I'm currently just blocking: rampellsoft.com.
Return-path: <[EMAIL PROTECTED]>
Received: from dtri3.rampellsoft.com ([69.90.152.226])
by rime.org (rime.org)
(MDaemon.PRO.v7.2.0d.R)
with ESMTP id md50000747666.msg
for <[EMAIL PROTECTED]>; Mon, 02 Aug 2004 12:56:35 -0400
Received-SPF: pass (rime.org: domain of [EMAIL PROTECTED]
designates 69.90.152.226 as permitted sender)
x-spf-client=MDaemon.PRO.v7.2.0d.R
receiver=rime.org
client-ip=69.90.152.226
envelope-from=<[EMAIL PROTECTED]>
helo=dtri3.rampellsoft.com
Received: from dtri3.rampellsoft.com (localhost.localdomain [127.0.0.1])
by dtri3.rampellsoft.com (8.12.8/8.12.8) with ESMTP id i72GxuU0014602
for <[EMAIL PROTECTED]>; Mon, 2 Aug 2004 12:59:56 -0400
Received: (from [EMAIL PROTECTED])
by dtri3.rampellsoft.com (8.12.8/8.12.8/Submit) id i72Gxuc4014600;
Mon, 2 Aug 2004 12:59:56 -0400
PM> That sounds fine. We'll be here when that happens. If they have a
PM> pattern to their alterations then we might code a broader heuristic
PM> (with some wildcards) to capture when they move. It's all up to you.
PM> Best,
PM> _M
PM> On Monday, August 2, 2004, 8:57:52 PM, Woody wrote:
WF>> Oops My current filter for didthey.. picked up the response from the list.
WF>> We are currently filtering the didthey... beacon with a simple Imail phrase
WF>> filter. Not seeing too much activity so far. We expect they will change the
WF>> path in thier beacon soon to avoid detection. We will continue to use the
WF>> phrase filter for now and may request a new rule when that fails to be
WF>> effective.
WF>> Thanks
WF>> Woody
WF>> -----Original Message-----
WF>> From: [EMAIL PROTECTED]
WF>> [mailto:[EMAIL PROTECTED] Behalf Of Pete McNeil
WF>> Sent: Monday, August 02, 2004 12:14 PM
WF>> To: Woody Fussell
WF>> Subject: Re: [sniffer] Did They ReadIt
WF>> On Monday, August 2, 2004, 12:06:30 PM, Woody wrote:
WF>>> Does Sniffer have a rule that identifies email that uses the services of
WF>>>www did they read it . com? If so, what category does it match. If not,
WF>> can such
WF>>> a rule or rules be included?
WF>> I'm guessing that there isn't a rule since this message made it to the
WF>> list and I don't recall it being anywhere.
WF>> We can certainly add a rule (white or black) upon request for any
WF>> registered rulebase.
WF>>> Woody Fussell
WF>>> Wilbur Smith Associates
WF>>> [EMAIL PROTECTED]
WF>>> This E-Mail came from the Message Sniffer mailing list. For
WF>>> information and (un)subscription instructions go to
WF>>> http://www.sortmonster.com/MessageSniffer/Help/Help.html
WF>> This E-Mail came from the Message Sniffer mailing list. For information and
WF>> (un)subscription instructions go to
WF>> http://www.sortmonster.com/MessageSniffer/Help/Help.html
WF>> This E-Mail came from the Message Sniffer mailing list. For
WF>> information and (un)subscription instructions go to
WF>> http://www.sortmonster.com/MessageSniffer/Help/Help.html
PM> This E-Mail came from the Message Sniffer mailing list. For
PM> information and (un)subscription instructions go to
PM> http://www.sortmonster.com/MessageSniffer/Help/Help.html
--
John M. Cline, LTC, USAFR <ret> "Never Give Up!"
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html
