🚀 go-pugleaf

In article <847905832snz@alquds.demon.co.uk>,
Shakib Otaqui <shakib@alquds.demon.co.uk> wrote:
>    Any ideas on the best way to implement it?  Seeing the many
>    variations in the spam I've received in the past I've used, for
>    example, "*emailsrus.com*" (without the quotes).

If you are talking about the Nokia and 666 spams, these have been 
nowhere near emailsrus.

As the sender is reasonably proficient in forging them, it is likely that
any significant filtering on envelope address will simply cause a change
to random addresses or to addresses that you can't safely refuse, or
which he has a grievance against.

The only way of anything like reliably filtering these is to accept the
message and then scan the subject and body for keywords inicative of
a spam.

This is largely a human factors problem.  You have to convince the
spammer that spamming is unprofitable and you have to convince all the
ISPs between him and the virtual backbone that they should not do
business with spammers and the people who service them.  One backbone
ISP, Sprint, currently has a policy that they are not responsible for
the actions of their ISP customers, possiby because CyberPromo (the
owners of the real emailsrus, have taken legal action against them for
their breach of contract in trying to cut them off!)

(Actually, I wonder if CyberPromo will take legal action for abuse of
their emailsrus trading name!)

If you want to do automatic processing, and bouncing, you need to
accept the message, construct a chain of trust on the Received lines,
reverse resolving any IP addresses, and trying successive higher SOA
and/or looking for the last "good" address on a traceroute, and then
bounce them to the ISP associated with that address.  This can only
really be reliably done manually.
-- 
David Woolley, London, England          david@djwhome.demon.co.uk
(Sending any email to this site constitutes a licence to copy it to any
company which might reasonably be assumed to have transported it or
might reasonably be assumed to service any addresses quoted in it. 15Sep1996)