> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of MJ > Sent: Tuesday, December 20, 2005 9:51 AM > To: Michael Scheidell > Cc: [email protected] > Subject: RE: [AMaViS-user] RATWARE_ZERO_TZ > > > > Thanks Michael, here is another example with full header These headers violate the RFC's, and do so in such a way as only has been seen by 'ratware' (ie, software designed, given away, or sold by spammers)
I also see no X-Mailer header. Inform your luser friend to spend money and buy real email list manager. > > Received: from hotmail.com (bay20-f13.bay20.hotmail.com [64.4.54.102]) > by mailgate2.cyberia.net.sa (Postfix) with ESMTP id > A33A71F07EF > for <[EMAIL PROTECTED]>; Tue, 20 Dec 2005 17:44:05 +0300 > (GMT) > Received: from mail pickup service by hotmail.com with > Microsoft SMTPSVC; > Tue, 20 Dec 2005 06:44:01 -0800 > Message-ID: <[EMAIL PROTECTED]> > Received: from 212.138.113.13 by by20fd.bay20.hotmail.msn.com > with HTTP; > Tue, 20 Dec 2005 14:44:01 GMT > X-Originating-IP: [212.138.x.x] > X-Originating-Email: [EMAIL PROTECTED] > X-Sender: [EMAIL PROTECTED] > From: "MJ" <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Cyberia > Date: Tue, 20 Dec 2005 14:44:01 +0000 > Mime-Version: 1.0 > Content-Type: text/html; format=flowed > X-OriginalArrivalTime: 20 Dec 2005 14:44:01.0705 (UTC) > FILETIME=[D1462190:01C60573] > X-Spam-Status: Yes, hits=7.111 tag=2 tag2=6.31 kill=6.31 > tests=[AWL=1.372, BAYES_50=0.001, DNS_FROM_RFC_ABUSE=0.2, > DNS_FROM_RFC_POST=1.708, HTML_50_60=0.134, > HTML_MESSAGE=0.001, INVALID_TZ_GMT=0.5, > MIME_HTML_ONLY=0.001, MSGID_FROM_MTA_HEADER=0, > RATWARE_ZERO_TZ=3.196, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] Based on what SA found, this user is using spamware to send his emails. ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_idv37&alloc_id865&op=click _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
