Someone else posted this sample to the list concerning a spam they had
recieved
and some header problems. Forgive me for stealing the message and
adding it to
this thread, but using the method I suggested earlier is quite effective.
Test output:
PASS 1...mfcpjs.mywealthbiz.info
Wildcard *.mywealthbiz.info = 222.51.91.234
SBL
First, the mfcpjs.mywealthbiz.info link could be a special URL which looks up
"mfcpjs" in a database to see which user/email clicked that URL. Its unlikely
that the DNS server is monitoring who looked up that hostname, however, to be
safe, that domain is never checked! Instead the wildcard is found, and
that IP
is checked, and is found in the SBL - so its spam, without looking up the
potentially dangerous "mfcpjs" portion. It also does not flag it as spam just
because there is a wildcard, so it won't give false positives.
-- Evan
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 19588 invoked from network); 20 May 2005 22:45:07 +0100
Received: from 82-35-6-77.cable.ubr01.hari.blueyonder.co.uk (@82.35.6.77)
by secure.roshan.name with SMTP; 20 May 2005 22:45:07 +0100
Language: English
X-MIME-Autoconverted: Yes
Alternate-Recipient: Allowed
Resent-Reply-To: "Marylou" <[EMAIL PROTECTED]>
Reply-To: "Marylou" <[EMAIL PROTECTED]>
From: "Marylou" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Easily earn $925, 879 this year
Date: Sat, 21 May 2005 01:39:52 +0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--142-39995-7611-328-538-423"
Earn $1000 in the next 24 hours!
Work from home - never drive to work again
No product to purchase
Unlimited income potential
You can earn $250,000 in the next 6 to 12 months.
Totally automated - No selling.
Copy and Paste this link into your browser to make money:
mfcpjs.mywealthbiz.info/appl_form_flower.html
thank you,
Marylou Farris
2816 Central Avenue
Richmond, VA
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
