RE: [Declude.JunkMail] Return address

[Markus Gufler]

Title: Nachricht

Hi Kami,

 

This are all the X-Declude-Sender lines from over 5000 hold messages on our system without an "@" inside

 

X-Declude-Sender: C:\`Bulk [68.15.65.94]
X-Declude-Sender: <> [216.127.33.23]
X-Declude-Sender: <> [68.35.200.107]
X-Declude-Sender: <> [212.154.34.10]
X-Declude-Sender: <> [62.123.0.57]
X-Declude-Sender: <> [212.41.208.19]
X-Declude-Sender: dtcLISA [212.19.66.109]
X-Declude-Sender: FREE [61.194.11.2]
X-Declude-Sender: <> [216.127.33.27]
X-Declude-Sender: <> [216.127.33.27]
X-Declude-Sender: <> [216.127.33.28]
X-Declude-Sender: <> [216.127.33.13]

 

Or most of this type of messages passes our filters or there are only around 0,24% of spam messages using no valid sender adress.

As I understand a X-Declude-Sender line like this you've posted means that there was no sender in the SMTP-protocol. The IP in [] behind is the sending SMTP-servers adress and are indicated in every X-Declude-Sender line.

 

Scott:

Are the "<>" gathered in any case from the SMTP-Data or are they created from declude if there was no value?

 

Markus

 

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan
Sent: Sunday, January 19, 2003 7:00 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Return address <IP>

Hi;

I know this subject was discussed but I can not find it in the archives. 

 

We are seeing more and more SPAM that have IP address as return address.  I just can't think of a legitimate email that would do that.

 

=============================

X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000100f].
X-RBL-Warning: SPAMCHK: Message failed SPAMCHK: 8.
X-RBL-Warning: WORDFILTERMx: Message failed WORDFILTERMx test (2)
X-RBL-Warning: COUNTRY: Message failed COUNTRY test (215)
X-Declude-Sender: <> [12.4.218.17]
X-Declude-Spoolname: Db07e004f01f2ba39.SMD
X-Note: This E-mail was scanned & filtered by Declude [1.66i2] for SPAM & virus.
X-Spam-Tests-Failed: IPNOTINMX, SPAMHEADERS, SPAMCHK, WORDFILTERMx, COUNTRY, WEIGHT20s, WEIGHT20r
X-Weight: 26

=============================

 

Was there a decision made on how to treat these?  Anyway to add weight if return address is an IP?

 

I will keep on searching the archives.

 

Regards,

Kami