I'd like to get this added to the default rule set, any objections? header FROM_MYFANBOX From:addr =~ /\@myfanbox\.com$/i score FROM_MYFANBOX 5
I got four emails that I would have assumed were spam if they had not said they were from a friend of mine with a very uncommon name. I eventually complained to him, he said other friends of his have gotten the same, he has no idea what's causing them. I did some googling. This is happening to other people. I don't know how exactly they're collecting people's names and address books, but they're easy enough to catch, so it's silly that SA is missing them. They're all currently hitting RCVD_IN_BRBL_LASTEXT, that's about it. Don't know why they're not on other blacklists yet. they're also showing up on senderbase as poor: http://www.senderbase.org/senderbase_queries/detailip?search_string=208.69.101.166 Hmm, that's interesting... Network Owner: SMS.ac # of domains controlled by this network owner: 482 Four sample emails here: http://www.chaosreigns.com/sa/myfanbox.txt His name (first and last) have been replaced with "[redacted]". -- "Every normal man must be tempted at times to spit upon his hands, hoist the black flag, and begin slitting throats." - Henry Louis Mencken (1880-1956) http://www.ChaosReigns.com
