[prev in list] [next in list] [prev in thread] [next in thread] 

List:       sylpheed
Subject:    [sylpheed:18374] Re: Filtering mysterious spam
From:       richard lucassen <mailinglists () lucassen ! org>
Date:       2003-01-30 10:41:49
[Download RAW message or body]


On Thu, 30 Jan 2003 10:59:10 +0100
Godwin Stewart <gstewart@gstewart.homeunix.net> wrote:

> On Wed, 29 Jan 2003 23:54:24 -0800, Joseph Zitt
> <jzitt@metatronpress.com> wrote to sylpheed@good-day.net:
> 
> > While this copy of the spam appears to come from Chinanet, that's
> > far from consistent among the other, otherwise identical ones.
> 
> ...which is why I maintain a local blacklist with subnets mainly in
> Korea and China:

>From my filter in "maildrop":

if (/^content-type:.*charset.*ks_c_.*/)
  to '/home/richard/qmail/.Trash/'
if (/^content-type:.*charset.*big5.*/)
  to '/home/richard/qmail/.Trash/'
if (/^content-type:.*charset.*euc-kr.*/)
  to '/home/richard/qmail/.Trash/'
if (/^content-type:.*charset.*gb23.*/)
  to '/home/richard/qmail/.Trash/'
if (/^content-type:.*charset.*shift_jis.*/)
  to '/home/richard/qmail/.Trash/'
if (/^content-type:.*charset.*iso-2022-kr.*/)
  to '/home/richard/qmail/.Trash/'

This filters out a lot of rubbish :-)

Just my 2cts,

Richard.
 
> # Blacklisted subnets for mfilter.pl
> 
> # kornet
> 61.78.0.0/15
> 61.80.0.0/14
> 61.84.0.0/15
> 211.192.0.0/13
> 211.222.212.0/22
> 61.72.0.0/14
> 168.126.0.0/16
> 218.144.0.0/12
> 
> # boranet
> 61.32.0.0/13
> 61.40.0.0/14
> 
> # hananet
> 211.200.78.0/23
> 
> # telesp (br)
> 200.148.0.0/17
> 200.161.0.0/16
> 200.158.0.0/17
> 200.168.0.0/16
> 
> # Brazil Telecom
> 200.180.0.0/16
> 
> Embratel (br)
> 200.247.0.0/16
> 
> # pingnet (cn)
> 194.148.0.0/16
> 
> # Ajato (br)
> 200.162.208.0/20
> 
> # eyes (kr)
> 211.238.96.128/25
> 
> # Hinet (tw)
> 61.228.0.0/14
> 61.224.0.0/15
> 
> # BT online (nigeria)
> 213.181.64.0/24
> 
> # ncic.com.tw
> 218.32.0.0/16
> 
> # capital network (cn)
> 211.101.128.0/17
> 211.102.0.0/17
> 
> # chinacomm (cn)
> 211.157.96.0/19
> 218.246.32.0/19
> 
> # Chinanet.cn
> 218.75.128.0/17
> 218.76.0.0/16
> 218.77.0.0/17
> 
> # more Korean sh*t
> 211.77.64.0/18
> 
> # ineedhits.com are becoming a nuisance...
> # 203.48.0.0 -> 203.51.255.255
> 203.48.0.0/14
> 
> # Interliant/SPRINT
> 216.205.144.0/20
> 
> 
> 
> -- 
> G. Stewart   --   gstewart@gstewart.homeunix.net
>                   gstewart@spamcop.net
> Registered Linux user #284683
> 
> GnuPG key  : BA3D01C6 (pgp.mit.edu)
> Fingerprint: C3DF C686 6572 6E59 E3E4  0F40 2B9A 2218 BA3D 01C6
> ---------------------------------------------------------------
> Bills travel through mail at twice the speed of checks.
> 


-- 
___________________________________________________________________
Recursion: see recursion

+------------------------------------------------------------------+
| Richard Lucassen, Utrecht,    Linux 2.4.20 RedHat 7.2            |
| The Netherlands               i686/1200MHz/768MB                 |
| Public key: http://www.xs4all.nl/~pe1bbf/pubkey.asc              |
+------------------------------------------------------------------+

[Attachment #3 (application/pgp-signature)]

[prev in list] [next in list] [prev in thread] [next in thread]