Can someone help me with the header of this message.
I think this came from earthlink.net mail server.
According to earthlink abuse they can't do anything about this type of spam since it did not originate from their network.
We get porn spam from this segement all the time.
You can always trust the IP address that IMail adds to the E-mail (which is normally the top one). In this case:
Received: from asmtp-a063f33.pas.sa.earthlink.net [207.217.120.149] by deepspace.i360.net with ESMTP
(SMTPD32-7.15) id A94339680150; Thu, 22 Jul 2004 10:12:03 -0500
the IP is 207.217.120.149. Although it *looks* like it came from earthlink.net, you can't be sure from that header. But looking at the reverse DNS entry of that IP:
X-Note: This E-mail was sent from asmtp-a063f33.pas.sa.earthlink.net ([207.217.120.149]).
shows that it did indeed come from an IP that claims to be an Earthlink IP. It is technically possible that a spammer could forge the reverse DNS entry, so you need to check that asmtp-a063f33.pas.sa.earthlink.net has an A record of 207.217.120.149, or you can check the IPWHOIS information for 207.217.120.149.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
