On Tuesday 03 April 2007, Randal, Phil wrote: >See my reply in the thread "How are cllassified this?" for how to catch >these in SA. > >We're getting thousands of them here.
I found a common IP address in the headers and added it to the .procmailrc rules. If I got all the escape \'s in there right, that address should disappear. But how long till they move to another is probably the $64k question. >Phil >-- >Phil Randal >Network Engineer >Herefordshire Council >Hereford, UK > >> -----Original Message----- >> From: Gene Heskett [mailto:[EMAIL PROTECTED] >> Sent: 03 April 2007 15:55 >> To: users@spamassassin.apache.org >> Subject: New spam method? >> >> Greetings; >> >> I seem to be attracting an unusual amount of little, less than 5 line >> spams that basicly contain nothing but a link to a known spam image >> server serving up a stock scam image. >> >> Unforch, the headers do not contain this name or address, and the >> Received: from line that is common to all only contains a 3 letter >> internet abbreviation. >> >> I've plugged that into procmailrc, but that seems a bit like using a >> sledgehammer to kill a fly, with a potential for FP's being sent >> to /dev/null. >> >> I don't see, in the procmailrc page, a method to do a wildcard on the >> first section of a char.char.char address, which I think would be a >> little more precise an aim at this particular offender. >> >> Anybody have any hints? >> >> -- >> Cheers, Gene >> "There are four boxes to be used in defense of liberty: >> soap, ballot, jury, and ammo. Please use in that order." >> -Ed Howdershelt (Author) >> You have a strong appeal for members of your own sex. -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) I never met a piece of chocolate I didn't like.
