You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Martin Radford <ma...@zamenhof.demon.co.uk> on 2004/02/11 23:16:07 UTC
Another incompetent spammer
Hi all,
Just spotted a spam full of %RANDOM_WORD and %RANDOM_TEXT.
What interested me, though, is that the Message-ID looked like this:
Message-ID: <VQ...@RND_FROM_DOMAIN>
^^^^^^^^^^^^^^^^
Note the "@RND_FROM_DOMAIN" -- no '%' symbol.
I know someone was collecting "spammer screwups", this one might be
worth adding if it's not there already....
Martin
--
Martin Radford | "Only wimps use tape backup: _real_
martin@zamenhof.demon.co.uk | men just upload their important stuff -o)
Registered Linux user #9257 | on ftp and let the rest of the world /\\
- see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V
Re: Another incompetent spammer
Posted by Matthias Fuhrmann <Ma...@stud.uni-hannover.de>.
On Wed, 11 Feb 2004, William Stearns wrote:
[...]
> > Failed to compile full SpamAssassin tests, skipping:
> > (Global symbol "@RND_FROM_DOMAIN" requires explicit package name
> > at /etc/mail/spamassassin/random.current.cf, rule rantext22, line 1.)
> >
> > needs some quoting?
>
> Damn!!!! *smile*
>
> New version's up there now; many thanks for catching that,
> Matthias. Now what was that quote about "Open Source benefitting from
> many eyes... " :-)
np, you are welcome :)
regards,
Matthias
Re: Another incompetent spammer
Posted by William Stearns <ws...@pobox.com>.
Good evening, Matthias, all,
On Thu, 12 Feb 2004, Matthias Fuhrmann wrote:
> On Wed, 11 Feb 2004, William Stearns wrote:
>
> [...]
> > > I know someone was collecting "spammer screwups", this one might be
> > > worth adding if it's not there already....
> >
> > Added to http:://www.stearns.org/sa-blacklist/random.current.cf -
> > thanks!
>
> spamassassin --lint failes with:
>
> Possible unintended interpolation of @RND_FROM_DOMAIN in string at
> /etc/mail/spamassassin/random.current.cf, rule rantext22, line 1.
> Failed to compile full SpamAssassin tests, skipping:
> (Global symbol "@RND_FROM_DOMAIN" requires explicit package name
> at /etc/mail/spamassassin/random.current.cf, rule rantext22, line 1.)
>
> needs some quoting?
Damn!!!! *smile*
New version's up there now; many thanks for catching that,
Matthias. Now what was that quote about "Open Source benefitting from
many eyes... " :-)
Cheers,
- Bill
---------------------------------------------------------------------------
"Villanueva pointed out that the state has recently begun paying
water and energy bills on behalf of many schools. '(T)hey are so poor
that they could not afford these services, and the provision was being
interrupted,' he said. 'Does it make sense in this context to use
tax-payer's money to pay Microsoft licenses?' "
-- Peruvian congressman Edgar Villanueva
(Courtesy of http://www.wired.com/news/business/0,1367,54141-2,00.html )
--------------------------------------------------------------------------
William Stearns (wstearns@pobox.com). Mason, Buildkernel, freedups, p0f,
rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org
--------------------------------------------------------------------------
Re: Another incompetent spammer
Posted by Matthias Fuhrmann <Ma...@stud.uni-hannover.de>.
On Wed, 11 Feb 2004, William Stearns wrote:
[...]
> > I know someone was collecting "spammer screwups", this one might be
> > worth adding if it's not there already....
>
> Added to http:://www.stearns.org/sa-blacklist/random.current.cf -
> thanks!
spamassassin --lint failes with:
Possible unintended interpolation of @RND_FROM_DOMAIN in string at
/etc/mail/spamassassin/random.current.cf, rule rantext22, line 1.
Failed to compile full SpamAssassin tests, skipping:
(Global symbol "@RND_FROM_DOMAIN" requires explicit package name
at /etc/mail/spamassassin/random.current.cf, rule rantext22, line 1.)
needs some quoting?
regards,
Matthias
Re: Another incompetent spammer
Posted by William Stearns <ws...@pobox.com>.
Good afternoon, Martin,
On Wed, 11 Feb 2004, Martin Radford wrote:
> Just spotted a spam full of %RANDOM_WORD and %RANDOM_TEXT.
>
> What interested me, though, is that the Message-ID looked like this:
>
> Message-ID: <VQ...@RND_FROM_DOMAIN>
>
> Note the "@RND_FROM_DOMAIN" -- no '%' symbol.
>
> I know someone was collecting "spammer screwups", this one might be
> worth adding if it's not there already....
Added to http:://www.stearns.org/sa-blacklist/random.current.cf -
thanks!
Cheers,
- Bill
---------------------------------------------------------------------------
"This door is baroquen, please wiggle Handel. (If I wiggle
Handel, will it wiggle Bach?)"
-- Found on a door in the MSU music building
(Courtesy of Slashdot)
--------------------------------------------------------------------------
William Stearns (wstearns@pobox.com). Mason, Buildkernel, freedups, p0f,
rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org
--------------------------------------------------------------------------