Has anyone seen this one [Archive] - Server Side Solutions Forums

Bob Escher

05-04-2004, 10:55 AM

Here's a new one that I haven't seen
before

Suggestions on how to block

Bob E

-MAIL-FROM:
Received: from 212.180.202.68.cfl.rr.com [68.202.180.212] by
pop.rsegroup.com (eWall 2.0)
Received: from %RECEIVED. ([20.197.240.160]) by 68.202.180.212 %REC_WITH;
Mon, 03 May 2004 17:43:15 -0500
Date: Mon, 03 May 2004 17:43:15 -0500
From: "Kenton Lindsay" <%FROM_USER@>
Reply-To: "Kenton Lindsay" <%FROM_USER@>
Message-Id: <%MESSAGEID@meat>
Organization: Microsoft Outlook Express 5.00.2615.200
To: bescher@rsegroup.com
Subject: remember how you were? mcdaniel
X-Mailer: Microsoft Outlook Express 5.00.2615.200
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="0194074564073882"

Content-Type: text/plain; charset=%CHARSET
Content-Transfer-Encoding: quoted-printable

keynes cursive mickey ridiculous
typify nepal intricate inseminate veterinarian plagued transistor quarry
headphone landlord
woody cite destine plan labradorite fallacy hillmen champ folksong cube

Content-Type: text/html; charset=%CHARSET
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<CENTER>You've heard about these =
pills on TV, in the news, and online and 
have probably asked yourself, "Do they really work?" The answer is 
YES! IGF2 is a powerful erection enhancing product that will 
create erections so strong and full that over time your penis will 
actually grow as a direct result! If you would like a more 
satisfying sex life then IGF2 is for you! 

<A HREF=3D"http://www.desireouroffers.biz/i=
ndex.shtml?xp92780g">Check It Out Now!</A> <B=
R><A HREF=3D"http://desireouroffers.biz/denise.php">Rem**ove M*e!</A> <=
BR></CENTER>

 <CENTER>
bloc toutdunlop aqueous bewhiskertattler
torch hinduismcombustible adrenal dreamydelphine
decay prerequisitebelfry calypso proffl
vanilla shunmesa utile philodendronmaori
abater octogenarianexultant lifeguard intentsepal
sculptural bivalveimperil confess centrifugalparcel
carpentry enumerablelitton effort adulteratealga
montreal duluthembodiment bled digressionconvolution
deuteron deaderosible whoever corroboratezagreb
eclogue buffleheadbarnet analytic bestsellingpitch
smack magazinehypothalamic cadmium solacecosta
transgression ocarinabigotry threefold airmassdelphinium
absentia shamefaceclick ambrosial homosexualblare
eternal danceadventitious flyer sanfordsulphur
begun primatewow amethystine bowelneuromuscular
cigar telefunkenreturn away sinclairbrittany
customary eerilyisinglass projector filmdomchordate
in christdefer aberdeen bisquecrutch
stay benedictinegunshot notebook fredlovelace
</CENTER>

Richard Sloman

05-04-2004, 11:49 AM

Well you could block all mail where the from name contains %

But once again it might be more useful if you show us the log, not the =
email.

Cozmo

05-04-2004, 05:06 PM

Sadly,
I've seen it all (or so i think...)

I've resigned myself on some of this stuff to just let it through - im down
to 6 or 7 spam a day vs. the 1500 a day im blocking, and another 1200 or so
a day that are being stopped by rbl's.....

Otherwise, you could block on the % , unless thats a wildcard in ewall ? -
or bolck on the name or the message content.. I see the words powerful
erection in there - dont think it would pass my 'sexual content' filter.
Strangely, i havent had any users tell me that they need the ability to
include the string 'powerful erection' in their day to day emails...

:)

James Robertson

05-04-2004, 05:10 PM

Hi Bob,

I drop all email from any sender such as <xxxx@> so i filter all senders
with "@>" and it has taken care of that problem. Those e-mail addys also did
a job on verification.

James