[SURBL-Discuss] Should bravemouser.com be blacklisted?

Fri May 7 15:45:22 CEST 2004

On Friday, May 7, 2004, 7:36:18 AM, ITReading ITReading wrote:
> Hello all,
> I continue to receive messages with URIs to "bravemouser.com"
> in the past few weeks.  Should this domain be added to one of
> the surbl lists?  Most of the messages are TV Pay Per View spam. 

> An example of one of the messages can be found here:
> http://www.aldridge-borden.com/bravemouser.txt 

I don't see any reports about it to SpamCop.  You may want to
do that.

Definitely looks like spam to me.

Interesting thing is that it uses a "base href" syntax
with a later relative anchor "<a href="r.asp?oid...":

<html><head><base href="http://www.bravemouser-MUNGED.com/Creatives/FLTR5/"></head>
<table align="center" border="0" cellpadding="0" cellspacing="0" width="10">
<tr><td><a href="r.asp?oid=519481245&sid=808272&aid=3"><img
border="0" src="http://www.bravemouser-MUNGED.com/Creatives/FLTR5/pix/1.gif" width="182" height="353"></a></td>
<td><a href="r.asp?oid=519481245&sid=808272&aid=3"><img border="0" src="pix/2.jpg" width="475" height="353"></a></td></tr>
</TABLE>
<P align="center"><font face="Verdana" size="1">You are receiving this newsletter from the Acquired mailing list as a result of a recent transaction on our network. To stop further messages from this mailing list follow the link <a href="http://www.bravemouser.com/Creatives/FLTR5/u.asp?oid=519481245&sid=808272&aid=4">here</a>.<BR><BR>Acquired Mailing List<BR>849 Almar Ave. STE., PMB 317<BR>Santa Cruz, CA 95060<BR>USA<img border="0" src="http://www.bravemouser.com/Creatives/FLTR5/o.asp?oid=519481245&sid=808272&aid=5" width="0" height="0"></font>
</HTML>

Does anyone know if the current message parsing code in SA 2.63
PerMsgStatus.pm or whatever correctly parses a base href +
relative reference?

IIRC from Buzgzilla, SA 3.0 will now resolve relative references
such as these into absolute URIs so I think it's handled
correctly there. 

Jeff C.