I've been very successful stopping this spammer by attacking spamheader code C040120E. This seems to be the only spammer that returns this code. I blast it with a 100 point penalty along with the spamheaders points, and they scoring the spam into the hold and delete ranges.
They can change domain names and IP address all they want, as long as their spam software has this flaw, I can nail them. I use an external test. It is posted here: http://it.farmprogress.com/declude/Header.htm ----- Original Message ----- From: "Bill Landry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, October 04, 2004 2:33 PM Subject: Re: [Declude.JunkMail] annoying spammer > Message----- Original Message ----- > From: Richard Farris > > > I am seeing a lot of these in my spamreview also....can't we just > blacklist the domain..? > > You could, but they use so many different domains if could be tough to keep > up with them. I just block the netblocks that have been assigned to Phoenix > Data Systems at my mail gateways: > > 204.94.0.0/15 REJECT > 204.96.0.0/15 REJECT > 205.241.64.0/18 REJECT > 207.43.0.0/18 REJECT > > Bill > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
