RE: [cobalt-users] RaQXTR - Help! Being spammed into next week

["Dan Kriwitsky" <list1@xxxxxxxxxxxxxxxxxxxx>]

> 
> Return-Path: <amandawl747@xxxxxxxx>
> Received: from juno.net ([202.164.175.234])
> 	by ns.intonet-technology.com (8.10.2/8.10.2) with SMTP 
> id gB8IGYS17766
> 	for <accounts@xxxxxxxxxxxx>; Sun, 8 Dec 2002 18:16:35 GMT

202.164.175.234 is not juno.net. It's an open proxy relay on Port 8080.
My server would have blocked it because it's listed in Spamhaus.
> 
> Return-Path: <amandakf273@xxxxxxxx>
> Received: from juno.net 
> (dC854579C.dslam-06-22-4-03-01-02.sal.dsl.cantv.net [200.84.87.156])
> 	by ns.intonet-technology.com (8.10.2/8.10.2) with SMTP 
> id gB8JoXS02415
> 	for <tim@xxxxxxxxxxxx>; Sun, 8 Dec 2002 19:50:35 GMT

200.84.87.156 is listed by Spamcop.

> 
> Here's the output from tail maillog as of now:
> 
> Dec  8 22:00:13 ns sendmail[8115]: gB8LxZ808115: 
> <knighthood@xxxxxxxxxxxx>... No such user here Dec  8 
> 22:00:15 ns sendmail[8120]: gB8Lxb808120: 
> <kittykat@xxxxxxxxxxxx>... No such user here Dec  8 22:00:15 
> ns sendmail[8156]: gB8Lxt808156: from=<amandanh638@xxxxxxxx>, 
> size=0, class=0, nrcpts=0, proto=SMTP, daemon=MTA, 
> relay=200-153-251-243.dsl.telesp.net.br [200.153.251.243] 

200.153.251.243 listed by Spamcop

> Dec  8 
> 22:00:16 ns sendmail[8117]: gB8Lxa808117: 
> from=<amandaqa030@xxxxxxxx>, size=0, class=0, nrcpts=0, 
> proto=SMTP, daemon=MTA, relay=[218.76.241.33] 

218.76.241.33 is in Spamcop

> Any help would be much appreciated, I can't afford for my 
> server to keep going down.
> 

You can set up Sendmail to use those blocklists. If you're not
comfortable doing it yourself, I'd contact someone like Jeff Lasman to
set up Sendmail to use Spamcop and Spamhaus to reject. I am amazed how
much spam is now being caught/blocked on my server by Spamcop alone just
because of so many idiots with open proxy servers.

-- 
C2002 Dan Kriwitsky

Please reply to the list only. Off list replies are not read.