if you have the pro version add a filter to look for the following and hold
or delete it
HELO 0 CONTAINS 66.166.107.118
HELO 0 CONTAINS mail.olivejar.net
Rick Davidson
National Systems Manager
North American Title Group
-
Matthew Hiltner: oliveJar Support wrote:
Is this mail originating from my server, relayed through my server (should
not be!), or is this a case of specially crafted headers?
My information is
mail server IP: 66.166.107.118
Both olivejar.net and stepindustries.net are domains that I host and whose
mail server would be mail.olivejar.net (66.166.107.118).
Certain lines like:
Received: from 66.166.107.118 [211.207.196.191] by mail.olivejar.net
X-Note: This E-mail was sent from [No Reverse DNS] ([211.207.196.191]).
X-AOL-IP: 66.166.107.118
confused me. First time I've seen this.
Return-Path: <[EMAIL PROTECTED]>
Received: from rly-xj05.mx.aol.com (rly-xj05.mail.aol.com
[172.20.116.42]) by air-xj04.mail.aol.com (v101_r1.6) with ESMTP id
MAILINXJ42-527416e9c902e9; Thu, 14 Oct 2004 11:35:15 -0400
Received: from mail.olivejar.net (h-66-166-107-118.chcgilgm.covad.net
[66.166.107.118]) by rly-xj05.mx.aol.com (v101_r1.6) with ESMTP id
MAILRELAYINXJ59-527416e9c902e9; Thu, 14 Oct 2004 11:34:45 -0400
Received: from SMTP32-FWD by stepindustries.net
(SMTP32) id A9CA5014600F2757D; Thu, 14 Oct 2004 10:35:17 -0500
Received: from 66.166.107.118 [211.207.196.191] by mail.olivejar.net
(SMTPD32-8.13) id ACA814600F2; Thu, 14 Oct 2004 10:35:04 -0500
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
FCC: mailbox://[EMAIL PROTECTED]/Sent
X-Identity-Key: id1
Date: Thu, 14 Oct 2004 14:30:42 -0200
From: Christian Cardenas <[EMAIL PROTECTED]>
X-Mozilla-Draft-Info: internal/draft; vcard=0; receipt=0; uuencode=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4)
Gecko/20030624 Netscape/7.1 (ax)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: <Undisclosed Recipients>
Subject: [~SPAM~] re[8]
Content-Type: multipart/related;
boundary="------------060907080005060807070002"
Message-Id: <[EMAIL PROTECTED]>
X-RBL-Warning: CBL: "Blocked - see
http://cbl.abuseat.org/lookup.cgi?ip=211.207.196.191";
X-RBL-Warning: SBL-XBL:
"http://www.spamhaus.org/query/bl?ip=211.207.196.191";
X-RBL-Warning: SPAMCOP: "Blocked - see
http://www.spamcop.net/bl.shtml?211.207.196.191";
X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]"
X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command.
X-RBL-Warning: HELOBOGUS: Domain 66.166.107.118 has no MX or A records
[0301].
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail
detected.
X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 211.207.196.191
with no reverse DNS entry.
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
[c004020f].
X-RBL-Warning: SPFUNKNOWN: SPF returned UNKNOWN for this E-mail.
X-Declude-Sender: [EMAIL PROTECTED] [211.207.196.191]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: CBL, SBL-XBL, SPAMCOP, NOPOSTMASTER, BADHEADERS,
CMDSPACE, HELOBOGUS, REVDNS, SPAMHEADERS, SPFUNKNOWN, WEIGHT10, WEIGHT102,
WEIGHT20, WEIGHT202 [56]
X-Country-Chain:
X-Note: This E-mail was sent from [No Reverse DNS] ([211.207.196.191]).
X-AOL-IP: 66.166.107.118
X-Mailer: Unknown (No Version)
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
