Anyone here who might have a solution for the last bit of spam that I'm getting at the moment? Spamassassin is seeing the mail, but not marking it high enough as spam :/ The spam always starts with some_name wrote: (in this case "Lora wrote:"), and I'm getting lot's of it! Looking at the /var/log/mail.info , the connection is always from "unknown" and the spammer is always using other "zombie PCs" IP's. (note: I have changed the hostname.net and domainname.tld in the shown files) /var/log/mail.info Code: Nov 27 10:44:58 host postfix/smtpd: connect from unknown[126.96.36.199] Nov 27 10:44:59 host postfix/smtpd: 746671250005: client=unknown[188.8.131.52] Nov 27 10:44:59 host postfix/cleanup: 746671250005: message-id=<[email protected]> Nov 27 10:44:59 host postfix/qmgr: 746671250005: from=<[email protected]>, size=2171, nrcpt=1 (queue active) Nov 27 10:44:59 host postfix/pickup: DEF9E125001D: uid=10075 from=<web42_marcella> Nov 27 10:44:59 host postfix/cleanup: DEF9E125001D: message-id=<[email protected]> Nov 27 10:44:59 host postfix/qmgr: DEF9E125001D: from=<[email protected]>, size=402, nrcpt=1 (queue active) Nov 27 10:44:59 host postfix/local: DEF9E125001D: to=<[email protected]>, relay=local, delay=0, status=sent (delivered to command: /usr/bin/procmail -f-) Nov 27 10:44:59 host postfix/qmgr: DEF9E125001D: removed Nov 27 10:45:00 host postfix/smtpd: disconnect from unknown[184.108.40.206] header of email Code: From [email protected] Mon Nov 27 10:44:59 2006 Return-Path: <[email protected]> X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on host.hostname.net X-Spam-Level: ** X-Spam-Status: No, score=2.0 required=5.0 tests=DATE_IN_FUTURE_03_06 autolearn=no version=3.1.7 X-Original-To: [email protected] Delivered-To: [email protected] Received: from your-d008eaa2b4.hananet.net (unknown [220.127.116.11]) by mail.hostname.net (Postfix) with ESMTP id 746671250005 for <[email protected]>; Mon, 27 Nov 2006 10:44:59 +0100 (CET) Received: from 18.104.22.168 (HELO newmail-g1.xinnetdns.com) by domainname.tld with esmtp (UKV:8Q8DA8 T/'Z.) id FR(;:;-7P7<DF-/K for [email protected]; Mon, 27 Nov 2006 09:47:19 -0540 From: "Lora Kyle" <[email protected]> To: <[email protected]> Subject: Lora wrote: Date: Mon, 27 Nov 2006 09:47:19 -0540 Message-ID: <01c7[email protected]> MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158 Thread-Index: Aca6Q8LLV9M2B-4Y:2X-8AZ78X5V02== X-Virus-Status: No X-Virus-Checker-Version: clamassassin 1.2.3 with clamscan / ClamAV 0.88.6/2244/Mon Nov 27 08:33:13 2006 I could make a rule in "outlook" to delete any message starting with wrote:, but this is not really the way to go I think.. In the "new 2.3" postfix there is an option 'reject_non_fqdn_hostname', but as I'm using the postfix that came with the Debian Sarge install (2.1.5) it does not have that option. Anyone here who might have an easy sollution of stopping this %#^@#@* spammer sending me this "crap"? (blocking IP's, blocking senders e-mail address, or shutting down my server is no option ) Or... Did anyone here (Debian OS) update his postfix that is setup in combination with ISPconfig?