On Tuesday, March 29, 2005, 1:08:43 AM, Jeff Chan wrote:

On Tuesday, March 29, 2005, 12:38:25 AM, Alex Broens wrote:

...

Good Morning!

...

New redir?

...

---

For more information or to have a broker contact you please visit: http://g.msn.com/0MNBUS00/1?http://ok-ref-now .com

...

No future contact: http://g.msn.com/0MNBUS00/1?http://ok-ref-now .com/gone.asp

OMG, it works:

http://g.msn.com/0MNBUS00/1?http://www.google.com/

Please send me a full spam off list.

OK The bad news is that MSN has an open redirector.

The good news is that SpamAssassin correctly checked the redirection site and detected the spammer's site:

Content analysis details: (10.3 points, 5.0 required)

pts rule name description

---

1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see http://www.spamcop.net/bl.shtml?220.88.208.168] 2.0 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist [URIs: ok-ref-now .com] 0.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: ok-ref-now .com] 2.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist [URIs: ok-ref-now .com] 3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist [URIs: ok-ref-now .com]

Jeff C. -- "If it appears in hams, then don't list it."