Re: [cobalt-users] How am I getting spammed?

[SM <nntp@xxxxxxxxx>]

At 11:18 27-09-2001 +0100, Step Firth wrote:
>I have a concern over the increasing amount of spam me and my clients seem
>to be getting, and some of them come through as below, looking as if there
>is a mailing list running on my Raq. There are no authorised list on the
>machine at all, so could it just be a tricky alias, or is someone hacked in
>and using my sendmail.

You can block the mail servers that are sending out the spam.  Look at the
headers to find the server address.  You can also use Procmail to set up
filters based on the headers.

>This is a header from one such dodgy spam.
>
>From: MAGIC-WEB <magic_web@xxxxxxxxxxxxx>

That's not the complete headers.  This is an example of headers which can
be useful to filter spam:

Received: (from mail@localhost)
	by list.cobalt.com (8.9.3/8.9.3) id TAA19976
	for xyzzyusers@xxxxxxxxxxxxxxx; Wed, 26 Sep 2001 19:18:13 -0700
Received: from zag.workstation.org.uk (zag.workstation.org.uk [195.62.206.2])
	by list.cobalt.com (8.9.3/8.9.3) with ESMTP id TAA19973
	for <cobalt-users@xxxxxxxxxxxxxxx>; Wed, 26 Sep 2001 19:18:11 -0700
Received: from [213.143.7.10] by zag.workstation.org.uk
          (Netscape Messaging Server 3.5)  with ESMTP id 1404
          for <cobalt-users@xxxxxxxxxxxxxxx>;
          Thu, 27 Sep 2001 11:15:09 +0100
User-Agent: Microsoft-Entourage/9.0.2509
From: Step Firth <step@xxxxxxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Message-ID: <B7D8BB79.4CDF%step@xxxxxxxxxxxxxxx>

If I was running list.cobalt.com, I would add a reject line for
zag.workstation.org.uk. :)

Regards,
-sm