On Tue, 7 Oct 1997 14:14:14 -0500, "Matthew G. Saroff (Do not Reply to
this Address)" <saroff(_at_)vs(_dot_)lmco(_dot_)com> wrote:
I got the following message (headers only here). It seems to imply
that Spamford has gotten a new link to the net. Any hints on the recipe to
blast this guy?
Luckily, you didn't include any headers after all. Cyberpromo appears
to be in the same AGIS netblocks they had before. (I believe they went
to court to get AGIS forced to allow them back on until they can find
another provider, but I've only had the time to glance headlines on
the spam lists I'm on.)
Here's what I've been using (partial):
:0:
* ^Received:.*[[(]\/((\
(# llv.com / nevwest: |205\.254\.16[4-7]\.)|\
(# nancynet is back! |205\.199.4\.)|\
(# tricreations: |207\.156\.166\.)|\
(# commonwealthpub.com: |207\.229\.0\.(6[6-9]|7[0-1]))|\
(# crushnet/marketit/etc:|151\.196\.87\.)|\
(# ad-promo/webpromo/...:|209\.14\.198\.)|\
(# globalfn/gatewayfin: |204\.137\.161\.|206\.31\.38\.79)|\
(# shoppingplanet: |205\.164\.7[01]\.)|\
(# ballman/we-deliver: |152\.160\.67\.8|208\.211\.205\.66)|\
(# servint: |(204\.32\.71|205\.177\.90|207\.(176\.29|226\.134)|\
209\.(8\.(5[6-9]|[67][0-9]|8[0-7])|50\.2(2[4-9]|[3-5][0-9]))\.))|\
(# cyberpromo netblocks: |198\.7\.176\.28|204\.137\.22[0-2]\.|204\.186\.116\.|\
205\.199\.2(12)?\.|206\.(154\.(10|151)|170\.192)\.|\
207\.(120\.46|124\.161)\.|208\.(5\.10|9\.6[45])\.)\
))[^])]*
spam
I might have lost a paren or two while trimming that down, but try it
with the message you wanted to filter and if it doesn't work, mail me
in private and I'll see what I need to fix :-)
/* era */
--
Paparazzi of the Net: No matter what you do to protect your privacy,
they'll hunt you down and spam you. <http://www.iki.fi/~era/spam/>