[SAtalk] USER IN WHITELIST spammer scam

Greg Webster Thu, 14 Aug 2003 13:17:09 -0700

Hi all,

Here is the headers from a recent spam that got through (addresses
changed to protect them):


[24.118.171.202])
        by intouch.ca (Postfix) with SMTP id C069C2079
        for <[EMAIL PROTECTED]>; Thu, 14 Aug 2003 10:40:45 -0700 (PDT)
Received: from terra.com ([127.127.127.127]) by terra.com (8.9.3/8.9.3)
with SMTP id 27423 for <[EMAIL PROTECTED]>; Thu, 14 Aug 2003 12:47:19
-0500
Message-ID: <[EMAIL PROTECTED]>
Received: from [127.127.127.127] by web27423.mail.yahoo.com via HTTP;
Thu, 14 Aug 2003 12:47:19 -0500
From: "Rolf Milde" <[EMAIL PROTECTED]>
To: "miniato" <[EMAIL PROTECTED]>
Date: Thu, 14 Aug 2003 12:47:14 -0500
Subject: Your Penis can be Enlarged
MIME-Version: 1.0
Content-Type: multipart/related;
  boundary="----=_NextPart_000_000F_6B1F6B1F.6B1F6B1F"
X-Spam-Status: No, hits=-87.7 required=5.0
        tests=ALL_NATURAL,BASE64_ENC_TEXT,BAYES_60,CLICK_BELOW,GUARANTEE,
              HTML_40_50,HTML_FONT_COLOR_UNSAFE,HTML_FONT_FACE_ODD,
              MIME_HTML_ONLY,MIME_MISSING_BOUNDARY,MONEY_BACK,
              MSG_ID_ADDED_BY_MTA_2,PENIS_ENLARGE2,USER_IN_WHITELIST
        version=2.55
X-Spam-Level: 
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)

As you can see from the From: and To: lines, the spammer used the
username part of the email address in his yahoo.com fake email address.
'XXXXX' replaces the same username in all locations.

'[EMAIL PROTECTED]' is not in our whitelist, and neither is '[EMAIL PROTECTED]' or
any variant.

It appears that there is a problem with the USER_IN_WHITELIST regexp to
me, but I may be mistaken. I can't think of any other way that this
would have made it through. Help?

If someone needs unaltered info, I can send it to them directly, but I
can't post on the list.

Thanks,

Greg

-- 
Greg Webster - [EMAIL PROTECTED]
In-Touch Software Corporation
Ph: (604)278-0515 - Fax: (604)608-3112


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

[SAtalk] USER IN WHITELIST spammer scam

Reply via email to