Hello all, I continue to receive messages with URIs to "bravemouser.com" in the past few weeks. Should this domain be added to one of the surbl lists? Most of the messages are TV Pay Per View spam.
An example of one of the messages can be found here: http://www.aldridge-borden.com/bravemouser.txt
-Charles Solomon
On Friday, May 7, 2004, 7:36:18 AM, ITReading ITReading wrote:
Hello all, I continue to receive messages with URIs to "bravemouser.com" in the past few weeks. Should this domain be added to one of the surbl lists? Most of the messages are TV Pay Per View spam.
An example of one of the messages can be found here: http://www.aldridge-borden.com/bravemouser.txt
I don't see any reports about it to SpamCop. You may want to do that.
Definitely looks like spam to me.
Interesting thing is that it uses a "base href" syntax with a later relative anchor "<a href="r.asp?oid...":
<html><head><base href="http://www.bravemouser-MUNGED.com/Creatives/FLTR5/"></head> <table align="center" border="0" cellpadding="0" cellspacing="0" width="10"> <tr><td><a href="r.asp?oid=519481245&sid=808272&aid=3"><img border="0" src="http://www.bravemouser-MUNGED.com/Creatives/FLTR5/pix/1.gif" width="182" height="353"></a></td> <td><a href="r.asp?oid=519481245&sid=808272&aid=3"><img border="0" src="pix/2.jpg" width="475" height="353"></a></td></tr> </TABLE> <P align="center"><font face="Verdana" size="1">You are receiving this newsletter from the Acquired mailing list as a result of a recent transaction on our network. To stop further messages from this mailing list follow the link <a href="http://www.bravemouser.com/Creatives/FLTR5/u.asp?oid=519481245&sid=808272&aid=4">here</a>.<BR><BR>Acquired Mailing List<BR>849 Almar Ave. STE., PMB 317<BR>Santa Cruz, CA 95060<BR>USA<img border="0" src="http://www.bravemouser.com/Creatives/FLTR5/o.asp?oid=519481245&sid=808272&aid=5" width="0" height="0"></font> </HTML>
Does anyone know if the current message parsing code in SA 2.63 PerMsgStatus.pm or whatever correctly parses a base href + relative reference?
IIRC from Buzgzilla, SA 3.0 will now resolve relative references such as these into absolute URIs so I think it's handled correctly there.
Jeff C.
-
ITReading ITReading -
Jeff Chan