You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Larry Ludwig <ll...@empoweringmedia.com> on 2007/03/26 03:17:49 UTC
New method of spamming
Hi,
I searched the mailing list and didn't find anyone mentioning this.. So I
thought I like to add this new method.
We are now seeing what fastmail.fm is also seeing:
http://blog.fastmail.fm/?p=599
Spammers are now in bulk spamming through the free webmail providers using
their botnets and not just a few emails. My question to the group is how
can test using RBL at this line within spamassassin:
Received: from [68.199.171.61] by web62312.mail.re1.yahoo.com via HTTP; Sat,
24 Mar 2007 20:15:58 PDT
Since that is the root of the issue.
Return-path: <li...@yahoo.com>
Envelope-to: xx@xxxxxxxxxxxx.xxx <mailto:xx@xxxxxxxxxxxx.xxx%3E;Sat>
Delivery-date: Sat, 24 Mar 2007 23:16:01 -0400
Received: from poseidon.empoweringmedia.net ([67.72.106.74])
by psyche.empoweringmedia.net with esmtp (Exim 4.66)
(envelope-from <li...@yahoo.com>)
id 1HVJD7-00088e-N6
for xx@xxxxxxxxxxxx.xxx <mailto:xx@xxxxxxxxxxxx.xxx%3E;Sat> ; Sat, 24 Mar
2007 23:16:01 -0400
Received: from localhost (unknown [127.0.0.1])
by poseidon.empoweringmedia.net (Postfix) with ESMTP id A2BD825411A
for <xx@xxxxxxxxxxxx.xxx <mailto:xx@xxxxxxxxxxxx.xxx%3E;Sat> >; Sun, 25 Mar
2007 03:16:01 +0000 (UTC)
X-AntiSpam-Software: Empowering Media Spam Filter v2.0.1
X-Spam-Score: 1.471
X-Spam-Level: *
X-Spam-Status: No, score=2.671-1.2 tagged_above=-999 required=7
tests=[BAYES_40=-0.185, DK_POLICY_TESTING=0.001, DK_SIGNED=0.001,
DK_VERIFIED=-0.001, DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_POST=1.708,
DNS_FROM_RFC_WHOIS=1.447, L_P0F_UNIX=-0.5]
X-Amavis-OS-Fingerprint: FreeBSD 4.7-5.2 (or MacOS X 10.2-10.4) (2) (up:
1807
hrs), (distance 8, link: ethernet/modem), [69.147.75.26]
Received: from poseidon.empoweringmedia.net ([127.0.0.1])
by localhost (poseidon.empoweringmedia.net [127.0.0.1]) (amavisd-new, port
10024)
with ESMTP id XJdXVZvQQGes for <xx@xxxxxxxxxxxx.xxx
<ma...@xxxxxxxxxxxx.xxx>;Sat> >;
Sat, 24 Mar 2007 23:15:59 -0400 (EDT)
X-policyd-weight: NOT_IN_DYN_NJABL=0 NOT_IN_SPAMHAUS=-1.75
NOT_IN_SPAMCOP=-1.75 NOT_IN_BL_NJABL=-1 NOT_IN_SORBS=-0.75 NOT_IN_DSBL_ORG=0
NOT_IN_IX_MANITU=0 CL_IP_EQ_HELO_IP=-2 (check from: .yahoo. - helo:
.web62312.mail.re1.yahoo. - helo-domain: .yahoo.)
FROM/MX_MATCHES_HELO(DOMAIN)=-2 IN_PM_RFCI=0.1 IN_ABUSE_RFCI=0.1
<client=69.147.75.26> <helo=web62312.mail.re1.yahoo.com>
<fr...@yahoo.com> <to=xx@xxxxxxxxxxxx.xxx
<mailto:xx@xxxxxxxxxxxx.xxx%3E;Sat> >, rate: -9.05
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4
Received: from web62312.mail.re1.yahoo.com (web62312.mail.re1.yahoo.com
[69.147.75.26])
by poseidon.empoweringmedia.net (Postfix) with SMTP id 5DEF1254119
for <xx@xxxxxxxxxxxx.xxx <mailto:xx@xxxxxxxxxxxx.xxx%3E;Sat> >; Sat, 24 Mar
2007 23:15:58 -0400 (EDT)
Received: (qmail 13928 invoked by uid 60001); 25 Mar 2007 03:15:58 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:Date:From:Subject:To:MIME-Version:Content-Type:Conten
t-Transfer-Encoding:Message-ID;
b=Q3qc7NKP2buIJv8X5aIMbpcDiznW0Ot8xHmAdbftd2L2EYlg7sLoQTk3y9cUAX9CXuF1I2recH
2eBdAaUh0siCz75VId62ku7NC35QICd7Y3GL0QCB3eZyqtexHFdYZq+RWFewBdFJTecCP5aM345D
D0loosxYDranEV2d6pzbE=;
X-YMail-OSG:
T8X0laoVM1lROohdhFoCrl9EMh749QG5RRWa1Ze8nftLgoofJrXExAk3QO1Fwg0lWLwo1nrBaqN1
0gSeuz87X9i.kdCAyp.ylqGP_D0JPu4MUmZ5U9_YO_IcImRNz.o-
Received: from [68.199.171.61] by web62312.mail.re1.yahoo.com via HTTP; Sat,
24 Mar 2007 20:15:58 PDT
Date: Sat, 24 Mar 2007 20:15:58 -0700 (PDT)
From: Lind Tombigbee <li...@yahoo.com>
Subject: Pronemeer.
To: ea <xx@xxxxxxxxxxxx.xxx <mailto:xx@xxxxxxxxxxxx.xxx%3E;Sat> >
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Message-ID: <78...@web62312.mail.re1.yahoo.com>
Content-Transfer-Encoding: quoted-printable
Ponr software.
Free ponr lingerie.
http://equdetuguza.info
Breast bondage tit bondage bound breast ponr videos
tit free.
Boob job ponr.
Ponr mowies.
=20
_________________________________________________________________________=
___________
No need to miss a message. Get email on-the-go=20
with Yahoo! Mail for Mobile. Get started.
http://mobile.yahoo.com/mail=20
-L
--
Larry Ludwig
Empowering Media
1-866-792-0489 x600
Have you visited our customer service blog?
http://www.supportem.com/blog/