Anyone else get spam from randomletters@china.com, india.com, canada.com?

[WannaFly]

I've been getting these emails lately, about 3 or 4 a day - from randomletters@country.com - and the body is just a bunch of random words. Anyone else getting these? How can i setup Spamassasin to kill thse(they are all diffferent @ hosts)
From: "Tripp" <invekpqwn@china.com>
Reply-to: "Bessie Tripp" <invekpqwn@china.com>
To: <my email>
Subject: Re: OOGV, without leaving word All headers

--------------------------------------------------------------------------------
cotoneaster edge divisive contract ascertain feeney amalgam zealand documentary
colby aroma joan leftward tam cloakroom apposite embezzle boatyard mahogany
madeline dunlop border controversy

 

[MrBond]

China.com has been a spam haven for YEARS. I have a filter in all my email programs to immediatly trash anything from that domain.

I used SpamAnnilihator, there was a random characters plugin that got most of those random letter email address ones. It's based on SpamAssassin, so you might find one that works for you.

 

[zimu]

check the ip address of the host, its possible they have the same originating ip.

otherwise, start blocking countries as they come, i.e. block china.com, india.com, canada.com.

 

[WannaFly]

Thanks for the replies, I have never gotten spam like this before, so i guess they finally got my email address somehow. I'll look into the originating IP's and start blocking each country. Thanks.

 

[Mr N8]

My spam server catched about 50-60 of them a day.

 

[TheToOTaLL]

Originally posted by: zimu
check the ip address of the host, its possible they have the same originating ip.

otherwise, start blocking countries as they come, i.e. block china.com, india.com, canada.com.

No, they usually don't come from the same IP.

If you look at the header of the message (I'm using Outlook here) all of them originate from PCs on ISP networks. Here's one I received this morning that "appears" to come from china.com:

Received: from 82-39-32-206.cable.ubr01.benw.blueyonder.co.uk ([82.39.32.206])

and one from Wednesday:

Received: from 184.red-217-127-167.pooles.rima-tde.net ([217.127.167.184])

So the best bet will to filter china.com addresses, because you can block IPs all day and you'll still get them.