Anyone here who might have a solution for the last bit of spam that I'm getting at the moment? Spamassassin is seeing the mail, but not marking it high enough as spam :/ The spam always starts with some_name wrote: (in this case "Lora wrote:"), and I'm getting lot's of it! Looking at the /var/log/mail.info , the connection is always from "unknown" and the spammer is always using other "zombie PCs" IP's. (note: I have changed the hostname.net and domainname.tld in the shown files) /var/log/mail.info Code: Nov 27 10:44:58 host postfix/smtpd: connect from unknown[18.104.22.168] Nov 27 10:44:59 host postfix/smtpd: 746671250005: client=unknown[22.214.171.124] Nov 27 10:44:59 host postfix/cleanup: 746671250005: message-id=<01c71209$07817a00$6c822ecf@deborahperque> Nov 27 10:44:59 host postfix/qmgr: 746671250005: from=<email@example.com>, size=2171, nrcpt=1 (queue active) Nov 27 10:44:59 host postfix/pickup: DEF9E125001D: uid=10075 from=<web42_marcella> Nov 27 10:44:59 host postfix/cleanup: DEF9E125001D: message-id=<20061127094459.DEF9E125001D@mail.hostname.net> Nov 27 10:44:59 host postfix/qmgr: DEF9E125001D: from=<firstname.lastname@example.org>, size=402, nrcpt=1 (queue active) Nov 27 10:44:59 host postfix/local: DEF9E125001D: to=<email@example.com>, relay=local, delay=0, status=sent (delivered to command: /usr/bin/procmail -f-) Nov 27 10:44:59 host postfix/qmgr: DEF9E125001D: removed Nov 27 10:45:00 host postfix/smtpd: disconnect from unknown[126.96.36.199] header of email Code: From firstname.lastname@example.org Mon Nov 27 10:44:59 2006 Return-Path: <email@example.com> X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on host.hostname.net X-Spam-Level: ** X-Spam-Status: No, score=2.0 required=5.0 tests=DATE_IN_FUTURE_03_06 autolearn=no version=3.1.7 X-Original-To: firstname.lastname@example.org Delivered-To: email@example.com Received: from your-d008eaa2b4.hananet.net (unknown [188.8.131.52]) by mail.hostname.net (Postfix) with ESMTP id 746671250005 for <firstname.lastname@example.org>; Mon, 27 Nov 2006 10:44:59 +0100 (CET) Received: from 184.108.40.206 (HELO newmail-g1.xinnetdns.com) by domainname.tld with esmtp (UKV:8Q8DA8 T/'Z.) id FR(;:;-7P7<DF-/K for email@example.com; Mon, 27 Nov 2006 09:47:19 -0540 From: "Lora Kyle" <firstname.lastname@example.org> To: <email@example.com> Subject: Lora wrote: Date: Mon, 27 Nov 2006 09:47:19 -0540 Message-ID: <01c71209$07817a00$6c822ecf@deborahperque> MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1158 Thread-Index: Aca6Q8LLV9M2B-4Y:2X-8AZ78X5V02== X-Virus-Status: No X-Virus-Checker-Version: clamassassin 1.2.3 with clamscan / ClamAV 0.88.6/2244/Mon Nov 27 08:33:13 2006 I could make a rule in "outlook" to delete any message starting with wrote:, but this is not really the way to go I think.. In the "new 2.3" postfix there is an option 'reject_non_fqdn_hostname', but as I'm using the postfix that came with the Debian Sarge install (2.1.5) it does not have that option. Anyone here who might have an easy sollution of stopping this %#^@#@* spammer sending me this "crap"? (blocking IP's, blocking senders e-mail address, or shutting down my server is no option ) Or... Did anyone here (Debian OS) update his postfix that is setup in combination with ISPconfig?