From: felicity@kluge.net  Sun Sep 22 21:55:57 2002
Return-Path: <felicity@kluge.net>
Delivered-To: yyyy@localhost.example.com
Received: from localhost (jalapeno [127.0.0.1])
	by jmason.org (Postfix) with ESMTP id 0B22316F03
	for <jm@localhost>; Sun, 22 Sep 2002 21:55:57 +0100 (IST)
Received: from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Sun, 22 Sep 2002 21:55:57 +0100 (IST)
Received: from eclectic.kluge.net
    (IDENT:QCBC2WuA3fKBlFCg7HAjloSLekUZTvh3@eclectic.kluge.net [66.92.69.221])
    by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g8MGbmC07994 for
    <jm@jmason.org>; Sun, 22 Sep 2002 17:37:48 +0100
Received: from eclectic.kluge.net (localhost [127.0.0.1]) by
    eclectic.kluge.net (8.12.6/8.12.6) with ESMTP id g8MGcKm5026158;
    Sun, 22 Sep 2002 12:38:20 -0400
Received: (from felicity@localhost) by eclectic.kluge.net
    (8.12.6/8.12.6/Submit) id g8MGcKc8026156; Sun, 22 Sep 2002 12:38:20 -0400
Date: Sun, 22 Sep 2002 12:38:20 -0400
From: Theo Van Dinter <felicity@kluge.net>
To: Justin Mason <yyyy@example.com>
Cc: Spamassassin List <spamassassin-talk@example.sourceforge.net>
Subject: Re: [SAtalk] telesp.net.br?
Message-Id: <20020922163819.GB25030@kluge.net>
References: <20020922133353.193AC16F03@example.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
    protocol="application/pgp-signature";
    boundary="qcHopEYAB45HaUaB"
Content-Disposition: inline
In-Reply-To: <20020922133353.193AC16F03@example.com>
User-Agent: Mutt/1.4i
X-GPG-Keyserver: http://wwwkeys.pgp.net
X-GPG-Keynumber: 0xE580B363
X-GPG-Fingerprint: 75B1 F6D0 8368 38E7 A4C5  F6C2 02E3 9051 E580 B363
X-Spam-Status: No, hits=-11.1 required=5.0
	tests=AWL,EMAIL_ATTRIBUTION,IN_REP_TO,PGP_SIGNATURE_2,
	      QUOTED_EMAIL_TEXT,REFERENCES,REPLY_WITH_QUOTES,USER_AGENT,
	      USER_AGENT_MUTT
	version=2.50-cvs
X-Spam-Level: 


--qcHopEYAB45HaUaB
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Sep 22, 2002 at 02:33:48PM +0100, Justin Mason wrote:
> I seem to be getting a *lot* of spam relayed via these guys recently.
> Can others confirm this?
>=20
> if it's the case, I'll come up with a forged-hostname test for it.

I do get some from them, typically some dsl.telesp.net.br host:

% grep -c telesp.net.br *| sort -rn
spammers-2002-09:59
spammers-2002-08:64
spammers-2002-07:23
spammers-2002-06:13
spammers-2002-05:4
spammers-2002-04:2

Definitely increasing per month.  Percentage-wise:  2002-09 has 1212
spams in it, so 59/1212 is about 4.8%.  Last month was 3.6%.

--=20
Randomly Generated Tagline:
I don't believe I've ever cuddled my elses.
              -- Larry Wall in <199806221550.IAA07171@wall.org>

--qcHopEYAB45HaUaB
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE9jfH7AuOQUeWAs2MRAkcuAKDZpe2Imevx9OkqkCh1rKh2IXvv6ACfZ/kn
aBRBTJx/PNPOZg5GNPk5b/s=
=mUje
-----END PGP SIGNATURE-----

--qcHopEYAB45HaUaB--


