Hi gurus;<div><br></div><div>I am new to Postfix,Amavis,SpamAssassin ; spam mail have been filling up our server - filling up the hardisk, and queues with useless mail that seem to be from self spawning domains and email addresses.</div>
<div><br></div><div>This is preventing genuine email from functioning properly.</div><div><br></div><div>However, I followed instructions on the net to do &quot;soft blacklisting&quot; and &quot;hard blacklisting&quot;  - but it does not seem to work.</div>
<div><br></div><div>I am assuming soft blacklisting gives an email a maximum number of hits before the address is given low priority and eventually blocked out.</div><div>I  also assumed hard blacklisting totally prevents a domain from sending email and filling up the queues.</div>
<div><br></div><div>What to do to stop these domains from sending emails permanently ?</div><div><br></div><div>----------</div><div>LOGS</div><div>----------</div><div><br></div><div><u>Blacklisting Rules: </u>on  /etc/mail/spamassassin/<a href="http://local.cf">local.cf</a></div>
<div><br></div><div><div><font color="#3333ff">blacklist_from</font> <a href="http://t.co">t.co</a> <a href="http://hotmail.com">hotmail.com</a> <a href="http://jhdgsndhj.com">jhdgsndhj.com</a> <a href="http://sgnbxhfghd.com">sgnbxhfghd.com</a> <a href="http://hjsnbfg.com">hjsnbfg.com</a> <a href="http://snybfhf.com">snybfhf.com</a> <a href="http://265kt.com">265kt.com</a> <a href="http://10t1v.com">10t1v.com</a> <a href="http://q9cho.com">q9cho.com</a> d10vx_.com jhdgsn</div>
<div><a href="http://dhj.com">dhj.com</a> <a href="http://snybfhf.com">snybfhf.com</a> <a href="http://djsnhdh.com">djsnhdh.com</a> <a href="http://hjndgsycfs.com">hjndgsycfs.com</a> <a href="http://jhgsnvdgh.com">jhgsnvdgh.com</a> <a href="http://dhjgnsghfs.com">dhjgnsghfs.com</a> <a href="http://sgnghfsg.com">sgnghfsg.com</a> <a href="http://sgnhscgfs.com">sgnhscgfs.com</a> <a href="http://ucidgsnhcvds.com">ucidgsnhcvds.com</a> jhcgsngfdgh.</div>
<div>com <a href="http://hydgsnhcvdsngh.com">hydgsnhcvdsngh.com</a> <a href="http://jhgsnhsxffg.com">jhgsnhsxffg.com</a> <a href="http://hycgndsgjfdg.com">hycgndsgjfdg.com</a> <a href="http://eungfyuds.com">eungfyuds.com</a> <a href="http://2udfwnw.com">2udfwnw.com</a></div>
<div><br></div><div><font color="#3333ff">blacklist_to</font> <a href="http://t.co">t.co</a> <a href="http://hotmail.com">hotmail.com</a> <a href="http://jhdgsndhj.com">jhdgsndhj.com</a> <a href="http://snybfhf.com">snybfhf.com</a> <a href="http://sgnbxhfghd.com">sgnbxhfghd.com</a> <a href="http://hjsnbfg.com">hjsnbfg.com</a> <a href="http://djsnhdh.com">djsnhdh.com</a> <a href="http://hjndgsycfs.com">hjndgsycfs.com</a> <a href="http://jhgsnvdgh.com">jhgsnvdgh.com</a> dhjgnsgh</div>
<div><a href="http://fs.com">fs.com</a> <a href="http://sgnghfsg.com">sgnghfsg.com</a> <a href="http://sgnhscgfs.com">sgnhscgfs.com</a> <a href="http://ucidgsnhcvds.com">ucidgsnhcvds.com</a> <a href="http://jhcgsngfdgh.com">jhcgsngfdgh.com</a> <a href="http://hydgsnhcvdsngh.com">hydgsnhcvdsngh.com</a> <a href="http://jhgsnhsxffg.com">jhgsnhsxffg.com</a> <a href="http://hycgndsgjfdg.com">hycgndsgjfdg.com</a> <a href="http://eungfyuds.com">eungfyuds.com</a></div>
<div> <a href="http://2udfwnw.com">2udfwnw.com</a></div></div><div><br></div><div><u>Blacklisting Rules Global:</u>  /etc/amavisd/amavisd.conf</div><div><br></div><div><br></div><div><div>@score_sender_maps = ({ # a by-recipient hash lookup table,</div>
<div>                       </div><div>                       [  # the _first_ matching sender determines the score boost</div><div><br></div><div>    new_RE(  # regexp-type lookup table, just happens to be all soft-blacklist</div>
<div>    [qr&#39;^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@&#39;i                  =&gt; 5.0],</div><div>    [qr&#39;^(greatcasino|investments|lose_weight_today|market\.alert)@&#39;i  =&gt; 5.0],</div><div>    [qr&#39;^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@&#39;i    =&gt; 5.0],</div>
<div>    [qr&#39;^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@&#39;i        =&gt; 5.0],</div><div>    [qr&#39;^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@&#39;i    =&gt; 5.0],</div><div>    [qr&#39;^(your_friend|greatoffers)@&#39;i                                                                  =&gt; 5.0],</div>
<div>    [qr&#39;^(inkjetplanet|marketopt|MakeMoney)\d*@&#39;i                                       =&gt; 5.0],</div><div>    [qr&#39;^(sex|fck)\d*@&#39;i                                                                                         =&gt; -5.0],</div>
<div>    [qr&#39;.*@\.*\.hotmail\.com$&#39;i                                                                           =&gt; -10.0],</div><div>    [qr&#39;.*@\.*\.yahoo\.com$&#39;i                                                                               =&gt; -10.0],</div>
<div>   ),</div></div><div><br></div><div><br></div><div><br></div><div>This does not seem to work (see active queues) - always close to 20000 (saturation) with useless domains.</div><div><br></div><div><div><br></div><div>
                                    T  5 10  20   40   80  160 320 640 1280 1280+</div><div>                    <span style="background-color:rgb(255,102,102)">     TOTAL 19979 </span> 0  4 890 3237 3470 2085 140  51 5110  4992</div>
<div>                     <a href="http://yahoo.com">yahoo.com</a>  <font color="#3333ff">6803 </font> 0  0 222  925  536  942  37   0 2308  1833</div><div>                 <a href="http://eungfyuds.com">eungfyuds.com</a>   467  0  0  52  186  227    0   0   0    0     2</div>
<div>                  <a href="http://coldthree.ru">coldthree.ru</a>   422  0  0   0    0    0    0   0   0    0   422</div><div>                   <a href="http://top10new.ru">top10new.ru</a>   371  0  0   0    0    0    0   0   0    0   371</div>
<div>               <a href="http://hjsgvnbfcgf.com">hjsgvnbfcgf.com</a>   336  0  0  36  123  177    0   0   0    0     0</div><div>               <a href="http://jhgvsnghsvg.com">jhgvsnghsvg.com</a>   313  0  1  30  117  164    0   0   0    0     1</div>
<div>               <a href="http://dhgnvdbcfgf.com">dhgnvdbcfgf.com</a>   302  0  1  37  111  153    0   0   0    0     0</div><div>              <a href="http://suynghjfsngf.com">suynghjfsngf.com</a>   295  0  0  34  120  139    0   0   0    0     2</div>
<div>               <a href="http://hygtjdfsfds.com">hygtjdfsfds.com</a>   275  0  1  40  109  119    0   0   0    1     5</div><div>               <a href="http://uysdgnhjgfh.com">uysdgnhjgfh.com</a>   274  0  0  30  110  128    0   0   0    0     6</div>
<div>             <a href="http://wehjnsvcghfdg.com">wehjnsvcghfdg.com</a>   262  0  0  39  102  119    0   0   0    0     2</div><div>                   <a href="http://jgswnhd.com">jgswnhd.com</a>   223  0  0  24  102   97    0   0   0    0     0</div>
<div>                <a href="http://jdgsngdfgh.com">jdgsngdfgh.com</a>   215  0  1  19   91  102    0   0   0    0     2</div><div>                  <a href="http://jdsgngyd.com">jdsgngyd.com</a>   213  0  0  21   99   90    0   0   0    0     3</div>
<div>              <a href="http://uficdgsnjgdg.com">uficdgsnjgdg.com</a>   190  0  0  25   74   91    0   0   0    0     0</div><div>                  <a href="http://dugnhdff.com">dugnhdff.com</a>   185  0  0  26   80   79    0   0   0    0     0</div>
<div>                 <a href="http://judgsyfdg.com">judgsyfdg.com</a>   184  0  0  19   96   69    0   0   0    0     0</div><div>                <a href="http://jdegngdfgh.com">jdegngdfgh.com</a>   184  0  0  23   80   79    0   0   0    0     2</div>
<div>                     <a href="http://cauen.com">cauen.com</a>   174  0  0   0    0    0  172   2   0    0     0</div></div>