One of my domains is being hit with the Sober worm emails (e.g., ones in German, etc. -- that I verified the subject line on Symantec's site). I looked at the message source for a couple, and they are being sent to mailboxes@<thedomain.com> or X-User@<thedomain.com> or mailhost@<thedomain.com> or MailBox@<thedomain.com>.
SpamAssassin is not catching them because the scores are low (e.g., 1.6-3). I am trying to see if there is another way to filter since they are not addressed to actual addresses. I have the default address set to :blackhole: for this domain.
SpamAssassin is not catching them because the scores are low (e.g., 1.6-3). I am trying to see if there is another way to filter since they are not addressed to actual addresses. I have the default address set to :blackhole: for this domain.
Comment