Filtering out a frequent Spammer...

Status
Not open for further replies.

kblessinggr

PedoBeard
Sep 15, 2008
5,723
80
0
G.R., Michigan
www.kbeezie.com
It seems that someone I worked with might have added my my emails to a spam list, as I'm always getting spam mail in pairs, one to my paypal address and one to my primary address. Always the same kind of spam, and always shows the From pointing to myself.

But I also noticed the originating hostname is never the same either in the raw logs.

Code:
Received: from ppp089210209188.dsl.hol.gr ([89.210.209.188])
	by host.kblinker.com with smtp (Exim 4.69)
	id 1LSoph-00058N-Ny

Received: from pt-82a3.adsl.wanadoo.nl ([62.234.162.163])
	by host.kblinker.com with smtp (Exim 4.69)
	id 1LSw2Y-0004nG-LU
	
Received: from 20158064117.user.veloxzone.com.br ([201.58.64.117])
	by host.kblinker.com with smtp (Exim 4.69)
	id 1LSwVV-0006mU-55

Received: from ip-80-54-40-130.zdnet.azartsat.pl ([80.54.40.130])
	by host.kblinker.com with smtp (Exim 4.69)
	id 1LSxXf-0001YE-5p

Received: from 91-168-41-19.rev.libertysurf.net ([91.168.41.19])
	by host.kblinker.com with smtp (Exim 4.69)
	id 1LSypF-0006ue-LZ

Received: from 173-17-26-21.client.mchsi.com ([173.17.26.21])
	by host.kblinker.com with smtp (Exim 4.69)
	id 1LSgTD-0001xb-8W

Received: from 201-68-217-39.dsl.telesp.net.br ([201.68.217.39])
	by host.kblinker.com with smtp (Exim 4.69)
	id 1LSeji-0008Ls-UG

Other than utilizing spamassasin is there a way I can blacklist certain hostmask, or trigger mail where the TO and FROM address are identical (well I guess I could do the trigger part in my email client if it let me test two fields against each other).

edit I think I found the original culprit, found a much older pair with this in the raw text
Code:
Received: from [59.184.178.25] (helo=allaboutmoms.com)
	by host.kblinker.com with smtp (Exim 4.69)
	id 1LS4UN-0004aT-6t

Note the "allaboutmoms.com", I remember my wife talking bout trying to join some mom's club, but I thought she used her gmail account (unless of course the membership fee would also go by the paypal email, which may explain the pairing).

Though the original questions above could still use an answer.
-Karl
 


I came here to say spam assassin, although depending on your web host you may be able to deny all traffic from specific IPs/hostnames.
 
Status
Not open for further replies.