Re[2]: geocities.yahoo.com.br rule help

[Robert Menschel <Ro...@Menschel.net>]

Hello Jonathan,

Thursday, December 15, 2005, 11:12:23 AM, you wrote:


>> Have you tried the 70_sare_specific.cf filter?  I am not sure it will catch
>> that specific problem but it catches spam with geocities and tripod url's for
>> me.

JN> Yeah, I'm using that list. It's been great, but the *.br one kept 
JN> getting through.

JN> I DID see THIS in there, though..

JN> header    SARE_SPEC_CLIENT_TOS2    From =~ m'\bscomp\@aol.net'i
JN> describe  SARE_SPEC_CLIENT_TOS2    known spammer address
JN> score     SARE_SPEC_CLIENT_TOS2    2.222

JN> scomp@aol.net is the AOL Postmaster feedback loop address. I don't think
JN>   that one oughta be in there.. unless spammers are forging it. Eeeek!

Yes, it seems to me here that spammers are forging it -- I'm getting
spam to addresses that have not requested the AOL feedback with these
symptoms.  I'm hoping to have an update to specific.cf shortly which
will either tighten up the rule to catch only the forgeries, or do
away with altogether (and let the spammers win until we find a better
way).

Bob Menschel