[CentOS] please block user

Wed Aug 26 19:29:10 UTC 2015
Alice Wonder <alice at domblogger.net>


On 08/26/2015 12:11 PM, g wrote:
>
>
> On 08/26/15 13:11, Valeri Galtsev wrote:
>> On Wed, August 26, 2015 12:55 pm, James A. Peltier wrote:
> <<>>
>
> something no one seems to have mentioned, so i will..
>
>>> | >> Received: from mx2.loverhearts.com (mx2.loverhearts.com
>
> loverhearts.com is a single page that seems to do nothing. and there is
> nothing in page source to do anything.
>
> validator.w3.org shows 1 error and 1 warning showing that page was
> poorly written.
>
> so the only harm is spam, which i now have going to my Junk folder.
>
> so, to all of you, i pass along a much more loving 'love' link;
>
>    http://lovehearts.com
>
> enjoy.
>
>

If you look at the SPF record for loverhearts.com (where they are coming 
from for me) there are a whole slew of servers permitted to send on 
their behalf.

So I took all those IP addresses specified and added them to my 
blacklist, it appears spammers are learning that SPF records can be a 
path to filter avoidance.

Maybe I'll start blocking any server with an SPF record that includes 
more than 5 IP addresses, or servers where any host in the SPF record is 
in a DNS blacklist.