The below headers are from a spam that keeps passing all but Sniffer's tests. The common denominator is that they come from mx-man.net but the from changes all the time. How can I reject anything that has mx-man.net in it's path?
Received: from StarGazer.TenForward.com [65.161.10.3] by tenforward.com (SMTPD32-7.12) id A6ADFBE00A0; Tue, 10 Sep 2002 12:23:25 -0700 Received: from a37.mx-man.net (a37.mx-man.net [203.57.38.37]) by StarGazer.TenForward.com (Postfix Relay Hub) with ESMTP id F34F2CC4C for <[EMAIL PROTECTED]>; Tue, 10 Sep 2002 12:23:23 -0700 (PDT) Received: by a37.mx-man.net (Postfix, from userid 1026) id D694F2649CE; Tue, 10 Sep 2002 23:37:35 +1000 (EST) Date: Tue, 10 Sep 2002 23:37:35 +1000 From: Joelle <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: How close can you shave a pussy? Message-Id: <[EMAIL PROTECTED]> Content-type: text/html; charset="iso-8859-1" X-RBL-Warning: SNIFFER: Message failed SNIFFER: 64. X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: SNIFFER X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 331067121 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
