At 7:55 PM -0700 11/13/02, Warren Michelsen wrote: >A spam in my queue begins: > >P I 11-11-2002 16:47:32 0000 thefreevirtual.org glen >R E 11-11-2002 16:47:36 0000 bzlaw.com glen >R E 11-11-2002 16:48:06 0000 bzlaw.com jeff >R E 11-11-2002 16:48:36 0000 bzlaw.com katie >R E 11-11-2002 16:49:06 0000 bzlaw.com oscar >R E 11-11-2002 16:51:06 0000 bzlaw.com pierre >R E 11-11-2002 16:53:06 0000 bzlaw.com rainbow > >Received: from [213.167.166.26] (HELO thefreevirtual.org) > by SMTP.az.net (Stalker SMTP Server 1.8b9d11) > with SMTP id S.0000110944; Mon, 11 Nov 2002 09:47:34 -0700 > > >Can I accept 213.167.166.26 as the real IP address of the offending MTA or >is it like the HELO argument (thefreevirtual.org) which can be any durned >thing the spammer pleases? >
That address shows as actively used by a spammer via spamcop: http://spamcop.net/w3m?action=checkblock&ip=213.167.166.26 that IP is listed in some RBLs per the samspade multi-rbl checker http://www.samspade.org/t/rbl?a=213.167.166.26&r=on I'd say you have a good small list to start your own blacklist from... -- Michael Croft http://www.whiterose.org/michael SAM: It's 106 miles to the Crack of Doom. We've got a magic ring, two daggers, it's dark, and we're wearing sunglasses FRODO: Hit it. ############################################################# This message is sent to you because you are subscribed to the mailing list <[EMAIL PROTECTED]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
