Re: [Declude.JunkMail] Message header review

[Matt]

Earthlink has for some reason been forwarding spam through this server for some time.  I'm not sure what the setup is, but it's a legitimate Earthlink server and the E-mail originates from a spam zombie. I have thought about IPBYPASS'ing this server in order to capture the real source, but I have yet to confirm if this server is just used for forwarding or what the case may be.  It could be that this is an open relay, a forwarding server, or a full fledged mail server.  I am guessing the first. Matt i360 Support wrote: Can someone help me with the header of this message.   I think this came from earthlink.net mail server. According to earthlink abuse they can't do anything about this type of spam since it did not originate from their network.   We get porn spam from this segement all the time.         Received: from asmtp-a063f33.pas.sa.earthlink.net [207.217.120.149] by deepspace.i360.net with ESMTP   (SMTPD32-7.15) id A94339680150; Thu, 22 Jul 2004 10:12:03 -0500 Received: from 68-235-252-102.atlsfl.adelphia.net ([68.235.252.102])  by asmtp-a063f33.pas.sa.earthlink.net with asmtp (Exim 4.34)  id 1BnfBN-00062N-F4; Thu, 22 Jul 2004 08:08:32 -0700 Message-ID: <[EMAIL PROTECTED]> Reply-To: "=?windows-1251?B?Y2FtZWxsaWE=?=" <[EMAIL PROTECTED]> From: "=?windows-1251?B?Y2FtZWxsaWE=?=" <[EMAIL PROTECTED]> Subject: SPAM: =?windows-1251?B?QnJpZGdldCBtb25yb2Ugc3Vja2luZyBhIGhhcmQgY29jayB2ZXJ5IGRlZXA=?= Date: Thu, 22 Jul 2004 00:56:07 -0400 MIME-Version: 1.0 Content-Type: text/html;  charset="windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-ELNK-Trace: 006cdaaeaf6f69a98241270f52c7d65b7e972de0d01da9401ceba94723fb6a47959954e32e1a9354350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 68.235.252.102 X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8400000a]. X-Declude-Sender: [EMAIL PROTECTED] [207.217.120.149] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, BADHEADERS, WEIGHT10 [11] X-Note: This E-mail was sent from asmtp-a063f33.pas.sa.earthlink.net ([207.217.120.149]). X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 384479918 -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================