Re: OK guys - why did this one get through.

2005-11-01 Thread jdow
From: "Craig McLean" <[EMAIL PROTECTED]> -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 jdow wrote: [Headers snipped] I've been using the rules below to catch the paypal phishing mails I get. I know they don't counter the header issues you are seeing, but I'd be interested to know if they hit o

Re: OK guys - why did this one get through.

2005-11-01 Thread jdow
From: "mouss" <[EMAIL PROTECTED]> jdow a écrit : From: "mouss" <[EMAIL PROTECTED]> Well, you sort of got it. But the from IS paypal.com, it claims. And there is no appropriate paypal received from. no, he has a "nasty" mispelling there. it's paypaI, with an 'I'. the spammer clearly did ef

Re: OK guys - why did this one get through.

2005-11-01 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 jdow wrote: [Headers snipped] I've been using the rules below to catch the paypal phishing mails I get. I know they don't counter the header issues you are seeing, but I'd be interested to know if they hit on the full message. If not, I'd appreciate

Re: OK guys - why did this one get through.

2005-11-01 Thread mouss
jdow a écrit : From: "mouss" <[EMAIL PROTECTED]> Well, you sort of got it. But the from IS paypal.com, it claims. And there is no appropriate paypal received from. no, he has a "nasty" mispelling there. it's paypaI, with an 'I'. the spammer clearly did efforts to avoid the rules! even if th

Re: OK guys - why did this one get through.

2005-11-01 Thread Andy Jezierski
"Fred" <[EMAIL PROTECTED]> wrote on 11/01/2005 09:21:28 AM: > jdow wrote: > > Well, you sort of got it. But the from IS paypal.com, it claims. And > > there is no appropriate paypal received from. > > > > The Spoof rules look specifically for paypaL.com in the from line, this guy > used paypaI n

Re: OK guys - why did this one get through.

2005-11-01 Thread Fred
jdow wrote: > Well, you sort of got it. But the from IS paypal.com, it claims. And > there is no appropriate paypal received from. > The Spoof rules look specifically for paypaL.com in the from line, this guy used paypaI notice I not L, I'll include this mis-spelling in the next update of the spoo

RE: OK guys - why did this one get through.

2005-11-01 Thread Damrose, Mark
> -Original Message- > From: jdow [mailto:[EMAIL PROTECTED] > >>>From: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> > Well, you sort of got it. But the from IS paypal.com, it > claims. And there is no appropriate paypal received from. The From is not paypal.com.

Re: OK guys - why did this one get through.

2005-11-01 Thread jdow
From: "mouss" <[EMAIL PROTECTED]> Chris a écrit : On Monday 31 October 2005 04:22 pm, jdow wrote: ===8<--- Status: U Return-Path: <[EMAIL PROTECTED]> Received: from smtp.earthlink.net [209.86.93.209] by localhost with POP3 (fetchmail-6.2.5) for [EMAIL PROTECTED] (single-drop); Mon, 31 Oct 2

Re: OK guys - why did this one get through.

2005-11-01 Thread jdow
From: "Chris" <[EMAIL PROTECTED]> On Monday 31 October 2005 04:22 pm, jdow wrote: ===8<--- Status: U Return-Path: <[EMAIL PROTECTED]> Received: from smtp.earthlink.net [209.86.93.209] by localhost with POP3 (fetchmail-6.2.5) for [EMAIL PROTECTED] (single-drop); Mon, 31 Oct 2005 03:55:59 -080

Re: OK guys - why did this one get through.

2005-11-01 Thread mouss
Chris a écrit : On Monday 31 October 2005 04:22 pm, jdow wrote: ===8<--- Status: U Return-Path: <[EMAIL PROTECTED]> Received: from smtp.earthlink.net [209.86.93.209] by localhost with POP3 (fetchmail-6.2.5) for [EMAIL PROTECTED] (single-drop); Mon, 31 Oct 2005 03:55:59 -0800 (PST) Received:

Re: OK guys - why did this one get through.

2005-10-31 Thread Chris
On Monday 31 October 2005 04:22 pm, jdow wrote: > ===8<--- > Status: U > Return-Path: <[EMAIL PROTECTED]> > Received: from smtp.earthlink.net [209.86.93.209] > by localhost with POP3 (fetchmail-6.2.5) > for [EMAIL PROTECTED] (single-drop); Mon, 31 Oct 2005 03:55:59 > -0800 (PST) Received: from m