On Wed, Feb 06, 2002 at 04:26:42PM -0800, Craig Hughes wrote: > > body HAVEN_IP /64\.118\.7\.|66\.163\.36\./ > > describe HAVEN_IP Contains an IP used by spammers > > score HAVEN_IP 3.0 > > I think IP matching is best left to the RBL folks; we can just call out > to them.
Sorry, I guess I wasn't entirely clear on this. This is an IP used in URLs for many, many different spams. Example: --- Are you a homeowner with less than perfect credit, self-employed, or have been turned down by other lenders when you needed cash? We Want To Help You Get What You Need WHEN YOU NEED IT THE MOST. Click Below For a FREE Instant Online Quote!! http://64.118.7.13/mort/quote_ref.html?ID=M13 --- Also: Subject: New "Work from Home" opportunity that just makes sense.... Subject: Instant Quote (Insurance spam) Subject: Hair Loss or Thinning Hair a Problem for You? New Solution that Works... Subject: Low- Cost Viagra!!! $2.80 Per Dose pjtfc They use several IPs in that same class C. I think the IPs were in Turkey, but it seems that all the core networks have now dropped their routes. Traceroutes from my desktop, from California and from Australia all stop when their hit the upstreams' core networks. Dan. _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
