Re: Anti-spam Working Group

[Walter Ian Kaye <]

At 4:53a -0700 09/07/98, Gunnar Lindberg wrote:
>Since I was stupid enough not to save the .de.uu.net person's mail-
>address (Kerstin ?) I actually though I'll just delete the spam and
>go on with life. But, since the question is brought up again I'll
>send it to the entire list and point out an "interesting problem":
>
>    From janet689@localhost  Fri Sep  4 06:16:42 1998
>    Return-Path: janet689@localhost
>    Received: from animal.cs.chalmers.se
>       (animal.cs.chalmers.se [129.16.225.30])
>       by wentzl.cdg.chalmers.se (8.8.8/8.8.8) with ESMTP id GAA19050
>       for lindberg@localhost;
>       Fri, 4 Sep 1998 06:16:42 +0200 (MET DST)
>    From: janet689@localhost
>    Received: from hex.de.uu.net (hex.de.uu.net [192.76.144.27])
>	by animal.cs.chalmers.se (8.8.5/8.8.5)
>	with ESMTP id GAA00279
>	for Lindberg@localhost;
>	Fri, 4 Sep 1998 06:16:40 +0200 (MET DST)
>    Date: Fri, 4 Sep 1998 06:08:58 +0200 (MET DST)
>    Message-Id: <199809040408.GAA24731@localhost
>    Received: from x
>	(1Cust215.tnt5.nyc3.da.uu.net [153.37.117.215]:1070)
>	by hex.de.uu.net with SMTP (5.65+:004/3.0.2)
>	id GAA24731; Fri, 4 Sep 1998 06:08:58 +0200 (MET DST)

>    ...
>
>This one almost certainly originated at UUNET in the US. It has then
>been relayed by UUNET Germany, hex.de.uu.net, to my .forward.

I had a Eudora filter to remove anything with da.uu.net in it since I got
a spam that way, but now I've gotten legitimate email sent from a gte.net
customer which traveled this way:

Received: from oemcomputer (1Cust194.tnt5.lax3.da.uu.net [153.37.66.194])
	by smtp1.mailsrvcs.net  with SMTP id EAA14042

Guess it's no good to filter on 'da.uu.net' in a Received: header. :/
(I just made a special 'skip rest' filter for my friend's address.)

Wish we could jail spammers simply on assault charges.


-Walter