From Newsgroup: comp.misc

I run my own mail server for my domain. Volumes are low enough that
running a greylist (blocking all the drive-by spammers) gets rid of
90% of the crap.

As for the rest, I had set up lists of blocked senders and recipients (addresses I have declared invalid on my domain) in Postfix. Then, a
few months ago, I decided I would like to collect statistics on how
often these list entries are hit, and I couldnrCOt be bothered to scan
logfiles to do it.

So a few months ago I implemented a rCLsocketmap serverrCY <https://www.postfix.org/socketmap_table.5.html> which responds to
lookup requests from Postfix for those lists, gets the information
from back-end database tables in MariaDB, and also logs entries in
other database tables to record the requests.

This makes it easy for me to add/remove entries in those blocklists,
without having to restart Postfix (or my socketmap server). And I can
pull back statistics on database lookups at any time.

The first thing IrCOve noticed so far, the most commonly-used rejection
entry in the blocked-sender table is the one that refuses mail from
the entire rCL.shoprCY TLD. I have never done any business with any site
with such a domain; has anybody else done so? My feeling is, no
reputable business has such a site.

As for blocked recipients, I am fond of giving out different recipient addresses to different online forums and businesses and anybody else
who needs to contact me. This way, I can spot immediately if an
address I gave to one entity starts being used for mail coming from an
entirely different entity.

One or two online sites were too trusting in their early days about
letting web scrapers glean email addresses from their user pages. I
did later go in and enter new addresses on these sites, and invalidate
the old ones, and they havenrCOt repeated the same mistake. But one of
those old addresses keeps popping up, in some interestingly-corrupted
forms.

The address I originally entered took the form rCLfrom--2forum-+@-2domainrCY.
I still get attempts to send mail to that (now invalid) address, but
also to rCLu003cfrom--2forum-+@-2domainrCY. And more recently also to rCLcfrom--2forum-+@-2domainrCY -- addresses which I have never used anywhere.

That rCLu003crCY looks like a corruption of rCLU+003CrCY, which would be how you would write the Unicode code point for the rCL<rCY character (which is
of course commonly used to delimit email addresses and URLs and such).
I suspect the rCLcfromrCY version is a further corruption of the rCLu003cfromrCY one.

I also get email sent to an address I havenrCOt used since my Apple
Macintosh days, which would have been over a quarter century ago.

I guess this goes to show that the spammersrCO address lists can only
grow over time, they can never remove any address as the lists are
passed on, just in case it is still valid, because by the nature of
their business they can never pay any attention to bounces that are
supposed to indicate invalid addresses.

And that passing on of lists introduces its own corruptions, as well.

I wonder how big the spammersrCO email lists are these days? I have this feeling the number of entries in typical lists might have exceeded the
entire population of the Earth by now ...
--- Synchronet 3.22a-Linux NewsLink 1.2