Bug 6806 - Public Blacklist for Email addresses
Summary: Public Blacklist for Email addresses
Status: RESOLVED MOVED
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: spamassassin (show other bugs)
Version: unspecified
Hardware: PC Linux
: P2 enhancement
Target Milestone: Undefined
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-06-13 06:51 UTC by Frank Urban
Modified: 2012-06-13 10:30 UTC (History)
1 user (show)


Attachment Type Modified Status Actions Submitter/CLA Status
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Frank Urban 2012-06-13 06:51:44 UTC 
Hi,

today most SPAM passing SpamAssassin is send from real existing Freemail addresses.
I'm now looking for a way to put them on a public Blacklist and not in our own SpamAssassin config.
In a first step I thought check_rbl_envfrom can help here, but I seemed that only the domain is checked here and not the whole address.
Because the @ can not be part of a DNS name I think thats the problem here.
So the next idear is to build a hash code for each email address and put this code on a blacklist, but how can this handeled by SpamAssassin?

Frank
Comment 1 AXB 2012-06-13 06:57:56 UTC 
To handle this you'll need a custom plugin to do the hashing/lookups

All this has been discussed many moons ago, there was a proof of concept BL zone, etc..
Search the SA user's list archive for "Emailbl"
Comment 2 Frank Urban 2012-06-13 07:38:06 UTC 
Hi,
thanks for this.
I found only some discussions out of 2009 but this seemed to be a dead project.
Is it that you are talking about?
Frank
Comment 3 AXB 2012-06-13 07:42:40 UTC 
(In reply to comment #2)
> Hi,
> thanks for this.
> I found only some discussions out of 2009 but this seemed to be a dead
> project.
> Is it that you are talking about?
> Frank

yep - It died because nobody was willing/able to make it happpen.
I'm sure there are several such Emailbl setups being run privately.
(I run one for a couple of friends & $dayjob)
Comment 4 Frank Urban 2012-06-13 07:57:04 UTC 
I read now this old discussion and try to understand what they have done
But out of my understanding that was much more as I think that we need.
I don't want to check addresses in the body of the mail for example

I still reporting my SPAMs to a IP blacklist. There they are filtering out the IPs from the Freemailer.
But in such a case this mail was a SPAM send from a real existing Freemailer mailbox and so I asked them to put these email addresses to a separate blacklist. Thats all is no problem. 
The only think I need is now a SpamAssasin Plugin check the FROM address from a email again this blacklist.
Sounds not too difficult for me.
Comment 5 AXB 2012-06-13 08:03:03 UTC 
(In reply to comment #4)
> I read now this old discussion and try to understand what they have done
> But out of my understanding that was much more as I think that we need.
> I don't want to check addresses in the body of the mail for example

You'd  want this for a simple reason: sender uses a non Freemail addr and the Freemailer drop box is in the msg body and you'd miss that.
Same applies to other relevant headers.

> I still reporting my SPAMs to a IP blacklist. There they are filtering out
> the IPs from the Freemailer.
> But in such a case this mail was a SPAM send from a real existing Freemailer
> mailbox and so I asked them to put these email addresses to a separate
> blacklist. Thats all is no problem. 
> The only think I need is now a SpamAssasin Plugin check the FROM address
> from a email again this blacklist.
> Sounds not too difficult for me.
Comment 6 Frank Urban 2012-06-13 08:10:18 UTC 
(In reply to comment #5)
> (In reply to comment #4)
> > I read now this old discussion and try to understand what they have done
> > But out of my understanding that was much more as I think that we need.
> > I don't want to check addresses in the body of the mail for example
> 
> You'd  want this for a simple reason: sender uses a non Freemail addr and
> the Freemailer drop box is in the msg body and you'd miss that.
> Same applies to other relevant headers.

I get every day around 20 mails from my users regarding SPAMs passing the filter. 18 of them are send directly from Freemailers
So I'm only interested in blocking them. SPAMs send with non Freemailer addresse are not the problem here.
Comment 7 AXB 2012-06-13 10:27:46 UTC 
This should be moved to the sa-users list and Bug closed.
Comment 8 Frank Urban 2012-06-13 10:30:16 UTC 
ok. Closed