[Scspamcop] Re: General Spam Question
Sofa King Tyred of Lar Ting
nobody at devnull.spamcop.net
Sun Nov 4 20:32:50 EST 2007
antioch wrote:
> I hope this is what you are requesting to see - it is a regular and one of
> the more interesting reads:-)
In the following, I found that 83.24.191.15 is on the CBL
(http://cbl.abuseat.org/lookup.cgi?ip=83.24.191.15), which means you
really can not trust the SMTP headers beyond that line (they are likely
forged).
As for the "[SPAM?]" being added, I would say that it's not a Barracuda
firewall or other device that's changing it, as they normally put
"X-original-subject" headers, or other such info to indicate the subject
has changed. I'd be looking at my spam-junk settings of the client (OE,
Thunderbird, etc.). There are some keywords in the spam that could
trigger this, or some Bayesian filtering that maybe is being done on
your client when it received the mail (via POP?). Nothing in the headers
says that the subject is getting changed anywhere else, but that doesn't
mean your ISP is not doing it. My ISP originally had no clue about how
their spam filtering was working when I started receiving "SPAM"
indicators in the subjects... Customer support and email administrators
sadly don't always communicate with each other if it's not in their job
description.
I got so fed up at the time with my SMTP/POP service, that I switched
over to Gmail. It's a system that's free and is mostly well managed.
Spam goes in a "spam" folder and isn't really modified.
Your original post had only one "?" which didn't seem like a question.
Perhaps we can better answer if you ask clearly what your question is.
> Return-Path: <lingbgseelzemet at gbgseelze.de>
> Received: from aamtain12-winn.ispmail.ntl.com ([81.103.221.35])
> by mtain05-winn.ispmail.ntl.com with ESMTP
> id
> <20071104194206.RTRS22778.mtain05-winn.ispmail.ntl.com at aamtain12-winn.ispmail.ntl.com>;
> Sun, 4 Nov 2007 19:42:06 +0000
> Received: from xxxxxxxx-2kgvt4 ([83.24.191.15])
> by aamtain12-winn.ispmail.ntl.com with ESMTP
> id
> <20071104194205.FCAA26004.aamtain12-winn.ispmail.ntl.com at xxxxxxxx-2kgvt4>;
> Sun, 4 Nov 2007 19:42:05 +0000
> Received: from [83.24.191.15] by mxlb.ispgateway.de; , 4 Nov 2007 20:42:05
> +0100
> Date: , 4 Nov 2007 20:42:05 +0100
> From: "Nellie Elliott" <lingbgseelzemet at gbgseelze.de>
> X-Mailer: The Bat! (v3.71.01) Home
> Reply-To: lingbgseelzemet at gbgseelze.de
> X-Priority: 3 (Normal)
> Message-ID: <150695293.41486303934118 at gbgseelze.de>
> To: steve.jemison at ntlworld.com
> Subject: [SPAM?] Realize all of her dreams with our help for short time
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="----------05E05E29C3F2195"
>
> ------------05E05E29C3F2195
> Content-Type: text/plain; charset=Windows-1252
> Content-Transfer-Encoding: 7bit
>
> Have you ever heard this, "Damn it! Your pe ufs n vum is is really
> tiny!"?Didn't you feel like a loser? Don't let women prefer
> vibrator to you! Megadik will improve your situation once and forever!You
> must believe in this wonderful preparation!"Wow! Your penis is
> unique!" Isn't that what you just love to hear? Soon you'll be
> the only one women will dream about! Megadik is your magic weapon!Here is
> the wanted web-site
> ------------05E05E29C3F2195
> Content-Type: text/html; charset=Windows-1252
> Content-Transfer-Encoding: 7bit
>
> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
> <HTML><HEAD><TITLE></TITLE>
> </HEAD>
> <BODY>
>
> <html><body><b>Have you ever heard this, "Damn it! Your pe<span
> style="FONT-SIZE: 1px; FLOAT: right; COLOR: white"> ufs </span>n<span
> style="FONT-SIZE: 1px; FLOAT: right; COLOR: white"> vum </span>is is really
> tiny!"?</b><br>Didn't you feel like a loser? <br><b>Don't let
> women prefer vibrator to you! Megadik will improve your situation once and
> forever!You must believe in this wonderful preparation!</b><br>"Wow!
> Your penis is unique!" Isn't that what you just love to hear?
> <br><b>Soon you'll be the only one women will dream about! Megadik is
> your magic weapon!</b><br><br><a href="http://tfg.edsglab.com/?kjs"><b>Here
> is the wanted web-site</b></a></body></html>
>
> </BODY></HTML>
> ------------05E05E29C3F2195--
>
>
--
Help fight spam by "educating" the lax, zombie-hosting ISPs:
http://pages.infinit.net/filmore/educateYourISP.htm
More information about the SCspamcop
mailing list