LuKreme wrote: > > On 29-Aug-2009, at 07:41, Mynabbler wrote: >> They typically originate from hotmail.com, > > Er, do they really originate from hotmail servers, or are they simply > spoofing a hotmail return address? Are you using zen? >
Ow yes. Zen is not an option. Aug 31 14:52:04 mail filter[22000]: n7VCpx0l031457: Spamassassin found from <prismesiti...@hotmail.com> at snt0-omc2-s10.snt0.hotmail.com [65.55.90.85] HELO snt0-omc2-s10.snt0.hotmail.com to <victim> hits: 9.52, names: FREEMAIL_FROM,PORTAL_ABUSE Subject: amanda righetti showing her nice big tits This one had a yahoo groups portal link... Genuine hotmail originated crap. Aug 31 14:57:19 mail filter[23165]: n7VCvEnb030505: Spamassassin found from <chasza9...@hotmail.com> at blu0-omc3-s32.blu0.hotmail.com [65.55.116.107] HELO blu0-omc3-s32.blu0.hotmail.com to <anothervictim> hits: 12.206, names: FREEMAIL_FROM,PORTAL_ABUSE,TRACKER_ID Subject: GorgeousCelebrityShowsHerNicePussyAndPerfectBoobs and that one has a livejournal link, brought to us by the same fine company. Comment by the hotmail abuse desk on a previous attempt to close the gate upstream: we are not responsable for the content on yahoo groups and our users communicating about it. Pfff. k-thank-you-bye-bye. :( At the moment the source is primarily hotmail, although other addresses have been used during the last two months. So, PORTAL_ABUSE is a meta consisting of the existence of a link to a portal provider in the message, and a slew of trics to be found in the subject, regardless of the source being either hotmail or some poor sod giving his credentials to a spammer. -- View this message in context: http://www.nabble.com/Porn-portal-spammers-tp25203019p25223292.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
