Hello Jonathan, Thursday, December 15, 2005, 11:12:23 AM, you wrote:
>> Have you tried the 70_sare_specific.cf filter? I am not sure it will catch >> that specific problem but it catches spam with geocities and tripod url's for >> me. JN> Yeah, I'm using that list. It's been great, but the *.br one kept JN> getting through. JN> I DID see THIS in there, though.. JN> header SARE_SPEC_CLIENT_TOS2 From =~ m'[EMAIL PROTECTED]'i JN> describe SARE_SPEC_CLIENT_TOS2 known spammer address JN> score SARE_SPEC_CLIENT_TOS2 2.222 JN> [EMAIL PROTECTED] is the AOL Postmaster feedback loop address. I don't think JN> that one oughta be in there.. unless spammers are forging it. Eeeek! Yes, it seems to me here that spammers are forging it -- I'm getting spam to addresses that have not requested the AOL feedback with these symptoms. I'm hoping to have an update to specific.cf shortly which will either tighten up the rule to catch only the forgeries, or do away with altogether (and let the spammers win until we find a better way). Bob Menschel
