I also get a lot of them. I think they're using the domain registry
database to pull their victims' addresses.
This sf.net email is sponsored by: Jabber - The world's fastest growing
real-time communications platform! Don't just IM. Build it in!

from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 6C63C43F9B
	for <jm@localhost>; Wed, 28 Aug 2002 10:50:09 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Wed, 28 Aug 2002 15:50:09 +0100 (IST)
from usw-sf-list2.sourceforge.net (usw-sf-fw2.sourceforge.net
    [216.136.171.252]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id
    g7SEliZ29140 for <jm-sa@jmason.org>; Wed, 28 Aug 2002 15:47:45 +0100
from usw-sf-list1-b.sourceforge.net ([10.3.1.13]
    helo=usw-sf-list1.sourceforge.net) by usw-sf-list2.sourceforge.net with
    esmtp (Exim 3.31-VA-mm2 #1 (Debian)) id 17k455-0002Jh-00; Wed,
    28 Aug 2002 07:46:03 -0700
from mailout01.sul.t-online.com ([194.25.134.80]) by
    usw-sf-list1.sourceforge.net with esmtp (Exim 3.31-VA-mm2 #1 (Debian)) id
    17k447-00035k-00 for <spamassassin-talk@lists.sourceforge.net>;
    Wed, 28 Aug 2002 07:45:03 -0700
from fwd08.sul.t-online.de by mailout01.sul.t-online.com with
    smtp id 17k444-0005vp-03; Wed, 28 Aug 2002 16:45:00 +0200
from otherland (otherland.msquadrat.de [10.10.10.10]) by
    nebukadnezar.msquadrat.de (Postfix on SuSE Linux 7.3 (i386)) with ESMTP id
    80DE73B1 for <spamassassin-talk@lists.sf.net>; Wed, 28 Aug 2002 16:44:40
    +0200 (CEST)
Warrant Mark warrants that this is a Habeas Compliant
Message (HCM) and not spam. Please report use of this
From spamassassin-talk-admin@lists.sourceforge.net  Wed Aug 28 15:50:09 2002

On Wednesday 28 August 2002 16:33 CET Theo Van Dinter wrote:
> On Wed, Aug 28, 2002 at 04:20:52PM +0200, Malte S. Stretz wrote:
> > I get about 3 of these per week. A google for trafficmagnet convinces
> > me that they're worth their own rule...
I recently cleaned my spam corpus from them but these are my current
I put it into cvs_rules_under_test, let's see what the 2.41 GA run thinks