On Wed, 2011-07-20 at 07:01 -0700, James McKenzie wrote: > In the meantime, both Dan and I are looking to see where spam is > coming from and if needed blocking IPs. If the IP address could be > captured and relayed to us before deleting messages from the forum, we > would appreciate it. > A clarification: the 'From:' address in messages originating from the users forum always of the form: "handle" <wineforum-user@xxxxxxxxxx> where 'handle' is the handle used to post to the forum. Quite apart from not containing a useful mail address, the handle is very frequently forged in spam: for instance, I see significant amounts of spam that allegedly was sent by yourself and, even where the handle wasn't forged, a poster doesn't have to supply a valid e-mail address to sign up - at least its been blank in every one of the few poster profiles I've looked at. That said, I can certainly produce lists of the apparent senders of spam from the user list if the details are still in my mail logs, but for the reasons given above, I don't think they'll be particularly useful. I can easily supply you with a list of all the domain names that have appeared in the body of spam I've received via the Wine users mailing list. I can produce a list of URLs and PERL regexes that match spammy URLs almost immediately, but if you want the list reduced to just those URLs that arrived in the Wine maillist that will take a day so to do. Let me know which URL list you'd prefer and if you'd like a sender list. Martin
