A different kind of bad week [LWN.net]

A different kind of bad week

Posted Sep 25, 2003 3:00 UTC (Thu) by yem (guest, #1138)
Parent article: A different kind of bad week

Try being the admin for one of the domains that Swen uses to spoof the "From" header.
I'm still getting bounces, autoresponses and complaints to abuse@. Can't simply remove the MX records because some people still use it :-(

(Log in to post comments)

A different kind of bad week

Posted Sep 25, 2003 3:42 UTC (Thu) by StevenCole (guest, #3068) [Link]

Speaking of the "From" header, notice how all the swen messages so far use "FROM" all in upper case? I haven't seen any other MTA do this. Looking at the actual executable with the strings command, you'll see that FROM is in there in upper case only, as well as TO and SUBJECT, plus a bunch of other interesting stuff. Anyway, you can use procmail to filter on this rather unique property of the swen mails.