On Friday, May 7, 2004, 7:36:18 AM, ITReading ITReading wrote: > Hello all, > I continue to receive messages with URIs to "bravemouser.com" > in the past few weeks. Should this domain be added to one of > the surbl lists? Most of the messages are TV Pay Per View spam.
> An example of one of the messages can be found here: > http://www.aldridge-borden.com/bravemouser.txt I don't see any reports about it to SpamCop. You may want to do that. Definitely looks like spam to me. Interesting thing is that it uses a "base href" syntax with a later relative anchor "<a href="r.asp?oid...": <html><head><base href="http://www.bravemouser-MUNGED.com/Creatives/FLTR5/";></head> <table align="center" border="0" cellpadding="0" cellspacing="0" width="10"> <tr><td><a href="r.asp?oid=519481245&sid=808272&aid=3"><img border="0" src="http://www.bravemouser-MUNGED.com/Creatives/FLTR5/pix/1.gif"; width="182" height="353"></a></td> <td><a href="r.asp?oid=519481245&sid=808272&aid=3"><img border="0" src="pix/2.jpg" width="475" height="353"></a></td></tr> </TABLE> <P align="center"><font face="Verdana" size="1">You are receiving this newsletter from the Acquired mailing list as a result of a recent transaction on our network. To stop further messages from this mailing list follow the link <a href="http://www.bravemouser.com/Creatives/FLTR5/u.asp?oid=519481245&sid=808272&aid=4";>here</a>.<BR><BR>Acquired Mailing List<BR>849 Almar Ave. STE., PMB 317<BR>Santa Cruz, CA 95060<BR>USA<img border="0" src="http://www.bravemouser.com/Creatives/FLTR5/o.asp?oid=519481245&sid=808272&aid=5"; width="0" height="0"></font> </HTML> Does anyone know if the current message parsing code in SA 2.63 PerMsgStatus.pm or whatever correctly parses a base href + relative reference? IIRC from Buzgzilla, SA 3.0 will now resolve relative references such as these into absolute URIs so I think it's handled correctly there. Jeff C.
![http://www.bravemouser-MUNGED.com/Creatives/FLTR5/pix/1.gif"](http://www.bravemouser-MUNGED.com/Creatives/FLTR5/pix/1.gif"){kind=link}