Mailing List Archive

Below is a copy of the message I sent to Vince earlier for
blocking site with a firewall ipfwadm


On Mon, 17 Mar 1997, Dom Mitchell wrote:

> Vince Vielhaber wrote:
> >
> > Has anyone figured out how to block the spam from sallynet? It has a
> > different envelope each time so badmailfrom won't help. Any ideas?
>
> TCP wrappers?
>
> -Dom
>



---------- Forwarded message ----------
Date: Mon, 17 Mar 1997 05:23:33 -0500 (EST)
From: hsilver@pyx.net
To: Vince Vielhaber <vev@michvhf.com>
Subject: Re: Blocking a site



On Mon, 17 Mar 1997, Vince Vielhaber wrote:

>
> Has anyone figured out how to block the spam from sallynet? It has a
> different envelope each time so badmailfrom won't help. Any ideas?
>
> Vince.

I used ipfwadm -I -a reject -P tcp -S 204.127.131.3/255.255.255.0
on the mailhost.worldnet.att.net after one user here received 12
copies of the same 20K++ spam in a 24 hour period. I have a banlist
using ipfwadm for other similar sites that seem to get around badmailfrom
I wish there was some sort of binding legal contract I could send to
them that actually would enable me to bill them for a per byte storage
fee unless they cease and desist. Such a legal contract if it were
enforcable and possible would shift the costs back to the spammers
where it belongs.

Harley

On Mon, 17 Mar 1997, Vince Vielhaber wrote:

> Has anyone figured out how to block the spam from sallynet? It has a
> different envelope each time so badmailfrom won't help. Any ideas?

Could you post a header from one of the spams you've gotten from sallynet?

jms

-- justin m streiner --------------------------------------------------------
Systems Administrator WINDOWS '95 BUG REPORT FORM
IUP Math / Computer Science Please describe the bug in detail in
email: streiner@co.iup.edu the space below. Write legibly.
web: http://www.co.iup.edu/~streiner ____
[____]

On Mon, 17 Mar 1997, Justin M. Streiner wrote:

> On Mon, 17 Mar 1997, Vince Vielhaber wrote:
>
> > Has anyone figured out how to block the spam from sallynet? It has a
> > different envelope each time so badmailfrom won't help. Any ideas?
>
> Could you post a header from one of the spams you've gotten from sallynet?

Here it is. Note this is a new envelope sender from what I've seen in
the past. This one showed up in the last hour or so.

I should note that it finally occurred to me that I can block them
with tcpcontrol (which I just installed but haven't configured yet).

---------------------------------------------------------------------
From dlane@globaltech2000.com Mon Mar 17 07:23:44 1997
Return-Path: <dlane@globaltech2000.com>
Delivered-To: vev@michvhf.com
Received: (qmail 4712 invoked from network); 17 Mar 1997 11:13:53 -0000
Received: from unknown (HELO alberta.sallynet.com) (root@208.1.117.130)
by cinnamon.michvhf.com with SMTP; 17 Mar 1997 11:13:53 -0000
Received: from mail.upsouth.com ([208.210.212.50]) by alberta.sallynet.com (8.8.3/8.7.3) with SMTP id EAA12613; Tue, 11 Mar 1997 04:47:59 -0500 (EST)
From: dlane@globaltech2000.com
Message-Id: <199703110947.EAA12613@alberta.sallynet.com>
To: Friend@public.com
Date: Mon, 10 Mar 97 19:10:25 EST
Subject: Save over 50% on Office 97 & Select Phone !!

-----------------------------------------------------------------------


Vince.
--
==========================================================================
Vince Vielhaber -- KA8CSH email: vev@michvhf.com flame-mail: /dev/null
Database Manager Michigan Area Repeater Council
# include <std/disclaimers.h> TEAM-OS2
Online Searchable Campground Directory http://www.camping-usa.com
==========================================================================

Vince Vielhaber wrote:
>
> Has anyone figured out how to block the spam from sallynet? It has a
> different envelope each time so badmailfrom won't help. Any ideas?

TCP wrappers?

-Dom

> Has anyone figured out how to block the spam from sallynet? It has a
> different envelope each time so badmailfrom won't help. Any ideas?

So far they don't do any spam relaying, so you can block their network
number 208.1.117 at the tcpwrapper or router level.

They're very aggressive -- I'm deflecting over a thousand connection
attempts per day.

Regards,
John Levine, johnl@iecc.com, http://iecc.com/johnl, Trumansburg NY
Primary Perpetrator of "The Internet for Dummies"
and Information Superhighwayman wanna-be