Re: [SAtalk] Fwd'ed spam

2002-05-03 Thread Charlie Watts
On 3 May 2002, Matt Sergeant wrote: > Actually, on second thoughts, maybe we should start to do a DB based URI > eval rule? Having a new rule for every single URI would kill > performance. Someone post a bug if you think that's a good idea. Why not use the existing DNS blacklist mechanisms? Feed

Re: [SAtalk] Fwd'ed spam

2002-05-03 Thread Matt Sergeant
On Thu, 2002-05-02 at 20:08, PremierNET Abuse wrote: > No relay it appears, and submitting it to Razor seems pointless at this point. > Looks like the ruleset for "pr0n" words is going to continue to grow. > http://YoungestChicks.com > http://AmateurYouth.com > http://DrunkTeenPics.com > http://T

Re: [SAtalk] Fwd'ed spam

2002-05-02 Thread Bart Schaefer
On Thu, 2 May 2002, Craig R Hughes wrote: > 1. X-UIDL is often added by legitimate mailer like UW-IMAP and such, > but that format of the string looks suspicious to me. I get that X-UIDL format from the a server that advertises itself as QPOP -- don't recall if that's qpopper or something else.

Re: [SAtalk] Fwd'ed spam

2002-05-02 Thread Craig R Hughes
Hmm, 2 interesting things in the message there: 1. X-UIDL is often added by legitimate mailer like UW-IMAP and such, but that format of the string looks suspicious to me. 2. Never before seen a Comment: header containing a unique ID like that C PremierNET Abuse wrote: PA> Return-Path: <[EMAI

[SAtalk] Fwd'ed spam

2002-05-02 Thread PremierNET Abuse
No relay it appears, and submitting it to Razor seems pointless at this point. Looks like the ruleset for "pr0n" words is going to continue to grow. --- Return-Path: <[EMAIL PROTECTED]> Received: from arcturus.whitcon.net (arcturus.whitcon.net [65.171.144.13]) by mail