This is forged. Your IP is actually being used as the HELO by the
spammer in the way that it appears. The IP enclosed by brackets and
closest to the "by" is the one that should be considered to be the
remote IP. Some spammers will forge your IP as the HELO in this way, in
fact it is quite common at least for the moment.
Matt
Matthew Hiltner: oliveJar Support wrote:
Is this mail originating from my server, relayed through my server (should
not be!), or is this a case of specially crafted headers?
My information is
mail server IP: 66.166.107.118
Both olivejar.net and stepindustries.net are domains that I host and whose
mail server would be mail.olivejar.net (66.166.107.118).
Certain lines like:
Received: from 66.166.107.118 [211.207.196.191] by mail.olivejar.net
X-Note: This E-mail was sent from [No Reverse DNS] ([211.207.196.191]).
X-AOL-IP: 66.166.107.118
confused me. First time I've seen this.
Return-Path: <[EMAIL PROTECTED]>
Received: from rly-xj05.mx.aol.com (rly-xj05.mail.aol.com
[172.20.116.42]) by air-xj04.mail.aol.com (v101_r1.6) with ESMTP id
MAILINXJ42-527416e9c902e9; Thu, 14 Oct 2004 11:35:15 -0400
Received: from mail.olivejar.net (h-66-166-107-118.chcgilgm.covad.net
[66.166.107.118]) by rly-xj05.mx.aol.com (v101_r1.6) with ESMTP id
MAILRELAYINXJ59-527416e9c902e9; Thu, 14 Oct 2004 11:34:45 -0400
Received: from SMTP32-FWD by stepindustries.net
(SMTP32) id A9CA5014600F2757D; Thu, 14 Oct 2004 10:35:17 -0500
Received: from 66.166.107.118 [211.207.196.191] by mail.olivejar.net
(SMTPD32-8.13) id ACA814600F2; Thu, 14 Oct 2004 10:35:04 -0500
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
FCC: mailbox://[EMAIL PROTECTED]/Sent
X-Identity-Key: id1
Date: Thu, 14 Oct 2004 14:30:42 -0200
From: Christian Cardenas <[EMAIL PROTECTED]>
X-Mozilla-Draft-Info: internal/draft; vcard=0; receipt=0; uuencode=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4)
Gecko/20030624 Netscape/7.1 (ax)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: <Undisclosed Recipients>
Subject: [~SPAM~] re[8]
Content-Type: multipart/related;
boundary="------------060907080005060807070002"
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: CBL: "Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=211.207.196.191";
X-RBL-Warning: SBL-XBL:
"http://www.spamhaus.org/query/bl?ip=211.207.196.191";
X-RBL-Warning: SPAMCOP: "Blocked - see
http://www.spamcop.net/bl.shtml?211.207.196.191";
X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command.
X-RBL-Warning: HELOBOGUS: Domain 66.166.107.118 has no MX or A records
[0301].
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail
detected.
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 211.207.196.191
with no reverse DNS entry.
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
[c004020f].
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-Declude-Sender: [EMAIL PROTECTED] [211.207.196.191]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: CBL, SBL-XBL, SPAMCOP, NOPOSTMASTER, BADHEADERS,
CMDSPACE, HELOBOGUS, REVDNS, SPAMHEADERS, SPFUNKNOWN, WEIGHT10, WEIGHT102,
WEIGHT20, WEIGHT202 [56]
X-Country-Chain:
X-Note: This E-mail was sent from [No Reverse DNS] ([211.207.196.191]).
X-AOL-IP: 66.166.107.118
X-Mailer: Unknown (No Version)
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
