[Scspamcop] Re: ISP's Mailserver Gags on Header; Can't Sub to SC

[Michael Brennan]

Mike Easter wrote:
> 
> Michael Brennan wrote:
<snip for concision>
> 
> > Got 579 message each time from my mailserver: rejection for
> > "content".    I haven't had a recurrence since the 24th.  Had this
> > happen a couple of years ago and vaguely recall it was some kind of
> > formatting problem, or attachments, or something like that -- can't
> > really recall now.
> 
> Perhaps seeing the entire alert message rejection might contribute.
> There is nothing in the .spam msg attachment but plaintext.  One would
> even have to be pretty stock spam 'astute' to determine that the payload
> was that you should buy some stock symboled C.C.T.I -- which isn't even
> a proper symbol, it should be CCTI.PK
> 
<snip>

What do you know -- I just got another one.  Same format, same
spamvertised penny-stock issue (munged as before, as you noted, with
variations).

I'm posting the sourcefile as a plain textfile attachment as before over
in .spam.

This time I captured the ISP's rejection message, which reads as follows
(unwrapped when grepped [they're a non-M$ shop, FreeBSD and Apache]):

"An unknown error was returned from the SMTP server. Subject
'Penny-Stock "Pump & Dump" UCE Spams', Account: 'pop.hal-pc.org',
Server: 'smtp.hal-pc.org', Protocol: SMTP, Server Response: '579 message
content is not acceptable here', Port: 25, Secure(SSL): No, Server
Error: 579, Error Number: 0x800CCC61"

Unacceptable content viewable over in .spam.

I immediately located in the rejected submittal message with its
attached spamitems, when I got the 579 notice, a penny-stock spam that
looked like the one that had been previously rejected last week, pulled
it off the message, and voila -- the e-mail with multiple attachments,
less this particular UCE, went through on the first attempt.  It would
appear to be the culprit.

Regards,
Michael