I see, I missed that. I just like to lay down extra points on the phish schemes. Thanks
Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 04/14/04 02:33PM >>> Because the sender was not listed as @paypal.com. Look at this line: > X-Declude-Sender: [EMAIL PROTECTED] [66.36.241.111] John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Scott Fisher > Sent: Wednesday, April 14, 2004 12:23 PM > To: [EMAIL PROTECTED] > Subject: [Declude.JunkMail] Paypal phish not detected by spamdomains > > This paypal phish got through without being detected by the spamdomains. Can > anyone explain it? > > Spamdomains line: > @paypal.com .paypal. > > > Headers: > Received: from imail.Farmprogress.com > by farmprogress.com; Tue, 13 Apr 2004 18:45:39 -0500 > Received: from web.numberoneserver.com [66.36.241.111] by > imail.Farmprogress.com with ESMTP > (SMTPD32-8.05) id AB986EFB0044; Tue, 13 Apr 2004 18:45:28 -0500 > Received: (from [EMAIL PROTECTED]) > by web.numberoneserver.com (8.11.6/8.11.6) id i3E00bo13908; > Tue, 13 Apr 2004 20:00:37 -0400 > Date: Tue, 13 Apr 2004 20:00:37 -0400 > Message-Id: <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: [JSpamFilter-25]Notification of PayPal Limited Account Access > From: [EMAIL PROTECTED] > Reply-To: [EMAIL PROTECTED] > Errors-To: [EMAIL PROTECTED] > X-Mailer: MSOUTLOOK / 4.3.2 > Content-type: text/html; charset=iso-8859-1 > X-Declude-Sender: [EMAIL PROTECTED] [66.36.241.111] > X-Declude-Spoolname: D7b986efb00442884.SMD > X-Note: Spam tests: SNIFFER-OBFUSCATION, OBFUSCATION, COUNTRY-FILTER, > WEIGHT20, WEIGHT25, WEIGHT25COPY. > X-Note: Total spam weight of this e-mail is 27. > X-Note: Reverse DNS sls-cb9p8.dca2.superb.net . > > Scott Fisher > Director of IT > Farm Progress Companies > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
