On 07/10/2012 09:58 AM, Eric Shubert wrote:
On 07/09/2012 07:47 PM, Cecil Yother, Jr. wrote:
I have a customer that is getting mail that's not addressed to him, but
the delivered to address is correct. It's all SPAM from different
return addresses from yahoo.com.
Here is the header. They all have bob as the first name before the @
but none of the recipients are on my server yet it reaches [email protected]
Any ideas on how to prevent this?
From: - Mon Jul 09 16:10:31 2012
X-Account-Key: account6
X-UIDL: 1341848754.4017.area510.net,S=3406
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: (qmail 4015 invoked by uid 89); 9 Jul 2012 15:45:53 -0000
Received: by simscan 1.4.0 ppid: 4007, pid: 4009, t: 0.7633s
scanners:
attach: 1.4.0 clamav: 0.97.4
/m: 54/d:14650 spam: 3.2.5
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
viktorya.area510.net
Received: from unknown (HELO nm28-vm1.bullet.mail.bf1.yahoo.com)
(98.139.212.252) by area510.net with SMTP; 9 Jul 2012 15:45:53 -0000
Received-SPF: none (area510.net: domain at yahoo.com does not
designate
permitted sender hosts)
Received: from [98.139.212.151] by nm28.bullet.mail.bf1.yahoo.com
with
NNFMP; 09 Jul 2012 15:45:50 -0000
Received: from [98.139.215.248] by tm8.bullet.mail.bf1.yahoo.com
with
NNFMP; 09 Jul 2012 15:45:50 -0000
Received: from [127.0.0.1] by omp1061.mail.bf1.yahoo.com with
NNFMP; 09
Jul 2012 15:45:50 -0000
X-Yahoo-Newman-Property: ymail-5
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 72956 invoked by uid 60001); 9 Jul 2012 15:45:49
-0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com;
s=s1024; t=1341848749; bh=KGVKk+9tl9DXcmg2j2FB/5PjzyMTpPWDTv6xMpx1UJY=;
h=Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type;b=FM6kElk4CrmK4RpWtQGI/Tge58dsI40Nfq7dZAZnXD2KnrjLML/oDIdh6yrugHllCN5qfZFdPmwsyXBrw9m52anaSyEDGzmQ/d4MaRPHKL11Opm5wJXnTyBuwWP/hDrY9+U3NVtxZvWHlcVZGVJ5qIRdEgwqZ0mq9l0gfXUhwLU=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024;
d=yahoo.com;
h=Received:X-Mailer:Message-ID:Date:From:Subject:To:MIME-Version:Content-Type;b=fUyEXw9lTPDI8eOCK0fxAAGbD2aAokjN0G1pvB5sN88t/jXTdMzJjfttAv85jJzs4DKtY5kE7BXXV1a1jJ52ODvYAa9Z0dgUGXwvtioa4gGdSWi6zwsUM+pTZo58XYJI4Z4fRJ6N4TB+xTvyUamgBCEq+Z7Rku5tjzdKplAH6sI=;
Received: from [118.174.38.138] by web140505.mail.bf1.yahoo.com via
HTTP; Mon, 09 Jul 2012 08:45:49 PDT
X-Mailer: YahooMailWebService/0.8.120.356233
Message-ID:
<[email protected]>
Date: Mon, 9 Jul 2012 08:45:49 -0700 (PDT)
From: Ginger Muttini <[email protected]>
Subject: re:
To: [email protected] <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="1211670101-1783750882-1341848749=:21056"
This is consistent with [email protected] being a bcc address, which I
expect is the case. The sender's yahoo account has likely been
compromised.
I don't think spamdyke will do much good, as it's coming from a yahoo
server.
I see SA listed as a spam checker, but don't see any score. Did SA not
scan the message? I expect that SA is going to be your best bet in
this case.
The return address is never the same, so not sure if it's a compromised
account or constantly new accounts.
So, I am not seeing his address because it's bcc?
SA did score it at 3.25 and my SA is set at 5
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
