Stopping Russian (and other) Spam

[Carlos Camacho]

In Plesk, SpamAssassin allows for adding emails or domains to the blacklist. I have a question on the wildcard usage.

I use wildcards for domains such as:

*@spammer.com

I'm wondering if the following would work:

*.ru

So any email that ends with .ru is tagged as spam, such as info@spammer.ru or info@tricky.spammer.ru

Does Plesk's SA allow for wildcards in this manner? I'm using the beta Mailfoundry but a good amount of Russian (and sometimes Chinese mail) seems to worm its way into my mail box.

Cheers,

[Carlos Camacho]

While I'm at it, I'd like to ask two more questions...

1) Older versions of Plesk use to have "Hits required for spam" set at 5. Newer versions seem to default to 7. I've got mine at 5. How about the rest of you?

2) In "Enable MAPS spam protection", I have this on. In "MAPS zones", I have "sbl-xbl.spamhaus.org". I seem to recall you can place more than one black-list address in that field, perhaps separated by ";". What do the rest of you have in "MAPS zones"?

Thanks!

[Carlos Camacho]

Oops, yet another question...

3) My server mail "IP address/mask" (Whitelist) is set to "127.0.0.1 / 32". I heard that older version or default version set it to "127.0.0.1 / 8" which opens up the server for security vunerabilities. (There is an exploite that can use your loop back IP to send out spam.) I just want to confirm that my info (thinking) is correct.

[Carlos Camacho]

Strange that I am talking to myself ;)

But I found the answer to one of my questions. I'll post it to help others:

Server > Server-wide mail preferences >

1. Enable MAPS spam protection (enable this)
2. MAPS zones (enter: sbl.spamhaus.org;bl.spamcop.net)

This will greatly reduce spam being received by your server and will cut down the amount of bounces in Qmail Queue.

I think I'll go with: sbl-xbl.spamhaus.org;dnsbl.sorbs.net;spamcop.net
Unless someone has better advice...

I also found this tip:



From the command line, an RBL check can be activated on Plesk with the following:

/usr/local/psa/bin/mailserver.sh --add-maps-zone sbl-xbl.spamhaus.org
/usr/local/psa/bin/mailserver.sh --set-maps-status true



Someone (:D) should add this to the Wiki.

[ozgreg]

Just watch out for spamhaus.org I had a shared hosting get listed and it tooks months and months to get off it..

[Carlos Camacho]

>Just watch out for spamhaus.org I had a shared hosting get listed and it tooks months and >months to get off it..
I'm confused by your statement. When I say I am using sbl-xbl.spamhaus.org, it is to use their blocking list for spam filtering. How would doing so get my domain on their lists? Seems like apple and oranges? :confused:

[ozgreg]

If you are on a shared hosting service and another account/customer spams or is being tagged as spam a lot of the lists (spamhaus.org for example) block the IP address rather than the domain sending the email/spam thus all domains sharing that IP address are black banned..

and when that happens my friend found it tooks months for spamhaus.org to remove the shared IP address from the spam list..

[Carlos Camacho]

Ozgreg,

I understand what you say, but I think that anyone sending me legit email chance of being on a RBL is small. Anyhow, thanks for explaning what you meant.

And now, to answer another of my own questions, entering "*.ru" into the blacklist in Plesk does work. The question is, will it have an adverse effect? If not, *.tw might be next on my list :)

[airoid]

Do you have instructions on how to add this to a cpanel server? This sounds like it may help a bit with the spam problem. Thanks!