[Spambayes] Two amusing spam clues

Matt Sergeant msergeant at startechgroup.co.uk
Fri Jan 10 11:15:00 EST 2003


On Thu, 2003-01-09 at 21:07, Toby Dickenson wrote:
> On Tuesday 07 January 2003 3:08 pm, Skip Montanaro wrote:
> > Neil> I guess a lot of spam doesn't have a message ID so the Debian
> > Neil> mail server adds one.
> >
> > Yeah, seems rather odd, doesn't it?  It's not like they are hard to
> > generated or anything.  For me message-id:@pobox.com and
> > message-id:@manatee.mojam.com are killer clues for the same reason.
> 
> I am seeing a high proportion of spams coming through our secondary MX, so 
> message-id:@charon.geminidataloggers.com is a suprising spam clue for me too.

This is to bypass postini, who's default setting is to set three (I
think) MX records: two of their servers at high priority and finally
yours at low priority in case postini's servers are down.

So spammers are starting to just choose the lowest priority MX server.

Matt.




More information about the Spambayes mailing list