Re: RFC compliance pedantry (was Re: New type of monstrosity)

2017-02-07 Thread John Hardin
On Tue, 7 Feb 2017, Ian Zimmerman wrote: On 2017-02-07 18:33, Ruga wrote: I follow the actual RFC standard, not the proposed revisions. The To From and Cc fields are defined by a grammar AND a natural language description. Such fields MUST hold addresses, were an address is a username the "@"

Re: RFC compliance pedantry (was Re: New type of monstrosity)

2017-02-07 Thread Ian Zimmerman
On 2017-02-07 18:33, Ruga wrote: > I follow the actual RFC standard, not the proposed revisions. The To > From and Cc fields are defined by a grammar AND a natural language > description. Such fields MUST hold addresses, were an address is a > username the "@" symbol and a domain name. The string

Re: RFC compliance pedantry (was Re: New type of monstrosity)

2017-02-07 Thread Ruga
I follow the actual RFC standard, not the proposed revisions. The To From and Cc fields are defined by a grammar AND a natural language description. Such fields MUST hold addresses, were an address is a username the "@" symbol and a domain name. The string "undisclosed recipients: ;" does not pa

Re: New type of monstrosity

2017-02-07 Thread @lbutlr
On Feb 7, 2017, at 12:57 AM, Ruga wrote: > The spample would never make it to our SA. It would be rejected upstream for > at least two reasons: > > > To: undisclosed recipients: ; > The To header is not RFC compliant. Where do you get that idea? “Undisclosed recipient: ;” is a group address.

RFC compliance pedantry (was Re: New type of monstrosity)

2017-02-07 Thread Dianne Skoll
On Tue, 07 Feb 2017 02:57:06 -0500 Ruga wrote: > > To: undisclosed recipients: ; > The To header is not RFC compliant. Yes it is. RFC 5322 even gives the header Cc: undisclosed recipients: ; as an example in Appendix A.1.3, Group Addresses. > The Subject header exceeds the > maximum line leng

Re: New type of monstrosity

2017-02-07 Thread Ian Zimmerman
On 2017-02-07 09:37, Matus UHLAR - fantomas wrote: > 11.5 - 3.5 = 8.0 And of course 1.2.3.x is not the true relay address, so > 1.5 BOTNET Relay might be a spambot or virusbot > [botnet0.8,ip=1.2.3.12,rdns=disorder.censored.net,maildomain=outlook.fr,baddns] this goes out of the

Re: New type of monstrosity

2017-02-07 Thread RW
On Mon, 6 Feb 2017 18:46:47 -0800 Ian Zimmerman wrote: > On 2017-02-06 20:06, Kevin A. McGrail wrote: > > > > Last couple of weeks I saw some messages whose entire contents is > > > in the Subject. > > > never seen such a monster. likely killed by some other piece in the > > puzzle. Throw it

Re: New type of monstrosity

2017-02-07 Thread RW
On Tue, 07 Feb 2017 02:57:06 -0500 Ruga wrote: > The spample would never make it to our SA. It would be rejected > upstream for at least two reasons: > > > To: undisclosed recipients: ; > > > The To header is not RFC compliant.The Subject header exceeds the > maximum line length, You can rej

Re: New type of monstrosity

2017-02-07 Thread Kevin A. McGrail
On 2/7/2017 2:57 AM, Ruga wrote: The spample would never make it to our SA. It would be rejected upstream for at least two reasons: That was my thought as well. I've never seen this type of spam and that was my expectation as well.

Re: New type of monstrosity

2017-02-07 Thread Matus UHLAR - fantomas
On 07.02.17 02:57, Ruga wrote: The spample would never make it to our SA. It would be rejected upstream for at least two reasons: To: undisclosed recipients: ; The To header is not RFC compliant. but very common... The Subject header exceeds the maximum line length, being another RFC c

Re: New type of monstrosity

2017-02-07 Thread Matus UHLAR - fantomas
Ian Zimmerman kirjoitti 7.2.2017 4:46: On 2017-02-06 20:06, Kevin A. McGrail wrote: > Last couple of weeks I saw some messages whose entire contents is in > the Subject. never seen such a monster. likely killed by some other piece in the puzzle. Throw it up on pastebin? http://pastebin.c