Date: Thu, 5 Dec 2002 19:41:08 +0000 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: freebsd-chat@FreeBSD.ORG Subject: Re: Mail Insanity Message-ID: <20021205194108.GA94487@happy-idiot-talk.infracaninophi> In-Reply-To: <02bb01c29c85$c0c5ff20$fa00a8c0@DaleCoportable> References: <3DEF75D7.9040401@centtech.com> <20021205173228.GA93795@happy-idiot-talk.infracaninophi> <02bb01c29c85$c0c5ff20$fa00a8c0@DaleCoportable>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Dec 05, 2002 at 11:42:57AM -0600, Kevin D. Kinsey, DaleCo, S.P. wrote:
> Matt, it appears that RFC 931 is not gonna catch these....check out
> 'envelope from'
Yeah. On reflection, I think most spammers have been taught to use
registered IP addresses. However...
> Received: from 200.171.46.76 (200-171-46-76.terra.com.br
> [200.171.46.76] (may be forged))
> by ezekiel.daleco.biz (8.12.6/8.12.3) with SMTP id gB5AiQj0014526
> for <kdk@csbc-lamar.org>; Thu, 5 Dec 2002 04:44:38 -0600 (CST)
> (envelope-from squvacs695@acscorp.com)
200.171.46.76 is listed in relays.osirusoft.com --- Spamassassin
should give it a lot of zap points based on that...
> Message-Id: <200212051044.gB5AiQj0014526@ezekiel.daleco.biz>
> Received: from 152.74.145.157 ([152.74.145.157]) by hd.regsoft.net
> with esmtp; Dec, 05 2002 5:22:35 AM -0800
> Received: from [159.218.252.32] by n7.groups.yahoo.com with SMTP;
> Dec, 05 2002 4:38:49 AM +1100
> Received: from rly-xw01.mx.aol.com ([153.196.56.114]) by
> da001d2020.lax-ca.osd.concentric.net with SMTP; Dec, 05 2002 3:39:50
> AM +0600
> Received: from unknown (164.203.204.135) by a231242.upc-a.chello.nl
> with SMTP; Dec, 05 2002 2:39:42 AM +0700
Also having Received: headers below the message ID line is a pretty
good indication of forged headers... Seeing as it's your
ezekiel.daleco.biz server that's assigned the Message-Id:, probably none
of those Received: headers mean anything. Then there's the Subject:
line.
Alas, there is no sure-fire way of catching every bit of spam, but
this one looks like it should be a pretty easy slam-dunk for most
anti-spam software.
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-chat" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021205194108.GA94487>