Info Tld And Spam

[mhinton]

Has anyone else receiving spam from the info TLD? If so, what steps do you take to prevent/deal with it? Currently, I have my SpamAssasin set to 7. I've debated doing user-level filtering and/or IP blocking.

[TCH-Bruce]

Do you have your default email set to :fail:

 

That will cut down on a lot of spam alone.

[mhinton]

Do you have your default email set to :fail:

 

That will cut down on a lot of spam alone.

 

Hi Bruce,

 

I do. Additionally, it's set to "Discard with error to sender". It's about 4 to 5 emails a day to the one account. The common thread (so far) has been that it's all coming from the .info TLD. The more I'm looking into the tools available to me, it's looking like I'm going to have to resort to account level filtering. I had thought to write a rule along the lines of "If from *.info, put SPAM in subject line". Any tips with that ?

[TCH-Bruce]

If you are using Spam Assassin can't you edit your blocked email addresses to include *.info ?

[TCH-Bruce]

Another method is in cPanel select Account level filtering. In the boxes select From and equals, in the bottom box enter *.info and select to discard the message. That should also do it.

[TCH-Carl]

Try reducing the spam score so that it is becomes more tight.

[stevesh]

I agree with Carl - our SpamAssassin is set at 3.5, and I haven't had a complaint from a user about missed emails. (Of course, we still get spam ...)

[mhinton]

Bruce,

I was a bit off. I had meant user account filtering. I created a rule where if "From" contains "*.info" discard message. When I tested the filter, using the Filter Test" it said "normal delivery occurred". I'll leave the rule in and see what happens.

 

@Carl and stevesh

Good idea on the Spam score. I went back and reviewed headers for the four messages received since 8/18/2008, X-Spam-Score:

3.0,4.4,3.2,4.4

 

I've set it to 4 at this time. I'll let everyone know results in near future. Thanks!

[mhinton]

Update. I think dropping the Spam score to 4 did work. Reviewing the X-Spam-Score for the 2 messages received today: 2.1 and 1.6. As for the rule, it did not seem to work as both these came from the *.info TLD. In reading, there are a few legitimate dot info sites out there. I'm removing the rule, and will let my email client direct it to a local folder. At which point, glance over them and move on. Thanks for the help everyone.

[TCH-Bruce]

Thanks for the update and glad you found something that works for you.