the rompe blog

As I promised in a comment to my previous entry I want to show you how I configured spamassassin to use an inexistant mail address as a spam trap to gain better quality of the database it uses for the bayesian filtering. One day I was fed up with the false negatives I had to feed to sa-learn manually to keep the bayes database up to date. So I decided to publish a mail address that I will never use for anything other than poisoning spambots and then let spamassassin score mail to this address so high that it will ever be classified as spam. As a result, spamassassin will remember these messages as spam in its database. In my case the trap address is s.pemtrep@rompe.org. I realized that there are some other addresses that seem to exist in some spammers address lists only, so I simply applied them to the same rule. The rule for spamassassin is quite simple:

header  ROMPE_BADRECIPS      To =~ /(kuk|s.pemtrep|ballepromp)\@rompe\.org/i
score   ROMPE_BADRECIPS      9.0
describe ROMPE_BADRECIPS     Spam trap recipient

Add something like this to your /etc/spamassassin/local.cf and you are done. Publish the address on the web (but don't forget to mark it as a spam trap since you don't want humans to write to this address!) and soon the spambots will begin to feed your database with high quality spam. This will, of course, increase your traffic a bit, but it will definately lower your amount of false negatives.

The next logical step would be to combine this with something like teergrube and/or temporary host blocking, but we will have to accept the first mail for our database before we can start sanctioning. I will have to think about this. Comments are welcome.