On Wednesday, August 28, 2002, at 01:50  PM, Robin Lynn Frank wrote:
> And if a spammer forges headers???
Header forgeries are trivially easy to detect. The main way that
spammers hide their originating IPs is not by forging headers,
but by sending through open proxy servers.  It used to be that
spammers used open relay mailserver, but these often betray the
originating IP, and the proliferation of open relay blocklists,
and the introduction of port 25 blocking on the part of many
ISPs make open relays unattractive to spammers.
One would think, that the combination of a forged Habeas-SWE,
and mail sent through an anonymizing open proxy would be a
fairly good indication of spam.  Tracking a spammer to his
meatspace location is not as difficult as you might think, once
you have legal recourse to subpoena records.
--B
-------------------------------------------------------
This sf.net email is sponsored by: Jabber - The world's fastest growing
real-time communications platform! Don't just IM. Build it in!
http://www.jabber.com/osdn/xim
_______________________________________________
Spamassassin-talk mailing list
Spamassassin-talk@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

No, hits=0.8 required=7.0
	tests=FORGED_RCVD_TRAIL,KNOWN_MAILING_LIST,RCVD_IN_RFCI,
	      SPAM_PHRASE_00_01,USER_AGENT_OUTLOOK
	version=2.40-cvs

No, hits=-27.1 required=7.0
	tests=EMAIL_ATTRIBUTION,HABEAS_SWE,KNOWN_MAILING_LIST,
	      QUOTED_EMAIL_TEXT,SPAM_PHRASE_02_03
	version=2.40-cvs

No, hits=-11.1 required=7.0
	tests=EMAIL_ATTRIBUTION,IN_REP_TO,KNOWN_MAILING_LIST,
	      QUOTED_EMAIL_TEXT,REFERENCES,SPAM_PHRASE_00_01
	version=2.40-cvs

No, hits=-8.6 required=7.0
	tests=FORGED_RCVD_TRAIL,KNOWN_MAILING_LIST,NOSPAM_INC,
	      QUOTED_EMAIL_TEXT,RCVD_IN_UNCONFIRMED_DSBL,REFERENCES,
	      SPAM_PHRASE_00_01,USER_AGENT,X_ACCEPT_LANG
	version=2.40-cvs

from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 9BB5A47C77
	for <jm@localhost>; Thu, 29 Aug 2002 06:06:18 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Thu, 29 Aug 2002 11:06:18 +0100 (IST)
from usw-sf-list2.sourceforge.net (usw-sf-fw2.sourceforge.net
    [216.136.171.252]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id
    g7T66TZ01029 for <jm-sa@jmason.org>; Thu, 29 Aug 2002 07:06:30 +0100
from usw-sf-list1-b.sourceforge.net ([10.3.1.13]
    helo=usw-sf-list1.sourceforge.net) by usw-sf-list2.sourceforge.net with
    esmtp (Exim 3.31-VA-mm2 #1 (Debian)) id 17kIQS-0006mo-00; Wed,
    28 Aug 2002 23:05:04 -0700
from yrex.com ([216.40.247.31] helo=host.yrex.com) by
    usw-sf-list1.sourceforge.net with smtp (Exim 3.31-VA-mm2 #1 (Debian)) id
    17kIPo-0005vK-00 for <spamassassin-talk@lists.sourceforge.net>;
    Wed, 28 Aug 2002 23:04:25 -0700
(qmail 4581 invoked from network); 29 Aug 2002 06:04:22 -0000
from mgm.dsl.xmission.com (HELO opus) (204.228.152.186) by
    yrex.com with SMTP; 29 Aug 2002 06:04:22 -0000
No, hits=-9.2 required=7.0
	tests=IN_REP_TO,KNOWN_MAILING_LIST,QUOTED_EMAIL_TEXT,
	      SPAM_PHRASE_03_05,USER_AGENT_OUTLOOK
	version=2.40-cvs
From spamassassin-talk-admin@lists.sourceforge.net  Thu Aug 29 11:08:46 2002