Hi Matt: What is a "static" spammer? I've looked into a few in the past week and they all were obviously were marketing mail companies (such as in this case, mta8br.cmpgnr.com [69.28.223.132]) - and, of course, the mail account that we receiving the spam was never subscribed there.
Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Saturday, November 18, 2006 07:54 PM To: [email protected] Subject: Re: [Declude.JunkMail] MXRate-Allow Andy, That result code is neither a whitelist or a blacklist, it is merely an indication that legitimate E-mail has been received in quantity from that IP. Due to the fact that spam levels are approaching 99% of connection traffic these days (not the same as message volume), it is not uncommon to find that places that send a lot of good E-mail also send a lot of spam from time to time. This particular result code is most useful in the context of Alligate, but it has little value when used simply as an IP4R test within Declude. You can however assume with a high degree of confidence that you won't be receiving zombie generated spam from this result code unless it was forwarded or in a very rare occasion, the server itself is hacked. You can also fairly safely assume that this will not be a static spammer. It can however be a bulk-mail provider that leaks some spam, or a real E-mail service that has Advance Fee Fraud users (Hotmail for instance), or service providers that are forwarding E-mail, or possibly forwarding phishing on behalf of hacked servers in their network. Matt Andy Schmidt wrote: Is it me - or should MXRate-Allow be treated as a "spam source" list? I don't know how many times I've looked at Spam that made it through and the IP is on their whitelist, such as "campaigner". Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 -----Original Message----- Received: from mta8br.cmpgnr.com [69.28.223.132] by hm-software.com (SMTPD-9.10) id A0C01D47C; Sat, 18 Nov 2006 11:11:44 -0500 Return-Path: [EMAIL PROTECTED] Message-ID: <[EMAIL PROTECTED]> Date: Sat, 18 Nov 2006 11:11:48 -0500 (EST) From: "Purplus Inc." <[EMAIL PROTECTED]> Reply-To: "Purplus Inc." <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Great New Deals >From Purplus Software Errors-To: [EMAIL PROTECTED] Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_220171_25603728.1163866308151" X-Campaign: 829605.828864.667296.793699032 Bounces-To: [EMAIL PROTECTED] X-RBL-Warning: Suspected SPAM. "Spam Received Recently See: http://www.sorbs.net/lookup.shtml?69.28.223.132"; X-Declude-RefID: X-Declude: Version 4.3.14; Code 0xe from mta8br.cmpgnr.com [69.28.223.132] X-Declude: Triggered [4] SENDERDB-ALLOW, SPFPASS, SNIFFER X-Countries: UNITED STATES->destination Return-Path: <[EMAIL PROTECTED]> X-RCPT-TO: <[EMAIL PROTECTED]> Status: X-UIDL: 463610395 X-IMail-ThreadID: 30c001bc00005152 From: Purplus Inc. [mailto:[EMAIL PROTECTED] Sent: Saturday, November 18, 2006 11:12 AM To: [EMAIL PROTECTED] Subject: Great New Deals >From Purplus Software ------------------------- SPAM DELETED ------------------------------------------ You are subscribed as [EMAIL PROTECTED] To unsubscribe please click <http://cmpgnr.com/r.html?c=829605&r=828864&t=793699032&l=6&[EMAIL PROTECTED] as&la=1&o=-40> here. <http://www.campaigner.com/?testdrive_1> <http://cmpgnr.com/app/campaigner/trk/opn.jsp?cid=829605&rid=828864&ctd=7936 99032&lid=87676647&g=0&f=87676648> --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
