|
I have been getting a lot of spam reciently. The subjects are typical and the From always displays as a common first name.
For each of these messages, I see no declude content. The ip and the address are not excluded or whitelisted and if it were an xheader should say it was. For some reason there is no declude processing here. Any ideas? The following is the header for one of these messages:
Received: from cyrix [82.201.160.214] by mail.ncats.net with ESMTP (SMTPD-9.10) id A0881C80; Wed, 18 Oct 2006 21:10:32 -0400 Message-ID: <[EMAIL PROTECTED]> From: "Robert" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: Cheapest way to solve health problems. Date: Thu, 19 Oct 2006 03:10:34 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------ms030809000704050003000706" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
I would normally see a header like this:
Received: from 203.111.235.51 [203.111.235.51] by mail.ncats.net (SMTPD-9.10) id AD4E1464; Wed, 18 Oct 2006 20:56:46 -0400 Received: from mx3.mail.yahoo.com by 203.111.235.51 (8.12.11/8.12.11) with ESMTP id Yz77Trqj3H8fGj for <[EMAIL PROTECTED]>; Wed, 18 Oct 2006 21:53:53 -0400 Received: from [251.130.5.67] by mx3.mail.yahoo.com with ESMTP (Exim 4.05) id NyG7OgPl6HWI for <[EMAIL PROTECTED]>; Wed, 18 Oct 2006 21:53:53 -0400 Date: Wed, 18 Oct 2006 21:53:53 -0400 From: Bridgett Kim <[EMAIL PROTECTED]> Reply-To: Bridgett Kim <[EMAIL PROTECTED]> Message-ID: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: SEXUALLY EXPLICIT : Hidden upskirt camera shots MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-RBL-Warning: CBL: "Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=203.111.235.51" X-RBL-Warning: SORBS-WEB: "Exploitable Server See: http://www.sorbs.net/lookup.shtml?203.111.235.51" X-RBL-Warning: BADWHOIS: "Inaccurate or missing WHOIS data" X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command. X-RBL-Warning: DYNHELO: Dynamic HELO found. X-RBL-Warning: HELOBOGUS: Domain 203.111.235.51 has no MX or A records [0301]. X-RBL-Warning: REVDNS: This E-mail was sent from a MUA/MTA 203.111.235.51 with no reverse DNS entry. X-RBL-Warning: ROUTING: This E-mail was routed in a poor manner consistent with spam [2000010f]. X-RBL-Warning: WEIGHT10: Weight of 52 reaches or exceeds the limit of 10. X-RBL-Warning: WEIGHT14: Weight of 52 reaches or exceeds the limit of 14. X-RBL-Warning: WEIGHT20: Weight of 52 reaches or exceeds the limit of 20. X-Declude-Sender: [EMAIL PROTECTED] [203.111.235.51] X-Declude-Spoolname: Dcd4d03210000c10b.smd X-Declude-RefID: X-Declude-Note: Scanned by Declude 4.3.14 for spam. "http://www.declude.com/x-note.htm" X-Declude-Scan: Incoming Score [52] at 20:56:55 on 18 Oct 2006 X-Declude-Fail: CBL [6], SORBS-WEB [5], BADWHOIS [3], NOABUSE [2], NOPOSTMASTER [1], CMDSPACE [8], DYNHELO [5], HELOBOGUS [5], REVDNS [10], ROUTING [2], COUNTRY-NONUS-CANADA [5], WEIGHT10 [10], WEIGHT14 [14], WEIGHT20 [20], WEIGHT30 [30] X-Country-Chain: [IANA Reserved]->PHILIPPINES->destination X-RCPT-TO: <[EMAIL PROTECTED]> Status: X-UIDL: 451635306 X-IMail-ThreadID: cd4d03210000c10b
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. |
- [Declude.JunkMail] Declude 4.3.14 - Issues Andy Schmidt
- [Declude.JunkMail] Declude 4.3.14 - Issues Andy Schmidt
- [Declude.JunkMail] Suge of spam in recie... Will
- RE: [Declude.JunkMail] Suge of spam ... Michael Thomas - Mathbox
