Re: [PLUG] Spam filter suggestions

On 7/10/06, Art Alexion <art.alexion@verizon.net> wrote:

I have an email address (arthur@alexion.com) that is about 12 years old and
was posted on several web sites in the '90s for a number of years.  Needless
to say, it gets an enormous amount of spam.

I find Verizon's pop server based filters decent; they filter out about 80%
that I never have to retrieve and process locally.  To help with this
account, I have it forwarded to a Verizon account and retrieve it from there,
a lot of spam being filtered as it passes through.  A good thing overall.

But a problem has come up that was not a problem before.  Mail sent by
spammers who spoof my address as the from and return address is getting
through.  Moreover, spamassassin isn't getting it locally, and I can't figure
out a kmail filter that will block it.

I used to filter it manually with the test that if the From header was me, but
the Authentication-Results was not Alexion.com, then it would be flagged
spam.  But now, with this forwarding scheme, the Authentication-Results do
contain Alexion.com, because it is being forwarded from that pop server.

Here is a header example of headers.  Any ideas for filtering?

X-Apparently-To: artalexion@yahoo.com via 209.73.179.122; Mon, 10 Jul 2006
05:10:35 -0700
X-YahooFilteredBulk: 206.46.252.55
X-Originating-IP: [ 206.46.252.55]
Authentication-Results: mta334.mail.mud.yahoo.com
from=alexion.com; domainkeys=neutral (no sig)
Received: from 206.46.252.55  (EHLO vms055pub.verizon.net) (206.46.252.55)
by mta334.mail.mud.yahoo.com with SMTP; Mon, 10 Jul 2006 05:10:35 -0700
Received: from 200-168-12-198.dsl.telesp.net.br ([200.168.12.198])
by vms055.mailsrvcs.net
(Sun Java System Messaging Server 6.2-2.05 (built Apr 28 2005))
with SMTP id <0J2600G0ESH4TI10@vms055.mailsrvcs.net> for artalexion@yahoo.com
(ORCPT arthur@alexion.com); Mon, 10 Jul 2006 07:10:32 -0500 (CDT)
Date: Mon, 10 Jul 2006 08:10:22 -0500
From: "Milton Prater" < arthur@alexion.com>
Subject: Hate studying?
X-Originating-IP: 199.24.156.240 by smtp.200.168.12.198;  Mon,
10 Jul 2006 08:10:22 -0500
To: arthur@alexion.com
Reply-to: "Milton Prater" <arthur@alexion.com>
Message-id: <asllkqQNVSQEarthur@alexion.com >
Content-type: text/plain
Content-transfer-encoding: quoted-printable
Status: RO
X-Status: RC
X-KMail-EncryptionState: N
X-KMail-SignatureState: N
X-KMail-MDN-Sent:

--

_____________________________________________________________
Art Alexion
Arthur S. Alexion LLC

PGP fingerprint: 52A4 B10C AA73 096F A661  92D2 3B65 8EAC ACC5 BA7A
The attachment - signature.asc - is my electronic signature; no need for
alarm.
Info @
http://mysite.verizon.net/art.alexion/encryption/signature.asc.what.html
_____________________________________________________________

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug