New spam method?

[Gene Heskett <ge...@verizon.net>]

Greetings;

I seem to be attracting an unusual amount of little, less than 5 line 
spams that basicly contain nothing but a link to a known spam image 
server serving up a stock scam image.

Unforch, the headers do not contain this name or address, and the 
Received: from line that is common to all only contains a 3 letter 
internet abbreviation.

I've plugged that into procmailrc, but that seems a bit like using a 
sledgehammer to kill a fly, with a potential for FP's being sent 
to /dev/null.

I don't see, in the procmailrc page, a method to do a wildcard on the 
first section of a char.char.char address, which I think would be a 
little more precise an aim at this particular offender.

Anybody have any hints?

-- 
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
You have a strong appeal for members of your own sex.

Re: New spam method?

[Gene Heskett <ge...@verizon.net>]

On Tuesday 03 April 2007, Randal, Phil wrote:
>See my reply in the thread "How are cllassified this?" for how to catch
>these in SA.
>
>We're getting thousands of them here.

I found a common IP address in the headers and added it to the .procmailrc 
rules.  If I got all the escape \'s in there right, that address should 
disappear.  But how long till they move to another is probably the $64k 
question.

>Phil
>--
>Phil Randal
>Network Engineer
>Herefordshire Council
>Hereford, UK
>
>> -----Original Message-----
>> From: Gene Heskett [mailto:gene.heskett@verizon.net]
>> Sent: 03 April 2007 15:55
>> To: users@spamassassin.apache.org
>> Subject: New spam method?
>>
>> Greetings;
>>
>> I seem to be attracting an unusual amount of little, less than 5 line
>> spams that basicly contain nothing but a link to a known spam image
>> server serving up a stock scam image.
>>
>> Unforch, the headers do not contain this name or address, and the
>> Received: from line that is common to all only contains a 3 letter
>> internet abbreviation.
>>
>> I've plugged that into procmailrc, but that seems a bit like using a
>> sledgehammer to kill a fly, with a potential for FP's being sent
>> to /dev/null.
>>
>> I don't see, in the procmailrc page, a method to do a wildcard on the
>> first section of a char.char.char address, which I think would be a
>> little more precise an aim at this particular offender.
>>
>> Anybody have any hints?
>>
>> --
>> Cheers, Gene
>> "There are four boxes to be used in defense of liberty:
>>  soap, ballot, jury, and ammo. Please use in that order."
>> -Ed Howdershelt (Author)
>> You have a strong appeal for members of your own sex.



-- 
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
I never met a piece of chocolate I didn't like.

RE: New spam method?

["Randal, Phil" <pr...@herefordshire.gov.uk>]

See my reply in the thread "How are cllassified this?" for how to catch
these in SA.

We're getting thousands of them here.

Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: Gene Heskett [mailto:gene.heskett@verizon.net] 
> Sent: 03 April 2007 15:55
> To: users@spamassassin.apache.org
> Subject: New spam method?
> 
> Greetings;
> 
> I seem to be attracting an unusual amount of little, less than 5 line 
> spams that basicly contain nothing but a link to a known spam image 
> server serving up a stock scam image.
> 
> Unforch, the headers do not contain this name or address, and the 
> Received: from line that is common to all only contains a 3 letter 
> internet abbreviation.
> 
> I've plugged that into procmailrc, but that seems a bit like using a 
> sledgehammer to kill a fly, with a potential for FP's being sent 
> to /dev/null.
> 
> I don't see, in the procmailrc page, a method to do a wildcard on the 
> first section of a char.char.char address, which I think would be a 
> little more precise an aim at this particular offender.
> 
> Anybody have any hints?
> 
> -- 
> Cheers, Gene
> "There are four boxes to be used in defense of liberty:
>  soap, ballot, jury, and ammo. Please use in that order."
> -Ed Howdershelt (Author)
> You have a strong appeal for members of your own sex.
>