I've noticed a flood of spam that is related to the same range of IPs.
All the spam email has different HTML text (which is english but meaningless) and a few embedded pictures (which I block) but actaully is clearly machine generated and the internal formatting is very similar. BTW all link and external pictures are blocked by my mailer.
What I have noticed is that the MX for the 'from' address domain all reside in a small range of IPs, all of them are on the same VPS service 'Node Outlet India LLP'. So somebody is using this service to host a farm of spambots.
I would like to generate a spamassassin rule that says something like:
- Extract the 'from' domain
- Look up MX of that domain
- Look up IP of that MX
- Does it look like 36.255.24.x/21
- Give it a high score, e.g. +2
I use spampd proxy and spamassassin running on Linux.
To clarify, here is an example: The spam email is from firstname.lastname@example.org
The source email passes SPF, DMARC and is DKIM signed - all legit - but it's spam. By just those checks alone it scores well as ham.
The only thing spammy about it is the content. Mostly HTML and out of domain link embedded pictures and little text, only those features makes it have a spam score at all, but not a large one. These emails are clearly designed to avoid anti-spam measures.
I do an MX RR DNS lookup on stufftobuy.com and you get mail.stufftobuy.com, do a A RR DNS lookup on mail.stufftobuy.com and it returns an IPV4 from one a handful of address rages that all the from domain MX records point to.
I need to do more analysis but it seems to be from just two server farms, one in India the other in Turkey.
Of 1000 emails, a single IPV4 may only appear twice.
I can't just score or block stufftobuy.com as that actual domain name may only be used once. The next message may be from makecatvids.com or whatever.
Equally I can't just blindly block thousands of IPV4 in postfix as that would make the assumption that the ISP is bad rather than one of their customers.
UPDATE: I can see the askdns plugin exists, but I can't see how one rule can feed into another. A single DNS lookup is not enough.