Re: [SAtalk] Possible spam signature

2002-10-19 Thread Thomas Hurst
* Martin Radford ([EMAIL PROTECTED]) wrote: > What's interesting about their externally visible servers is that they > don't do ESMTP; they don't advertise that they do it, and they give > "500 Unknown or unimplemented command" when you send "EHLO" commands. > I doubt this is Exim's behaviour (but

Re: [SAtalk] Possible spam signature

2002-10-19 Thread Martin Radford
At Sat Oct 19 16:40:46 2002, Thomas Hurst wrote: > Demon use a mixture of exim (externally) and MMDF (internally). It's > probably exim adding the headers since it gets the messages first. > > However, exim 4 generates id's that look like: > > <[EMAIL PROTECTED]> > > And I don't think exim

Re: [SAtalk] Possible spam signature

2002-10-19 Thread Thomas Hurst
* Justin Mason ([EMAIL PROTECTED]) wrote: > Martin Radford said: > > > These are Message-IDs generated by my ISP's incoming mail server for > > mails that don't already have a message id. And that would explain > > why no one else is seeing these, while I've got a fair number. > aha. Yep, we ha

Re: [SAtalk] Possible spam signature

2002-10-19 Thread Martin Radford
At Sat Oct 19 14:45:38 2002, Daniel Liston wrote: > > The first received: line with (8.9.3/8.9.3) would give me the impression > that they are using sendmail. [shrug] No, it's me that's running Sendmail. Demon deliver mail via SMTP to their dial-up customers (we have static IPs). Only in the la

Re: [SAtalk] Possible spam signature

2002-10-19 Thread Graham Murray
Daniel Liston <[EMAIL PROTECTED]> writes: > The first received: line with (8.9.3/8.9.3) would give me the impression > that they are using sendmail. [shrug] No. That is the customer's mail system. Unlike almost all other dial-up ISPs, Demon offer SMTP mail delivery to dial-up customers. --

Re: [SAtalk] Possible spam signature

2002-10-19 Thread Daniel Liston
The first received: line with (8.9.3/8.9.3) would give me the impression that they are using sendmail. [shrug] Dan Nix wrote: On Fri, 18 Oct 2002, Martin Radford stipulated: I'm pretty sure it's their own custom MTA. The SMTP connection banner is: It used to be a distorted MMDF variant, I

Re: [SAtalk] Possible spam signature

2002-10-19 Thread Nix
On Fri, 18 Oct 2002, Martin Radford stipulated: > I'm pretty sure it's their own custom MTA. The SMTP connection banner > is: It used to be a distorted MMDF variant, I think, but that may have changed in the last couple of years. -- `It's hard to properly dramatize, say, the domestic effects o

Re: [SAtalk] Possible spam signature

2002-10-17 Thread Martin Radford
At Thu Oct 17 23:54:05 2002, Justin Mason wrote: > Martin Radford said: > > > These are Message-IDs generated by my ISP's incoming mail server for > > mails that don't already have a message id. And that would explain > > why no one else is seeing these, while I've got a fair number. > > > > I'l

Re: [SAtalk] Possible spam signature

2002-10-17 Thread Justin Mason
Martin Radford said: > These are Message-IDs generated by my ISP's incoming mail server for > mails that don't already have a message id. And that would explain > why no one else is seeing these, while I've got a fair number. > > I'll keep that as a local rule, since I've never come across a le

Re: [SAtalk] Possible spam signature

2002-10-17 Thread Martin Radford
At Wed Oct 16 00:43:49 2002, martin wrote: > > > > Would anyone like to run this rule against their corpora and let me > > > > know if it might be useful? > > > > > > Sorry dude: > > > 0.0000.0000.0000.000.001.00 THEO_MSGID_TEST > > > > same here, I'm afraid. looks like y

Re: [SAtalk] Possible spam signature

2002-10-15 Thread Martin Radford
At Wed Oct 16 00:09:34 2002, Justin Mason wrote: > > > > Would anyone like to run this rule against their corpora and let me > > > know if it might be useful? > > > > Sorry dude: > > 0.0000.0000.0000.000.001.00 THEO_MSGID_TEST > > same here, I'm afraid. looks like you'v

Re: [SAtalk] Possible spam signature

2002-10-15 Thread Justin Mason
Theo Van Dinter said: > > Would anyone like to run this rule against their corpora and let me > > know if it might be useful? > > Sorry dude: > 0.0000.0000.0000.000.001.00 THEO_MSGID_TEST same here, I'm afraid. looks like you've got a lone spammer with his homegrown too

Re: [SAtalk] Possible spam signature

2002-10-15 Thread Tony L. Svanstrom
On Tue, 15 Oct 2002 the voices made Martin Radford write: > I've spotted in the last day or so a possible spam-indicator based on > the Message-ID of a number of recent spams. > > These have the format: > Message-ID =~ /^<10[0-9]{8}\.[0-9]{7}\.0\@\S+>$/ > > (i.e ten digits "dot" seven digits "dot

Re: [SAtalk] Possible spam signature

2002-10-15 Thread Theo Van Dinter
On Tue, Oct 15, 2002 at 08:07:46PM +0100, Martin Radford wrote: > These have the format: > Message-ID =~ /^<10[0-9]{8}\.[0-9]{7}\.0\@\S+>$/ > > Would anyone like to run this rule against their corpora and let me > know if it might be useful? Sorry dude: OVERALL% SPAM% NONSPAM% S/ORANK