps it didn't like the format?

I've also got a ipset country block running for some places that seam to
be spam and nothing but spam... SEO spam is one of the worst...

OVH is a block on sight, along with digital ocean and a few others... #0(



\/orlon
aka
Stephen


--- Talisman v0.42-dev (Linux/m68k)
 * Origin: Vorlon Empire: Amiga 3000 powered in Sector 550 (21:1/195.1)

.