hege at hege
Oct 6, 2008, 10:55 AM
Post #4 of 8
(319 views)
Permalink
|
On Mon, Oct 06, 2008 at 08:04:56PM +0300, Henrik K wrote:
> On Mon, Oct 06, 2008 at 05:31:55PM +0200, Matus UHLAR - fantomas wrote:
> > Hello,
> >
> > did anyone try to use DNSBL lookups for header(s) X-PHP-Script?
> > I have patch into PHP that inserts IP address into that header, and looking
> > in dnsbl for spam sources could help me filter out spam posted through HTTP.
> >
> > I could prepare such rules, but if anyone has such, I'd be glad not to
> > reinvent the wheel.
>
> Why don't you check the BLs directly from PHP?
Answering myself..
Ok, I was curious and googled a little.. I guess it could useful if you are
a shared provider (of course you should make sure users don't open holes in
the first place).
X-PHP-Script doesn't seem to be very widely patched - or PHP isn't abused
that much, which is nice. I grepped 3 weeks worth of spam quarantine, 17335
messages. 46 contained it. 28 unique IPS, out of which 8 was on sbl-xbl and
one or two on some other big lists. Doesn't seem very effective here.
Now, if you want to try it in SA, the easiest way is to just edit DNSEval.pm
and search X-Originating-IP inside it. Add X-PHP-Script to that array.
|
