>Is this the EXACT text (less the quote > marks)? If so, it looks Imail >is munging two copies of the same message together upon receipt. >Whether this is the result of a deliberate hack or some badly written >spam-blaster is not clear.
I'm a little out of my depth here, so I don't know what the EXACT test is, but I'll run one if you can let me know how . . . . >Let us know if that's a straight cut-and-paste from MAIN.MBX. If so, >it's not something seen before and is need of prompt research. That should be what it is . . . On the server I logged into the MAIN.MBX using the IMail Client, opened the offending email, clicked on 'Message/View Headers' and cut-pasted the the header from there. If there is a more appropriate way to get at the header (that may tell you more) let me know. >>Note that looking up sport158.com is useless--the EHLO is easily >>forged. Egad! so when I ping sport158.com the IP that comes back isn't necessarily real?! -Ken _________________________________________ Ken Innes EKOS Research Associates Inc. www.ekos.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Sanford Whiteman Sent: Tuesday, June 04, 2002 2:16 To: Ken Innes Subject: Re[6]: [IMail Forum] no message header >>From <[EMAIL PROTECTED]> Tue Jun 04 12:14:15 2002 > Received: from sport158.com [From <[EMAIL PROTECTED]> Tue Jun 04 12:14:15 > 2002 > Received: from sport158.com [66.46.195.18] by ekos.com with ESMTP > (SMTPD32-7.10) id A754C232065A; Tue, 04 Jun 2002 12:14:12 -0400 > X-UIDL: 322766513] by ekos.com with ESMTP > (SMTPD32-7.10) id A754C232065A; Tue, 04 Jun 2002 12:14:12 -0400 > X-UIDL: 322766513 -Sandy Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
