I'm comming in late but when I looked at FROM_DAEMON I think it was
the "request" in request(_at_)cy(_dot_)(_dot_)(_dot_)(_dot_)(_dot_) that
matched.
--
Proud supporter of boycott Microsoft
http://www.vcnet.com/bms
On Tue, 13 May 1997, Jack Lyons wrote:
On Tue, 13 May 1997, Robert Nicholson wrote:
OK, looks like
request(_at_)cyberpromo(_dot_)com matched FROM_MAILER
Looks like I can't use that rule to catch mailer messages anymore.
Anybody see this message?
Yes, and it got caught my my FROM_DAEMON trap, which I had to install
because some other spammer hijacked our SMTP port and created a daemon
loop, which I've never seen.
The following are the headers of the message that matched FROM_DAEMON -
could someone enlighten me as to what matched? I don't get it.
From request(_at_)cyberpromo(_dot_)com Tue May 13 17:33:42 1997
Received: from news1.radix.net (news1.radix.net [204.157.34.41]) by
saltmine.radix.net (8.8.3/8.8.3) with ESMTP id RAA10145 for
<revjack(_at_)saltmine(_dot_)radix(_dot_)net>; Tue, 13 May 1997 17:33:42
-0400 (EDT)
From: request(_at_)cyberpromo(_dot_)com
Received: from sanfran.infinex.com (ns1.infinex.com [207.113.220.1]) by
news1.radix.net (8.8.3/8.8.3) with ESMTP id RAA26760 for
<revjack(_at_)radix(_dot_)net>; Tue, 13 May 1997 17:34:06 -0400 (EDT)
Received: from Zena (hd49-024.hil.compuserve.com [199.174.229.24]) by
sanfran.infinex.com (8.8.3/8.8.3) with SMTP id OAA22726; Tue, 13 May 1997
14:32:11 -0700
Date: Tue, 13 May 1997 14:32:11 -0700
Message-Id: <199705132132(_dot_)OAA22726(_at_)sanfran(_dot_)infinex(_dot_)com>
To: donli(_at_)netcom(_dot_)com
Subject: NEVER GO HUNGRY AGAIN
Received: from tomsnet!.com (mh.tomsnet!.com [100.301.57.69]) by
m4.tomsnet!.com (8.6.12/8.6.12) with ESMTP id PAA21932
Received: from reb50.rs40-date.net (root(_at_)reb50(_dot_)rs_date(_dot_)net
[289.36.1.176]) by tomsnet!.com (8.6.12/8.6.12) with ESMTP id PBA023891 for
<zena(_at_)tomsnet!(_dot_)com>;
Received: from emoose.mail.n_bot.com (emoose.mx.n_bot.com [198.81.11.42]) by
md.s#parpnet.net (8.7.4/8.7.3) with ESMTP id RAC035940 for <wayne_bobbit.com>;
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Received: from clift.b89-crost.com (clift.b89_crost.com [199.3.12.256]) by
dot.2_bycentric.net (8.8.5/04/01 3.26)) id LAT131787;
Received: from spr_most.bix.45neter!.com(204.332.183.71) by
hars11.ix.45neter!.com via smapt (V1.3) id smr0029301;
Status: RO
X-Status:
--
_________________
revjack(_at_)radix(_dot_)net