Re: Match sending IP rdns name?

Hi Mark

Thank you, but my question was, how to match the rdns name of the
source IP.

Well i found out the header matcher can also match Received: header
lines.

header          IMP_RECV_SHOP          Received =~ /\.shop\ /
score           IMP_RECV_SHOP          10
describe        IMP_RECV_SHOP          Received: from shop TLD

This works for me.

Am Sat, 21 Jun 2025 13:47:19 -0400
schrieb Mark London <[email protected]>:

> I and probably a lot of people here, block that domain and a bunch 
> others, even before they reach spamassassin
> 
> "Why Phishers Love New TLDs Like .shop, .top and .xyz"
> 
> https://krebsonsecurity.com/2024/12/why-phishers-love-new-tlds-like-shop-top-and-xyz/
> 
> "Spammers and scammers gravitate toward domains in the new gTLDs because 
> these registrars tend to offer cheap or free registration with little to 
> no account or identity verification requirements."
> 
> On 6/20/2025 3:40 AM, Benoît Panizzon wrote:
> > Is there a way to match the sending IP rdns name?
> >
> > Received: from future.roommagic.shop (future.roommagic.shop [37.59.92.8] Port:45265)
> >
> > like match /\.shop$/ of the rdns name?
> >  
> 




Mit freundlichen Grüssen

-Benoît Panizzon-
-- 
I m p r o W a r e   A G    -    Leiter Commerce Kunden
______________________________________________________

Zurlindenstrasse 29             Tel  +41 61 826 93 00
CH-4133 Pratteln                Fax  +41 61 826 93 01
Schweiz                         Web  http://www.imp.ch
______________________________________________________